Harden the surface: 0600 databases, checksum-verified installs, rate-limited login and key exchange

.github/workflows/release.yml

@@ -110,6 +110,8 @@ jobs:
             artifacts/*
             install.sh
             install.ps1
+            uninstall.sh
+            uninstall.ps1
           # Pre-release tags (e.g. v1.1.0-alpha.1) publish as pre-releases.
           prerelease: ${{ contains(github.ref_name, '-alpha') }}
           generate_release_notes: true

.opencode/session-goal.md

@@ -75,8 +75,18 @@
 - ✅ На машине пользователя: визард alpha.15, правильный токен, venv из wheel, воркер emil-pc online, 15 пустых воркеров вычищены из БД.
 - ✅ Гейт: race + lint + pytest 208.
 
+## Progress (день 2: контроль версий + изоляция)
+- ✅ Визард сверяет установленную версию scimesh с версией бинарника: preflight показывает «installed X, worker needs Y — press Install» и снова предлагает кнопку Install (ensureMatchingScimeshVersion, dev-сборки пропускают). Проверено на машине: a21 vs a22 → красный → Install → зелёный 1.1.0a22.
+- ✅ Все проверки и task-раннеры запускаются с `-I` (isolated): каталог запуска больше не перекрывает venv (был артефакт cwd-затенения исходниками). Затронуты: check, дефолтные раннеры агента, визард (config/save/start), serve, agent_cmd.
+- ✅ Релиз v1.1.0-alpha.22; полный гейт (race + lint 0 issues + pytest 213); бинарник юзера обновлён, рантайм переустановлен (a22), воркер с concurrency=4; большой джоб юзера (1934 шарда) завершён (очередь 0).
+
 ## Completion
 COMPLETED — ночной план выполнен полностью (10 пунктов + 2 найденных бага, включая E2E quorum на релизном коде). Все гейты зелёные, релиз v1.1.0-alpha.16 опубликован.
 
+## Progress (день 2: контроль версий + изоляция)
+- ✅ Визард сверяет установленную версию scimesh с версией бинарника: preflight показывает «installed X, worker needs Y — press Install» и снова предлагает кнопку Install (ensureMatchingScimeshVersion, dev-сборки пропускают). Проверено на машине: a21 vs a22 → красный → Install → зелёный 1.1.0a22.
+- ✅ Все проверки и task-раннеры запускаются с `-I` (isolated): каталог запуска больше не перекрывает venv (был артефакт cwd-затенения исходниками). Затронуты: check, дефолтные раннеры агента, визард (config/save/start), serve, agent_cmd.
+- ✅ Релиз v1.1.0-alpha.22; полный гейт (race + lint 0 issues + pytest 213); бинарник юзера обновлён, рантайм переустановлен (a22), воркер с concurrency=4; большой джоб юзера (1934 шарда) завершён (очередь 0).
+
 ## Completion (предыдущая задача)
 COMPLETED — пайплайн доведён до рабочего состояния и проверен на релизных артефактах v1.1.0-alpha.14.

README.md

@@ -61,7 +61,16 @@ powershell -ExecutionPolicy Bypass -c "irm https://raw.githubusercontent.com/emi
 ```
 
 Set `SCIMESH_AUTO_START=0` to install without starting anything. The old demo
-control room was removed: `/ui` is the admin console. A standalone
+control room was removed: `/ui` is the admin console.
+
+To remove a component, run the matching uninstaller (data is kept unless you
+pass `--purge`):
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/emil28092005/SciMesh/main/uninstall.sh | bash -s coordinator
+curl -fsSL https://raw.githubusercontent.com/emil28092005/SciMesh/main/uninstall.sh | bash -s worker --purge
+# Windows: irm .../uninstall.ps1 | iex  (set $env:SCIMESH_COMPONENT, -Purge deletes data)
+``` A standalone
 worker is installed the same way (`bash -s worker`, or
 `SCIMESH_COMPONENT=worker` on Windows); its installer opens the local setup
 wizard (`worker-agent setup`) in the browser automatically.

coordinator/cmd/coordinator/serve_cmd.go

@@ -10,6 +10,7 @@ import (
 	"flag"
 	"fmt"
 	"log/slog"
+	"net"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -96,18 +97,16 @@ func runServe(args []string) error {
 	defer func() { _ = closeUsers() }()
 
 	// 5. Local worker agents before the server, so they can claim immediately.
-	coordinatorURL := "http://" + *addr
-	agents, err := spawnAgents(ctx, log, *dataDir, *workers, coordinatorURL, workerToken, venvPython)
+	// They always dial the loopback address: an --addr of 0.0.0.0 is not a
+	// connectable target from the same host.
