fix(security): drop PASSWORD_SECRET from proxy env + add slowloris read-timeout (#101 P0)

[axisrow]

Summary

Two P0 unauthenticated-security fixes from the multi-agent code review in #101.

• Add Claude Code GitHub Workflow #1 — PASSWORD_SECRET leaked into the proxy's environment (entrypoint.sh). runuser (without --login) inherits the caller's whole environment, so an operator-supplied -e PASSWORD_SECRET=... landed in the proxy's /proc/<pid>/environ — readable by any TTYD_USER process (including terminal shells) and enough to forge session/CSRF tokens. unset PASSWORD_SECRET after writing the secret file and before launching the proxy makes the mode-400 file the only channel, as CLAUDE.md guarantees.
• Add build script for npm package cache invalidation #2 — slowloris DoS: no socket read timeout (app/ttydproxy). BaseHTTPRequestHandler had no read timeout, so a slow client pinned a ThreadingHTTPServer worker forever (the login rate-limiter only fires after the slow window). Added a config-driven REQUEST_TIMEOUT (default 30s, min 1) applied as the handler's timeout class attribute.

#101 findings closed

• Add Claude Code GitHub Workflow #1 (PASSWORD_SECRET in proxy env) — security, CONFIRMED
• Add build script for npm package cache invalidation #2 (slowloris DoS) — security, CONFIRMED

New/changed env vars

• REQUEST_TIMEOUT — per-connection socket read timeout in seconds (default 30, min 1). Read in config.py, validated via env_int. Documented in .env.example by PR-B (which owns that file in this split).

Note: finding #2 targets app/server.py in the review, but the fix lives in config.py + app.py (the handler subclass carries the timeout attribute) so the value stays env-configurable and validated, rather than editing the stdlib-only server.py.

Ports / volumes

No changes.

Tests

New: test_password_secret_unset_before_proxy_launch (ordering assertion in test_shell_scripts.py), REQUEST_TIMEOUT config + handler-attribute tests in test_config_timeouts.py. Full pytest tests/ green; bash -n entrypoint.sh clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KgvJhzd8gEhXVE4MVu18nn

[axisrow]

🔍 Local review (cycle 1)

Reviewed locally (Claude subagent + Codex companion), no bots pinged. Both reviewers ran; findings triaged against the real code + git history.

Verdict	Reviewer	Finding	Location
SKIP	codex	Proxy signing secret still readable by a same-UID terminal shell	entrypoint.sh:466-481
SKIP	codex	Slowloris timeout is per-read (idle), not a total header deadline	app/ttydproxy/app.py:90-94

No FIX verdicts. Rationale (both findings are technically accurate but describe threats broader than the narrowly-scoped #101 P0 this PR closes):

• Same-UID file read (SKIP, out of scope): The proxy and the terminal shells both run as TTYD_USER, and /run/ttyd-proxy.secret is mode-400 owned by TTYD_USER, so a same-UID shell can read it. But this is pre-existing architecture — git show main:entrypoint.sh has the identical install -m 400 -o TTYD_USER + runuser -u TTYD_USER … python3 /app/ttyd_proxy.py. This PR's only change to that region is adding unset PASSWORD_SECRET. Код-ревью всего проекта: 15 находок (4 CONFIRMED корректность/безопасность) #101 finding Add Claude Code GitHub Workflow #1 was scoped specifically to the /proc/<pid>/environ leak, which the unset fully closes; the added comment claims only that the secret "never appears in the proxy's environment", which is accurate (it does not claim same-UID unreadability). A separate proxy principal is a reasonable follow-up hardening, tracked outside this hotfix.
• Total header deadline (SKIP, follow-up): self.timeout is a per-blocking-read idle timeout, not a cumulative deadline — technically true. But a 30s idle timeout defeats exactly the classic slowloris Код-ревью всего проекта: 15 находок (4 CONFIRMED корректность/безопасность) #101 Add build script for npm package cache invalidation #2 described (a byte-per-minute client dies at 30s). A wall-clock total-header deadline is stronger but a larger change (custom handle_one_request), out of scope for a 1-line P0.

Both are recorded as valid follow-up hardening ideas. This completes the local review cycle for #102 — merge is left to the maintainer.

[axisrow]

Applied the deferred non-blocking test-strength nitpick in a4dc665 (assert the handler timeout is wired to config.REQUEST_TIMEOUT, not merely positive). Local review cycle for #102 is complete.