fix: security, config, and validation blockers for runtime release

- Bootstrap multibase without sending the API key across redirects.
- Cross-origin redirect validation and database selector detection.
- Odoo session cookie domain/path/secure check before using it.
- .env parsed with interpolate=false to keep ${...} literal.
- Transient bootstrap failures are retried (do not mark permanent failure).
- 16 unit tests for database bootstrap, session cookie, and dotenv safety.
- CI workflow compiles, runs unit tests, smoke checks, and validates installer URLs.
- Full LGPL-3.0-or-later license text.
- Public installer URLs corrected from nicolasramos-es to nicolasramos.
- Release checklist with mandatory E2E evidence per platform and integration.
- Compatibility and configuration docs updated with support status.

Author: Codex

.github/workflows/quality.yml

@@ -13,10 +13,18 @@ jobs:
         with:
           python-version: '3.11'
       - name: Install dependencies
-        run: python3 -m pip install -r requirements.txt
+        run: |
+          python3 -m pip install --upgrade pip
+          python3 -m pip install -r requirements.txt
       - name: Compile runtime
         run: python3 -m py_compile daemon.py scripts/smoke.py
+      - name: Run runtime unit tests
+        run: python3 -m unittest tests.test_daemon
       - name: Run smoke checks
         run: python3 scripts/smoke.py
       - name: Check shell installer syntax
         run: bash -n install.sh
+      - name: Check repository text and release URLs
+        run: |
+          ! grep -RIn --exclude-dir=.git 'raw\.githubusercontent\.com/nicolasramos[-]es/odoo-agent-runtime' README.md docs install.sh install.ps1 .github LICENSE
+          test -s LICENSE

LICENSE

@@ -1,6 +1,165 @@
-GNU LESSER GENERAL PUBLIC LICENSE
-Version 3, 29 June 2007
+                   GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
 
-This project is licensed under the GNU Lesser General Public License version 3.
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
 
-See https://www.gnu.org/licenses/lgpl-3.0.en.html for the full license text.
+
+  This version of the GNU Lesser General Public License incorporates
+the terms and conditions of version 3 of the GNU General Public
+License, supplemented by the additional permissions listed below.
+
+  0. Additional Definitions.
+
+  As used herein, "this License" refers to version 3 of the GNU Lesser
+General Public License, and the "GNU GPL" refers to version 3 of the GNU
+General Public License.
+
+  "The Library" refers to a covered work governed by this License,
+other than an Application or a Combined Work as defined below.
+
+  An "Application" is any work that makes use of an interface provided
+by the Library, but which is not otherwise based on the Library.
+Defining a subclass of a class defined by the Library is deemed a mode
+of using an interface provided by the Library.
+
+  A "Combined Work" is a work produced by combining or linking an
+Application with the Library.  The particular version of the Library
+with which the Combined Work was made is also called the "Linked
+Version".
+
+  The "Minimal Corresponding Source" for a Combined Work means the
+Corresponding Source for the Combined Work, excluding any source code
+for portions of the Combined Work that, considered in isolation, are
+based on the Application, and not on the Linked Version.
+
+  The "Corresponding Application Code" for a Combined Work means the
+object code and/or source code for the Application, including any data
+and utility programs needed for reproducing the Combined Work from the
+Application, but excluding the System Libraries of the Combined Work.
+
+  1. Exception to Section 3 of the GNU GPL.
+
+  You may convey a covered work under sections 3 and 4 of this License
+without being bound by section 3 of the GNU GPL.
+
+  2. Conveying Modified Versions.
+
+  If you modify a copy of the Library, and, in your modifications, a
+facility refers to a function or data to be supplied by an Application
+that uses the facility (other than as an argument passed when the
+facility is invoked), then you may convey a copy of the modified
+version:
+
+   a) under this License, provided that you make a good faith effort to
+   ensure that, in the event an Application does not supply the
+   function or data, the facility still operates, and performs
+   whatever part of its purpose remains meaningful, or
+
+   b) under the GNU GPL, with none of the additional permissions of
+   this License applicable to that copy.
+
+  3. Object Code Incorporating Material from Library Header Files.
+
+  The object code form of an Application may incorporate material from
+a header file that is part of the Library.  You may convey such object
+code under terms of your choice, provided that, if the incorporated
+material is not limited to numerical parameters, data structure
+layouts and accessors, or small macros, inline functions and templates
+(ten or fewer lines in length), you do both of the following:
+
+   a) Give prominent notice with each copy of the object code that the
+   Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the object code with a copy of the GNU GPL and this license
+   document.
+
+  4. Combined Works.
+
+  You may convey a Combined Work under terms of your choice that,
+taken together, effectively do not restrict modification of the
+portions of the Library contained in the Combined Work and reverse
+engineering for debugging such modifications, if you also do each of
+the following:
+
+   a) Give prominent notice with each copy of the Combined Work that
+   the Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the Combined Work with a copy of the GNU GPL and this license
+   document.
+
+   c) For a Combined Work that displays copyright notices during
+   execution, include the copyright notice for the Library among
+   these notices, as well as a reference directing the user to the
+   copies of the GNU GPL and this license document.
+
+   d) Do one of the following:
+
+       0) Convey the Minimal Corresponding Source under the terms of this
+       License, and the Corresponding Application Code in a form
+       suitable for, and under terms that permit, the user to
+       recombine or relink the Application with a modified version of
+       the Linked Version to produce a modified Combined Work, in the
+       manner specified by section 6 of the GNU GPL for conveying
+       Corresponding Source.
+
+       1) Use a suitable shared library mechanism for linking with the
+       Library.  A suitable mechanism is one that (a) uses at run time
+       a copy of the Library already present on the user's computer
+       system, and (b) will operate properly with a modified version
+       of the Library that is interface-compatible with the Linked
+       Version.
+
+   e) Provide Installation Information, but only if you would otherwise
+   be required to provide such information under section 6 of the
+   GNU GPL, and only to the extent that such information is
+   necessary to install and execute a modified version of the
+   Combined Work produced by recombining or relinking the
+   Application with a modified version of the Linked Version. (If
+   you use option 4d0, the Installation Information must accompany
+   the Minimal Corresponding Source and Corresponding Application
+   Code. If you use option 4d1, you must provide the Installation
+   Information in the manner specified by section 6 of the GNU GPL
+   for conveying Corresponding Source.)
+
+  5. Combined Libraries.
+
+  You may place library facilities that are a work based on the
+Library side by side in a single library together with other library
+facilities that are not Applications and are not covered by this
+License, and convey such a combined library under terms of your
+choice, if you do both of the following:
+
+   a) Accompany the combined library with a copy of the same work based
+   on the Library, uncombined with any other library facilities,
+   conveyed under the terms of this License.
+
+   b) Give prominent notice with the combined library that part of it
+   is a work based on the Library, and explaining where to find the
+   accompanying uncombined form of the same work.
+
+  6. Revised Versions of the GNU Lesser General Public License.
+
+  The Free Software Foundation may publish revised and/or new versions
+of the GNU Lesser General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+  Each version is given a distinguishing version number. If the
+Library as you received it specifies that a certain numbered version
+of the GNU Lesser General Public License "or any later version"
+applies to it, you have the option of following the terms and
+conditions either of that published version or of any later version
+published by the Free Software Foundation. If the Library as you
+received it does not specify a version number of the GNU Lesser
+General Public License, you may choose any version of the GNU Lesser
+General Public License ever published by the Free Software Foundation.
+
+  If the Library as you received it specifies that a proxy can decide
+whether future versions of the GNU Lesser General Public License shall
+apply, that proxy's public statement of acceptance of any version is
+permanent authorization for you to choose that version for the
+Library.

