security(runner): reject direct AG-UI connections that bypass backend proxy

[jeremyeder]

Jira: RHOAIENG-51907

Problem

The runner pod exposes its AG-UI endpoint on port 8001 with no access control. Anyone who can reach the pod (in-cluster, or via port-forward) can:

• Send prompts and consume the response stream
• Execute arbitrary work in the session's context
• Do so without the frontend or backend being aware

The runner doesn't validate that requests came through the backend proxy. There's no shared event bus — AG-UI is request/response SSE, so whoever makes the POST gets the exclusive stream. No fan-out to other listeners.

Impact

• Work can happen "off-camera" — the UI shows nothing
• No audit trail through the backend
• Potential security concern in multi-tenant clusters

Proposed Solution

The runner should validate that AG-UI requests came through the backend proxy. Options:

1. Require a proxy header/token that only the backend adds (e.g., X-Ambient-Internal-Token)
2. NetworkPolicy restricting port 8001 to only the backend pod
3. mTLS between backend and runner

Option 1 is simplest. The backend already has the runner token — it could include it as a header, and the runner validates it.

Context

Discovered when a direct curl to the runner pod via port-forward delivered a prompt and consumed the entire AG-UI stream, leaving the frontend with no visibility into the session's work.

[github-actions]

Amber Change Summary

The following files were modified:

 components/backend/websocket/agui_proxy.go         |  61 +++++++-
 components/operator/go.mod                         |   2 +-
 components/operator/internal/handlers/sessions.go  |  23 ++-
 .../claude-code-runner/ambient_runner/app.py       |   7 +-
 .../ambient_runner/middleware/__init__.py          |   3 +-
 .../ambient_runner/middleware/proxy_auth.py        |  75 +++++++++
 .../claude-code-runner/tests/test_proxy_auth.py    | 168 +++++++++++++++++++++
 7 files changed, 331 insertions(+), 8 deletions(-)

Next Steps:

• Review that changes match the issue description
• Verify no scope creep or unintended modifications
• A PR will be created shortly for formal review

---

🔍 View AI decision process (logs available for 90 days)

[github-actions]

🤖 Amber has created a pull request to address this issue: #756

The changes are ready for review. All automated checks will run on the PR.

---

🔍 View AI decision process (logs available for 90 days)

[github-actions]

Inactive for 30 days. Will close in 7 days unless there's activity.