security(websocket): authenticate /api/intelligent_agent/stream before processing (#17000)

[mrveiss]

Thinking Path

websocket_stream (autobot-backend/api/intelligent_agent.py) is the WebSocket
twin of the authenticated POST /api/intelligent_agent/process, but it only
called enforce_ws_origin — which by its own docstring passes any client that
omits an Origin header, i.e. every non-browser caller. Any client could reach
agent.process_natural_language_goal with no credential at all.

POST /process requires Depends(get_current_user) but never threads
current_user into agent.process_natural_language_goal(request.goal, context=request.context) beyond the auth gate itself — so the fix for the
WebSocket doesn't invent new plumbing to pass an identity into the agent either;
it matches /process's actual behavior: a verified caller is required before
the goal ever runs.

For the auth mechanism and rejection shape, the issue named
api/voice_stream.py's voice_stream_ws as the convention to follow exactly.
I checked api/ws_security.py's enforce_ws_authentication as the issue also
suggested, but it closes the socket without accepting first (code 1008) —
the opposite of the voice_stream_ws / api/websockets.py (#2818) convention
this repo already uses in the most call sites (api/websockets.py x3,
api/voice_stream.py, api/transcripts.py, api/live_events.py,
api/presence_ws.py): authenticate, then on rejection accept() then
close(code=4001, reason=...) so the client gets a real WS close frame instead
of a raw handshake rejection indistinguishable from a missing route (#12366,
#15745). enforce_ws_authentication didn't fit that convention, so I used
auth_middleware.authenticate_websocket directly, mirroring voice_stream_ws
line for line.

What Changed

• autobot-backend/api/intelligent_agent.py websocket_stream: after the
  existing enforce_ws_origin check, authenticate with
  auth_middleware.authenticate_websocket before any receive_json() or
  get_agent() call. On a missing/invalid token: accept() then
  close(code=4001, reason="Authentication required"), then return — the
  refused handshake never reaches process_natural_language_goal.
• autobot-backend/api/intelligent_agent_ws_auth_17000_test.py (new): 4 tests
  covering the 4 acceptance criteria.

Not changed: the agent doesn't receive the authenticated principal as a new
parameter, because /process doesn't pass current_user to
agent.process_natural_language_goal either — only using it as an auth gate.
Threading it through would be new plumbing beyond what /process does.

Verification

Local (design aid only — environment is below CI's declared dependency floors;
CI is the evidence):

$ python3 -m pytest api/intelligent_agent_ws_auth_17000_test.py -v
api/intelligent_agent_ws_auth_17000_test.py::TestIntelligentAgentStreamAuthentication::test_no_token_is_refused PASSED
api/intelligent_agent_ws_auth_17000_test.py::TestIntelligentAgentStreamAuthentication::test_invalid_token_is_refused PASSED
api/intelligent_agent_ws_auth_17000_test.py::TestIntelligentAgentStreamAuthentication::test_a_refused_handshake_never_calls_process_natural_language_goal PASSED
api/intelligent_agent_ws_auth_17000_test.py::TestIntelligentAgentStreamAuthentication::test_valid_token_is_accepted_and_reaches_the_agent PASSED
4 passed in 0.79s

Also checked:

• python3 -m py_compile api/intelligent_agent.py — OK
• python3 -m black --check / python3 -m ruff check on both changed files — clean
• tools/lint/check_decorator_order.py on the modified file — no violations
• function_length_checker.py --whole-file on the modified file — no violations
  (websocket_stream's counted body is unchanged in the 31–50 bucket; the
  docstring addition doesn't count toward the limit)
• api/intelligent_agent.py is not in repo_tests/python_file_size_ratchet_baseline.py
  (only intelligence/intelligent_agent.py, a different file, is tracked), so
  no size-ratchet is at risk
• docs/developer/THREAT_MODEL.md does not reference api/intelligent_agent.py
  or websocket_stream by line number, so no anchor needed updating
• pre-push hook ran pytest on the new test file and passed before the push went out

Model Used

Claude Sonnet 5

Closes #17000

🤖 Generated with Claude Code

Single-issue rationale

This is a single, self-contained critical security fix (unauthenticated agent WebSocket, #17000) with no other open issue sharing its scope or files. Batching it with unrelated work would only delay a critical fix reaching main.

[coderabbitai]

Warning

Review limit reached

Next included review available in 5 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: mrveiss/AutoBot-AI/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 56c850ee-b4b2-4aba-bfe0-4cc37b4e08d6

📥 Commits

Reviewing files that changed from the base of the PR and between 27acbd1 and af31193.

📒 Files selected for processing (2)

• autobot-backend/api/intelligent_agent.py
• autobot-backend/api/intelligent_agent_ws_auth_17000_test.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Notice: 29 open PRs — past the runaway threshold (25)

There is no PR queue limit, and this is not a request to defer this PR. Work proceeds one issue at a time without a cap on open PRs; review capacity is the constraint.

This notice only means the count is high enough to be worth a glance for a runaway — something opening PRs in a loop, or a merge pipeline that has stalled so nothing is draining.

