Dev-only gates spelled `NODE_ENV !== 'production'` still open in a real production deployment that never sets NODE_ENV (`os serve` does not force it, `os start` does)

[os-warren]

Filed as the declared residual of #10366, whose maintainer ruling (2026-08-22) is being implemented as literally ruled. Filing rather than silently tightening, per the disposition precedent in #11035. Unassigned and unlabelled — this is for triage, not a grade.

The residual

#10366 gates the localhost trusted-origin substitution in
packages/plugins/plugin-auth/src/auth-manager.ts on the ruling's literal
predicate:

process.env.NODE_ENV !== 'production'

When NODE_ENV is unset, undefined !== 'production' is true. So a real
production deployment that never sets NODE_ENV is still treated as
non-production and still receives the development convenience.

The ruling's literal text governs, and tightening it to === 'development'
would be a stricter boundary than ruled — it would break test and
unset-NODE_ENV development flows. So #10366 implements it as ruled and
records the gap here instead.

Measured — the gap is narrower than it first reads, and it is not zero

Re-derived on origin/main @ 24043c290:

• os start forces it. packages/cli/src/commands/start.ts:347 —
  if (!localEnv.NODE_ENV) localEnv.NODE_ENV = 'production';, with the comment
  "NODE_ENV is only forced to production when the user has not set it."
  A deployment booted through os start therefore lands on production without
  the operator doing anything. packages/cli/src/commands/doctor.ts:213 already
  advertises this as settled ("what os start already forces").
• os serve does not. No equivalent assignment exists in
  packages/cli/src/commands/serve.ts. os serve is also the only production
  AuthManager construction site in this repo (enumerated on AuthManager trusts localhost wildcards for CSRF in production whenever trustedOrigins arrives empty — measured #10366). A
  deployment run through os serve with NODE_ENV unset is production in every
  sense except the one the predicate can see.

So the residual is real but confined to the os serve shape.

Why this is worth its own card rather than a wider predicate

The pattern is not local to one call site. auth-manager.ts alone carries
several spellings of the environment test — !== 'production',
=== 'production', === 'development' — and the !== 'production' ones all
share this open end. Whatever is decided here should be decided once for the
family, not per gate:

1. Make os serve default NODE_ENV to production the way os start
   already does — one line, moves every !== 'production' gate at once, and
   makes the two boot commands agree.
2. Introduce a single reusable predicate that treats unset as production
   for security-relevant gates specifically, leaving DX gates on the current
   spelling.
3. Accept it and document that NODE_ENV must be set explicitly for os serve
   production deployments.

⛔ Not claimed. I did not assess exploitability, and I did not survey which
other !== 'production' gates in the tree would change behaviour under options
1 or 2 — that survey is the bulk of the work and belongs to whoever takes this.
The relevant property, stated without recipe: a gate whose intent is "not in
production" currently fails open when the environment is undeclared.

Related

• AuthManager trusts localhost wildcards for CSRF in production whenever trustedOrigins arrives empty — measured #10366 — the ruling being implemented; this is its declared residual.
• serve: an empty OS_AUTH_URL is treated as a real setting, producing an EMPTY trustedOrigins list that refuses every origin instead of falling back to the default #10202 — the empty-OS_AUTH_URL mechanism; its ''-coalescing question is
  parked and stays parked.
• 2FA re-enrollment kills the confirmed secret before the new one is confirmed — the availability half #10700 could not reach #11035 — precedent for filing a ruled-around residual rather than tightening.

Recorded from the os-dev seat implementing #10366; every line number above was
re-derived in a worktree off 24043c290.

---

Generated by Claude Code

[os-zhuang]

Triage: 入决策箱(needs-user-decision + domain:cli + security,类型 Bug)。安全边界姿态是人工地板,分诊不代裁。

一句话问题:用 os serve 起生产、又没设 NODE_ENV 的部署,认证层还开着「本地开发便利门」——环境没申报自己是生产,安全闸就默认它不是。

选项 × 真实代价

选项	做什么	客户可感知代价
A	os serve 与 os start 对齐:NODE_ENV 未设时补成 production(一行)	把 serve 当开发命令、依赖未设 env 走开发行为的工作流(若存在)一次性变严;整族 !== 'production' 门同时收紧
B	安全相关门换共享谓词「未设 = 生产」,DX 门维持	两套环境判定长期并存,每个新门要选边,选错即漏
C	只写文档:serve 上生产必须设 NODE_ENV	靠人记住;忘设 = 静默开门,没人看得见

业务直译:A = 大楼两个入口用同一套「下班后自动落锁」;B = 只给金库门装,别的门贴告示;C = 全靠告示。

四轴(业务立场)
① 长远合理性:两个启动命令一个口径,消灭「哪个命令起的」这种特例;doctor 已把 os start 的行为当既定事实宣传。
② 实际业务拉动:唯一的生产 AuthManager 构造点就在 serve 路径(卡内枚举过)——真实生产 + 未设 env 的部署今天就带着开发便利门在跑。
③ 防 AI 犯错:fail-closed——AI 写的部署脚本忘了设变量时,结果是「更严」而不是「静默开门」;谁也看不见的第三态最危险。
④ 创业阶段不扩散:A 不新增机制,只是把既有行为(os start 的那一行)对齐过去。

推荐 A,回退 B。置信缺口:本分析没有做「整族 !== 'production' 门在 A 下的行为翻转清单」(卡自己声明这是接卡人的主要工作量);也没有现网数据说明有多少 serve-当-开发 的用法依赖未设 env。
回一个字母即可;「A,但先出翻转清单再动」= dev 先交 survey、PR 附表后再合。

裁后执行:A ⇒ cli 席派发,dev 先枚举全树 NODE_ENV 谓词、PR 正文附翻转表与回归 pin(serve 未设 env ⇒ localhost trusted-origin 便利门关闭);B ⇒ 谓词落共享包,安全门逐个迁,DX 门留待后续。

---

Generated by Claude Code

[os-zhuang]

[facets-block]

• 业务需求:指向 A —— 唯一的生产 AuthManager 构造点在 serve 路径,未设 env 的生产今天就开着开发便利门
• 长远合理:指向 A —— 两个启动命令一个口径,消灭「哪个命令起的」特例
• 防 AI 错:指向 A —— fail-closed:忘设变量的结果是更严,不是静默开门
• 阶段聚焦:指向 A —— 不新增机制,对齐 os start 既有行为
  推荐:A(os serve 未设 NODE_ENV 时补 production;dev 先交整族门翻转清单)· 置信缺口:全树 !== 'production' 门的翻转清单未做;serve-当-开发依赖未设 env 的用法无读数

---

Generated by Claude Code

[os-zhuang]

Maintainer ruling recorded (2026-08-23, live PM chat, verbatim: 「其他同意你的意见」— adopting recommendation A): os serve defaults NODE_ENV to production when unset, exactly as os start already does — one line, the whole !== 'production' gate family tightens together, and the two boot commands agree.

State: needs-user-decision → pm:queue, domain:cli + security (same stroke). Dispatch constraints (the ruling's own condition): dev FIRST enumerates every NODE_ENV predicate in the tree and attaches the behavior-flip table to the PR body — the survey is the bulk of the work and the PR is reviewable only with it; regression pin: os serve with unset NODE_ENV ⇒ the localhost trusted-origin convenience gate is CLOSED; test/dev flows that explicitly set NODE_ENV=development|test must be shown unaffected. A flip the table reveals as breaking a legitimate workflow forks back here with the specific gate named.

---

Generated by Claude Code