+	agentURL, resolvedPublic := serveURLs(*addr, *publicURL)
+	agents, err := spawnAgents(ctx, log, *dataDir, *workers, agentURL, workerToken, venvPython)
 	if err != nil {
 		return err
 	}
 	defer stopAgents(agents)
 
 	// 6. The coordinator server itself.
-	coordinatorPublicURL := *publicURL
-	if coordinatorPublicURL == "" {
-		coordinatorPublicURL = "http://" + *addr
-	}
 	cfg := infra.Config{
 		Addr:                 *addr,
 		DatabaseEngine:       "sqlite",
@@ -115,8 +114,10 @@ func runServe(args []string) error {
 		Token:                workerToken,
 		JWTSecret:            jwtSecret,
 		UserserviceURL:       "http://" + usersAddr,
-		PublicCoordinatorURL: coordinatorPublicURL,
-		PublicUserserviceURL: "http://" + usersAddr,
+		PublicCoordinatorURL: resolvedPublic,
+		// The exchange is fronted by the coordinator's own proxy, so the UI
+		// falls back to the coordinator origin for USERSERVICE_URL.
+		PublicUserserviceURL: "",
 		LogLevel:             "info",
 		StorageDir:           filepath.Join(*dataDir, "artifacts"),
 		DocsDir:              *docsDir,
@@ -132,12 +133,13 @@ func runServe(args []string) error {
 		WorkerOfflineAfter:   1 * time.Minute,
 		AutoMigrate:          true,
 	}
+	browserURL, _ := serveURLs(*addr, *publicURL)
 	if *open {
-		openBrowser("http://" + *addr + "/ui/admin")
+		openBrowser(browserURL + "/ui/admin")
 	}
 
 	// Print the login once the server is about to start.
-	fmt.Printf("\nSciMesh is starting at http://%s/ui\n", *addr)
+	fmt.Printf("\nSciMesh is starting at %s/ui\n", browserURL)
 	fmt.Printf("  admin login: %s / %s\n", *email, *password)
 	if runtimeStatus(venvPython) {
 		fmt.Printf("  scientific runtime: ready (%s)\n", venvPython)
@@ -337,3 +339,33 @@ func openBrowser(target string) {
 	// #nosec G204 -- target is the local UI URL the operator asked to open.
 	_ = exec.CommandContext(context.Background(), command, target).Start()
 }
+
+// serveURLs derives the two addresses of a serve instance from the listen
+// address and the optional --public-url flag:
+//
+//   - the agent URL is always the loopback form of the port, because spawned
+//     local workers share the host and 0.0.0.0 is not connectable from it;
+//   - the public URL is what browsers and remote workers are told. An explicit
+//     --public-url wins; a listen host that is a real address is used as-is;
+//     a wildcard host (0.0.0.0, ::, or empty) yields an empty public URL, so
+//     the UI falls back to the browser's own origin (the coordinator's LAN
+//     address as the browser sees it).
+func serveURLs(addr, publicURL string) (agentURL, resolvedPublic string) {
+	host, port, err := net.SplitHostPort(addr)
+	if err != nil {
+		// No port in the listen address: assume the default and treat the
+		// whole string as a host (e.g. a bare wildcard).
+		host, port = addr, "8080"
+	}
+	agentURL = "http://127.0.0.1:" + port
+	if publicURL != "" {
+		return agentURL, publicURL
+	}
+	host = strings.Trim(host, "[]")
+	switch host {
+	case "", "0.0.0.0", "::":
+		return agentURL, ""
+	default:
+		return agentURL, "http://" + addr
+	}
+}

coordinator/cmd/coordinator/serve_cmd_test.go

@@ -0,0 +1,22 @@
+package main
+
+import "testing"
+
+func TestServeURLs(t *testing.T) {
+	cases := []struct {
+		addr, public, agent, resolved string
+	}{
+		{"127.0.0.1:8080", "", "http://127.0.0.1:8080", "http://127.0.0.1:8080"},
+		{"0.0.0.0:8080", "", "http://127.0.0.1:8080", ""},
+		{":8080", "", "http://127.0.0.1:8080", ""},
+		{"::", "", "http://127.0.0.1:8080", ""},
+		{"192.168.1.10:8080", "", "http://127.0.0.1:8080", "http://192.168.1.10:8080"},
+		{"0.0.0.0:8080", "http://cluster.example:8080", "http://127.0.0.1:8080", "http://cluster.example:8080"},
+	}
+	for _, c := range cases {
+		agent, resolved := serveURLs(c.addr, c.public)
+		if agent != c.agent || resolved != c.resolved {
+			t.Errorf("serveURLs(%q, %q) = (%q, %q), want (%q, %q)", c.addr, c.public, agent, resolved, c.agent, c.resolved)
+		}
+	}
+}

coordinator/internal/agent/client.go

@@ -48,6 +48,12 @@ type Client struct {
 }
 
 func NewClient(baseURL string, tokens TokenProvider, timeout time.Duration) *Client {
+	// Payload transfers get a more generous budget than control calls: a large
+	// shard over a slow link easily outlives the API timeout.