Currently open:

• fix(auth): attribute approval decisions to the verified human caller (#17042) #17051 fix(auth): attribute approval decisions to the verified human caller (security(approvals): an LLC approval's decided_by comes from the request body — any credential can decide and attribute it to anyone; neither approval system requires a human #17042)
• feat(backend): orphan-storage detector framework + code-source clone detector (#17038, #17039) #17050 feat(backend): orphan-storage detector framework + code-source clone detector (Umbrella: SLM Data hygiene page — detect and safely clean up orphaned data across services #17038, feat(backend): orphan-storage detector framework + code-source clone detector, delete through the owning service (#17038) #17039)
• chore(vehicle): land WebSocket auth stack — 4 approved PRs (#16891, #16939, #17018, #17027) #17048 chore(vehicle): land WebSocket auth stack — 4 approved PRs (security(websocket): auth token travels via Sec-WebSocket-Protocol, not the URL (#16457) #16891, security(websocket): every authenticated WebSocket echoes the bearer subprotocol through one helper (#16457) #16939, fix(security): authenticate nine WebSocket endpoints before accept, owner-scope the overseer and workflow sockets, admin-only /api/long-running (#17009, #17010) #17018, fix(ops): long-running operations — create works and records its creator, creator-or-admin access, the panel reads real data, unimplemented starts answer 501 (#17017) #17027)
• chore(vehicle): land CI & hooks infra — 6 approved PRs (#16938, #17032, #16952, #16958, #16882, #16959) #17047 chore(vehicle): land CI & hooks infra — 6 approved PRs (fix(ci): chain formatter dispatch after the branch guard in pre-commit (#16923) #16938, chore(hooks): track the commit-msg hook, install it, and enforce the subject convention (#17029) #17032, fix(tests): prune SKIP dirs during the walk, not after rglob returns (#16601) #16952, test(security): a delegated subagent runs a write its parent is held from (#16950) #16958, security(infra): stop binding ChromaDB to every interface by default (#15317) #16882, fix(infra): gate doc-sync to main-at-origin-tip, move it off post-commit (#16934) #16959)
• chore(vehicle): land security & KB hardening — 5 approved PRs (#16930, #16895, #16937, #16954, #16989) #17046 chore(vehicle): land security & KB hardening — 5 approved PRs (security(rag): route the chat's RAG path through the content firewall (#16771) #16930, security(secrets): content-scanning credential redactor -- catches a credential in free text (#13708) #16895, fix(security): match injection patterns against what a model reads, not the raw text (#16354) #16937, fix(multimodal): the response says whether a result was stored, and if not, why (#16926) #16954, feat(auth): SLM API keys only on declared routes, 403 elsewhere, every key request audited; main backend accepts none (#16040, #16294, #16999) #16989)
• fix(hooks): use stdin JSON instead of $TOOL_ARGS in settings.json hooks (#17024) #17044 fix(hooks): use stdin JSON instead of $TOOL_ARGS in settings.json hooks (Suspected dead hooks in .claude/settings.json: $TOOL_ARGS may not be a real env var #17024)
• security: guessable-default fixes for #16299 (baseline-reasons guard, generate-on-first-run secrets) #17037 security: guessable-default fixes for security: guessable default credentials ship in templates, ansible defaults and the compose file #16299 (baseline-reasons guard, generate-on-first-run secrets)
• chore(hooks): track the commit-msg hook, install it, and enforce the subject convention (#17029) #17032 chore(hooks): track the commit-msg hook, install it, and enforce the subject convention (commit-msg hook should reject a subject with no issue reference #17029)
• fix(ops): long-running operations — create works and records its creator, creator-or-admin access, the panel reads real data, unimplemented starts answer 501 (#17017) #17027 fix(ops): long-running operations — create works and records its creator, creator-or-admin access, the panel reads real data, unimplemented starts answer 501 (long-running: the four start routes cannot create an operation — create_operation gets estimated_items/context it does not accept (TypeError → 500) #17017)
• fix(security): authenticate nine WebSocket endpoints before accept, owner-scope the overseer and workflow sockets, admin-only /api/long-running (#17009, #17010) #17018 fix(security): authenticate nine WebSocket endpoints before accept, owner-scope the overseer and workflow sockets, admin-only /api/long-running (security(ws): nine WebSocket endpoints accept without authentication — PTY execution, workflow control and KB writes among them #17009, security: /api/long-running has no authentication — anyone can start test runs, scans and KB population, or cancel any operation #17010)
• security(kb): re-scope #16985 to a guard -- every connector already reaches store_fact #17016 security(kb): re-scope security(secrets): wire credential redaction into the remaining 11 KB connectors (#13708 follow-up) #16985 to a guard -- every connector already reaches store_fact
• feat(agents): one-shot idle notice (#16949) #17015 feat(agents): one-shot idle notice (feat(agents): subscribe once to be told when a peer is next idle #16949)
• feat(ci): add an open-PR cap to the pre-push gate (#17006) #17008 feat(ci): add an open-PR cap to the pre-push gate (Open-PR cap: refuse new-branch pushes at/above AUTOBOT_OPEN_PR_CAP (default 40) #17006)
• fix(agents): the peer channel delivers to the recipient, not the sender; broadcast reaches every other agent (#16986) #17001 fix(agents): the peer channel delivers to the recipient, not the sender; broadcast reaches every other agent (agents: the peer channel never delivers to the recipient — a request lands in the sender's own inbox and the sender answers itself #16986)
