7 Commits

Include renames

Author	SHA1	Message	Date
Anandan	d29ab98a79	Improve sandbox permission handling (#323) ... Retry shell commands outside the sandbox when sandboxed output only reflects the sandbox namespace, and keep network retries sandboxed when a network grant is enough. Show user-facing permission reasons for escalated shell commands instead of exposing internal sandbox policy text. Tested: env GOCACHE=/tmp/zero-go-cache go test ./internal/agent ./internal/tui -run 'TestRunUsesEscalatedJustificationForPermissionPrompt|TestRunUsesUserFacingEscalatedFallbackForPermissionPrompt|TestPermissionPromptMapsEscalatedSandboxReason|TestRunRetriesShellUnsandboxedAfterSandboxNamespaceLimitedOutput' Tested: env GOCACHE=/tmp/zero-go-cache go test ./internal/tools Tested: env HOME=/tmp/zero-test-home-clean XDG_CONFIG_HOME=/tmp/zero-test-config-clean GOCACHE=/tmp/zero-go-cache go test ./...	2026-06-26 16:21:06 +05:30
Anandan	6be50cd3a7	fix(sandbox): retry approved network shell commands (#301) ... * fix(sandbox): retry approved network shell commands * test(sandbox): fix portable smoke expectations * fix(sandbox): restore Windows offline egress block	2026-06-23 17:44:46 +05:30
KRATOSandgnanam1990	f7ee189ba5	fix: resolve 15 findings from the 2026-06-20 deep audit (#281) ... * docs(audit): 2026-06-20 deep adversarial audit report Audit-only deliverable (no source changed). Fresh origin/main (bfbdbb1) deep read across 13 subsystems with per-finding adversarial re-verification, plus reconciliation of the 2026-06-10/2026-06-13 audits. Result: build/vet clean; race detector finds 0 data races (67/68 pkgs; the 3 internal/tools failures are -race-only timing flakes). 35 surviving findings (1 high, 15 medium, 17 low, 2 info); 64 prior findings fixed, 14 partial, 12 still-open. * fix(providerhealth): strip credentials on cross-host redirect (AUDIT-M10) The connectivity probe's CheckRedirect re-validated the redirect host against the SSRF blocklist but never stripped auth headers. Go's stdlib only auto-strips Authorization/Cookie/WWW-Authenticate on a host change — not x-api-key, x-goog-api-key, or custom provider headers — so a baseURL that 3xx-redirects to an attacker-controlled public host received the provider API key verbatim. Thread the exact set of auth-bearing header names (kind default + profile AuthHeader + CustomHeaders keys + well-known) into the client and Header.Del them whenever the redirect target's host:port differs from the original. Regression test asserts the creds are dropped cross-host and kept same-host. * fix(sessions): fsync events.jsonl append for crash durability (AUDIT-M12) appendEventLocked wrote the event into the page cache and returned success, then durably wrote (fsync'd) the derived metadata. A crash after the metadata fsync but before the events.jsonl page flushed left metadata.EventCount ahead of the log — silently dropping the last appended event, including the checkpoint a /rewind targets. Add file.Sync() before Close so the log is at least as durable as the metadata derived from it. (Note: the fsync itself has no portable unit-test seam; covered by the existing sessions append/durability suite for no-regression.) * fix(cron): DST fall-back double-fire + claim double-grant (AUDIT-M4, AUDIT-M5) M4: fireJob/claimFire computed the next slot from the raw sub-second now(), so schedule.Next's DST fall-back collapse guard (which only engages for a minute-aligned 'after') never fired — a daily job in the repeated wall-clock hour ran twice on the fall-back day. Feed sched.Next a minute-truncated instant at the claim and the post-exec advance (the due-check still uses the real instant so sub-minute NextRunAt jobs are unaffected). M5: claimFire left NextRunAt unchanged when the schedule couldn't advance (unparseable/exhausted spec), so two concurrent schedulers both saw the job due and both fired it. Pause the job inside the same locked claim instead: the winner still fires once and the post-exec keeps it paused; the loser sees a non-active job and is refused. Tests: claimFire double-claim on an unadvanceable job (second refused, job paused) and a DST fall-back daily job advancing past the