Harden logins and lifecycle, fix Drive reliability, and tighten CI

.dockerignore

@@ -1,7 +1,9 @@
 .git
 .venv
 __pycache__
+**/__pycache__
 *.pyc
+**/*.pyc
 .pytest_cache
 .worktrees
 .claude
@@ -11,6 +13,7 @@ __pycache__
 *.key
 *.log
 node_modules
+**/node_modules
 web/web-ui/threads.json
 .env
 *.env.local

.env.example

@@ -14,13 +14,13 @@ CASE_MAX_RUNNING=4
 # engine sees (on a Mac that is the VM, not the Mac). A create/wake past it 409s.
 CASE_MAX_RAM_MB=
 
-# Drive talks to cased on loopback / the compose network. No SSH.
-CASE_LOCAL=1
-
-# Drive home: threads.json, drive/shots (and later drive/inbox). Compose sets
-# CASE_HOME=/data so they share the ui-data volume. Unset = ~/.case.
+# Drive home: drive/shots and drive/inbox. Compose sets CASE_HOME=/data, the
+# ui-data volume. Unset = ~/.case.
 # CASE_HOME=
 
+# Drive threads. Compose sets /data/threads.json. Unset = web/web-ui/threads.json.
+# CASE_THREADS=
+
 # Per-turn input-token ceiling for Drive chat. Default 2000000.
 # CASE_TURN_TOKENS=2000000
 
@@ -30,6 +30,9 @@ CASE_LOCAL=1
 # Desktop resolution for new/woken computers (WxH or WxHxDEPTH).
 # DESK_RESOLUTION=1280x800x24
 
+# 1 = desktops mirror their Chromium and websockify logs to docker logs.
+# DESK_DEBUG=1
+
 # Browser Drive still takes the key per request (x-openai-key / x-anthropic-key).
 # The box key below is used by phone chat and schedules.
 # CASE_DRIVE_PROVIDER=openai
@@ -42,6 +45,13 @@ CASE_LOCAL=1
 # on PATH.
 # CASE_BRAIN_URL=
 # CASE_BRAIN_CMD=
+# Seconds a scheduled run may take before it is stopped. Default 1800.
+# CASE_BRAIN_TIMEOUT=1800
+
+# Session keeper: how often saved logins with a probe_url are checked, and how
+# recently a computer must have been used for the check to skip it. Seconds.
+# CASE_SESSION_KEEPER_INTERVAL_S=21600
+# CASE_SESSION_KEEPER_BUSY_S=900
 
 # Phone chat over Telegram: make a bot with @BotFather, paste its token, start
 # the ui, send /start to the bot and it replies with the chat id to put here.
@@ -62,7 +72,7 @@ CASE_LOCAL=1
 # unset on a laptop; those links and buttons are omitted.
 # CASE_PUBLIC_HOST=
 
-# Extra hostnames Drive and cased will answer to (comma-separated). Only needed
+# Extra hostnames Drive, cased and MCP will answer to (comma-separated). Only needed
 # when something fronts them under another name; any other Host gets a 403.
 # CASE_PUBLIC_HOST is allowed without being repeated here.
 # CASE_ALLOWED_HOSTS=
@@ -76,3 +86,12 @@ CASE_LOCAL=1
 # CASE_DBC_AUTHTOKEN=
 # CASE_DBC_USERNAME=
 # CASE_DBC_PASSWORD=
+# Proxy the solver should use to load the page (host:port), and its type.
+# CASE_DBC_PROXY=
+# CASE_DBC_PROXYTYPE=HTTP
+
+# Anonymous usage stats: counts of computers and schedules, and whether
+# scheduled runs succeed. Never a name, prompt, domain or credential. Either
+# line turns them off.
+# CASE_TELEMETRY=0
+# DO_NOT_TRACK=1

.github/workflows/audit.yml

@@ -0,0 +1,43 @@
+# SPDX-License-Identifier: MIT
+# Known-vulnerability check for the pinned dependencies. Weekly, because an
+# advisory lands on a pin that has not changed; and on pull requests that change
+# a pin, so a bump is checked before it merges.
+name: audit
+
+on:
+  schedule:
+    - cron: "17 6 * * 1"
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - requirements*.txt
+      - image/requirements.txt
+      - web/package*.json
+      - .github/workflows/audit.yml
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "22"
+
+      - name: Python
+        run: |
+          python -m venv .venv
+          .venv/bin/pip install pip-audit==2.10.1
+          # separate runs: cased and deskd pin different fastapi, so one resolve fails
+          .venv/bin/pip-audit -r requirements-dev.txt
+          .venv/bin/pip-audit -r image/requirements.txt
+
+      - name: Drive
+        run: npm --prefix web audit --omit=dev

.github/workflows/ci.yml

@@ -11,24 +11,36 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
+          cache: pip
+          cache-dependency-path: requirements*.txt
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
+          cache: npm
+          cache-dependency-path: web/package-lock.json
 
