@open-mercato/ai-assistant 0.6.5-develop.5337.1.534b781eac → 0.6.5

package/src/modules/ai_assistant/lib/__tests__/codemode-tools.test.ts

@@ -7,6 +7,7 @@ import {
   CODE_MODE_MAX_MUTATION_CALLS,
   CODE_MODE_REQUIRED_FEATURES,
   createApiRequestFn,
+  isUnsafeApiRequestPath,
   isUnsafeHttpMethod,
   matchApiEndpointPath,
 } from '../codemode-tools'
@@ -287,6 +288,112 @@ describe('authorizeCodeModeApiRequest', () => {
   })
 })
 
+describe('path traversal hardening (issue #2667)', () => {
+  describe('isUnsafeApiRequestPath', () => {
+    it.each([
+      '/api/foo/../admin',
+      '/api/foo/..',
+      '/api/foo/./admin',
+      '/api/.',
+      '/api/foo/%2e%2e/admin',
+      '/api/foo/%2E%2E/admin',
+      '/api/foo/%2e./admin',
+      '/api/foo/.%2e/admin',
+      '/api/foo/%2e/admin',
+      '/api/foo\\admin',
+      '/api/foo%2fadmin',
+      '/api/foo%2Fadmin',
+      '/api/foo%5cadmin',
+      'foo/../admin',
+      '/api/foo/../admin?expand=1',
+      // Raw ASCII tab/newline/CR are stripped by the WHATWG URL parser before
+      // the fetch, so `.<ctrl>.` collapses to `..` on the wire.
+      '/api/foo/.\t./admin',
+      '/api/foo/.\n./admin',
+      '/api/foo/.\r./admin',
+      '/api/foo/\t../admin',
+    ])('flags %s as unsafe', (path) => {
+      expect(isUnsafeApiRequestPath(path)).toBe(true)
+    })
+
+    it.each([
+      '/api/customers/companies',
+      '/api/customers/companies/company-1',
+      'customers/companies/company-1?expand=1',
+      '/api/catalog/products/1.2.3',
+      '/api/customers/companies/00000000-0000-0000-0000-000000000000',
+    ])('treats %s as safe', (path) => {
+      expect(isUnsafeApiRequestPath(path)).toBe(false)
+    })
+  })
+
+  it('denies a traversal path even when a parameterized endpoint would match', async () => {
+    mockedGetApiEndpoints.mockReset()
+    // A documented read the user is authorized for. The un-normalized segment
+    // matcher would have accepted '/api/foo/..' against '/api/foo/{id}', then
+    // the wire fetch would collapse it to '/api/admin'. The guard blocks it.
+    mockedGetApiEndpoints.mockResolvedValue([
+      {
+        id: 'get_foo',
+        operationId: 'get_foo',
+        method: 'GET',
+        path: '/api/foo/{id}',
+        summary: '',
+        description: '',
+        tags: [],
+        requiredFeatures: [],
+        parameters: [],
+        requestBodySchema: null,
+        deprecated: false,
+      },
+    ])
+
+    const result = await authorizeCodeModeApiRequest(createContext(), 'GET', '/api/foo/..')
+
+    expect(result).toEqual({
+      allowed: false,
+      statusCode: 403,
+      error: 'Code Mode rejected unsafe API path: GET /api/foo/..',
+    })
+  })
+
+  it('never issues the wire request for a traversal path', async () => {
+    mockedGetApiEndpoints.mockReset()
+    mockedFetchWithTimeout.mockReset()
+    mockedFetchWithTimeout.mockResolvedValue(okResponse())
+    mockedGetApiEndpoints.mockResolvedValue([
+      {
+        id: 'create_company',
+        operationId: 'create_company',
+        method: 'POST',
+        path: '/api/customers/companies',
+        summary: '',
+        description: '',
+        tags: [],
+        requiredFeatures: ['customers.companies.create'],
+        parameters: [],
+        requestBodySchema: null,
+        deprecated: false,
+      },
+    ])
+
+    const apiRequest = createApiRequestFn(
+      createContext({ userFeatures: ['ai_assistant.view', 'customers.companies.create'] }),
+      () => {}
+    )
+
+    const result = (await apiRequest({
+      method: 'POST',
+      path: '/api/customers/companies/../admin',
+      body: {},
+    })) as { success: boolean; statusCode: number }
+
+    expect(result.success).toBe(false)
+    expect(result.statusCode).toBe(403)
+    expect(mockedFetchWithTimeout).not.toHaveBeenCalled()
+  })
+})
+
 describe('mutation call cap (issue #2724)', () => {
   beforeEach(() => {
     mockedGetApiEndpoints.mockReset()

