@corbet-labs/ccht 0.2.2 → 0.2.3

package/source/src/native/env.rs

@@ -0,0 +1,264 @@
+//! Environment allowlist profile for spawning agent processes.
+//!
+//! Child processes inherit only explicitly allowed variables; every other
+//! value is blanked to an empty string so secrets from the parent process
+//! cannot silently replace native agent login. Paths and locale names are
+//! not secrets, while tokens and keys must never be forwarded.
+
+use std::collections::BTreeMap;
+
+/// Environment allowlist applied to agent child processes.
+///
+/// [`EnvProfile::Strict`] forwards a minimal locale, home, and certificate
+/// set. [`EnvProfile::Permissive`] is a documented superset that additionally
+/// forwards common locale and certificate-bundle variables; both profiles
+/// blank every other variable to an empty string.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum EnvProfile {
+    /// Minimal allowlist for spawned agent processes.
+    Strict,
+    /// Strict set plus extra locale and certificate-bundle variables.
+    Permissive,
+}
+
+impl EnvProfile {
+    /// Minimal profile: `PATH`, `HOME`, `XDG_*`, `LANG`/`LC_*`, `TZ`,
+    /// `TERM`, `TMPDIR`, `SSL_CERT_*`, and `NODE_EXTRA_CA_CERTS`.
+    #[must_use]
+    pub fn strict() -> Self {
+        Self::Strict
+    }
+
+    /// Superset of [`EnvProfile::strict`] that additionally allows
+    /// `LANGUAGE`, `REQUESTS_CA_BUNDLE`, `CURL_CA_BUNDLE`, and `CA_BUNDLE`.
+    ///
+    /// These extras are `TMPDIR`-independent locale and certificate path
+    /// variables; no secret-bearing variable is added.
+    #[must_use]
+    pub fn permissive() -> Self {
+        Self::Permissive
+    }
+
+    /// Whether this profile forwards `key` with its value intact.
+    fn allows(&self, key: &str) -> bool {
+        if is_strict_allowed(key) {
+            return true;
+        }
+        match self {
+            Self::Strict => false,
+            Self::Permissive => is_permissive_extra(key),
+        }
+    }
+
+    /// Copy `env`, keeping allowed values and blanking the rest to empty.
+    ///
+    /// All input keys are preserved; disallowed values become `""` so the
+    /// child cannot inherit ambient secrets through the environment.
+    #[must_use]
+    pub fn apply(&self, env: &BTreeMap<String, String>) -> BTreeMap<String, String> {
+        env.iter()
+            .map(|(key, value)| {
+                if self.allows(key) {
+                    (key.clone(), value.clone())
+                } else {
+                    (key.clone(), String::new())
+                }
+            })
+            .collect()
+    }
+
+    /// Filter [`crate::native::AgentCommand`] environment in place.
+    ///
+    /// Allowed entries keep their values; every other entry is blanked to
+    /// an empty string. The program and arguments are left unchanged.
+    pub fn apply_to_command(&self, cmd: &mut crate::native::AgentCommand) {
+        cmd.env = self.apply(&cmd.env);
+    }
+}
+
+/// Strict allowlist: exact names plus `XDG_`, `LC_`, and `SSL_CERT_` prefixes.
+fn is_strict_allowed(key: &str) -> bool {
+    match key {
+        "PATH" | "HOME" | "LANG" | "TZ" | "TERM" | "TMPDIR" | "NODE_EXTRA_CA_CERTS" => true,
+        _ => key.starts_with("XDG_") || key.starts_with("LC_") || key.starts_with("SSL_CERT_"),
+    }
+}
+
+/// Permissive extras beyond the strict set; still locale/cert paths only.