+	transferTimeout := timeout * 4
+	if transferTimeout < 2*time.Minute {
+		transferTimeout = 2 * time.Minute
+	}
 	return &Client{
 		baseURL: strings.TrimRight(baseURL, "/"),
 		tokens:  tokens,
@@ -57,7 +63,7 @@ func NewClient(baseURL string, tokens TokenProvider, timeout time.Duration) *Cli
 			CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse },
 		},
 		dlClient: &http.Client{
-			Timeout: timeout,
+			Timeout: transferTimeout,
 			CheckRedirect: func(req *http.Request, via []*http.Request) error {
 				if len(via) >= 10 {
 					return fmt.Errorf("too many redirects")

coordinator/internal/agent/client_test.go

@@ -223,3 +223,17 @@ func sha256Of(t *testing.T, value string) string {
 	digest := sha256.Sum256([]byte(value))
 	return fmt.Sprintf("%x", digest)
 }
+
+func TestNewClientTransferTimeoutExceedsAPITimeout(t *testing.T) {
+	c := NewClient("http://coord:8080", &StaticToken{token: "t"}, 30*time.Second)
+	if c.apiClient.Timeout != 30*time.Second {
+		t.Errorf("api timeout = %v, want 30s", c.apiClient.Timeout)
+	}
+	if c.dlClient.Timeout < 2*time.Minute {
+		t.Errorf("transfer timeout = %v, want at least 2m", c.dlClient.Timeout)
+	}
+	short := NewClient("http://coord:8080", &StaticToken{token: "t"}, 3*time.Minute)
+	if short.dlClient.Timeout != 12*time.Minute {
+		t.Errorf("transfer timeout = %v, want 4x the api timeout", short.dlClient.Timeout)
+	}
+}

coordinator/internal/storage/sqlite/sqlite.go

@@ -18,6 +18,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"os"
 	"time"
 
 	_ "modernc.org/sqlite"
@@ -37,9 +38,29 @@ func Open(path string) (*sql.DB, error) {
 		_ = db.Close()
 		return nil, fmt.Errorf("ping sqlite database: %w", err)
 	}
+	if err := lockDownDatabase(path); err != nil {
+		_ = db.Close()
+		return nil, fmt.Errorf("lock down sqlite database: %w", err)
+	}
 	return db, nil
 }
 
+// lockDownDatabase restricts the database files to the owner: sqlite creates
+// them with the process umask (0644), which would let any local user read job
+// metadata and password hashes. WAL/SHM siblings inherit the main file's mode,
+// so existing ones are corrected too. Best-effort: failures only warn callers
+// via the returned error, never corrupt state.
+func lockDownDatabase(path string) error {
+	for _, candidate := range []string{path, path + "-wal", path + "-shm"} {
+		if info, err := os.Stat(candidate); err == nil && !info.IsDir() {
+			if err := os.Chmod(candidate, 0o600); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
 // querier is satisfied by both *sql.DB and *sql.Tx, letting every repository
 // method run identically inside or outside a transaction.
 type querier interface {

coordinator/internal/storage/sqlite/sqlite_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"database/sql"
 	"errors"
+	"os"
 	"path/filepath"
 	"testing"
 	"time"
@@ -347,3 +348,19 @@ func TestCancelByJobInvalidatesTasks(t *testing.T) {
 		t.Errorf("cancelled task = %+v", got)
 	}
 }
+
+func TestOpenRestrictsDatabasePermissions(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "locked.db")
+	db, err := Open(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_ = db.Close()
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if perm := info.Mode().Perm(); perm != 0o600 {
+		t.Errorf("db perms = %o, want 600", perm)
+	}
+}

coordinator/internal/transport/http/ratelimit.go

@@ -0,0 +1,117 @@
+package http
+
+import (
+	"net"
+	"net/http"
+	"sync"
+	"time"
+)
+
+// documentedLimits describes the default policy for the two public surfaces;
+// keep in sync with loginRatePerMinute and exchangeRatePerMinute below.
