fix(security): consolidate release-1.10.3 hardening backports

[erichare]

Summary

This is the consolidated security and tenant-isolation backport for release-1.10.3.

It combines the remaining targeted 1.10.3 fixes, ports the applicable hardening from #13530 and its follow-up #14044, and includes the recently merged flow-loading fix from #14053.

Backports consolidated here

• #14037 — confine AssemblyAI audio file access
• #14039 — enforce server-owned KB connector roots
• #14041 — track assignment, loop, and comprehension aliases in the component code scanner
• #14065 — enforce per-user Knowledge component path containment
• #13530 — harden multi-tenant surfaces, adapted to the 1.10 code and migration layout
• #14044 — close follow-up tenant-isolation gaps
• #14053 — preserve variable bindings when loading flows from disk

The target branch moved while this PR was assembled. These related fixes are therefore already inherited from release-1.10.3 rather than duplicated in this diff:

• #14032 — restrict component code module access
• #14033 — block Docling SSRF
• #14034 — validate password changes
• #14036 — harden MCP stdio configuration
• #14040 — block native FFI imports in generated code
• #14043 — authorize voice WebSocket flows

#14047 is not part of this meta backport; it landed independently on the target branch.

Security coverage

• tenant-scoped chat history, project/MCP access, and per-user caches
• trusted component/code-execution gates, alias and native-FFI detection, and protected environment-variable fallbacks
• MCP package/interpreter/Docker command validation and HTTP/SSE connector SSRF validation
• local-file, KB, vector-store, Git, AssemblyAI, and Docling path/network confinement
• recursive public-flow secret scrubbing and browser-safe image downloads
• hardened defaults in published images, including disabled connector loopback exemptions

The backport preserves single-tenant compatibility defaults where practical; published images opt into the stricter multi-tenant controls.

Database

The 1.10-specific message-ownership migrations are linear and leave exactly one Alembic head:

d49cbced8696

Validation

• 355 isolated LFX security tests passed
• 427 combined backend regression tests passed, 12 skipped
• 134 code-security scanner tests passed after the final live PR refresh
• 10 AssemblyAI hardening tests and 27 component-index tests passed after the final live PR refresh
• full pre-commit suite passed across the branch delta
• generated MCP, Knowledge, starter-project, component-index, and secret-baseline artifacts match the hardened sources
• one Alembic head: d49cbced8696

Known limitation

Connector clients that do not expose a pinned-IP transport can still resolve DNS after validation. Literal and private targets are blocked; the residual DNS re-resolution risk is documented and unchanged from the 1.11 hardening.

[github-actions]

✅ Test Coverage Advisor

No source changes detected without accompanying tests. Thanks for keeping coverage up! 🎉

Advisory check only — never blocks merge.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.38%. Comparing base (912b4a4) to head (7bc28bf).
⚠️ Report is 11 commits behind head on release-1.10.3.

Additional details and impacted files

@@                Coverage Diff                 @@
##           release-1.10.3   #14071      +/-   ##
==================================================
- Coverage           58.71%   57.38%   -1.33%     
==================================================
  Files                2307     1901     -406     
  Lines              220314   183454   -36860     
  Branches            31177    31337     +160     
==================================================
- Hits               129354   105281   -24073     
+ Misses              89475    76611   -12864     
- Partials             1485     1562      +77     

Flag	Coverage Δ
backend	?
frontend	57.94% <ø> (+0.05%)	⬆️
lfx	55.22% <ø> (+0.57%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/lfx/src/lfx/base/data/base_file.py	48.48% <ø> (+0.22%)	⬆️
.../lfx/src/lfx/base/knowledge_bases/backends/base.py	0.00% <ø> (ø)
...nowledge_bases/ingestion_sources/connector_base.py	0.00% <ø> (ø)
...x/base/knowledge_bases/ingestion_sources/folder.py	0.00% <ø> (ø)
src/lfx/src/lfx/base/mcp/security.py	82.60% <ø> (ø)
src/lfx/src/lfx/base/mcp/source_policy.py	70.84% <ø> (ø)
src/lfx/src/lfx/base/mcp/util.py	16.10% <ø> (+4.28%)	⬆️
...rc/lfx/src/lfx/base/models/groq_model_discovery.py	15.75% <ø> (+0.47%)	⬆️
src/lfx/src/lfx/base/models/model_utils.py	68.92% <ø> (+3.10%)	⬆️
.../src/lfx/base/models/unified_models/credentials.py	43.56% <ø> (+0.15%)	⬆️
... and 13 more

... and 445 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Frontend Unit Test Coverage Report

Coverage Summary

Lines	Statements	Branches	Functions
	43.53% (58077/133393)	69.19% (7885/11395)	41.56% (1298/3123)

Unit Test Results

Tests	Skipped	Failures	Errors	Time
4979	0 💤	0 ❌	0 🔥	12m 31s ⏱️

[github-actions]

Build successful! ✅
Deploying docs draft.
Deploy successful! View draft