8 Commits

Include renames

Author	SHA1	Message	Date
Gnanam	a766163401	fix: pre-push review findings on the exec_command buffer-cap fix ... Ran an adversarial review before opening the PR. It found the truncation notice added alongside the buffer cap didn't actually work: prefixing execOutputTruncatedMessage into drainString()'s text meant the notice always sat ~2MiB before the end of the combined output, but the tool's own downstream truncateExecOutput() keeps at most a 400KB tail (even at the maximum allowed max_output_tokens) — so the notice was reliably swallowed, or chopped into an unreadable fragment at smaller budgets. Verified with direct reproductions against the real functions. Fixed by moving the signal out of the text stream entirely: - execOutputBuffer gains consumeTruncated() (read+reset, called once per collect()) and peekTruncated() (read-only, for status views) instead of injecting a marker into the drained bytes. - collect() now returns (string, bool); both call sites thread the bool through to execToolResult, which sets meta["output_buffer_truncated"] and appends the notice to the response body *after* truncateExecOutput runs, so it can never be re-truncated or land in a discarded region. - Also flagged: a session torn down without ever being polled again after truncation loses the signal entirely, since nothing drains/logs it on teardown. Full audit-trail logging felt like overkill for a soft transparency signal on top of a hard memory-safety fix, but exposed peekTruncated() on ExecSessionSnapshot and surfaced it in the /ps row (background_terminals.go) so it's visible any time a still-running session is checked — covers the common case (the review's own scenario: a long-lived dev server nobody's polling but that's still alive) even though a session reaped before ever being looked at is still a gap. New tests: reworked TestExecOutputBufferCapsUndrainedData for the consume/peek API, and TestExecToolResultSurfacesBufferTruncationOutsideByteBudget reproducing the review's exact failure case (max_output_tokens=1) and proving the notice now survives it.	2026-07-01 14:54:20 +05:30
Gnanam	16ce70b7a9	fix: cap unbounded exec_command output buffer to prevent OOM kill ... execOutputBuffer.data accumulated every byte a backgrounded exec_command session wrote, with no size cap, unlike buffer.recent which is correctly bounded to recentExecOutputBytes for the /ps preview. drainString() only clears data when the agent actually polls that session again — so a long-lived background session nobody polls (e.g. a dev server left running after the run that started it was cancelled) grows this buffer forever as long as the process keeps writing, with no ceiling. Traced this directly to a real crash: a session that had been running for ~5.5 hours (an earlier turn invoking swarm agents got cancelled mid-flight, per that session's own event log) accumulated to ~42.7GB of compressed memory, at which point macOS's memorystatus killed the process outright ("killing zero due to low-swap"). Fixed by capping data at maxExecOutputBufferBytes (2MiB), trimming from the front like recent already does, and surfacing a one-time truncation notice on the next drain so data loss is visible rather than silent.	2026-07-01 14:21:42 +05:30
Anandan	d29ab98a79	Improve sandbox permission handling (#323) ... Retry shell commands outside the sandbox when sandboxed output only reflects the sandbox namespace, and keep network retries sandboxed when a network grant is enough. Show user-facing permission reasons for escalated shell commands instead of exposing internal sandbox policy text. Tested: env GOCACHE=/tmp/zero-go-cache go test ./internal/agent ./internal/tui -run 'TestRunUsesEscalatedJustificationForPermissionPrompt|TestRunUsesUserFacingEscalatedFallbackForPermissionPrompt|TestPermissionPromptMapsEscalatedSandboxReason|TestRunRetriesShellUnsandboxedAfterSandboxNamespaceLimitedOutput' Tested: env GOCACHE=/tmp/zero-go-cache go test ./internal/tools Tested: env HOME=/tmp/zero-test-home-clean XDG_CONFIG_HOME=/tmp/zero-test-config-clean GOCACHE=/tmp/zero-go-cache go test ./...	2026-06-26 16:21:06 +05:30
