fix(dashboard): embedding Test Connection expands {file:}/{env:} tokens and allows http/loopback/LAN

Two user-reported bugs in the dashboard 'Test Connection' probe, both from the
probe applying untrusted-project-config security policy to what is actually the
user-config editor:

1. A {file:~/...key} api_key (the pattern we document and recommend) was refused
   with an {env:}-flavored message ('variable is not set in this process / shell
   exports the var') that is nonsense for a file token.
2. A self-hosted http://127.0.0.1:1234/v1 endpoint was rejected as 'must start
   with http:// or https://' (it does) — the validator was https-only, and even
   with http allowed the SSRF guard then blocked loopback, so localhost servers
   (LMStudio/Ollama/llama.cpp, the most common local setup) couldn't be tested.

The probe's only input is the USER-level ConfigEditor; project-tier editing covers
only dreamer schedule/model, never embedding. So the 'malicious project config
picks a hostile endpoint/secret-file and the user clicks Test' precondition is not
reachable here, and the probe now mirrors doctor (which it is documented to
mirror):

- expand_config_value() resolves {env:VAR} and {file:~|/abs|rel} exactly like the
  plugin's load-time variable.ts (file contents trimmed; relative paths resolve
  against the user config dir). Unresolved tokens still don't reach the network.
- {file:} tokens resolving into credential dirs (~/.ssh, ~/.aws, ~/.gnupg,
  ~/.config/gh) are REFUSED (new BlockedSensitiveFile outcome) — defense in depth.
- http:// is now accepted alongside https://.
- loopback + private/LAN (incl. IPv6 ULA) are now allowed. Cloud instance-metadata
  (169.254.169.254, AWS IPv6 fd00:ec2::254, incl. IPv4-mapped), IPv4/IPv6
  link-local, and unspecified stay blocked; URL userinfo still rejected.
- Frontend message branches on token kind (file vs env) so the guidance is
  accurate, and renders the new sensitive-file refusal.

Documented the reversal of the prior probe-SSRF audit finding as A53 so future
audits don't re-flag it. Rust 133/0 (incl. new metadata/loopback/scheme/expand
tests), tsc + biome + build clean.

Co-authored-by: Alfonso [Magic Context] <288211368+alfonso-magic-context@users.noreply.github.com>

Author: ualtinok

docs/AUDIT-KNOWN-ISSUES.md

@@ -862,3 +862,25 @@ config" — trusting it (and letting GC run against the model it names) is corre
 not a data-safety hole. The destructive-sweep scenario requires a conflicted
 shared file to exist, which the migrator structurally never produces. If a user
 hand-authors a shared config, that IS their authoritative intent by definition.
+
+### A53. Dashboard embedding "Test Connection" expands {env:}/{file:} tokens and allows http/loopback/LAN (deliberate, user-config-only surface)
+A prior audit added a hard SSRF + token-refusal guard to the dashboard
+`test_embedding_endpoint` probe (`embedding_probe.rs`): it refused to expand
+`{env:}`/`{file:}` tokens, required `https`, and blocked loopback + RFC1918.
+That guard was relaxed deliberately because it broke the two most common, fully
+legitimate setups (a `{file:~/...key}` api_key, the pattern we document, and a
+self-hosted `http://localhost` embedding server) while protecting a threat that
+is not reachable on this surface. The probe's only input is the **user-level**
+config editor (`ConfigEditor`, rendered once from `App.tsx`); project-tier
+editing covers only dreamer schedule/model, never embedding. So the
+"malicious-project-config picks a hostile endpoint/secret-file and the user
+clicks Test" precondition is **not satisfiable**: the values are always the
+user's own, and expanding them to test is exactly what the plugin does at
+runtime. The probe now mirrors `doctor` (Node), which it is documented to mirror.
+Retained guards (cheap, no legit cost): cloud instance-metadata (IPv4
+169.254.169.254 + AWS IPv6 `fd00:ec2::254`, incl. IPv4-mapped) is always blocked;
+IPv4 link-local (169.254/16) + IPv6 link-local (fe80::/10) + unspecified stay
+blocked; URL userinfo (`user:pass@`) is rejected; and `{file:}` tokens resolving
+into credential dirs (`~/.ssh`, `~/.aws`, `~/.gnupg`, `~/.config/gh`) are refused.
+Do not re-add the https-only / token-refusal / loopback-block guards without a
+new threat model showing an attacker-controlled value can reach this probe.