repeat (not re-firing it). * fix(daemon): bound the control handshake + track bridge conns for Shutdown (AUDIT-M7, M8, I1) The remote bridge clears the connection deadline before handing the conn to Server.ServeConn, and the local socket set none, so handleConn's two ReadControl handshake calls could block forever — an authenticated-but-idle remote peer pinned a bridge connection slot (32 of them exhaust the bridge), and the local path had the same unbounded read. Set a handshake deadline in handleConn and clear it before the (long-lived) streaming dispatch (M7, I1). ServeConn also bypassed trackConn, so Shutdown's conns-close sweep couldn't close a remote conn stalled in that handshake read. Track/untrack it like the local accept loop does (M8). Tests: handleConn returns under a shortened handshake deadline when the peer never sends hello; Shutdown closes a ServeConn'd conn well under the 10s deadline. * fix(swarm): atomic rename-with-verify mailbox stale-lock break (AUDIT-M13) The stale-break compared two consecutive reads of the SAME lock file (string(data) == string(stale)), so the equality was always true and gave no protection: two waiters could both observe a stale lock and both os.Remove it while a third recreated it via O_EXCL, leaving two live writers to the same per-agent inbox (split-brain). Replace with the proven rename-with-verify used by the cron/hooks/oauth locks: rename the stale file aside (only one racer wins the rename), re-check the moved file's mtime is still stale before deleting, and rename it back if a holder rotated a fresh lock in the gap. Tests: a genuinely stale lock is reclaimed (no .stale.* leftover); a fresh held lock is never broken. (The double-break race itself is not deterministically unit-testable; the fix mirrors the cron/hooks/oauth pattern.) * fix(streamjson): anchor api_key redaction so prose isn't mangled (AUDIT-M1) The api_key secret pattern used ["'=:\s]+ as the delimiter class, so a bare space after the marker counted — 'the api_key: foo setting' and 'apiKey value spans' had the following word replaced with [REDACTED] in every emitted stream-json event (text deltas, tool output, final answer). Require a real assignment delimiter (= or :) and a credential-length body, mirroring the already-anchored sk-/bearer patterns. Prose survives; real api_key=... secrets still redact. * fix(tools): snapshot exec-session lastUsedAt under its lock to fix prune race (AUDIT-L15) sessionToPruneLocked sorted on execSession.lastUsedAt while holding only manager.mu, but touch() writes lastUsedAt under session.mu — a data race on a time.Time that could torn-read and mis-select the prune victim. Snapshot each session's lastUsedAt via a session.mu-guarded getter before sorting (lock order stays manager.mu -> session.mu; no path takes them the other way). Adds a -race regression test driving touch() concurrently with the prune selection. * fix(swarm): release per-job context on MaxRuns completion (AUDIT-L13) Scheduler.run returned on MaxRuns completion without calling job.cancel(), so the job's derived context (and the goroutine context.WithCancel spawns to propagate parent cancellation) leaked until the whole scheduler was cancelled at session end. Add defer job.cancel() (idempotent with Cancel/Close) so it is released on every exit path. * fix(agent): route post-compaction and max-turns connects through streamWithReconnect (AUDIT-L1) The main turn connect already retries transient disconnects via streamWithReconnect, but the post-compaction retry connect, the reactive mid-stream reconnect, and finalAnswerAfterMaxTurns called provider.StreamCompletion directly — a single transient hiccup on those (e.g. the final summary after a long autonomous/cron run, or the turn right after a context-limit compaction) failed the whole run with no retry. All three are pre-content connects, so routing them through the helper carries no OnText-duplication risk. * fix(cli): reject trailing args after --skip-permissions-unsafe (AUDIT-L3) zero --skip-permissions-unsafe "fix bug" silently discarded the prompt and launched the interactive TUI, so a scripted one-shot unsafe invocation appeared to hang. Reject