Anandan	80ab238361	Align sandbox command approval behavior (#322) ... * Align shell approval sandbox execution Make approved shell command-prefix executions use the escalated sandbox path when denied-read policy allows it, so remembered approvals do not still hit the restrictive sandbox. Allow auto sandbox mode to degrade to a direct command plan when native command wrapping is unavailable, while strict sandbox require continues to fail closed. Update regression tests for degraded execution, prefix-approved shell calls, and unavailable native sandbox metadata. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/agent ./internal/sandbox Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/tools -run 'TestRegistryRunsWithDegradedUnavailableNativeSandbox|TestBashToolRunsWithDegradedUnavailableNativeSandbox|TestBashRequireEscalatedBypassesNativeSandboxAfterApproval|TestExecCommandRequireEscalatedBypassesNativeSandboxAfterApproval' Tested: GOCACHE=/tmp/zero-go-cache go test ./... -run '^$' Tested: git diff --check * Align sandbox command approval behavior Evaluate reusable shell approvals across plain command segments so prefix grants can cover commands with safe read-only tails without relying on command-specific sandbox exceptions. Keep process inspection commands sandboxed by default; unsandboxed host access continues to require explicit escalation or a narrow command-prefix approval. Improve shell tool guidance around sandboxed additional permissions, full escalation, justifications, and narrow reusable prefixes. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./internal/tools ./internal/agent Tested: env HOME=/tmp/zero-test-home-clean XDG_CONFIG_HOME=/tmp/zero-test-config-clean GOCACHE=/tmp/zero-go-cache go test ./... * Normalize explicit sandbox backend platforms Infer the platform from a caller-provided sandbox backend name before choosing the manager runtime platform. This keeps Linux, macOS, and Windows backend plans deterministic across host OSes when tests or callers provide a backend without an explicit Platform field. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./internal/tools Tested: env HOME=/tmp/zero-test-home-clean XDG_CONFIG_HOME=/tmp/zero-test-config-clean GOCACHE=/tmp/zero-go-cache go test ./...	2026-06-26 13:20:07 +05:30
Anandan	6be50cd3a7	fix(sandbox): retry approved network shell commands (#301) ... * fix(sandbox): retry approved network shell commands * test(sandbox): fix portable smoke expectations * fix(sandbox): restore Windows offline egress block	2026-06-23 17:44:46 +05:30
KRATOSandgnanam1990	f7ee189ba5	fix: resolve 15 findings from the 2026-06-20 deep audit (#281) ... * docs(audit): 2026-06-20 deep adversarial audit report Audit-only deliverable (no source changed). Fresh origin/main (bfbdbb1) deep read across 13 subsystems with per-finding adversarial re-verification, plus reconciliation of the 2026-06-10/2026-06-13 audits. Result: build/vet clean; race detector finds 0 data races (67/68 pkgs; the 3 internal/tools failures are -race-only timing flakes). 35 surviving findings (1 high, 15 medium, 17 low, 2 info); 64 prior findings fixed, 14 partial, 12 still-open. * fix(providerhealth): strip credentials on cross-host redirect (AUDIT-M10) The connectivity probe's CheckRedirect re-validated the redirect host against the SSRF blocklist but never stripped auth headers. Go's stdlib only auto-strips Authorization/Cookie/WWW-Authenticate on a host change — not x-api-key, x-goog-api-key, or custom provider headers — so a baseURL that 3xx-redirects to an attacker-controlled public host received the provider API key verbatim. Thread the exact set of auth-bearing header names (kind default + profile AuthHeader + CustomHeaders keys + well-known) into the client and Header.Del them whenever the redirect target's host:port differs from the original. Regression test asserts the creds are dropped cross-host and kept same-host. * fix(sessions): fsync events.jsonl append for crash durability (AUDIT-M12) appendEventLocked wrote the event into the page cache and returned success, then durably wrote (fsync'd) the derived metadata. A crash after the metadata fsync but before the events.jsonl page flushed left metadata.EventCount ahead of the log — silently dropping the last appended event, including the checkpoint a /rewind targets. Add file.Sync() before Close so the log is at least as durable as the metadata derived from it. (Note: the fsync itself has no portable unit-test seam; covered by the existing sessions append/durability suite for no-regression.) * fix(cron): DST fall-back double-fire + claim double-grant (AUDIT-M4, AUDIT-M5) M4: fireJob/claimFire computed the next slot from the raw sub-second now(), so schedule.Next's DST fall-back collapse guard (which only engages for a minute-aligned 