+const (
+	loginRatePerMinute    = 10
+	loginBurst            = 5
+	exchangeRatePerMinute = 30
+	exchangeBurst         = 10
+)
+
+// tokenBucket is a fixed-rate token bucket for one client address.
+type tokenBucket struct {
+	mu     sync.Mutex
+	tokens float64
+	last   time.Time
+	rate   float64 // tokens per second
+	burst  float64
+}
+
+func newTokenBucket(ratePerMinute, burst float64) *tokenBucket {
+	return &tokenBucket{
+		tokens: burst,
+		last:   time.Now(),
+		rate:   ratePerMinute / 60,
+		burst:  burst,
+	}
+}
+
+// allow consumes one token when available; the bucket refills continuously.
+func (b *tokenBucket) allow() bool {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	now := time.Now()
+	b.tokens += now.Sub(b.last).Seconds() * b.rate
+	if b.tokens > b.burst {
+		b.tokens = b.burst
+	}
+	b.last = now
+	if b.tokens < 1 {
+		return false
+	}
+	b.tokens--
+	return true
+}
+
+// ipLimiter tracks one bucket per client address and prunes stale entries.
+type ipLimiter struct {
+	mu            sync.Mutex
+	buckets       map[string]*tokenBucket
+	ratePerMinute float64
+	burst         float64
+}
+
+func newIPLimiter(ratePerMinute, burst float64) *ipLimiter {
+	return &ipLimiter{
+		buckets:       make(map[string]*tokenBucket),
+		ratePerMinute: ratePerMinute,
+		burst:         burst,
+	}
+}
+
+// Allow reports whether the caller's address may proceed. It also sweeps
+// entries idle for more than ten minutes so the map stays bounded.
+func (l *ipLimiter) Allow(r *http.Request) bool {
+	ip := remoteIP(r)
+	l.mu.Lock()
+	if len(l.buckets) > 1024 {
+		cutoff := time.Now().Add(-10 * time.Minute)
+		for addr, bucket := range l.buckets {
+			bucket.mu.Lock()
+			idle := bucket.last.Before(cutoff)
+			bucket.mu.Unlock()
+			if idle {
+				delete(l.buckets, addr)
+			}
+		}
+	}
+	bucket, ok := l.buckets[ip]
+	if !ok {
+		bucket = newTokenBucket(l.ratePerMinute, l.burst)
+		l.buckets[ip] = bucket
+	}
+	l.mu.Unlock()
+	return bucket.allow()
+}
+
+func remoteIP(r *http.Request) string {
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		return r.RemoteAddr
+	}
+	return host
+}
+
+// rateLimited wraps a handler with a per-address limiter; exhausted callers
+// receive 429 with a Retry-After header.
+func rateLimited(limiter *ipLimiter, next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !limiter.Allow(r) {
+			w.Header().Set("Retry-After", "60")
+			writeJSON(w, http.StatusTooManyRequests, map[string]string{
+				"error":      "too many requests, try again shortly",
+				"request_id": requestIDFrom(r.Context()),
+			})
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}

coordinator/internal/transport/http/ratelimit_test.go

@@ -0,0 +1,54 @@
+package http
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestTokenBucketBurstThenThrottles(t *testing.T) {
+	bucket := newTokenBucket(10, 3)
+	for i := 0; i < 3; i++ {
+		if !bucket.allow() {
+			t.Fatalf("request %d must pass within the burst", i)
+		}
+	}
+	if bucket.allow() {
+		t.Error("fourth request within the burst must be throttled")
+	}
+}
+
+func TestRateLimitedReturns429(t *testing.T) {
+	limiter := newIPLimiter(10, 2)
+	next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	})
+	handler := rateLimited(limiter, next)
+
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/ui/login", nil)
+	req.RemoteAddr = "10.0.0.5:5555"
+	// Burst is 2: the first two pass, the third is throttled.
+	for i := 0; i < 2; i++ {
+		rec := httptest.NewRecorder()
+		handler.ServeHTTP(rec, req)
+		if rec.Code != http.StatusOK {
+			t.Fatalf("request %d: got %d", i, rec.Code)
+		}
+	}
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	if rec.Code != http.StatusTooManyRequests {
+		t.Fatalf("third request: got %d, want 429", rec.Code)
+	}
+	if rec.Header().Get("Retry-After") == "" {
+		t.Error("429 must carry Retry-After")
+	}
+	// A different address is not throttled by the same bucket.