       - name: Install deps
         run: |
           python -m venv .venv
           .venv/bin/pip install -r requirements-dev.txt
 
+      - name: Lint
+        run: .venv/bin/ruff check --select F,E9 control-plane mcp image tests
+
       - name: Unit tests (no Docker)
         run: |
           # Everything except the acceptance suite, which needs a real desktop
@@ -47,6 +59,30 @@ jobs:
           npm --prefix web ci --omit=dev    # serve.mjs imports openai at module load
           npm --prefix web test
 
+      - name: Shell scripts
+        run: .venv/bin/shellcheck -e SC1090 image/start.sh bin/case   # SC1090: ~/.case/env is the user's
+
+      - name: Compose file
+        run: docker compose config -q
+
+  # deskd runs on Debian bookworm's Python in the image, against its own pins, not
+  # the control plane's. Test it there too.
+  deskd:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: image/requirements.txt
+      - name: deskd tests on the image's pins
+        run: |
+          python -m venv .venv
+          .venv/bin/pip install -r image/requirements.txt httpx==0.28.1
+          .venv/bin/python tests/test_deskd.py
+
   # Case is dual-licensed and sold commercially, which is only possible if the
   # project can sublicense every contribution. Deliberately no third-party CLA
   # bot: the one everyone used was archived in March 2026, and a licensing gate
@@ -55,6 +91,7 @@ jobs:
   cla:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Contributor has signed the CLA
@@ -88,16 +125,20 @@ jobs:
 
   spdx:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Every source file declares its license
         run: |
+          # A plain pathspec's * crosses directories, so web/*.mjs covers web/ at any depth.
+          # The list is built first so a git failure fails the step instead of an empty loop.
+          files=$(git ls-files \
+                    'control-plane/*.py' 'image/*.py' 'image/*.sh' \
+                    'mcp/*.py' 'tests/*.py' 'web/*.mjs' 'web/*.html' 'bin/case')
           missing=0
-          while read -r f; do
+          for f in $files; do
             grep -q 'SPDX-License-Identifier' "$f" || { echo "no SPDX header: $f"; missing=1; }
-          done < <(git ls-files \
-                     'control-plane/*.py' 'image/*.py' 'image/*.sh' \
-                     'mcp/*.py' 'tests/*.py' 'web/**/*.mjs' 'bin/case')
+          done
           [ "$missing" = 0 ] || {
             echo "New files take the SPDX id of their directory. See LICENSE.md."
             exit 1

.github/workflows/images.yml

@@ -0,0 +1,62 @@
+# SPDX-License-Identifier: MIT
+# Build the three images on changes that can break them, so a bad base digest,
+# noVNC checksum or pin shows up on the pull request instead of at release.
+# Nothing is pushed; publish-image.yml does that from tags.
+name: images
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - image/**
+      - Dockerfile.*
+      - .dockerignore
+      - compose.yaml
+      - requirements.txt
+      - web/package*.json
+      - .github/workflows/images.yml
+  pull_request:
+    paths:
+      - image/**
+      - Dockerfile.*
+      - .dockerignore
+      - compose.yaml
+      - requirements.txt
+      - web/package*.json
+      - .github/workflows/images.yml
+
+permissions:
+  contents: read
+
+concurrency:
+  group: images-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: desk
+            context: ./image
+            file: ./image/Dockerfile
+          - name: control
+            context: .
+            file: ./Dockerfile.cased
+          - name: ui
+            context: .
+            file: ./Dockerfile.ui
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        with:
+          context: ${{ matrix.context }}
+          file: ${{ matrix.file }}
+          platforms: linux/amd64
+          cache-from: type=gha,scope=check-${{ matrix.name }}
+          cache-to: type=gha,mode=max,scope=check-${{ matrix.name }}
+          push: false

.github/workflows/publish-image.yml

@@ -91,15 +91,17 @@ jobs:
           tags: |
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest,enable=${{ github.ref_type == 'tag' }}
+            type=raw,value=latest,enable=${{ github.ref_type == 'tag' && !contains(github.ref_name, '-') }}
             type=raw,value=edge,enable=${{ github.ref_type != 'tag' }}
 
       - name: One manifest for both arches
+        env:
+          META_JSON: ${{ steps.meta.outputs.json }}
         run: |
           cd /tmp/digests
           # shellcheck disable=SC2046
           docker buildx imagetools create \
-            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< '${{ steps.meta.outputs.json }}') \
+            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$META_JSON") \
             $(printf '${{ env.IMAGE }}@sha256:%s ' *)
 
       - name: Show what landed

CONTRIBUTING.md

@@ -33,10 +33,14 @@ for f in tests/test_*.py; do
   case "$f" in tests/test_acceptance.py) continue ;; esac
   .venv/bin/python "$f" || exit 1
 done
+.venv/bin/ruff check --select F,E9 control-plane mcp image tests
 npm --prefix web ci
 npm --prefix web test
 ```
 
+Unit tests run one file per process, as CI does: each file sets up its own vault
+when it is imported, so a single pytest run across the files shares one and fails.
+
 ## Acceptance tests (Docker)
 
 ```bash

README.md

@@ -217,6 +217,8 @@ to the same topic. It marks its own posts so it does not read them as new tasks.
 