'after') never fired — a daily job in the repeated wall-clock hour ran twice on the fall-back day. Feed sched.Next a minute-truncated instant at the claim and the post-exec advance (the due-check still uses the real instant so sub-minute NextRunAt jobs are unaffected). M5: claimFire left NextRunAt unchanged when the schedule couldn't advance (unparseable/exhausted spec), so two concurrent schedulers both saw the job due and both fired it. Pause the job inside the same locked claim instead: the winner still fires once and the post-exec keeps it paused; the loser sees a non-active job and is refused. Tests: claimFire double-claim on an unadvanceable job (second refused, job paused) and a DST fall-back daily job advancing past the repeat (not re-firing it). * fix(daemon): bound the control handshake + track bridge conns for Shutdown (AUDIT-M7, M8, I1) The remote bridge clears the connection deadline before handing the conn to Server.ServeConn, and the local socket set none, so handleConn's two ReadControl handshake calls could block forever — an authenticated-but-idle remote peer pinned a bridge connection slot (32 of them exhaust the bridge), and the local path had the same unbounded read. Set a handshake deadline in handleConn and clear it before the (long-lived) streaming dispatch (M7, I1). ServeConn also bypassed trackConn, so Shutdown's conns-close sweep couldn't close a remote conn stalled in that handshake read. Track/untrack it like the local accept loop does (M8). Tests: handleConn returns under a shortened handshake deadline when the peer never sends hello; Shutdown closes a ServeConn'd conn well under the 10s deadline. * fix(swarm): atomic rename-with-verify mailbox stale-lock break (AUDIT-M13) The stale-break compared two consecutive reads of the SAME lock file (string(data) == string(stale)), so the equality was always true and gave no protection: two waiters could both observe a stale lock and both os.Remove it while a third recreated it via O_EXCL, leaving two live writers to the same per-agent inbox (split-brain). Replace with the proven rename-with-verify used by the cron/hooks/oauth locks: rename the stale file aside (only one racer wins the rename), re-check the moved file's mtime is still stale before deleting, and rename it back if a holder rotated a fresh lock in the gap. Tests: a genuinely stale lock is reclaimed (no .stale.* leftover); a fresh held lock is never broken. (The double-break race itself is not deterministically unit-testable; the fix mirrors the cron/hooks/oauth pattern.) * fix(streamjson): anchor api_key redaction so prose isn't mangled (AUDIT-M1) The api_key secret pattern used ["'=:\s]+ as the delimiter class, so a bare space after the marker counted — 'the api_key: foo setting' and 'apiKey value spans' had the following word replaced with [REDACTED] in every emitted stream-json event (text deltas, tool output, final answer). Require a real assignment delimiter (= or :) and a credential-length body, mirroring the already-anchored sk-/bearer patterns. Prose survives; real api_key=... secrets still redact. * fix(tools): snapshot exec-session lastUsedAt under its lock to fix prune race (AUDIT-L15) sessionToPruneLocked sorted on execSession.lastUsedAt while holding only manager.mu, but touch() writes lastUsedAt under session.mu — a data race on a time.Time that could torn-read and mis-select the prune victim. Snapshot each session's lastUsedAt via a session.mu-guarded getter before sorting (lock order stays manager.mu -> session.mu; no path takes them the other way). Adds a -race regression test driving touch() concurrently with the prune selection. * fix(swarm): release per-job context on MaxRuns completion (AUDIT-L13) Scheduler.run returned on MaxRuns completion without calling job.cancel(), so the job's derived context (and the goroutine context.WithCancel spawns to propagate parent cancellation) leaked until the whole scheduler was cancelled at session end. Add defer job.cancel() (idempotent with Cancel/Close) so it is released on every exit path. * fix(agent): route post-compaction and max-turns connects through streamWithReconnect (AUDIT-L1) The main turn connect already retries transient disconnects via streamWithReconnect, but the post-compaction retry connect, the reactive mid-stream reconnect, and finalAnswerAfterMaxTurns called provider.StreamCompletion directly — a single transient hiccup on those (e.g. the final summary after a long