package/src/modules/ai_assistant/lib/__tests__/generated-registry-loader.test.ts

@@ -5,6 +5,7 @@ import { pathToFileURL } from 'node:url'
 import * as registry from '@open-mercato/shared/modules/registry'
 import {
   rewriteGeneratedAliasImports,
+  escapeUnsafeJsStringChars,
   findGeneratedFile,
   ensureApiRouteManifestsRegistered,
 } from '../generated-registry-loader'
@@ -13,6 +14,14 @@ function makeTempDir(): string {
   return fs.mkdtempSync(path.join(os.tmpdir(), 'om-gen-loader-'))
 }
 
+// Mirror the production sanitizer so expectations match how the rewriter
+// embeds a resolved path into the generated source. For ordinary file URLs the
+// escape is a no-op, but routing the expected literal through the same helper
+// keeps the test honest if the rewriter's escaping ever changes.
+function safeJsLiteral(value: string): string {
+  return escapeUnsafeJsStringChars(JSON.stringify(value))
+}
+
 describe('rewriteGeneratedAliasImports', () => {
   // Regression for the MCP dev-server crash:
   //   "Cannot find package '@/.mercato' imported from .../tool-loader.js"
@@ -28,7 +37,7 @@ describe('rewriteGeneratedAliasImports', () => {
     const expectedUrl = pathToFileURL(
       path.join(appRoot, '.mercato/generated/entities'),
     ).href
-    expect(out).toBe(`import { x } from ${JSON.stringify(expectedUrl)}`)
+    expect(out).toBe(`import { x } from ${safeJsLiteral(expectedUrl)}`)
     expect(out).not.toContain('@/')
   })
 
@@ -40,7 +49,7 @@ describe('rewriteGeneratedAliasImports', () => {
     const expectedUrl = pathToFileURL(
       path.join(appRoot, '.mercato/generated/ai-tools.generated'),
     ).href
-    const expected = source.replace(aliasSpecifier, JSON.stringify(expectedUrl))
+    const expected = source.replace(aliasSpecifier, safeJsLiteral(expectedUrl))
     expect(out).toBe(expected)
     expect(out).not.toContain('@/')
   })
@@ -53,7 +62,7 @@ describe('rewriteGeneratedAliasImports', () => {
     const out = rewriteGeneratedAliasImports(`import x from '@/src/thing'`, appRoot)
 
     const expectedUrl = pathToFileURL(path.join(appRoot, 'src', 'thing.ts')).href
-    expect(out).toBe(`import x from ${JSON.stringify(expectedUrl)}`)
+    expect(out).toBe(`import x from ${safeJsLiteral(expectedUrl)}`)
   })
 
   it('leaves non-alias imports untouched', () => {
@@ -66,6 +75,24 @@ describe('rewriteGeneratedAliasImports', () => {
   })
 })
 
+describe('escapeUnsafeJsStringChars', () => {
+  it('escapes characters JSON.stringify leaves intact in a JS string literal', () => {
+    const lineSep = String.fromCharCode(0x2028)
+    const paraSep = String.fromCharCode(0x2029)
+    const out = escapeUnsafeJsStringChars(`a<b>c${lineSep}d${paraSep}e`)
+    expect(out).toBe('a\\u003Cb\\u003Ec\\u2028d\\u2029e')
+    expect(out).not.toContain('<')
+    expect(out).not.toContain('>')
+    expect(out).not.toContain(lineSep)
+    expect(out).not.toContain(paraSep)
+  })
+
+  it('leaves ordinary file URLs unchanged', () => {
+    const url = pathToFileURL(path.join('/tmp', 'app', '.mercato', 'x.generated')).href
+    expect(escapeUnsafeJsStringChars(JSON.stringify(url))).toBe(JSON.stringify(url))
+  })
+})
+
 describe('findGeneratedFile', () => {
   let cwdSpy: jest.SpyInstance
 