daemon.py

@@ -29,6 +29,7 @@
 
 
 DEFAULT_TIMEOUT_SECONDS = 600
+ODOO_SESSION_COOKIE = 'session_id'
 
 
 def get_hostname():
@@ -67,10 +68,74 @@ def __init__(self, odoo_url, api_key, name, poll_interval=10, max_concurrent=3,
             'X-API-Key': api_key,
             'Content-Type': 'application/json',
         })
+        # Bootstrap is deliberately isolated from API authentication. It may
+        # follow redirects, so it must never share API headers with API calls.
+        self.bootstrap_session = requests.Session()
+        self.bootstrap_session.headers.clear()
 
     def _api_url(self, path):
         return f'{self.odoo_url}{path}'
 
+    def _has_odoo_origin(self, url):
+        """Return whether *url* has the configured Odoo origin."""
+        if not isinstance(url, str):
+            return False
+        try:
+            configured = urlparse(self.odoo_url)
+            candidate = urlparse(url)
+            configured_port = configured.port or (443 if configured.scheme == 'https' else 80)
+            candidate_port = candidate.port or (443 if candidate.scheme == 'https' else 80)
+        except ValueError:
+            return False
+        return (
+            bool(configured.scheme and configured.hostname and candidate.scheme and candidate.hostname)
+            and candidate.scheme.lower() == configured.scheme.lower()
+            and candidate.hostname.lower() == configured.hostname.lower()
+            and candidate_port == configured_port
+        )
+
+    def _bootstrap_validation_failed(self, message, *args):
+        """Record a non-retryable database bootstrap validation failure."""
+        self._database_bootstrap_failed = True
+        logger.error(message, *args)
+        return False
+
+    def _bootstrap_session_cookies(self, response):
+        """Yield Odoo session cookies collected during database bootstrap."""
+        for cookies in (self.bootstrap_session.cookies, getattr(response, 'cookies', None)):
+            if cookies is None:
+                continue
+            try:
+                for cookie in cookies:
+                    if cookie.name == ODOO_SESSION_COOKIE and cookie.value:
+                        yield cookie
+            except TypeError:
+                continue
+
+    def _session_cookie_applies_to_api_url(self, cookie):
+        """Return whether a session cookie will be sent to the runtime API URL."""
+        api_url = urlparse(self._api_url('/api/agent/runtime/heartbeat'))
+        host = api_url.hostname
+        if not host:
+            return False
+
+        cookie_domain = (getattr(cookie, 'domain', '') or '').lstrip('.').lower()
+        cookie_path = getattr(cookie, 'path', '/') or '/'
+        if not cookie_domain:
+            return False
+        if getattr(cookie, 'domain_specified', False):
+            matches_host = host.lower() == cookie_domain or host.lower().endswith(f'.{cookie_domain}')
+        else:
+            matches_host = host.lower() == cookie_domain
+        if not matches_host:
+            return False
+        if not api_url.path.startswith(cookie_path):
+            return False
+        if not cookie_path.endswith('/') and len(api_url.path) > len(cookie_path):
+            if api_url.path[len(cookie_path)] != '/':
+                return False
+        return not getattr(cookie, 'secure', False) or api_url.scheme.lower() == 'https'
+
     def _bootstrap_database_session(self):
         """Select the configured Odoo database and retain its session cookie."""
         if self._database_bootstrapped:
@@ -79,31 +144,61 @@ def _bootstrap_database_session(self):
             return False
 