 When one handoff is waiting, your next message answers it. If several are
 waiting, prefix the answer with its handoff ID, such as `h_ab12 483920`.
+An approval takes only `approve` or `deny`; any other reply is refused and the
+handoff keeps waiting.
 With no handoff waiting, a message steers the current Phone task or starts a
 new task on the first computer returned by cased. Create a computer before
 sending your first task.
@@ -242,7 +244,7 @@ Choose a computer's size under **+ New computer**, then **SIZE**. The default is
 
 | Setting | What it controls | Compose default |
 | --- | --- | --- |
-| `CASE_MAX_RUNNING` | Maximum number of awake computers | 4 |
+| `CASE_MAX_RUNNING` | Maximum number of awake computers | 4 (8 without Compose) |
 | `CASE_MAX_RAM_MB` | Total RAM that awake computers may reserve, in MB | 75% of the memory visible to cased |
 
 On macOS with Compose, that memory comes from the Docker VM. A 4 GB VM has room
@@ -277,7 +279,9 @@ Set `CASE_TOKEN` to that value in `.env`. Add your proxy hostname to
 `CASE_TOKEN` protects Drive and the REST API. Open Drive through the HTTPS proxy
 with `?token=<your-token>` on the first visit. MCP on port 8788 has no built-in
 client authentication: keep it local or configure authentication at its proxy.
-Setting `CASE_TOKEN` alone does not protect the MCP endpoint.
+Setting `CASE_TOKEN` alone does not protect the MCP endpoint. MCP checks `Host`
+against the same list as cased and Drive, so a proxy in front of it needs its
+hostname in `CASE_ALLOWED_HOSTS` too.
 
 For ntfy Assist links and approval buttons, set `CASE_PUBLIC_HOST` to the public
 hostname of your cased proxy, without a scheme. That hostname is allowed without
@@ -326,13 +330,20 @@ Start cased, then Drive:
 
 ```bash
 bin/case up
-CASE_LOCAL=1 CASE_URL=http://127.0.0.1:8787 node web/web-ui/serve.mjs
+CASE_URL=http://127.0.0.1:8787 node web/web-ui/serve.mjs
 ```
 
 Open the [computers page](http://127.0.0.1:4174/deploy). Drive runs in the
 foreground in this terminal. Host processes use environment variables, not the
-Compose `.env` file. If cased runs directly on macOS, set `CASE_MAX_RAM_MB`
-explicitly; its automatic memory budget requires Linux's `/proc/meminfo`.
+Compose `.env` file; `bin/case` also reads `~/.case/env` if it exists. If cased
+runs directly on macOS, set `CASE_MAX_RAM_MB` explicitly; its automatic memory
+budget requires Linux's `/proc/meminfo`.
+
+A few settings only apply here. `CASE_PORT` moves cased off 8787.
+`CASE_VNC_PORT` pins every desktop's noVNC to one host port for a reverse proxy.
+`CASE_BRAIN_BIN` points the scheduler at a `claude` binary that is not on `PATH`,
+and `CASE_MCP_CONFIG` replaces `case-mcp.json`. On macOS, `CASE_CPU` and
+`CASE_MEM` size the Colima VM that `bin/case up` starts (default 4 CPUs, 4 GB).
 
 For a client that uses stdio MCP, [case-mcp.json](case-mcp.json) starts
 `mcp/case_mcp.py` with Python. It needs the installed Python dependencies and
@@ -375,11 +386,13 @@ installation, or the `case-home` volume mounted at `/data` in Compose. Back up
 the database and key together, along with the desktop volumes you want to keep.
 Treat these backups as sensitive data.
 
-Drive keeps `threads.json`, screenshots under `drive/shots`, and attachments
-under `drive/inbox` in its home directory. This is `~/.case` by default; Compose
-uses the `ui-data` volume mounted at `/data`. Deleting a thread does not remove
-its screenshots or attachments. Files added through the plus menu stay on the
-Drive host for the model to read; they are not copied onto the desktop computer.
+Drive keeps screenshots under `drive/shots` and attachments under `drive/inbox`
+in its home directory, `~/.case` by default. Its threads are in
+`web/web-ui/threads.json` by default, or the file `CASE_THREADS` names. Compose
+keeps all of them on the `ui-data` volume mounted at `/data`. Deleting a thread
+does not remove its screenshots or attachments. Files added through the plus
+menu stay on the Drive host for the model to read; they are not copied onto the
+desktop computer.
 
 </details>