4 Commits

Include renames

Author	SHA1	Message	Date
isaaccladandCursor	a3ba2ac45b	Fix browser terminal paste for hosting clients. ... Use bracketed paste, reliably bind paste capture, stop blocking mousedown focus, and give shells a short prompt with horizontal-scroll readline so long pasted commands do not wrap incorrectly. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-07-13 18:02:02 +00:00
isaaccladandClaude Opus 4.8	18d1e735d8	Jail the remote (SSH) terminal path too, not just local ... Accounts whose node has an ssh_private_key take the remote branch, which still launched an unjailed 'runuser' shell — leaving the breach open. Route it through the same jailkit launcher (no sudo; provider connects as root). Now every terminal session is chrooted to the customer's own home. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-26 23:55:22 +00:00
isaaccladandClaude Opus 4.8	2a1228b40e	Jail the control-panel terminal to the customer's home (chroot) ... SECURITY: the browser terminal ran an unconfined login shell as the account's system user, so customers could browse the whole host (/var/www, other tenants, /etc). Run it inside a jailkit chroot instead: a vetted, sudo-scoped launcher (/usr/local/sbin/ladill-jailsh) enters a private mount namespace, bind-mounts ONLY that user's home into /home/jail, and chroots as the user. They can no longer see anything outside their own home. Provisioning committed in deployment/ (setup-terminal-jail.sh + ladill-jailsh) so it is reproducible. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-26 23:41:18 +00:00
isaaccladandCursor	e251a4cf60	Initial Ladill Hosting app with Gitea deploy pipeline. ... Shared web hosting extracted from the platform monolith, with CI deploy to /var/www/ladill-hosting matching Bird/Domains/Email. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-06 16:24:20 +00:00