         login_url = f'{self.odoo_url}/web/login?{urlencode({"db": self.database})}'
+        # Defensive even if this object is reused unexpectedly: bootstrap must
+        # never carry an API key across its redirect chain.
+        for header in list(self.bootstrap_session.headers):
+            if header.lower() == 'x-api-key':
+                del self.bootstrap_session.headers[header]
         try:
-            response = self.session.get(login_url, allow_redirects=True, timeout=30)
+            response = self.bootstrap_session.get(login_url, allow_redirects=True, timeout=30)
             response.raise_for_status()
         except requests.exceptions.RequestException as exc:
-            self._database_bootstrap_failed = True
             logger.error(
                 'Database bootstrap failed for ODOO_DATABASE=%r: %s. '
-                'Runtime API calls were not attempted.',
+                'Runtime API calls were not attempted; the runtime can retry.',
                 self.database,
                 exc,
             )
             return False
 
         final_url = getattr(response, 'url', '')
-        if (
-            isinstance(final_url, str)
-            and urlparse(final_url).path.rstrip('/') == '/web/database/selector'
-        ):
-            self._database_bootstrap_failed = True
-            logger.error(
+        redirect_urls = [
+            getattr(redirect, 'url', None)
+            for redirect in (getattr(response, 'history', ()) or ())
+        ]
+        if any(not self._has_odoo_origin(url) for url in [*redirect_urls, final_url]):
+            return self._bootstrap_validation_failed(
+                'Database bootstrap failed for ODOO_DATABASE=%r: cross-origin redirect chain or final URL. '
+                'Runtime API calls were not attempted.',
+                self.database,
+            )
+
+        if any(urlparse(url).path.rstrip('/') == '/web/database/selector' for url in [*redirect_urls, final_url]):
+            return self._bootstrap_validation_failed(
                 'Database bootstrap failed for ODOO_DATABASE=%r: redirected to '
                 '/web/database/selector. Runtime API calls were not attempted.',
                 self.database,
             )
-            return False
+
+        session_cookies = list(self._bootstrap_session_cookies(response))
+        if not session_cookies:
+            return self._bootstrap_validation_failed(
+                'Database bootstrap failed for ODOO_DATABASE=%r: no Odoo session cookie was set. '
+                'Runtime API calls were not attempted.',
+                self.database,
+            )
+
+        if not any(self._session_cookie_applies_to_api_url(cookie) for cookie in session_cookies):
+            return self._bootstrap_validation_failed(
+                'Database bootstrap failed for ODOO_DATABASE=%r: Odoo session cookie does not apply to the runtime API URL. '
+                'Runtime API calls were not attempted.',
+                self.database,
+            )
+
+        self.session.cookies.update(self.bootstrap_session.cookies)
+        response_cookies = getattr(response, 'cookies', None)
+        if response_cookies is not None:
+            self.session.cookies.update(response_cookies)
 
         self._database_bootstrapped = True
         logger.info('Selected Odoo database %r for this runtime session.', self.database)
@@ -140,7 +235,7 @@ def _is_ok(self, result):
     def send_heartbeat(self):
         """Send heartbeat to Odoo."""
         data = {
-            'version': '0.3.0',
+            'version': '0.2.1',
             'runtime_name': self.name,
             'device_info': get_device_info(),
         }
@@ -488,8 +583,13 @@ def setup_logging(verbose=False):
     )
 
 
+def load_runtime_dotenv(dotenv_path=None):
+    """Load runtime configuration without expanding dollar expressions."""
+    return load_dotenv(dotenv_path=dotenv_path, interpolate=False)
+
+
 def main():
-    load_dotenv()
+    load_runtime_dotenv()
 
     parser = argparse.ArgumentParser(description='Odoo Agent Runtime Daemon')
     parser.add_argument('--odoo-url', default=os.getenv('ODOO_URL', 'http://localhost:8069'),