package/src/modules/ai_assistant/lib/__tests__/mcp-client.test.ts

@@ -58,7 +58,7 @@ describe('McpClient stdio transport', () => {
       command: 'node',
       args: ['server.js'],
       cwd: '/tmp/open-mercato',
-      env: process.env,
+      env: { ...process.env, OPEN_MERCATO_API_KEY: 'test-secret' },
       stderr: 'pipe',
     })
     expect(mockClientConnect).toHaveBeenCalledTimes(1)
@@ -71,4 +71,23 @@ describe('McpClient stdio transport', () => {
     expect(mockTransportClose).toHaveBeenCalledTimes(1)
     expect(mockManualChildKill).not.toHaveBeenCalled()
   })
+
+  it('passes the API key via OPEN_MERCATO_API_KEY env, never on argv (issue #2669)', async () => {
+    await McpClient.connect({
+      transport: 'stdio',
+      apiKeySecret: 'omk_secret.value',
+    })
+
+    expect(StdioClientTransport).toHaveBeenCalledTimes(1)
+    const transportArgs = (StdioClientTransport as jest.Mock).mock.calls[0][0]
+
+    // The secret must reach the child process exclusively through the env var.
+    expect(transportArgs.env.OPEN_MERCATO_API_KEY).toBe('omk_secret.value')
+
+    // It must NOT appear on argv (world-readable via ps / /proc/<pid>/cmdline).
+    expect(transportArgs.args).toEqual(['mercato', 'ai_assistant', 'mcp:serve'])
+    expect(transportArgs.args).not.toContain('--api-key')
+    expect(transportArgs.args).not.toContain('omk_secret.value')
+    expect(JSON.stringify(transportArgs.args)).not.toContain('omk_secret.value')
+  })
 })

package/src/modules/ai_assistant/lib/__tests__/mcp-dev-key-resolution.test.ts

@@ -0,0 +1,92 @@
+import { resolve } from 'node:path'
+import { findProjectRoot, checkMcpConfigPermissions } from '../mcp-dev-key-resolution'
+
+describe('mcp:dev API key resolution (#2671)', () => {
+  describe('findProjectRoot', () => {
+    const projectRoot = resolve('/home/dev/project')
+    const launchDir = resolve('/home/dev/project/packages/ai-assistant')
+
+    it('returns the nearest ancestor containing a root marker', () => {
+      const exists = (path: string) => path === resolve(projectRoot, '.git')
+      expect(findProjectRoot(launchDir, exists)).toBe(projectRoot)
+    })
+
+    it('stops at the nearest marker and never picks a marker higher up the tree', () => {
+      // A marker exists both at the real project root and at a higher ancestor.
+      // Walking up from the launch dir must stop at the closest one, so an
+      // attacker planting a marker (and a sibling .mcp.json) higher up cannot
+      // shadow the real project root.
+      const higherAncestor = resolve('/home/dev')
+      const exists = (path: string) =>
+        path === resolve(projectRoot, '.git') || path === resolve(higherAncestor, '.git')
+      expect(findProjectRoot(launchDir, exists)).toBe(projectRoot)
+      expect(findProjectRoot(launchDir, exists)).not.toBe(higherAncestor)
+    })
+
+    it('falls back to the start directory (never the filesystem root) when no marker is found', () => {
+      const exists = () => false
+      expect(findProjectRoot(launchDir, exists)).toBe(launchDir)
+      expect(findProjectRoot(launchDir, exists)).not.toBe(resolve('/'))
+    })
+
+    it('recognises any of the supported root markers', () => {
+      const exists = (path: string) => path === resolve(projectRoot, 'yarn.lock')
+      expect(findProjectRoot(launchDir, exists)).toBe(projectRoot)
+    })
+  })
+
+  describe('checkMcpConfigPermissions', () => {
+    const configPath = '/home/dev/project/.mcp.json'
+
+    it('refuses to read a config owned by another user', () => {
+      const warnings: string[] = []
+      const result = checkMcpConfigPermissions(
+        configPath,
+        { uid: 4242, mode: 0o600 },
+        1000,
+        (message) => warnings.push(message),
+      )
+      expect(result.ok).toBe(false)
+      expect(result.reason).toContain('owned by uid 4242')
+      expect(warnings).toHaveLength(0)
+    })
+
+    it('warns loudly but allows when the config is group/world accessible', () => {
+      const warnings: string[] = []
+      const result = checkMcpConfigPermissions(
+        configPath,
+        { uid: 1000, mode: 0o644 },
+        1000,
+        (message) => warnings.push(message),
+      )
+      expect(result.ok).toBe(true)
+      expect(warnings).toHaveLength(1)
+      expect(warnings[0]).toContain('accessible to group/other')
+      expect(warnings[0]).toContain('chmod 600')
+    })
+
+    it('accepts an owner-only config without warning', () => {
+      const warnings: string[] = []
+      const result = checkMcpConfigPermissions(
+        configPath,
+        { uid: 1000, mode: 0o600 },
+        1000,
+        (message) => warnings.push(message),
+      )
+      expect(result.ok).toBe(true)
+      expect(warnings).toHaveLength(0)
+    })
+
+    it('skips ownership/permission checks when uid is unavailable (non-POSIX)', () => {
+      const warnings: string[] = []
+      const result = checkMcpConfigPermissions(
+        configPath,
+        { uid: 4242, mode: 0o644 },
+        null,
+        (message) => warnings.push(message),
+      )
+      expect(result.ok).toBe(true)
+      expect(warnings).toHaveLength(0)
+    })
+  })
+})

