Repository navigation
feat: export handoffs to host paths - #1141
Conversation
…nd scan gaps Addresses the security review findings on the host-path handoff export: 1. Hardened write (wizard-tools/handoff.ts): the output write now refuses relative paths and non-regular destinations (symlink/dir/FIFO/device), writes a unique sibling temp file with O_NOFOLLOW | O_EXCL, renames it atomically over the target, and enforces 0o600 on the final file even when the host pre-created it looser. Write failures stay fail-open for the user-facing handoff but are surfaced in the tool result message and logged (agent-safe reason; full detail local-only). 2. Env isolation (agent-env-isolation.ts): POSTHOG_HANDOFF_OUTPUT_PATH, POSTHOG_TASK_RUN_ID, and POSTHOG_TASK_ID are stripped from the agent subprocess env. None is read by the subprocess (the MCP tool executes in the wizard process); leaking them told the agent exactly which file its report lands in. POSTHOG_API_KEY / POSTHOG_HOST stay passed through deliberately (pre-existing disposition, documented). 3. Scanner coverage (pi security.ts + yara-hooks.ts): publish_handoff content now passes the same 'output'-context YARA scan + triage as write/edit, on both harnesses — pi via a preExecutionYaraBlock case, anthropic via a new PreToolUse matcher on the MCP tool. Previously it was the one agent-driven write no scanner saw; now hardcoded keys / PII in the report block before persistence.
![veria-ai[bot]](https://avatars.githubusercontent.com/in/1723776?s=60&v=4){kind=small}
|
|
||
| let stat; | ||
| try { | ||
| stat = lstatSync(targetPath); |
There was a problem hiding this comment.
Medium: Symlinked parent directories redirect the host write
lstatSync checks only the final component, so a symlinked ancestor makes an unrelated target appear to be a regular file; the temporary file and renameSync then follow that ancestor and overwrite the redirected file. Resolve the operation through a host-owned directory that untrusted project code cannot modify, or use directory-relative filesystem operations that pin and validate the parent rather than relying on path-string checks.
PR overviewThis pull request adds support for exporting handoffs from the wizard tooling to host filesystem paths. One security issue remains open in the host export path handling. A project-controlled symlink in a parent directory can redirect the export and overwrite an unintended host file within the process's filesystem permissions. No reported issues have been addressed yet. Open issues (1)
Fixed/addressed: 0 · PR risk: 6/10 |
|
/trunk merge |
Problem
Cloud workers cannot use the report the Wizard publishes, so pull requests must use a generic body.
Changes
Test plan
fuse.jsdependency.LLM context
Autonomy: Human-driven (agent-assisted)
Codex implemented the change. Skills used: wizard-development, writing-tests, and writing-pr-descriptions.