+fn is_permissive_extra(key: &str) -> bool {
+    matches!(
+        key,
+        "LANGUAGE" | "REQUESTS_CA_BUNDLE" | "CURL_CA_BUNDLE" | "CA_BUNDLE"
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::native::AgentCommand;
+
+    fn env(pairs: &[(&str, &str)]) -> BTreeMap<String, String> {
+        pairs
+            .iter()
+            .map(|(key, value)| ((*key).to_owned(), (*value).to_owned()))
+            .collect()
+    }
+
+    #[test]
+    fn strict_keeps_allowlist_and_blanks_secrets() {
+        let profile = EnvProfile::strict();
+        let input = env(&[
+            ("PATH", "/usr/bin"),
+            ("HOME", "/home/app"),
+            ("XDG_CONFIG_HOME", "/home/app/.config"),
+            ("LANG", "en_US.UTF-8"),
+            ("LC_MESSAGES", "en_US.UTF-8"),
+            ("TZ", "UTC"),
+            ("TERM", "xterm"),
+            ("TMPDIR", "/tmp"),
+            ("SSL_CERT_FILE", "/etc/ssl/certs.pem"),
+            ("NODE_EXTRA_CA_CERTS", "/etc/ssl/certs.pem"),
+            ("OPENAI_API_KEY", "super-secret"),
+            ("AWS_SECRET_ACCESS_KEY", "super-secret"),
+            ("GITHUB_TOKEN", "super-secret"),
+        ]);
+        let filtered = profile.apply(&input);
+        for (key, value) in &input {
+            if is_strict_allowed(key) {
+                assert_eq!(filtered.get(key).map(String::as_str), Some(value.as_str()));
+            } else {
+                assert_eq!(
+                    filtered.get(key).map(String::as_str),
+                    Some(""),
+                    "expected blanking for {key}"
+                );
+            }
+        }
+        assert_eq!(
+            filtered.get("OPENAI_API_KEY").map(String::as_str),
+            Some(""),
+            "secret variables must be blanked"
+        );
+    }
+
+    #[test]
+    fn permissive_is_a_documented_superset_of_strict() {
+        let strict = EnvProfile::strict();
+        let permissive = EnvProfile::permissive();
+        let strict_keys = [
+            "PATH",
+            "HOME",
+            "XDG_DATA_HOME",
+            "LANG",
+            "LC_ALL",
+            "TZ",
+            "TERM",
+            "TMPDIR",
+            "SSL_CERT_DIR",
+            "NODE_EXTRA_CA_CERTS",
+        ];
+        let extra_keys = [
+            "LANGUAGE",
+            "REQUESTS_CA_BUNDLE",
+            "CURL_CA_BUNDLE",
+            "CA_BUNDLE",
+        ];
+        for key in strict_keys {
+            let input = env(&[(key, "value")]);
+            assert_eq!(
+                strict.apply(&input).get(key).map(String::as_str),
+                Some("value")
+            );
+            assert_eq!(
+                permissive.apply(&input).get(key).map(String::as_str),
+                Some("value"),
+                "permissive must keep every strict variable"
+            );
+        }
+        for key in extra_keys {
+            let input = env(&[(key, "value")]);
+            assert_eq!(
+                strict.apply(&input).get(key).map(String::as_str),
+                Some(""),
+                "extra variable must not be in the strict set"
+            );
+            assert_eq!(
+                permissive.apply(&input).get(key).map(String::as_str),
+                Some("value")
+            );
+        }
+    }
+
+    #[test]
+    fn permissive_still_blanks_secrets() {
+        let filtered = EnvProfile::permissive().apply(&env(&[
+            ("OPENAI_API_KEY", "super-secret"),
+            ("AWS_SESSION_TOKEN", "super-secret"),
+            ("ANTHROPIC_AUTH_TOKEN", "super-secret"),
+            ("LANGUAGE", "en"),
+        ]));
+        assert_eq!(filtered.get("OPENAI_API_KEY").map(String::as_str), Some(""));
+        assert_eq!(
+            filtered.get("AWS_SESSION_TOKEN").map(String::as_str),
+            Some("")
+        );
+        assert_eq!(
+            filtered.get("ANTHROPIC_AUTH_TOKEN").map(String::as_str),
+            Some("")
+        );
+        assert_eq!(filtered.get("LANGUAGE").map(String::as_str), Some("en"));
+    }
+
+    #[test]
+    fn apply_to_command_filters_env_without_touching_program() {
+        let mut command = AgentCommand::new("agent");
+        command.env.insert("PATH".into(), "/usr/bin".into());
+        command
+            .env
+            .insert("OPENAI_API_KEY".into(), "super-secret".into());
+        EnvProfile::strict().apply_to_command(&mut command);
+        assert_eq!(
+            command.program.to_str(),
+            Some("agent"),
+            "program must be unchanged"
+        );
+        assert_eq!(
+            command.env.get("PATH").map(String::as_str),
+            Some("/usr/bin")
+        );
+        assert_eq!(
+            command.env.get("OPENAI_API_KEY").map(String::as_str),
+            Some("")
+        );
+    }
+
+    #[test]
+    fn agent_command_debug_shows_keys_only() {
+        let mut command = AgentCommand::new("agent");
+        command
+            .env
+            .insert("OPENAI_API_KEY".into(), "super-secret-value".into());
+        EnvProfile::strict().apply_to_command(&mut command);
+        let rendered = format!("{command:?}");
+        assert!(
+            rendered.contains("OPENAI_API_KEY"),
+            "debug output should keep environment keys"
+        );
+        assert!(
+            !rendered.contains("super-secret-value"),
+            "debug output must never leak environment values"
+        );
+    }
+
+    #[test]
+    fn empty_environment_stays_empty_and_names_are_case_sensitive() {
+        let empty: BTreeMap<String, String> = BTreeMap::new();
+        assert!(EnvProfile::strict().apply(&empty).is_empty());
+        assert!(EnvProfile::permissive().apply(&empty).is_empty());
+        // Allowlist names are exact; lowercase variants must be blanked.
