harden durable prompt relay and sensitive read approvals

README.md

@@ -19,9 +19,10 @@ No Hugging Face or provider credential is baked into this image.
 extension reads the bounded policy file at `AGENT_POLICY_PATH` (normally
 `/run/chat-ui-agent/policy`). A missing, invalid, or oversized file falls back to `AGENT_POLICY`:
 
-- `auto` confirms remote publishes, uploads, deployments, and other likely exit points.
-- `ask` confirms all writes, edits, shell commands, and likely secret-file reads.
-- `read-only` confirms any attempted write, edit, or shell command.
+- `auto` confirms remote publishes, uploads, deployments, other likely exit points, and reads of
+  credential-bearing files or process-environment values.
+- `ask` confirms all writes, edits, shell commands, and sensitive reads.
+- `read-only` confirms any attempted write, edit, or shell command, plus sensitive direct reads.
 
 Missing or invalid policy values use `ask`. This live policy file makes “always allow” effective
 for the active session without restarting Pi. If the RPC UI is unavailable, gated calls are blocked.

approval-policy.mjs

@@ -51,7 +51,8 @@ export function classifySensitivePath(value) {
 		/(?:^|\/)\.(?:aws\/credentials|docker\/config\.json|kube\/config)$/.test(path) ||
 		/(?:^|\/)\.config\/(?:gh\/hosts\.yml|glab-cli\/config\.yml)$/.test(path) ||
 		/(?:^|\/)\.config\/huggingface\/(?:token|stored_tokens)$/.test(path) ||
-		/(?:^|\/)\.(?:cache\/)?huggingface\/token$/.test(path)
+		/(?:^|\/)\.(?:cache\/)?huggingface\/token$/.test(path) ||
+		/(?:^|\/)\.pi\/agent\/models\.json$/.test(path)
 	) {
 		return sensitivePath("credential-file", "a service credential file");
 	}
@@ -109,6 +110,17 @@ export function classifyToolApproval(policyValue, toolNameValue, inputValue) {
 	const policy = normalizeAgentPolicy(policyValue);
 	const toolName = safeString(toolNameValue).trim().toLowerCase();
 	const input = isRecord(inputValue) ? inputValue : {};
+	const sensitiveRead = READ_TOOLS.has(toolName) ? classifySensitiveRead(toolName, input) : null;
+
+	if (sensitiveRead) {
+		return requirement({
+			category: "sensitive-read",
+			title: "Approve sensitive read?",
+			reason: `Workspace policy requires confirmation before reading ${sensitiveRead.description}.`,
+			toolName,
+			preview: sensitiveRead.preview,
+		});
+	}
 
 	if (policy === "ask") {
 		if (WRITE_TOOLS.has(toolName)) {
@@ -129,18 +141,6 @@ export function classifyToolApproval(policyValue, toolNameValue, inputValue) {
 				preview: commandPreview(input),
 			});
 		}
-		if (READ_TOOLS.has(toolName)) {
-			const sensitiveRead = classifySensitiveRead(toolName, input);
-			if (sensitiveRead) {
-				return requirement({
-					category: "sensitive-read",
-					title: "Approve sensitive read?",
-					reason: `Ask policy requires confirmation before reading ${sensitiveRead.description}.`,
-					toolName,
-					preview: sensitiveRead.preview,
-				});
-			}
-		}
 		return null;
 	}
 
@@ -168,6 +168,16 @@ export function classifyToolApproval(policyValue, toolNameValue, inputValue) {
 
 	if (toolName !== "bash") return null;
 	const command = getString(input, "command");
+	const sensitiveShellRead = classifySensitiveShellRead(command);
+	if (sensitiveShellRead) {
+		return requirement({
+			category: "sensitive-read",
+			title: "Approve sensitive read?",
+			reason: `Auto policy requires confirmation before reading ${sensitiveShellRead.description}.`,
+			toolName,
+			preview: command,
+		});
+	}
 	const exit = classifyExitPoint(command);
 	if (!exit) return null;
 	return requirement({
@@ -179,6 +189,60 @@ export function classifyToolApproval(policyValue, toolNameValue, inputValue) {
 	});
 }
 
+/** Classify common shell forms that can disclose credential-bearing files or environment values. */
+export function classifySensitiveShellRead(value) {
+	const command = safeString(value);
+	if (!command.trim()) return null;
+
+	for (const rawSegment of tokenizeShellSegments(command)) {
+		const tokens = unwrapInvocation(rawSegment);
+		if (tokens.length === 0) {
+			if (executableName(rawSegment[0]) === "env") {
+				return sensitivePath("process-environment", "the sandbox process environment");
+			}
+			continue;
+		}
+
+		const executable = executableName(tokens[0]);
+		const args = tokens.slice(1);
+		if (
+			executable === "printenv" ||
+			(executable === "set" && args.length === 0) ||
+			(["declare", "export", "readonly", "typeset"].includes(executable) && args.includes("-p")) ||
+			(executable === "compgen" && args.includes("-v"))
+		) {
+			return sensitivePath("process-environment", "the sandbox process environment");
+		}
+		if (["bash", "dash", "fish", "sh", "zsh"].includes(executable)) {
+			const commandIndex = args.findIndex(
+				(arg) => arg === "--command" || (/^-[^-]+$/.test(arg) && arg.slice(1).includes("c"))
+			);
+			if (commandIndex >= 0 && args[commandIndex + 1]) {
+				const nested = classifySensitiveShellRead(args[commandIndex + 1]);
+				if (nested) return nested;
+			}
+		}
+
+		for (const candidateValue of args) {
+			const candidate = candidateValue.replace(/^[<>]+|[<>]+$/g, "");
+			const classification = classifySensitivePath(candidate);
+			if (classification) return classification;
+		}
+
+		if (
+			["awk", "find", "grep", "rg"].includes(executable) &&
+			args.some((arg) => SECRET_PATTERN.test(arg))
+		) {
+			return sensitivePath("secret-pattern", "content or filenames matching a secret pattern");
+		}
+	}
+
+	if (/\b(?:process\.env|os\.environ|deno\.env|system\.getenv)\b/i.test(command)) {
+		return sensitivePath("process-environment", "the sandbox process environment");
+	}
+	return null;
+}
+
 /** Scrub common credential forms before an approval request is persisted by the UI. */
 export function redactSensitiveText(value, maxChars = MAX_APPROVAL_PREVIEW_CHARS) {
 	let text = stripUnsafeControls(safeString(value));

