Repository navigation
fix(security): scope Helm tools, clipboard writes and webhook tokens - #312
Merged
Merged
Conversation
Four small hardening changes from the November review. - Helm get_session_status and kill_session accepted any session id. They now act only on sessions the calling Helm session spawned, and report any other id as not found so the tools cannot be used to probe. - OSC 52 clipboard writes were honoured for every terminal, including hidden background sessions, so one session could replace what was copied from another. A write is now accepted only when the window has focus and the focused element is inside that terminal. The sequence is still consumed either way. Decoded text over 1,000,000 characters is refused. - The webhook Bearer token was sent to any http(s) URL. A token is no longer sent over plain http to a non-loopback host; the request is skipped and one warning is logged per origin, without the path, query or token. The Vault client's loopback check is shared and now covers all of 127.0.0.0/8. - A crash left Helm MCP config files, which hold a bridge token, under userData. The first Helm setup in a process now removes stale ones. Helm spawn_session and its autoMode handling are unchanged. Tests: Helm child scoping for both tools, the focus rule (unit and in the terminal manager, including a background terminal), webhook token transport, loopback hosts, stale config cleanup. Full suite: 2321 passed; the one failure is the known Windows-host real-shell test. Co-Authored-By: OpenAI Codex <noreply@openai.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Review items 5.3 and 5.4 (
docs/REVIEW_2026-11-09.md). Four small, independent hardening changes.get_session_statusandkill_sessionaccepted any session id. They now act only on sessions the calling Helm session spawned. Any other id is reported as not found, the same as an unknown id.http:URL whose host is not loopback, the request is skipped and one warning is logged per origin (no path, query or token). Without a token, plain HTTP works as before. The Vault client's loopback check is shared and now covers127.0.0.0/8.<userData>/helm-mcp-configs/<id>.json, which holds a bridge token, on disk. The first Helm setup in a process removes stale ones. Files written later in the same process are not touched.No new IPC channels and no Settings UI.
Test plan
npx tsc --noEmitnpx eslinton touched filesnpx vitest run— 2321 passed; 1 failed, the known Windows-host real-shell test (remote-command.test.ts)http://LAN address stops posting;http://127.0.0.1andhttps://still postOut of scope
spawn_sessionandautoMode. GatingautoModewould change existing Helm behaviour and is a product decision.CONFIG_SETdeny-list and--remote-debugging-porthandling.🤖 Generated with Claude Code