Add secure SMB sources to the file manager

[bifrost0x]

Summary

• add opt-in SMB 3.1.1 sources to the existing file workspace, including saved non-secret share definitions and transient password-based connections
• generalize file operations and bounded HTTP/server-to-server transfers across owned SFTP and SMB sources
• require exact target allowlisting, signing, encryption, secure negotiation, share confinement, no-follow path handling, and atomic editor replacement
• add responsive SMB UI aligned with Quick Connect and SFTP, full localization, documentation, and disposable Samba integration coverage

Security

• SMB remains disabled by default and uses fixed TCP 445 with exact SMB_ALLOWED_TARGETS
• passwords are never persisted or buffered and are dispatched only once through a connected volatile Socket.IO path
• source ownership and capabilities are revalidated at operation boundaries
• editor writes fail closed when atomic replacement is unavailable; share-root mutations and reparse traversal are rejected
• cross-source transfers use canonical lock ordering and bounded quotas/cancellation
• audit records include canonical host/share/result metadata without SMB credentials or raw exceptions
• repeated security review passes found and resolved the reported issues; the final hardening review reported no findings

Testing

• pytest tests -q — 2,074 passed, 33 skipped
• npm run test:js — 306 passed
• npm run lint:js
• npm run vendor:check
• scripts/lock_requirements.ps1 -Check
• npx playwright test tests/e2e/smb-file-workspace.spec.js — 6 passed
• disposable Samba integration — passed
• Docker build, gthread startup, health check, and /ready — passed

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b8e10605d9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".