any trailing positional arg loudly (after checking for a misplaced --add-dir first, which keeps its specific error), pointing users at the working form: zero exec --skip-permissions-unsafe -p "...". * fix(provideroauth): error on present-but-wrong-shape chatgpt account-id claim (AUDIT-L11) extractChatGPTAccountID returned ("", nil) both when the id_token had no account-id claim AND when OpenAI's auth namespace was present but the account id was missing/empty/non-string. The latter is a claim-shape change: the caller only warns on a non-nil error, so it silently omitted the chatgpt-account-id header and every Codex call 401'd with no diagnostic, indistinguishable from an expired token. Return an error for the present-but-unusable case so the login warning fires; a genuinely absent claim still soft-skips ("", nil). * test(tools): widen exec-session poll windows so the suite is -race-clean (AUDIT report §2) Three exec-session timing tests assumed a 250ms-sleep / immediate child would finish within a fixed 1000ms yield. Under -race the child (the race-instrumented test binary) starts slowly enough to overrun it, so the tool correctly returned a still-running session_id instead of an exit_code and the asserts failed — the non-green -race suite the audit flagged in §2. collect() returns as soon as the session completes, so widening the poll window to 30s makes them deterministic under -race without slowing the passing case. Test-only; no behavior change. * docs(audit): mark remediation status (fixed/deferred/skipped) for the 2026-06-20 audit * docs(audit): strip trailing whitespace from the report (fix git diff --check) * fix(tools): drain PTY output before marking an exec session done (AUDIT-M14) A TTY exec session's stdout was copied into the buffer by a fire-and-forget io.Copy goroutine, but startSession's Wait goroutine called markDone (and then removed the session) as soon as command.Wait() returned — before that goroutine had necessarily drained the master FD. The command's final output chunk (e.g. a test runner's last PASS/FAIL line) could be lost on exit, and since the exited session is removed it could not be polled back. This also surfaced as the flaky TestExecCommandTTYSessionAcceptsInputOnLinux on loaded CI. Make the PTY cleanup (called after command.Wait, before markDone) join the copy goroutine before closing the master: the child has exited so the master EOFs once io.Copy finishes draining; waiting for that (bounded by bashWaitDelay) guarantees all output is buffered before the session is marked done. Closing the master first would truncate the unread tail, so the join precedes the Close. Linux-only path (exec_pty_linux.go); verified via GOOS=linux build+vet (the TTY test only runs on linux/CI). * docs(audit): mark M14 fixed (PTY drain) in remediation status --------- Co-authored-by: gnanam1990 <[email protected]>	2026-06-21 00:44:23 +05:30
Vasanth T	bfbdbb10f6	test(tools): make write_stdin "\x03" the trigger in the interrupt test (#273) ... The de-flake infra (resilientTempDir + deterministic <-session.done wait) is already on main, but the test still called session.terminate() directly before write_stdin "\x03" — so the session was already reaped when the code under test (exec_command.go's Ctrl-C branch) ran, and the assertion no longer guarded it: the test would pass even if that branch were deleted (caught in review). Capture the session handle before the interrupt (write_stdin removes a finished session from the manager), then make write_stdin "\x03" the operation that terminates, then wait on session.done. Keeps the de-flake; restores the coverage. Verified by mutation: removing session.terminate() from the Ctrl-C branch makes this test fail. Runs 15x locally without flaking.	2026-06-20 23:12:57 +05:30
Anandan	f5038151c8	Add managed background terminals (#270) ... * Add managed background terminal sessions * Stop background terminals on TUI exit * Cover approved local network sandbox mode * Polish background terminal rendering * Tighten exec session cleanup guidance * Address background terminal review feedback * Kill exec session trees on Windows * Trigger CI for Windows cleanup	2026-06-20 20:30:39 +05:30
