The controller's own exposure

The web UI is the interactive path, so the controller holds more than a provisioning service would.

• It can reach every workspace over SSH with a key that is on the controller and nowhere else. Anyone who reaches the controller reaches every live workspace.
• Auth is off unless CONTROLLER_AUTH_SECRET is set. Without it there is no sign-in and no API key, and the only thing between the controller and a caller is the network it sits on.
• The agent's screen is rendered as parsed spans, never as HTML. An agent echoes file contents, diffs, and whatever a prompt told it to print. Handing that to an HTML converter would let any repository script the controller's own origin, where the operator's session cookie lives.
• ssh does not preserve argument boundaries. It joins the command and the remote shell splits it again, so every argument is quoted before it leaves. Without that, a repository name or an agent prompt carrying a semicolon is remote code execution under the controller's key.