+	other := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/ui/login", nil)
+	other.RemoteAddr = "10.0.0.6:5555"
+	rec = httptest.NewRecorder()
+	handler.ServeHTTP(rec, other)
+	if rec.Code != http.StatusOK {
+		t.Errorf("other client: got %d, want 200", rec.Code)
+	}
+}

coordinator/internal/transport/http/server.go

@@ -135,7 +135,7 @@ func (s *Server) Handler(token string, uiToken ...string) http.Handler {
 	// Worker-key exchange is fronted by the coordinator when the userservice
 	// is embedded (serve mode): the key itself is the credential.
 	if s.userserviceURL != "" {
-		mux.HandleFunc("POST /worker-tokens/exchange", s.handleWorkerTokenExchangeProxy)
+		mux.Handle("POST /worker-tokens/exchange", rateLimited(newIPLimiter(exchangeRatePerMinute, exchangeBurst), http.HandlerFunc(s.handleWorkerTokenExchangeProxy)))
 	}
 
 	hasBasicAuth := len(uiToken) > 0 && uiToken[0] != ""
@@ -163,7 +163,7 @@ func (s *Server) Handler(token string, uiToken ...string) http.Handler {
 		if s.uiSessionMode() {
 			// Public auth pages — reachable without a session so a user can log in.
 			ui.HandleFunc("GET /ui/login", s.handleUILoginForm)
-			ui.HandleFunc("POST /ui/login", s.handleUILogin)
+			ui.Handle("POST /ui/login", rateLimited(newIPLimiter(loginRatePerMinute, loginBurst), http.HandlerFunc(s.handleUILogin)))
 			ui.HandleFunc("GET /ui/logout-form", s.handleUILogoutForm)
 			ui.HandleFunc("GET /ui/register", s.handleUIRegisterForm)
 			ui.HandleFunc("POST /ui/register", s.handleUIRegister)

coordinator/internal/userservice/storage/sqlite/sqlite.go

@@ -7,6 +7,7 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
+	"os"
 	"time"
 
 	_ "modernc.org/sqlite"
@@ -290,6 +291,17 @@ func indexOf(haystack, needle string) int {
 }
 
 // Open opens (and creates when missing) the userservice database file.
+func lockDownDatabase(path string) error {
+	for _, candidate := range []string{path, path + "-wal", path + "-shm"} {
+		if info, err := os.Stat(candidate); err == nil && !info.IsDir() {
+			if err := os.Chmod(candidate, 0o600); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
 func Open(path string) (*sql.DB, error) {
 	dsn := fmt.Sprintf("file:%s?_pragma=busy_timeout(10000)&_pragma=journal_mode(WAL)&_pragma=foreign_keys(1)&_pragma=synchronous(NORMAL)", path)
 	db, err := sql.Open("sqlite", dsn)
@@ -300,5 +312,9 @@ func Open(path string) (*sql.DB, error) {
 		_ = db.Close()
 		return nil, fmt.Errorf("ping userservice database: %w", err)
 	}
+	if err := lockDownDatabase(path); err != nil {
+		_ = db.Close()
+		return nil, fmt.Errorf("lock down userservice database: %w", err)
+	}
 	return db, nil
 }

coordinator/internal/userservice/transport/http/ratelimit.go

@@ -0,0 +1,97 @@
+package http
+
+import (
+	"net"
+	"net/http"
+	"sync"
+	"time"
+)
+
+// The same per-address token-bucket policy as the coordinator transport:
+// login is the credential brute-force surface, the exchange the only public
+// token-minting one.