package/src/modules/ai_assistant/lib/__tests__/mcp-server-auth-fail-closed.test.ts

@@ -0,0 +1,133 @@
+import { createMcpServer } from '../mcp-server'
+import type { McpServerOptions } from '../types'
+
+jest.mock('@modelcontextprotocol/sdk/server/index.js', () => ({
+  Server: class {
+    setRequestHandler() {}
+  },
+}))
+jest.mock('@modelcontextprotocol/sdk/server/stdio.js', () => ({
+  StdioServerTransport: class {},
+}))
+jest.mock('@modelcontextprotocol/sdk/types.js', () => ({
+  ListToolsRequestSchema: {},
+  CallToolRequestSchema: {},
+}))
+jest.mock('../tool-registry', () => ({
+  getToolRegistry: () => ({
+    getTools: () => new Map(),
+    listToolNames: () => [],
+  }),
+}))
+jest.mock('../tool-executor', () => ({ executeTool: jest.fn() }))
+jest.mock('../tool-loader', () => ({
+  loadAllModuleTools: jest.fn(),
+  indexToolsForSearch: jest.fn(),
+}))
+
+const authenticateMcpRequest = jest.fn()
+jest.mock('../auth', () => ({
+  authenticateMcpRequest: (...args: unknown[]) => authenticateMcpRequest(...args),
+  hasRequiredFeatures: jest.fn(() => true),
+}))
+
+const loadAcl = jest.fn()
+
+function makeContainer() {
+  return {
+    resolve: (name: string) => {
+      if (name === 'rbacService') return { loadAcl }
+      return {}
+    },
+  } as unknown as McpServerOptions['container']
+}
+
+function baseOptions(overrides: Partial<McpServerOptions>): McpServerOptions {
+  return {
+    config: { name: 'test-mcp', version: '0.0.0', debug: false },
+    container: makeContainer(),
+    ...overrides,
+  } as McpServerOptions
+}
+
+describe('issue #2673 — MCP stdio server must fail closed without auth', () => {
+  beforeEach(() => {
+    authenticateMcpRequest.mockReset()
+    loadAcl.mockReset()
+    loadAcl.mockResolvedValue({ isSuperAdmin: false, features: ['ai_assistant.view'] })
+    jest.spyOn(console, 'error').mockImplementation(() => {})
+  })
+
+  afterEach(() => {
+    jest.restoreAllMocks()
+  })
+
+  it('throws when neither apiKeySecret nor context is supplied', async () => {
+    await expect(createMcpServer(baseOptions({}))).rejects.toThrow(
+      /refused to start: no authentication/i,
+    )
+    expect(loadAcl).not.toHaveBeenCalled()
+  })
+
+  it('throws when context lacks a userId (the mcp:serve --tenant-without-user path)', async () => {
+    await expect(
+      createMcpServer(
+        baseOptions({ context: { tenantId: 't1', organizationId: 'o1', userId: null } }),
+      ),
+    ).rejects.toThrow(/refused to start: no authentication/i)
+    expect(loadAcl).not.toHaveBeenCalled()
+  })
+
+  it('treats an empty-string apiKeySecret as missing and fails closed', async () => {
+    await expect(createMcpServer(baseOptions({ apiKeySecret: '' }))).rejects.toThrow(
+      /refused to start: no authentication/i,
+    )
+    expect(authenticateMcpRequest).not.toHaveBeenCalled()
+  })
+
+  it('treats a whitespace-only apiKeySecret as missing and fails closed', async () => {
+    await expect(createMcpServer(baseOptions({ apiKeySecret: '   ' }))).rejects.toThrow(
+      /refused to start: no authentication/i,
+    )
+    expect(authenticateMcpRequest).not.toHaveBeenCalled()
+  })
