feat(agent): enforce a drive trust boundary — shell opt-in, egress allowlist, redaction - #29
Merged
Merged
Conversation
…hancements] Observed page content is untrusted input, and the model held an unsandboxed shell and unrestricted navigate/request URLs in the same context. Add the drive-time boundary: - shell tools are withheld and refused unless the operator opts in (--allow-shell / config allowShell) - navigate/request egress is allowlisted to the start URL's origin, the loaded extension's pages, and --allow-host / config allowedHosts - network, console, command, and response side channels are redacted (query strings, bearer tokens, key-shaped values) before the transcript ships to the model provider Refusals feed back to the model as failed actions, so a drive adapts instead of aborting. Signed-off-by: Tom Ballard <tom@armytage.co>
…roadmap:autonomous-qa-enhancements] Pins that an injected instruction cannot reach the shell or a non-allowlisted origin, that one extension's pages stay distinct from another's under opaque WHATWG origins, that the trust boundary threads CLI -> QaOptions -> DriveOptions and config -> scoped drives, and that credential-shaped values are scrubbed from side channels. Signed-off-by: Tom Ballard <tom@armytage.co>
…enhancements] Implements lore-proofkeeper/requirements/req-agent-trust-boundary.md. Adds the requirement and design artifacts, the roadmap initiative, a README 'Trust boundary' section, and the changelog entry noting the behavior change (terminal drives now opt in with --allow-shell). Signed-off-by: Tom Ballard <tom@armytage.co>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Batch 1 of the technical-review fixes: the drive's trust boundary. Everything the model observes during a drive is content from the product under test — untrusted input — yet the same model held an unsandboxed shell (
spawnSync(..., { shell: true })) and unrestrictednavigate/requestURLs, and the transcript shipped to the model provider unredacted.What
run_command,expect_output,expect_exit) are withheld from the advertised catalog and refused at dispatch unless the operator opts in with--allow-shell(CLI) orallowShell(scope config). A tool the model never sees is a tool an injected page can't ask for; the dispatch check makes it a guarantee.navigate/requestmay only reach the start URL's origin, the loaded extension's own pages, and hosts passed via repeatable--allow-host/ configallowedHosts. Cloud-metadata endpoints, internal services, and exfil targets are refused. Non-special schemes (chrome-extension:) have opaque WHATWG origins, so those compare asprotocol//host— one extension's pages stay distinct from another's.New modules:
src/agent/policy.ts(EgressPolicy,callRefusal,urlRefusal,buildPolicy),src/agent/redact.ts(redactUrl,redactText) — both exported from the library surface.Behavior change
A drive that needs the terminal must now pass
--allow-shell; one that reaches a second origin must--allow-hostit. Noted in the CHANGELOG under Unreleased.Corpus (dogfood)
req-agent-trust-boundary+design-agent-trust-boundary, linked to theautonomous-qa-enhancementsroadmap with a new initiative;## Verified By→tests/agent-policy.test.ts,tests/redact.test.ts. Gates green:rac validate(29/29),rac relationships --validate(0 issues, health 100),rac review(no priority findings), self-coverage 14/14.Verification
agent-policy,redact, plus threading assertions inqa-command,scoped-qa,scope-config).PROOFKEEPER_E2E=1): all 6 drive integration suites pass, including the terminal drive (now opted in withallowShell: true) and the HTTP drive (same-origin request allowed by policy).npm run typecheck/buildgreen.