+const (
+	loginRatePerMinute    = 10
+	loginBurst            = 5
+	exchangeRatePerMinute = 30
+	exchangeBurst         = 10
+)
+
+type tokenBucket struct {
+	mu     sync.Mutex
+	tokens float64
+	last   time.Time
+	rate   float64
+	burst  float64
+}
+
+func newTokenBucket(ratePerMinute, burst float64) *tokenBucket {
+	return &tokenBucket{tokens: burst, last: time.Now(), rate: ratePerMinute / 60, burst: burst}
+}
+
+func (b *tokenBucket) allow() bool {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	now := time.Now()
+	b.tokens += now.Sub(b.last).Seconds() * b.rate
+	if b.tokens > b.burst {
+		b.tokens = b.burst
+	}
+	b.last = now
+	if b.tokens < 1 {
+		return false
+	}
+	b.tokens--
+	return true
+}
+
+type ipLimiter struct {
+	mu            sync.Mutex
+	buckets       map[string]*tokenBucket
+	ratePerMinute float64
+	burst         float64
+}
+
+func newIPLimiter(ratePerMinute, burst float64) *ipLimiter {
+	return &ipLimiter{buckets: map[string]*tokenBucket{}, ratePerMinute: ratePerMinute, burst: burst}
+}
+
+func (l *ipLimiter) Allow(r *http.Request) bool {
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		host = r.RemoteAddr
+	}
+	l.mu.Lock()
+	if len(l.buckets) > 1024 {
+		cutoff := time.Now().Add(-10 * time.Minute)
+		for addr, bucket := range l.buckets {
+			bucket.mu.Lock()
+			idle := bucket.last.Before(cutoff)
+			bucket.mu.Unlock()
+			if idle {
+				delete(l.buckets, addr)
+			}
+		}
+	}
+	bucket, ok := l.buckets[host]
+	if !ok {
+		bucket = newTokenBucket(l.ratePerMinute, l.burst)
+		l.buckets[host] = bucket
+	}
+	l.mu.Unlock()
+	return bucket.allow()
+}
+
+func rateLimited(limiter *ipLimiter, next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !limiter.Allow(r) {
+			w.Header().Set("Retry-After", "60")
+			writeJSON(w, http.StatusTooManyRequests, errorResponse{
+				Error:     "too many requests, try again shortly",
+				RequestID: requestIDFrom(r.Context()),
+			})
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}

coordinator/internal/userservice/transport/http/server.go

@@ -51,14 +51,14 @@ func NewServer(log *slog.Logger, uc UseCases, issuer auth.Issuer) http.Handler {
 	// Method-aware patterns (Go 1.22+): a GET to /register is a 405, not a match.
 	mux.HandleFunc("GET /health", h.handleHealth)
 	mux.HandleFunc("POST /register", h.handleRegister)
-	mux.HandleFunc("POST /login", h.handleLogin)
+	mux.Handle("POST /login", rateLimited(newIPLimiter(loginRatePerMinute, loginBurst), http.HandlerFunc(h.handleLogin)))
 	// /me proves a token round-trips; it sits behind JWT auth.
 	mux.Handle("GET /me", chain(http.HandlerFunc(h.handleMe), withJWT(issuer)))
 
 	// Worker keys: a user mints a long-lived key (JWT-protected), and a worker
 	// trades it for a short-lived JWT on the public exchange endpoint — the key
 	// itself is the credential there, so no prior token is required.
-	mux.HandleFunc("POST /worker-tokens/exchange", h.handleExchangeWorkerKey)
+	mux.Handle("POST /worker-tokens/exchange", rateLimited(newIPLimiter(exchangeRatePerMinute, exchangeBurst), http.HandlerFunc(h.handleExchangeWorkerKey)))
 	mux.Handle("POST /worker-keys", chain(http.HandlerFunc(h.handleCreateWorkerKey), withJWT(issuer)))
 	mux.Handle("GET /worker-keys", chain(http.HandlerFunc(h.handleListWorkerKeys), withJWT(issuer)))
 	mux.Handle("DELETE /worker-keys/{id}", chain(http.HandlerFunc(h.handleRevokeWorkerKey), withJWT(issuer)))

install.ps1

@@ -57,6 +57,31 @@ $Target = Join-Path $InstallDir "$Binary.exe"
 
 Write-Host "Downloading $Url"
 Invoke-WebRequest -Uri $Url -OutFile "$Target.tmp"
+
+# Verify the SHA-256 checksum from the release before installing (see
+# install.sh for the caveats). $env:SCIMESH_SKIP_VERIFY -eq "1" bypasses.
+if ($env:SCIMESH_SKIP_VERIFY -ne "1") {
+    try {
+        $SumUrl = "https://github.com/$Repo/releases/download/$Version/SHA256SUMS.txt"
+        $Sums = (Invoke-WebRequest -Uri $SumUrl).Content
+        $BinaryName = Split-Path $Url -Leaf
+        $Line = ($Sums -split "`n") | Where-Object { $_.Trim().EndsWith("  " + $BinaryName) } | Select-Object -First 1
+        if ($Line) {
+            $Expected = ($Line -split "\s+")[0]
+            $Actual = (Get-FileHash -Algorithm SHA256 -Path "$Target.tmp").Hash.ToLower()
+            if ($Actual -ne $Expected.ToLower()) {
+                Remove-Item -Force "$Target.tmp"
+                throw "checksum mismatch for $Binary (got $Actual, want $Expected)"
+            }
+            Write-Host "Checksum verified ($($Expected.Substring(0,12))...)"
