security(#298): require owner-signed revision before auto-update

[nolanmak]

Closes #298.

Hardens the 5-minute auto-updater (checkForUpdates() in src/index.ts) so it only deploys revisions cryptographically verified to come from the owner — not the spoofable git author field.

• Before any pull/build/restart, the candidate origin/main HEAD must pass git verify-tag (preferred — signed release tags, decouples deploy from every push) or git verify-commit, with an allowed-signers file as the trust anchor (AUGMENTAGENT_UPDATE_ALLOWED_SIGNERS).
• Unsigned / bad-sig / untrusted-signer → skip entirely (no pull/build/restart), log loudly, best-effort Discord alert.
• Required by default; explicit AUGMENTAGENT_UPDATE_REQUIRE_SIGNATURE=false escape hatch for users who can't sign.
• Dependency install switched to npm ci --omit=dev --ignore-scripts (no install lifecycle scripts in package.json; build still runs explicitly).

Verification: npm install + npx tsc --noEmit pass (exit 0).

Follow-up (out of scope, important): there is a second auto-update path — POST /api/webhook/github in dashboard.ts runs the same git pull && npm install && build && restart after only HMAC-verifying the webhook delivery (proves it came from GitHub, not that the commit is owner-signed). The same isRevisionSignedByOwner() gate should be applied there. Also: enable branch protection on main + signed commits as the upstream control.

🤖 swarm-authored, human-review-required (draft).

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 24e38d14-681a-4101-963f-c43c4efa2103

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sec/298-signed-autoupdate

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}