fix(dashboard): pass -R repo to gh commands so multi-remote setups work (replay of 416244f)

[antfleet-ops]

Benchmark replay

This PR replays upstream commit 416244f ("fix(dashboard): pass -R repo to gh commands so multi-remote setups work") as a diff against its parent.

Not for merge. Purpose: AntFleet two-model PR review evaluation.

See BENCHMARK.md for the policy.

[antfleet]

AntFleet · 3 findings

Both reviewers flagged the items below on the changed files. AntFleet posts only what two independent frontier models agree on.

---

Security · Critical — Missing authentication/authorization on secret-management endpoints
dashboard/app/api/secrets/route.ts:95-145

Both route handlers expose the ability to read which secrets are set, create/overwrite arbitrary GitHub Actions secrets (including ANTHROPIC_API_KEY / CLAUDE_CODE_OAUTH_TOKEN), and delete them. There is no authentication, no session check, no CSRF token, and no origin/host verification. If the Next.js dashboard is ever exposed beyond localhost (or reachable from a browser visiting a malicious page that POSTs JSON with a simple Content-Type to bypass CORS preflight is harder, but a curl/proxy or…

Fix: Require authentication for all mutating routes (and arguably GET, which leaks which secrets exist). At minimum, bind the dev server to 127.0.0.1, verify a same-origin/Host header, require a CSRF token, and gate behind a session cookie or local-only token. Also reject requests if NODE_ENV === 'produ…

---

Bug · High — Token reassembly from claude setup-token can splice in non-token text and write garbage to CLAUDE_CODE_OAUTH_TOKEN
dashboard/app/api/auth/route.ts:81-108

The first-line push is tokenChars.push(trimmed) without filtering — trimmed is the entire first line starting at sk-ant-oat, which in real claude setup-token output is wrapped inside an ANSI/box-drawing TUI and often contains trailing spaces, box characters, or ANSI escape sequences. Because no regex is applied to the first line, ANSI escape bytes and box-drawing glyphs get concatenated into token. The resulting token is then written to the GitHub secret as the OAuth token, silently…

Fix: Strip ANSI escapes first (e.g. output.replace(/\x1b\[[0-9;]*[A-Za-z]/g, '')), then extract with a strict regex like /sk-ant-oat[A-Za-z0-9_-]+/ over the cleaned text, possibly joined across line breaks first by removing all whitespace inside the matched run. Validate length/format before calling…

---

Performance · Low — Synchronous child_process calls block the Node event loop on every request
dashboard/app/api/secrets/route.ts:30-75

Every GET/POST/DELETE fans out to multiple synchronous gh invocations (auth status, repo detection, secret list). On a multi-user dashboard this serializes all other requests handled by the same Node worker for hundreds of ms per call. The dashboard is described as a local tool, so severity is low, but the comment // Check if ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN is set in GET hides that it actually shells out three times.

Fix: Use the async execFile (promisified) and await it; or batch results behind a short in-memory cache (e.g. 5s TTL) for repo and auth-status checks.

—

_{Review 6017bf3f · claude-opus-4-7 + gpt-5 (unanimous) · 126s · ~$0.40}

[antfleet]

AntFleet · finding 6017bf3f-2 closed in 4b9b492

Performance · Low — Synchronous child_process calls block the Node event loop on every request
dashboard/app/api/secrets/route.ts:30-75

_{Originally flagged in the AntFleet review. Receipt automated.}

[antfleet]

AntFleet · finding 6017bf3f-1 closed in 4b9b492

Bug · High — Token reassembly from claude setup-token can splice in non-token text and write garbage to CLAUDE_CODE_OAUTH_TOKEN
dashboard/app/api/auth/route.ts:81-108

_{Originally flagged in the AntFleet review. Receipt automated.}

[antfleet]

AntFleet · finding 6017bf3f-0 closed in 4b9b492

Security · Critical — Missing authentication/authorization on secret-management endpoints
dashboard/app/api/secrets/route.ts:95-145

_{Originally flagged in the AntFleet review. Receipt automated.}