+        } else {
+            Write-Host "WARNING: no checksum entry for $Binary; skipping verification"
+        }
+    } catch {
+        Write-Host "WARNING: could not verify checksum ($($_.Exception.Message)); continuing"
+    }
+}
+
 Move-Item -Force "$Target.tmp" $Target
 
 Write-Host ""

install.sh

@@ -60,6 +60,33 @@ TARGET="$INSTALL_DIR/$BINARY"
 URL="https://github.com/${REPO}/releases/download/${VERSION}/${BINARY}-${OS}-${ARCH}"
 echo "Downloading $URL"
 curl -fsSL -o "$TARGET.tmp" "$URL"
+
+# Verify the SHA-256 checksum from the release before installing. This guards
+# against corrupted downloads and stale CDN caches; it does not protect
+# against an active MITM on the same channel (the checksum file travels it
+# too). Set SCIMESH_SKIP_VERIFY=1 to bypass.
+if [ "${SCIMESH_SKIP_VERIFY:-0}" != "1" ]; then
+  if SUMFILE=$(mktemp) && curl -fsSL -o "$SUMFILE" "https://github.com/${REPO}/releases/download/${VERSION}/SHA256SUMS.txt"; then
+    EXPECTED=$(awk '$2 == "'"$(basename "$URL")"'" {print $1}' "$SUMFILE" 2>/dev/null | head -1)
+    rm -f "$SUMFILE"
+    if [ -n "$EXPECTED" ]; then
+      ACTUAL=$(sha256sum "$TARGET.tmp" | awk '{print $1}')
+      if [ "$ACTUAL" != "$EXPECTED" ]; then
+        rm -f "$TARGET.tmp"
+        echo "ERROR: checksum mismatch for $BINARY (got $ACTUAL, want $EXPECTED)" >&2
+        echo "The download may be corrupted or served by a stale cache. Retry later, or" >&2
+        echo "pin the version with SCIMESH_VERSION=${VERSION} and re-run." >&2
+        exit 1
+      fi
+      echo "Checksum verified ($(echo "$EXPECTED" | cut -c1-12)…)"
+    else
+      echo "WARNING: no checksum entry for $(basename "$URL"); skipping verification"
+    fi
+  else
+    echo "WARNING: could not fetch SHA256SUMS.txt; skipping verification"
+  fi
+fi
+
 chmod +x "$TARGET.tmp"
 mv "$TARGET.tmp" "$TARGET"
 

uninstall.ps1

@@ -0,0 +1,66 @@
+# SciMesh uninstaller for Windows: stops the running component, removes its
+# binary, and — when asked — deletes its data directory.
+#
+#   powershell -ExecutionPolicy Bypass -c "irm https://raw.githubusercontent.com/emil28092005/SciMesh/main/uninstall.ps1 | iex"
+#
+# $env:SCIMESH_COMPONENT selects the component (coordinator | worker | all,
+# default all). Data is kept unless $env:SCIMESH_PURGE -eq "1" or the
+# -Purge switch is passed (in a pipe there is no interactive prompt).
+param(
+    [switch]$Purge
+)
+$ErrorActionPreference = "Stop"
+
+$Component = if ($env:SCIMESH_COMPONENT) { $env:SCIMESH_COMPONENT } else { "all" }
+if ($Purge -or $env:SCIMESH_PURGE -eq "1") { $Purge = $true } else { $Purge = $false }
+
+$InstallDir = if ($env:SCIMESH_INSTALL_DIR) {
+    $env:SCIMESH_INSTALL_DIR
+} else {
+    Join-Path $env:LOCALAPPDATA "SciMesh"
+}
+
+function Remove-Component {
+    param([string]$Name, [string]$Binary)
+    Write-Host "Stopping $Name…"
+    Get-Process -Name $Name -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
+    $target = Join-Path $InstallDir $Binary
+    if (Test-Path $target) {
+        Write-Host "Removing $target…"
+        Remove-Item -Force $target
+    }
+}
+
+function Remove-Data {
+    param([string]$Dir, [string]$Label)
+    if (-not (Test-Path $Dir)) { return }
+    if ($Purge) {
+        Remove-Item -Recurse -Force $Dir
+        Write-Host "Deleted $Dir"
+        return
+    }
+    # No interactive prompt in a pipe: keep the data by default.
+    Write-Host "Keeping $Dir ($Label). Pass -Purge to delete it."