bridge.mjs

@@ -11,6 +11,7 @@ const PI_BIN = process.env.PI_BIN || "pi";
 const MAX_EVENTS = parsePositiveInt(process.env.BRIDGE_MAX_EVENTS, 5_000);
 const MAX_BUFFER_BYTES = parsePositiveInt(process.env.BRIDGE_MAX_BUFFER_BYTES, 8 * 1024 * 1024);
 const MAX_LINE_BYTES = parsePositiveInt(process.env.BRIDGE_MAX_LINE_BYTES, 1024 * 1024);
+const MAX_COMMANDS = parsePositiveInt(process.env.BRIDGE_MAX_COMMANDS, 20_000);
 const WS_HIGH_WATER_BYTES = parsePositiveInt(
 	process.env.BRIDGE_WS_HIGH_WATER_BYTES,
 	4 * 1024 * 1024
@@ -24,6 +25,9 @@ let bufferedBytes = 0;
 let stdoutBuffer = "";
 const replayBuffer = [];
 const sockets = new Set();
+// The bridge outlives chat-ui pods. Stable command ids turn a server retry into
+// an idempotent acknowledgement instead of a second pi prompt.
+const commands = new Map();
 
 const pi = spawn(PI_BIN, piArgs, {
 	cwd: WORKSPACE,
@@ -102,11 +106,49 @@ webSockets.on("connection", (socket, request) => {
 			});
 			return;
 		}
+		if (typeof command.id === "string" && command.id.length > 0) {
+			const fingerprint = JSON.stringify(command);
+			const previous = commands.get(command.id);
+			if (previous) {
+				if (previous.fingerprint !== fingerprint) {
+					send(socket, {
+						type: "bridge_error",
+						message: `RPC command id '${command.id}' was reused with a different payload`,
+					});
+					return;
+				}
+				// An in-flight retry simply waits for the original broadcast response.
+				// A completed retry gets a fresh replay sequence so a client whose
+				// cursor already covered the original response can correlate it.
+				if (previous.response) record(previous.response);
+				return;
+			}
+		}
 		if (!pi.stdin.writable || pi.exitCode !== null) {
 			send(socket, { type: "bridge_error", message: "pi is not running" });
 			return;
 		}
-		pi.stdin.write(`${JSON.stringify(command)}\n`);
+		const commandEntry =
+			typeof command.id === "string" && command.id.length > 0
+				? { fingerprint: JSON.stringify(command), type: command.type }
+				: undefined;
+		if (commandEntry) {
+			commands.set(command.id, commandEntry);
+			pruneCommands();
+		}
+		try {
+			pi.stdin.write(`${JSON.stringify(command)}\n`, (error) => {
+				if (!error || !commandEntry || commandEntry.response) return;
+				if (commands.get(command.id) === commandEntry) commands.delete(command.id);
+				send(socket, { type: "bridge_error", message: `Unable to send RPC command: ${error.message}` });
+			});
+		} catch (error) {
+			if (commandEntry && commands.get(command.id) === commandEntry) commands.delete(command.id);
+			send(socket, {
+				type: "bridge_error",
+				message: `Unable to send RPC command: ${error instanceof Error ? error.message : String(error)}`,
+			});
+		}
 	});
 
 	socket.on("close", () => {
@@ -154,7 +196,12 @@ function handlePiLine(line) {
 		return;
 	}
 	try {
-		record(JSON.parse(line));
+		const payload = JSON.parse(line);
+		if (payload?.type === "response" && typeof payload.id === "string") {
+			const command = commands.get(payload.id);
+			if (command) command.response = payload;
+		}
+		record(payload);
 	} catch {
 		record({
 			type: "bridge_error",
@@ -164,6 +211,18 @@ function handlePiLine(line) {
 	}
 }
 
+function pruneCommands() {
+	if (commands.size <= MAX_COMMANDS) return;
+	for (const [id, command] of commands) {
+		// Prompt ids are the cross-server exactly-once boundary. Keep them for
+		// the lifetime of this pi process even if a very chatty extension causes
+		// ordinary diagnostic/control command entries to roll over.
+		if (!command.response || command.type === "prompt") continue;
+		commands.delete(id);
+		if (commands.size <= MAX_COMMANDS) return;
+	}
+}
+
 function record(payload) {
 	const record = { seq: nextSequence++, payload };
 	const bytes = Buffer.byteLength(JSON.stringify(record));