+        let input = env(&[("path", "/usr/bin"), ("Path", "/usr/bin")]);
+        let filtered = EnvProfile::strict().apply(&input);
+        assert_eq!(filtered.get("path").map(String::as_str), Some(""));
+        assert_eq!(filtered.get("Path").map(String::as_str), Some(""));
+    }
+}

package/source/src/native/fixture.py

@@ -0,0 +1,191 @@
+"""Offline ACP peer for exercising the public native client through real stdio."""
+import json
+import os
+import pathlib
+import subprocess
+import sys
+import time
+
+mode = sys.argv[1]
+sessions = 0
+configurations = {}
+pending = {}
+permissions = {}
+permission_id = 100
+if len(sys.argv) > 2 and sys.argv[2].endswith(".json"):
+    child = subprocess.Popen([sys.executable, "-c", "import time; time.sleep(60)"])
+    pathlib.Path(sys.argv[2]).write_text(json.dumps({"agent": os.getpid(), "descendant": child.pid}))
+
+
+def send(value):
+    print(json.dumps({"jsonrpc": "2.0", **value}), flush=True)
+
+
+def response(request_id, result):
+    send({"id": request_id, "result": result})
+
+
+def update(session, text):
+    send({"method": "session/update", "params": {"sessionId": session,
+          "update": {"sessionUpdate": "agent_message_chunk",
+                     "content": {"type": "text", "text": text}}}})
+
+
+# Fake OpenCode control server for driver tests. The Rust driver spawns:
+# python3 -u -c <this file> <opencode_ok|opencode_fail|opencode_never>
+#   serve --hostname 127.0.0.1 --port <port>
+# Only loopback is used; no real network leaves the host.
+if "serve" in sys.argv:
+    if mode == "opencode_never":
+        time.sleep(60)
+        sys.exit(0)
+    port = 0
+    if "--port" in sys.argv:
+        port = int(sys.argv[sys.argv.index("--port") + 1])
+    from http.server import BaseHTTPRequestHandler, HTTPServer
+
+    class DriverHandler(BaseHTTPRequestHandler):
+        def log_message(self, format, *args):
+            pass
+
+        def _reply(self, code, body):
+            data = body if isinstance(body, bytes) else body.encode()
+            self.send_response(code)
+            self.send_header("Content-Type", "application/json")
+            self.send_header("Content-Length", str(len(data)))
+            self.send_header("Connection", "close")
+            self.end_headers()
+            self.wfile.write(data)
+
+        def do_GET(self):
+            path = self.path.split("?")[0]
+            if path == "/global/health":
+                self._reply(200, b"{}")
+            elif path == "/provider":
+                if mode == "opencode_fail":
+                    self._reply(200, json.dumps({"connected": []}).encode())
+                else:
+                    self._reply(200, json.dumps({"connected": ["opencode-go"]}).encode())
+            else:
+                self._reply(404, b"{}")
+
+        def do_PUT(self):
+            path = self.path.split("?")[0]
+            if path == "/auth/opencode-go":
+                length = int(self.headers.get("Content-Length", "0") or "0")
+                if length > 0:
+                    self.rfile.read(min(length, 1_048_576))
+                if mode == "opencode_fail":
+                    self._reply(500, b"{}")
+                else:
+                    self._reply(200, b"{}")
+            else:
+                self._reply(404, b"{}")
+
+    HTTPServer(("127.0.0.1", port), DriverHandler).serve_forever()
+    sys.exit(0)
+
+
+for line in sys.stdin:
+    message = json.loads(line)
+    method = message.get("method")
+    params = message.get("params", {})
+    request_id = message.get("id")
+    if method == "initialize":
+        if mode == "slow_init":
+            time.sleep(60)
+        response(request_id, {"protocolVersion": 1,
+                 "agentCapabilities": {"loadSession": True,
+                     "sessionCapabilities": {"resume": {}, "close": {}}},
+                 "agentInfo": {"name": "offline-fixture", "version": "1"}})
+    elif method in ("session/new", "session/load", "session/resume"):
+        if mode == "auth_required":
+            send({"id": request_id, "error": {"code": -32000,
+                  "message": "SECRET-SHOULD-NOT-ESCAPE", "data": {"token": "SECRET"}}})
+            continue
+        sessions += 1
+        session = params.get("sessionId", "fixture-" + str(sessions))
+        if method == "session/load":
+            update(session, "restored history")