+}
+
+switch ($Component) {
+    "coordinator" {
+        Remove-Component -Name "coordinator" -Binary "coordinator.exe"
+        Remove-Data -Dir (Join-Path $HOME ".scimesh") -Label "secrets, databases, artifacts, users"
+    }
+    "worker" {
+        Remove-Component -Name "worker-agent" -Binary "worker-agent.exe"
+        Remove-Data -Dir (Join-Path $HOME ".scimesh-worker") -Label "worker config, runtime venv, logs"
+    }
+    "all" {
+        Remove-Component -Name "coordinator" -Binary "coordinator.exe"
+        Remove-Component -Name "worker-agent" -Binary "worker-agent.exe"
+        Remove-Data -Dir (Join-Path $HOME ".scimesh") -Label "secrets, databases, artifacts, users"
+        Remove-Data -Dir (Join-Path $HOME ".scimesh-worker") -Label "worker config, runtime venv, logs"
+    }
+    default { throw "unknown component: $Component (use 'coordinator', 'worker' or 'all')" }
+}
+
+Write-Host ""
+Write-Host "SciMesh $Component uninstalled."
+Write-Host "Pass -Purge to also delete the data directories."

uninstall.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+# SciMesh uninstaller: stops the running component, removes its binary, and —
+# when asked — deletes its data directory.
+#
+#   curl -fsSL https://raw.githubusercontent.com/emil28092005/SciMesh/main/uninstall.sh | bash -s coordinator
+#   curl -fsSL https://raw.githubusercontent.com/emil28092005/SciMesh/main/uninstall.sh | bash -s worker
+#   curl -fsSL https://raw.githubusercontent.com/emil28092005/SciMesh/main/uninstall.sh         # both
+#
+# Data (jobs, artifacts, users, secrets, the managed venv) is kept by default.
+# Pass --purge (or set SCIMESH_PURGE=1) to delete it without asking; without
+# it the script prompts interactively. Because `curl | bash` pipes have no
+# interactive stdin, the default is always "keep data".
+set -eu
+
+COMPONENT="${1:-all}"
+PURGE=0
+for arg in "$@"; do
+  case "$arg" in
+    --purge) PURGE=1 ;;
+  esac
+done
+[ "${SCIMESH_PURGE:-0}" = "1" ] && PURGE=1
+
+INSTALL_DIR="${SCIMESH_INSTALL_DIR:-$HOME/.local/bin}"
+
+remove_component() {
+  case "$1" in
+    coordinator)
+      echo "Stopping the coordinator (serve)…"
+      pkill -x coordinator 2>/dev/null || true
+      echo "Removing $INSTALL_DIR/coordinator…"
+      rm -f "$INSTALL_DIR/coordinator"
+      ;;
+    worker)
+      echo "Stopping the worker agent and its setup wizard…"
+      pkill -x worker-agent 2>/dev/null || true
+      echo "Removing $INSTALL_DIR/worker-agent…"
+      rm -f "$INSTALL_DIR/worker-agent"
+      ;;
+    *) echo "unknown component: $1 (use 'coordinator', 'worker' or 'all')" >&2; exit 1 ;;
+  esac
+}
+
+remove_data() {
+  local dir="$1" label="$2"
+  if [ ! -d "$dir" ]; then
+    return 0
+  fi
+  if [ "$PURGE" = "1" ]; then
+    rm -rf "$dir"
+    echo "Deleted $dir"
+    return 0
+  fi
+  # In a pipe (curl | bash) stdin is exhausted, so the prompt defaults to keep.
+  printf "Delete %s (%s)? [y/N] " "$dir" "$label"
+  read -r answer || answer=""
+  case "$answer" in
+    y|Y|yes|YES) rm -rf "$dir"; echo "Deleted $dir" ;;
+    *) echo "Keeping $dir" ;;
+  esac
+}
+
+case "$COMPONENT" in
+  coordinator)
+    remove_component coordinator
+    remove_data "$HOME/.scimesh" "secrets, databases, artifacts, users, managed venv"
+    ;;
+  worker)
+    remove_component worker
+    remove_data "$HOME/.scimesh-worker" "worker config, runtime venv, logs"
+    ;;
+  all)
+    remove_component coordinator
+    remove_component worker
+    remove_data "$HOME/.scimesh" "secrets, databases, artifacts, users, managed venv"
+    remove_data "$HOME/.scimesh-worker" "worker config, runtime venv, logs"
+    ;;
+  *) echo "unknown component: $COMPONENT (use 'coordinator', 'worker' or 'all')" >&2; exit 1 ;;
+esac
+
+echo
+echo "SciMesh $COMPONENT uninstalled."
+echo "Pass --purge to also delete the data directories without asking."