+
+  it('loads the real user ACL when context carries a non-empty userId', async () => {
+    const server = await createMcpServer(
+      baseOptions({ context: { tenantId: 't1', organizationId: 'o1', userId: 'u1' } }),
+    )
+    expect(server).toBeDefined()
+    expect(loadAcl).toHaveBeenCalledWith('u1', { tenantId: 't1', organizationId: 'o1' })
+  })
+
+  it('allows unauthenticated superadmin only behind the explicit opt-in, without loading an ACL', async () => {
+    const server = await createMcpServer(
+      baseOptions({
+        context: { tenantId: 't1', organizationId: 'o1', userId: null },
+        allowUnauthenticatedSuperadmin: true,
+      }),
+    )
+    expect(server).toBeDefined()
+    expect(loadAcl).not.toHaveBeenCalled()
+  })
+
+  it('allows fully unauthenticated superadmin behind the opt-in with no context', async () => {
+    const server = await createMcpServer(baseOptions({ allowUnauthenticatedSuperadmin: true }))
+    expect(server).toBeDefined()
+  })
+
+  it('still authenticates via a valid apiKeySecret', async () => {
+    authenticateMcpRequest.mockResolvedValue({
+      success: true,
+      tenantId: 't1',
+      organizationId: 'o1',
+      userId: 'u1',
+      features: ['ai_assistant.view'],
+      isSuperAdmin: false,
+      keyName: 'test-key',
+    })
+    const server = await createMcpServer(baseOptions({ apiKeySecret: 'omk_valid.secret' }))
+    expect(server).toBeDefined()
+    expect(authenticateMcpRequest).toHaveBeenCalledWith('omk_valid.secret', expect.anything())
+  })
+})

package/src/modules/ai_assistant/lib/__tests__/task-plan-stream.test.ts

@@ -2,7 +2,7 @@
  * Tests for the server-side task-plan SSE injector
  * (`packages/ai-assistant/src/modules/ai_assistant/lib/task-plan-stream.ts`).
  *
- * Covers spec `.ai/specs/2026-05-13-ai-chat-visible-task-plan.md`
+ * Covers spec `.ai/specs/implemented/2026-05-13-ai-chat-visible-task-plan.md`
  * acceptance criteria:
  *   - runtime-derived labels from tool lifecycle chunks
  *   - agent-authored labels via the safe `meta.update_task_plan` tool

package/src/modules/ai_assistant/lib/ai-api-operation-runner.ts

@@ -105,6 +105,14 @@ function buildAuthEnvelope(ctx: AiToolExecutionContext): TrustedAuthContextEnvel
   if (!userId) {
     return { auth: null, status: 'invalid' }
   }
+  // MCP api-key contexts use an `api_key:<uuid>` subject (see auth.ts). Surface
+  // the bare key UUID as `keyId` so downstream actor logging resolves to a valid
+  // UUID — the CRUD factory computes `actorUserId = auth.keyId ?? auth.sub`, and
+  // the access-log schema rejects a non-UUID `actorUserId`. This matches real
+  // HTTP api-key auth, where `keyId` is the api key record id.
+  const apiKeyId = userId.startsWith('api_key:')
+    ? userId.slice('api_key:'.length)
+    : undefined
   const auth: AuthContext = {
     sub: userId,
     userId,
@@ -112,6 +120,7 @@ function buildAuthEnvelope(ctx: AiToolExecutionContext): TrustedAuthContextEnvel
     orgId: ctx.organizationId,
     roles: [],
     isSuperAdmin: ctx.isSuperAdmin,
+    ...(apiKeyId ? { keyId: apiKeyId } : {}),
   }
   return { auth, status: 'authenticated' }
 }