packages/dashboard/src-tauri/src/commands.rs

@@ -1,8 +1,10 @@
 use crate::embedding_probe::{
-    find_substitution_token, probe_embedding_endpoint, EmbeddingProbeOptions, EmbeddingProbeOutcome,
+    expand_config_value, probe_embedding_endpoint, EmbeddingProbeOptions, EmbeddingProbeOutcome,
+    TokenExpandError,
 };
 use crate::process_ext::NoWindowExtTokio;
 use crate::{config, db, log_parser, AppState};
+use std::path::{Path, PathBuf};
 use tauri::State;
 
 // ── Memory commands ─────────────────────────────────────────
@@ -903,10 +905,27 @@ pub async fn get_available_pi_models() -> Vec<String> {
 ///
 /// 3. 401/403 → `AuthFailed` (specific "credentials rejected" message).
 ///    404/405 → `EndpointUnsupported` (wrong URL / no embeddings API).
-fn reject_probe_token(field: &str, value: &str) -> Option<EmbeddingProbeOutcome> {
-    find_substitution_token(value).map(|token| EmbeddingProbeOutcome::UnresolvedToken {
-        field: field.to_string(),
-        token,
+/// Expand an `{env:}`/`{file:}` token in one probe field, mapping a failure to
+/// the matching probe outcome. The embedding fields come from the USER-level
+/// config editor, so expanding the user's own tokens to test their endpoint is
+/// exactly what the plugin does at runtime (see `expand_config_value`).
+fn expand_probe_field(
+    field: &str,
+    value: &str,
+    config_dir: &Path,
+) -> Result<String, EmbeddingProbeOutcome> {
+    expand_config_value(value, config_dir).map_err(|err| match err {
+        TokenExpandError::Unresolved(token) => EmbeddingProbeOutcome::UnresolvedToken {
+            field: field.to_string(),
+            token,
+        },
+        TokenExpandError::SensitiveFile { token, reason } => {
+            EmbeddingProbeOutcome::BlockedSensitiveFile {
+                field: field.to_string(),
+                token,
+                reason,
+            }
+        }
     })
 }
 
@@ -917,17 +936,19 @@ fn prepare_embedding_probe_options(
     input_type: Option<String>,
     truncate: Option<String>,
 ) -> Result<EmbeddingProbeOptions, EmbeddingProbeOutcome> {
-    if let Some(outcome) = reject_probe_token("endpoint", &endpoint) {
-        return Err(outcome);
-    }
-    if let Some(outcome) = reject_probe_token("model", &model) {
-        return Err(outcome);
-    }
-    if let Some(key) = api_key.as_deref() {
-        if let Some(outcome) = reject_probe_token("api_key", key) {
-            return Err(outcome);
-        }
-    }
+    // Relative `{file:}` references resolve against the user config file's dir,
+    // matching the plugin's load-time resolution.
+    let config_dir = config::resolve_user_config_path()
+        .parent()
+        .map(Path::to_path_buf)
+        .unwrap_or_else(|| PathBuf::from("."));
+
+    let endpoint = expand_probe_field("endpoint", &endpoint, &config_dir)?;
+    let model = expand_probe_field("model", &model, &config_dir)?;
+    let api_key = match api_key {
+        Some(key) => Some(expand_probe_field("api_key", &key, &config_dir)?),
+        None => None,
+    };
 
     let input_type = input_type
         .map(|s| s.trim().to_string())
@@ -1130,50 +1151,61 @@ mod tests {
     }
 
     #[test]
-    fn embedding_probe_refuses_file_api_key_without_reading_secret() {
+    fn embedding_probe_expands_file_api_key_for_the_test() {
+        // The embedding fields come from the USER config editor, so a
+        // {file:...} api_key is the user's own secret; expand it (as the
+        // plugin does at runtime) instead of refusing.
         let dir = tempfile::tempdir().expect("tempdir");
         let secret_path = dir.path().join("embedding-secret.txt");
-        std::fs::write(&secret_path, "super-secret-token").expect("write secret");
+        std::fs::write(&secret_path, "  super-secret-token\n").expect("write secret");
         let token = format!("{{file:{}}}", secret_path.display());
 
