Agents security and deployment

Agents v0.10 · Early access · Updated 23 October 2026

v0.10 is an operator service for one workspace. A production-named profile enables safeguards; it does not certify deployment acceptance.

Provision roles offline

node tools/auth-setup.mjs admin admin
node tools/auth-setup.mjs support operator
node tools/auth-setup.mjs reviewer viewer
node tools/backup-key.mjs

Administrator controls configuration, sources, publication, exports and security. Operator handles conversations, tickets, notes and ordinary operational work. Viewer reads workspace information but cannot mutate or export private data. Roles share one workspace. They do not provide customer isolation or anonymous-widget access. Restart after account-file changes.

Session protection

Credentials use scrypt and random salts. Sessions use opaque HttpOnly, SameSite=Strict cookies; the strict profile adds Secure. Tokens are hashed server-side and invalidated by restart. Default expiry is eight hours absolute and 30 minutes idle. Mutations need X-CreekX-CSRF. Operator security can revoke sessions. SSO, MFA and email reset are not implemented.

Strict TLS proxy profile

CREEKX_PROFILE=production
CREEKX_PUBLIC_ORIGIN=https://agents.example.com
CREEKX_TRUST_LOOPBACK_PROXY=true
CREEKX_AUTH_USERS_FILE=/private/creekx/operators.json
CREEKX_BACKUP_KEY_FILE=/private/creekx/backup.key
CREEKX_STORE=sqlite

The application remains bound to 127.0.0.1. Strict requests require the configured Host, X-Forwarded-Proto=https and valid proxy-set X-Real-IP. The loopback proxy must overwrite client-provided address headers. An Origin header must exactly match the configured origin. Review deploy/nginx.conf.example in the package, replace hostname/certificate paths and validate on the deployment host. Never publicly tunnel the unconfigured development profile.

Rate and resource controls

Login throttling tracks failed attempts per address and bounds password work. Limits cover payload/read time, inference concurrency, sessions, messages, response sizes and speech attempts. Failed speech attempts consume budget. Add perimeter controls for internet access. Test proxy rejection, CSRF, role denial, logout and throttling on the actual host; startup checks are not an independent security audit.

Data and filesystem boundaries

Protect credentials, data, exports and backup keys with service-account OS permissions. POSIX mode flags do not establish Windows ACL protection. Transcripts and source snapshots can retain confidential text. Archiving originals does not remove historical copies. Remote models receive context; browser speech can use external recognition even with evidence mode. Review every destination and retention policy.

Before wider access

Do not embed the operator API as a public widget. Customer authorization, tenancy, document-level permissions and full deletion workflows remain open. Test backup restoration privately and retain matching data/application versions. See operations before changing a valued workspace.