package/src/modules/ai_assistant/lib/ai-overrides.ts

@@ -28,7 +28,7 @@ import {
  *
  * `null` always means "remove from the registry"; a definition replaces.
  *
- * @see ../../../../../../.ai/specs/2026-04-30-ai-overrides-and-module-disable.md
+ * @see ../../../../../../.ai/specs/implemented/2026-04-30-ai-overrides-and-module-disable.md
  */
 import type { AiAgentDefinition, AiAgentExtension } from './ai-agent-definition'
 import type { AiToolDefinition } from './types'

package/src/modules/ai_assistant/lib/ai-sdk.ts

@@ -11,5 +11,5 @@ export { createGoogleGenerativeAI } from '@ai-sdk/google'
 // using `generateObject` / `streamText` already has the registry populated.
 //
 // @see ./llm-bootstrap.ts
-// @see .ai/specs/2026-04-14-llm-provider-ports-and-adapters.md
+// @see .ai/specs/implemented/2026-04-14-llm-provider-ports-and-adapters.md
 import './llm-bootstrap'

package/src/modules/ai_assistant/lib/attachment-parts.ts

@@ -128,10 +128,23 @@ async function loadAttachmentRow(
   // core package owns the MikroORM metadata and is the only place tests would
   // need to bootstrap for real DB access.
   const { Attachment } = await import('@open-mercato/core/modules/attachments/data/entities')
+  // Tenant isolation is enforced in the SQL WHERE clause, not just the JS
+  // post-filter below: the decryption scope (5th arg) only drives field
+  // decryption, so omitting tenant/org from `where` would let `em.findOne`
+  // return a row from another tenant. Super-admins bypass the scope. Org-scoped
+  // callers also constrain by org; tenant-wide callers (organizationId === null)
+  // may read any org within their tenant.
+  const where: Record<string, unknown> = { id: attachmentId }
+  if (!authContext.isSuperAdmin) {
+    where.tenantId = authContext.tenantId
+    if (authContext.organizationId != null) {
+      where.organizationId = authContext.organizationId
+    }
+  }
   const record = await findOneWithDecryption(
     em,
     Attachment as never,
-    { id: attachmentId } as never,
+    where as never,
     undefined,
     {
       tenantId: authContext.tenantId,
@@ -157,10 +170,18 @@ async function loadAttachmentRow(
 
 function rowBelongsToCaller(row: AttachmentRow, authContext: AiChatRequestContext): boolean {
   if (authContext.isSuperAdmin) return true
-  // Tenant scope: if the record is tenant-scoped, it MUST match the caller tenant.
-  if (row.tenantId && row.tenantId !== authContext.tenantId) return false
-  // Organization scope: if the record is org-scoped, it MUST match the caller org.
-  if (row.organizationId && row.organizationId !== authContext.organizationId) return false
+  // Tenant scope: fail closed. The record MUST carry the caller's tenant.
+  // A null `tenant_id` (a supported "global"/unscoped attachment state) is NOT
+  // accessible through the AI path: it has no `partition.isPublic` gate, so a
+  // truthiness short-circuit here would leak the bytes / extracted text into a
+  // different tenant's LLM context (cross-tenant IDOR, issue #2663). Requiring
+  // strict equality also rejects a non-super-admin caller with a null tenant.
+  if (authContext.tenantId == null || row.tenantId !== authContext.tenantId) return false
+  // Organization scope: when the caller is org-scoped, the record MUST match
+  // that organization (this also rejects null-org rows for an org-scoped
+  // caller). Tenant-wide callers (organizationId === null) may read any org
+  // within their tenant.
+  if (authContext.organizationId != null && row.organizationId !== authContext.organizationId) return false
   return true
 }
 