-        let outcome = prepare_embedding_probe_options(
+        let options = prepare_embedding_probe_options(
             "https://example.com/v1".to_string(),
             "text-embedding-3-small".to_string(),
-            Some(token.clone()),
+            Some(token),
             None,
             None,
         )
-        .expect_err("file token must be refused before any network probe");
+        .expect("resolvable file token should expand, not error");
 
-        match outcome {
-            EmbeddingProbeOutcome::UnresolvedToken {
-                field,
-                token: reported,
-            } => {
-                assert_eq!(field, "api_key");
-                assert_eq!(reported, token);
-            }
-            other => panic!("expected unresolved token, got {other:?}"),
-        }
+        // file contents are trimmed by expand_config_value (the file had
+        // leading/trailing whitespace).
+        assert_eq!(options.api_key.as_deref(), Some("super-secret-token"));
     }
 
     #[test]
-    fn embedding_probe_refuses_env_model_token_without_expanding() {
-        std::env::set_var("MC_DASHBOARD_TEST_MODEL", "secret-model");
-        let outcome = prepare_embedding_probe_options(
+    fn embedding_probe_expands_env_model_token_for_the_test() {
+        std::env::set_var("MC_DASHBOARD_TEST_MODEL", "resolved-model");
+        let options = prepare_embedding_probe_options(
             "https://example.com/v1".to_string(),
             "{env:MC_DASHBOARD_TEST_MODEL}".to_string(),
             Some("literal-key".to_string()),
             None,
             None,
         )
-        .expect_err("env token must be refused before any network probe");
+        .expect("resolvable env token should expand, not error");
         std::env::remove_var("MC_DASHBOARD_TEST_MODEL");
 
+        assert_eq!(options.model, "resolved-model");
+    }
+
+    #[test]
+    fn embedding_probe_reports_unresolved_env_token() {
+        std::env::remove_var("MC_DASHBOARD_UNSET_TEST_VAR");
+        let outcome = prepare_embedding_probe_options(
+            "https://example.com/v1".to_string(),
+            "text-embedding-3-small".to_string(),
+            Some("{env:MC_DASHBOARD_UNSET_TEST_VAR}".to_string()),
+            None,
+            None,
+        )
+        .expect_err("an unset env token must not reach the network");
+
         match outcome {
             EmbeddingProbeOutcome::UnresolvedToken { field, token } => {
-                assert_eq!(field, "model");
-                assert_eq!(token, "{env:MC_DASHBOARD_TEST_MODEL}");
+                assert_eq!(field, "api_key");
+                assert_eq!(token, "{env:MC_DASHBOARD_UNSET_TEST_VAR}");
             }
             other => panic!("expected unresolved token, got {other:?}"),
         }

packages/dashboard/src-tauri/src/db.rs

@@ -1254,9 +1254,9 @@ fn build_db_cache_events_with_decisions(
             finish: row.finish,
             turn_id: String::new(),
             is_turn_start: false,
-            context_limit: 0,           // filled in after sessions are known
+            context_limit: 0,               // filled in after sessions are known
             context_limit_estimated: false, // set with context_limit below
-            is_drop: false,             // computed in pass 2
+            is_drop: false,                 // computed in pass 2
         });
     }
 
@@ -6775,7 +6775,10 @@ mod memory_project_filter_tests {
         let rows = get_memories(&conn, None, None, None, None, None, 100, 0)
             .expect("get_memories must not error when memory_embeddings is absent");
         assert_eq!(rows.len(), 1);
-        assert!(!rows[0].has_embedding, "no embeddings table → has_embedding=false");
+        assert!(
+            !rows[0].has_embedding,
+            "no embeddings table → has_embedding=false"
+        );
 
         let stats = get_memory_stats(&conn, None, None).expect("stats must not error");
         assert_eq!(stats.with_embeddings, 0);