Vasanth TandClaude Opus 4.8	c572791edf	feat: clipboard image paste + provider 400 handler for image rejection (#268) ... * fix(agent): abort on image-rejection 400s instead of retrying in a loop * feat(imageinput): add ReadClipboardImage for OS clipboard image extraction * feat(tui): clipboard image paste — detect and attach screenshots from OS clipboard * fix(imageinput): use temp file for Windows clipboard image (PowerShell stdout can't emit raw binary) * test: handle both image-present and image-absent clipboard states * fix(vision): add kimi-k2 and qwen-vl to vision-capable name heuristic * fix(tui): render image errors as red error rows instead of grey system notes * feat(vision): check models.dev InputModalities for vision support instead of only name heuristics The vision gate now checks three sources: 1. Curated model registry (catalog authority + name heuristic) 2. Discovered model list from models.dev (InputModalities contains 'image') 3. Name heuristic fallback for unknown models This means custom/ollama/cloud models (kimi-k2, qwen-vl, etc.) are correctly detected as vision-capable when models.dev reports them with image input modality — no more manual name matching needed. * chore: gofmt clipboard_test.go * fix(imageinput): remove shell injection in the Linux clipboard reader The Linux clipboard reader built shell commands by concatenating a clipboard-derived MIME type into `sh -c`: exec.Command("sh", "-c", "wl-paste --type "+t+" 2>/dev/null") exec.Command("sh", "-c", "xclip ... -t "+t+" -o 2>/dev/null") `t` comes from `wl-paste --list-types` / `xclip TARGETS` and is only filtered by `HasPrefix(t, "image/")`, so a hostile clipboard offerer could register a target like `image/png; rm -rf ~` — it passes the prefix check and then executes through the shell. A real (if low-likelihood) local code-exec vector. Drop the shell entirely: every helper now runs via exec.Command(prog, args...) with the MIME type passed as a discrete argument (matching the existing no-shell pattern in pdf.go). Stderr is discarded by not assigning it. Factored into runClipboardStdout + imageMIMETypes helpers. Test: imageMIMETypes filters to image/* lines and returns even an injection-shaped type verbatim (safe now that it never reaches a shell). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * test(tools): de-flake TestWriteStdinInterruptTerminatesSession The test had two Windows-CI flakes that reddened unrelated PRs: 1. It relied on write_stdin's 1000ms yield window being long enough for the async SIGKILL + reap to land before asserting the session was no longer running. On a loaded runner the reap exceeded that window, so write_stdin reported "still running" and the assertion failed. Fix: after terminating, wait on session.done deterministically (30s safety timeout that fails loudly if the kill genuinely hangs); the common case returns the instant the process exits. 2. The SIGKILL'd child had the test's t.TempDir() as its cwd, and Windows may not release the directory handle the instant the process is reaped — so t.TempDir()'s immediate RemoveAll on cleanup failed with "being used by another process". Fix: resilientTempDir retries RemoveAll for up to 5s (best-effort; a leaked temp dir never fails the test). Verified 20x locally; full internal/tools suite green. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> --------- Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>	2026-06-20 19:40:32 +05:30
Anandan	cf54e2cb0e	Add persistent exec command sessions (#267) ... * Add persistent exec command sessions Introduce exec_command and write_stdin tools backed by a shared session manager so long-running shell commands can remain alive and be polled or interrupted across tool calls. Wire exec_command through the existing shell permission, network prompt, command-prefix approval, sandbox grant scope, specialist manifest, and prompt/documentation paths. Keep web_fetch limited to public remote HTTP(S) URLs so localhost/private URLs go through shell commands where sandbox network permission applies. Tested: git diff --cached --check * Fix exec session lifecycle review issues	2026-06-20 14:20:32 +05:30