autonomous/cron run, or the turn right after a context-limit compaction) failed the whole run with no retry. All three are pre-content connects, so routing them through the helper carries no OnText-duplication risk. * fix(cli): reject trailing args after --skip-permissions-unsafe (AUDIT-L3) zero --skip-permissions-unsafe "fix bug" silently discarded the prompt and launched the interactive TUI, so a scripted one-shot unsafe invocation appeared to hang. Reject any trailing positional arg loudly (after checking for a misplaced --add-dir first, which keeps its specific error), pointing users at the working form: zero exec --skip-permissions-unsafe -p "...". * fix(provideroauth): error on present-but-wrong-shape chatgpt account-id claim (AUDIT-L11) extractChatGPTAccountID returned ("", nil) both when the id_token had no account-id claim AND when OpenAI's auth namespace was present but the account id was missing/empty/non-string. The latter is a claim-shape change: the caller only warns on a non-nil error, so it silently omitted the chatgpt-account-id header and every Codex call 401'd with no diagnostic, indistinguishable from an expired token. Return an error for the present-but-unusable case so the login warning fires; a genuinely absent claim still soft-skips ("", nil). * test(tools): widen exec-session poll windows so the suite is -race-clean (AUDIT report §2) Three exec-session timing tests assumed a 250ms-sleep / immediate child would finish within a fixed 1000ms yield. Under -race the child (the race-instrumented test binary) starts slowly enough to overrun it, so the tool correctly returned a still-running session_id instead of an exit_code and the asserts failed — the non-green -race suite the audit flagged in §2. collect() returns as soon as the session completes, so widening the poll window to 30s makes them deterministic under -race without slowing the passing case. Test-only; no behavior change. * docs(audit): mark remediation status (fixed/deferred/skipped) for the 2026-06-20 audit * docs(audit): strip trailing whitespace from the report (fix git diff --check) * fix(tools): drain PTY output before marking an exec session done (AUDIT-M14) A TTY exec session's stdout was copied into the buffer by a fire-and-forget io.Copy goroutine, but startSession's Wait goroutine called markDone (and then removed the session) as soon as command.Wait() returned — before that goroutine had necessarily drained the master FD. The command's final output chunk (e.g. a test runner's last PASS/FAIL line) could be lost on exit, and since the exited session is removed it could not be polled back. This also surfaced as the flaky TestExecCommandTTYSessionAcceptsInputOnLinux on loaded CI. Make the PTY cleanup (called after command.Wait, before markDone) join the copy goroutine before closing the master: the child has exited so the master EOFs once io.Copy finishes draining; waiting for that (bounded by bashWaitDelay) guarantees all output is buffered before the session is marked done. Closing the master first would truncate the unread tail, so the join precedes the Close. Linux-only path (exec_pty_linux.go); verified via GOOS=linux build+vet (the TTY test only runs on linux/CI). * docs(audit): mark M14 fixed (PTY drain) in remediation status --------- Co-authored-by: gnanam1990 <[email protected]>	2026-06-21 00:44:23 +05:30
Anandan	f5038151c8	Add managed background terminals (#270) ... * Add managed background terminal sessions * Stop background terminals on TUI exit * Cover approved local network sandbox mode * Polish background terminal rendering * Tighten exec session cleanup guidance * Address background terminal review feedback * Kill exec session trees on Windows * Trigger CI for Windows cleanup	2026-06-20 20:30:39 +05:30
Anandan	cf54e2cb0e	Add persistent exec command sessions (#267) ... * Add persistent exec command sessions Introduce exec_command and write_stdin tools backed by a shared session manager so long-running shell commands can remain alive and be polled or interrupted across tool calls. Wire exec_command through the existing shell permission, network prompt, command-prefix approval, sandbox grant scope, specialist manifest, and prompt/documentation paths. Keep web_fetch limited to public remote HTTP(S) URLs so localhost/private URLs go through shell commands where sandbox network permission applies. Tested: git diff --cached --check * Fix exec session lifecycle review issues	2026-06-20 14:20:32 +05:30