+        configurations[session] = [{
+            "id": "model", "name": "Model", "category": "model", "type": "select",
+            "currentValue": "test-model", "options": [{"value": "test-model", "name": "Test"},
+                {"value": "second-model", "name": "Second"}]},
+            {"id": "thinking", "name": "Thinking", "type": "boolean", "currentValue": False}]
+        response(request_id, {"sessionId": session, "configOptions": configurations[session]})
+    elif method == "session/set_config_option":
+        configuration = configurations[params["sessionId"]]
+        for option in configuration:
+            if option["id"] == params["configId"]:
+                option["currentValue"] = params["value"]
+        if params["configId"] == "model":
+            configuration[1]["currentValue"] = params["value"] == "second-model"
+        response(request_id, {"configOptions": configuration})
+    elif method == "session/prompt":
+        session = params["sessionId"]
+        pending[session] = request_id
+        if mode == "exit":
+            sys.exit(2)
+        if mode in ("ask", "deny", "unsupported_host_request"):
+            permission_id += 1
+            permissions[permission_id] = session
+            if mode == "unsupported_host_request":
+                send({"id": permission_id, "method": "fs/read_text_file",
+                      "params": {"sessionId": session, "path": "/never-read-this"}})
+            else:
+                send({"id": permission_id, "method": "session/request_permission", "params": {
+                    "sessionId": session, "toolCall": {"toolCallId": "tool-1", "title": "Test action"},
+                    "options": [{"optionId": "allow", "name": "Allow once", "kind": "allow_once"},
+                                {"optionId": "reject", "name": "Reject once", "kind": "reject_once"}]}})
+        elif mode in ("hang", "ignore_cancel"):
+            update(session, "waiting")
+        else:
+            if mode == "startup_cwd":
+                update(session, os.getcwd())
+            elif mode == "burst":
+                for _ in range(1000):
+                    update(session, "x")
+            else:
+                update(session, "hello ")
+                update(session, "world")
+            response(pending.pop(session), {"stopReason": "end_turn"})
+    elif method == "session/cancel":
+        session = params["sessionId"]
+        if mode != "ignore_cancel" and session in pending:
+            response(pending.pop(session), {"stopReason": "cancelled"})
+    elif method == "session/close":
+        response(request_id, {})
+    elif method == "account/login/start":
+        if mode == "codex_bad_url":
+            response(request_id, {"loginId": "login-1",
+                      "verificationUrl": "http://evil.example.com/x",
+                      "userCode": "ABCD-1234"})
+        elif mode == "codex_bad_code":
+            response(request_id, {"loginId": "login-1",
+                      "verificationUrl": "https://auth.openai.com/codex/device",
+                      "userCode": "!!!"})
+        else:
+            response(request_id, {"loginId": "login-1",
+                      "verificationUrl": "https://auth.openai.com/codex/device",
+                      "userCode": "ABCD-1234"})
+            if mode == "codex_ok":
+                send({"method": "account/login/completed",
+                      "params": {"loginId": "login-1", "success": True}})
+            elif mode == "codex_declined":
+                send({"method": "account/login/completed",
+                      "params": {"loginId": "login-1", "success": False}})
+    elif method == "account/read":
+        response(request_id, {"account": {"type": "chatgpt",
+                  "email": "user@example.com"}})
+    elif method is None and request_id in permissions:
+        session = permissions.pop(request_id)
+        if mode == "unsupported_host_request":
+            assert message["error"]["code"] == -32601
+            text = "unsupported"
+        else:
+            outcome = message["result"]["outcome"]
+            text = outcome.get("optionId", outcome["outcome"])
+        update(session, text)
+        response(pending.pop(session), {"stopReason": "end_turn"})
+    elif request_id is not None:
+        send({"id": request_id, "error": {"code": -32601, "message": "Unsupported fixture request"}})