• feat(agents): peer-to-peer messaging and idle notice (#16948, #16949) #16996 feat(agents): peer-to-peer messaging and idle notice (feat(agents): deliver peer messages at the recipient's next turn, not mid-task #16948, feat(agents): subscribe once to be told when a peer is next idle #16949)
• fix(test): give result.metadata a real dict in 3 multimodal perf/scalability mocks (#16990) #16995 fix(test): give result.metadata a real dict in 3 multimodal perf/scalability mocks (bug(test): 3 multimodal performance/scalability tests fail — metadata Mock lacks __setitem__ since #15234 #16990)
• feat(auth): SLM API keys only on declared routes, 403 elsewhere, every key request audited; main backend accepts none (#16040, #16294, #16999) #16989 feat(auth): SLM API keys only on declared routes, 403 elsewhere, every key request audited; main backend accepts none (API key scopes are stored and displayed but never enforced — keys inherit full user authority #16040, feat(auth): decide which routes accept API keys, and wire X-API-Key through the #16040 mechanism #16294, docs(api): the public API docs tell integrators to send a user API key to the main backend, which accepts none #16999)
• fix(ci): bump the mcp CI floor mirror to match the backend's declared floor (#16449) #16983 fix(ci): bump the mcp CI floor mirror to match the backend's declared floor (chore(mcp): autobot-backend/mcp/ shadows the real mcp PyPI SDK, making it unreachable by name #16449)
• fix(deploy): enable rendered nginx sites on self-update, not just full provision #16980 fix(deploy): enable rendered nginx sites on self-update, not just full provision
• feat(agents): capture a terminal session's tenant at creation (#16975) #16978 feat(agents): capture a terminal session's tenant at creation (feat(agents): capture a terminal session's tenant at creation — it cannot be recovered afterwards #16975)
• feat(security): bound every Company OS run by its org role, per adapter (#16950) #16974 feat(security): bound every Company OS run by its org role, per adapter (security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950)
• fix(deploy): the user-frontend build sites publish through a staged swap (#15603) #16970 fix(deploy): the user-frontend build sites publish through a staged swap (bug(deploy): the user-frontend build sites still publish their own failures, and three SLM build sites sit outside the shared staged publish #15603)
• fix(security): A2A trust keyed on the verified pair, capabilities enforced where they apply (#16957, #16950) #16969 fix(security): A2A trust keyed on the verified pair, capabilities enforced where they apply (security(a2a): three of four trust-matrix capabilities are enforced nowhere — a level that denies them denies nothing #16957, security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950)
• fix(security): a delegated agent inherits its parent's authority; the originator survives relays (#16950) #16966 fix(security): a delegated agent inherits its parent's authority; the originator survives relays (security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950)
• feat(agents): live presence registry, one query across all three agent kinds (#16947) #16965 feat(agents): live presence registry, one query across all three agent kinds (feat(agents): live presence — one registry of named agents with busy/idle state, across all three kinds #16947)
• feat(agents): wire QuotaHeadroomStore's read side, add provider/cpu/queue claim kinds (#16951) #16964 feat(agents): wire QuotaHeadroomStore's read side, add provider/cpu/queue claim kinds (feat(agents): coordinate agents competing for shared resources — API limits, CPU time, queues #16951)
• fix(infra): gate doc-sync to main-at-origin-tip, move it off post-commit (#16934) #16959 fix(infra): gate doc-sync to main-at-origin-tip, move it off post-commit (bug(kb): the doc-sync commit hook re-embeds every doc into the live KB from any worktree, because its hash cache is per-checkout #16934)
• test(security): a delegated subagent runs a write its parent is held from (#16950) #16958 test(security): a delegated subagent runs a write its parent is held from (security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950)
• test(security): the ungated-router list may only shrink, so a new entry fails (#16375) #16955 test(security): the ungated-router list may only shrink, so a new entry fails (security(api): 44 config-registered routers declare no auth gate, triaged by exposure (found by widening the router-auth guard, #16368) #16375)

If the queue is draining normally, ignore this. Otherwise:

1. Check whether CI is dispatching at all — see the ci-dispatch-watchdog status on these PRs
2. Merge the ones whose CI has finished and review has passed: gh pr merge <number> --squash --delete-branch
3. Look for a loop opening near-identical PRs

Warn-only runaway detector — .github/workflows/pr-queue-gate.yml. It never blocks a merge.

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No new hardcoded values of either class — ssot and other both block.

Known backlog in pipeline-scripts/hardcoded_values_baseline.txt is suppressed and tracked in #14371.

[mrveiss]

Carried by vehicle #17086, which includes this PR's approved head af31193be. Closed now as carried, per the owner's ruling (2026-09-19) that consolidated work shouldn't keep open duplicates or trigger extra CI. The branch is kept. The vehicle's own Closes lines close the linked issues when it lands. If #17086 is abandoned, this PR gets reopened.