fix(docker): harden integrated service exposure

Squash merge PR #1291 into dev.

src/docker/docker-bootstrap.ts

@@ -1,8 +1,11 @@
+import { randomBytes } from 'crypto';
 import { spawn } from 'child_process';
-import { ensureCLIProxyBinary } from '../cliproxy/binary-manager';
+import { ensureCLIProxyBinary, getInstalledCliproxyVersion } from '../cliproxy/binary-manager';
 import {
   configExists,
   configNeedsRegeneration,
+  CCS_CONTROL_PANEL_SECRET,
+  CCS_INTERNAL_API_KEY,
   generateConfig,
   getCliproxyWritablePath,
   regenerateConfig,
@@ -10,13 +13,42 @@ import {
 import { CLIPROXY_DEFAULT_PORT } from '../cliproxy/config/port-manager';
 import { getCliproxyConfigPath } from '../cliproxy/config/path-resolver';
 import { registerSession, unregisterSession } from '../cliproxy/session-tracker';
-import { getInstalledCliproxyVersion } from '../cliproxy/binary-manager';
+import { loadOrCreateUnifiedConfig, mutateConfig } from '../config/config-loader-facade';
+
+function generateDockerSecret(): string {
+  return randomBytes(32).toString('base64url');
+}
+
+export function ensureDockerCliproxyAuth(): boolean {
+  const config = loadOrCreateUnifiedConfig();
+  const auth = config.cliproxy.auth;
+  const needsApiKey = !auth?.api_key || auth.api_key === CCS_INTERNAL_API_KEY;
+  const needsManagementSecret =
+    !auth?.management_secret || auth.management_secret === CCS_CONTROL_PANEL_SECRET;
+
+  if (!needsApiKey && !needsManagementSecret) {
+    return false;
+  }
+
+  mutateConfig((nextConfig) => {
+    nextConfig.cliproxy.auth ??= {};
+    if (needsApiKey) {
+      nextConfig.cliproxy.auth.api_key = generateDockerSecret();
+    }
+    if (needsManagementSecret) {
+      nextConfig.cliproxy.auth.management_secret = generateDockerSecret();
+    }
+  });
+
+  return true;
+}
 
 async function prepareIntegratedRuntime(): Promise<{ binaryPath: string; configPath: string }> {
   const binaryPath = await ensureCLIProxyBinary(false);
+  const authWasGenerated = ensureDockerCliproxyAuth();
   const configPath = !configExists(CLIPROXY_DEFAULT_PORT)
     ? generateConfig('gemini', CLIPROXY_DEFAULT_PORT)
-    : configNeedsRegeneration()
+    : authWasGenerated || configNeedsRegeneration()
       ? regenerateConfig(CLIPROXY_DEFAULT_PORT)
       : getCliproxyConfigPath();
 

src/docker/docker-executor.ts

@@ -202,6 +202,7 @@ export class DockerExecutor {
           CCS_NPM_VERSION: this.getInstalledCcsVersion(),
           CCS_DASHBOARD_PORT: String(options.port),
           CCS_CLIPROXY_PORT: String(options.proxyPort),
+          CCS_DOCKER_BIND_HOST: process.env.CCS_DOCKER_BIND_HOST || '127.0.0.1',
         },
         REMOTE_DOCKER_BUILD_TIMEOUT_MS
       ),