package/src/modules/ai_assistant/lib/chat-config.ts

@@ -12,7 +12,7 @@ import './llm-bootstrap'
 // refactor the registry accepts any stable id string, so this type
 // becomes `string`. Backward-compatibility note: downstream callers that
 // used exhaustive switches on the old union must add a `default:` branch.
-// See `.ai/specs/2026-04-14-llm-provider-ports-and-adapters.md`.
+// See `.ai/specs/implemented/2026-04-14-llm-provider-ports-and-adapters.md`.
 export type ChatProviderId = string
 
 export type ChatModelInfo = {

package/src/modules/ai_assistant/lib/client-factory.ts

@@ -93,16 +93,10 @@ export async function createMcpClient(options: CreateClientOptions): Promise<Mcp
 
       if (options.stdioArgs) {
         stdioOptions.args = options.stdioArgs
-      } else {
-        // Default args include the API key
-        stdioOptions.args = [
-          'mercato',
-          'ai_assistant',
-          'mcp:serve',
-          '--api-key',
-          apiKeySecret,
-        ]
       }
+      // Otherwise let McpClient.connectStdio apply its default args. The API key
+      // is delivered to the child via the OPEN_MERCATO_API_KEY env var, never on
+      // argv — command-line arguments are world-readable (ps / /proc/<pid>/cmdline).
 
       if (options.cwd) {
         stdioOptions.cwd = options.cwd

package/src/modules/ai_assistant/lib/codemode-tools.ts

@@ -883,6 +883,15 @@ export async function authorizeCodeModeApiRequest(
   path: string
 ): Promise<CodeModeApiAuthorization> {
   const normalizedMethod = method.toUpperCase()
+
+  if (isUnsafeApiRequestPath(path)) {
+    return {
+      allowed: false,
+      statusCode: 403,
+      error: `Code Mode rejected unsafe API path: ${normalizedMethod} ${path}`,
+    }
+  }
+
   const normalizedPath = normalizeApiRequestPath(path)
   const endpoint = await findCodeModeApiEndpoint(normalizedMethod, normalizedPath)
 
@@ -979,6 +988,46 @@ function normalizeApiRequestPath(path: string): string {
   return normalizedPath
 }
 
+const SINGLE_DOT_SEGMENTS = new Set(['.', '%2e'])
+const DOUBLE_DOT_SEGMENTS = new Set(['..', '.%2e', '%2e.', '%2e%2e'])
+
+/**
+ * Rejects request paths that the WHATWG URL parser would rewrite before the
+ * actual fetch (`..`/`.` path segments — including their percent-encoded forms
+ * — backslashes, and percent-encoded separators). Code Mode authorizes the
+ * literal path it was given, but `new URL()` collapses dot segments and
+ * normalizes backslashes for http(s) URLs, so without this guard the wire
+ * request can resolve to a different endpoint than the one that was authorized.
+ */
+export function isUnsafeApiRequestPath(path: string): boolean {
+  const [rawPath] = String(path ?? '').split('?')
+
+  // The WHATWG URL parser strips ASCII tab/newline/carriage-return from the URL
+  // before parsing, so a smuggled `.<TAB>.` segment collapses to `..` on the
+  // wire even though the literal segment never equals a dot segment here. Raw
+  // control characters never appear in legitimate REST paths, so reject them.
+  if (/[\u0000-\u001f]/.test(rawPath)) {
+    return true
+  }
+
+  // http(s) URLs treat backslashes as path separators, so they can smuggle
+  // separators past the segment-based authorizer.
+  if (rawPath.includes('\\')) {
+    return true
+  }
+
+  // Percent-encoded separators never appear in legitimate REST paths and let
+  // the literal-'/' segment split desync from the parsed request URL.
+  if (/%2f/i.test(rawPath) || /%5c/i.test(rawPath)) {
+    return true
+  }
+
+  return rawPath.split('/').some((segment) => {
+    const lowered = segment.toLowerCase()
+    return SINGLE_DOT_SEGMENTS.has(lowered) || DOUBLE_DOT_SEGMENTS.has(lowered)
+  })
+}
+
 function isPathParameterSegment(segment: string): boolean {
   return (
     (segment.startsWith('{') && segment.endsWith('}')) ||