feat(agent-handoff): cut 1.17 — hardened session-start git reads, own version stamp, stripped binary (#235 #229 #228) - #245
Merged
Merged
Conversation
…ripped launcher The session-start launcher ran its Git reads with the full inherited process environment and no configuration isolation, so a `core.fsmonitor` setting reachable from the target checkout named a hook that Git executed on every session start — command execution earned purely by being opened as a session-start target. Every read now runs with an explicit minimal environment (PATH and HOME only, so no GIT_DIR, GIT_WORK_TREE, or GIT_CONFIG_* value can redirect it) and carries `-c core.fsmonitor=`, which outranks every config file, plus `--no-optional-locks`. A Go regression test crafts that config in a fixture repository, proves plain Git still runs the hook there, and then proves session start does not. Injected context is unchanged. 1.15 and 1.16 byte-copied the 1.14 binary, so `--version` answered 1.14 — the one question the stale-launcher diagnostic exists to answer. 1.17 re-links from its own payload path with its own stamp, the build script states that cut-time rule, and the new contract test pins the equality against the catalog's *default* version so a future carry-forward fails instead of shipping. The published 1.14-1.16 bytes keep answering 1.14; bugs/010 records why that is not drift. `-s -w` joins ARTIFACT_LDFLAGS (#228 lever 1): 3,906,258 -> 2,646,142 bytes, with .gopclntab retained so panic traces keep function names and lines. conventions 26 records the policy and that published bytes stay unstripped. Catalog 5 promotes 1.17 and retains 1.16; family landing pages, family index, payload projection, generated catalog, root README links, and the hygiene executable inventory follow. Refs: #235, #229, #228
The #235 hardening had no regression coverage for its environment half: only the fsmonitor test existed, and a refactor back to `command.Env = nil` would have passed every test in the package. The new case exports GIT_DIR and GIT_WORK_TREE naming a decoy repository plus a GIT_CONFIG_COUNT triple that injects a core.fsmonitor hook, then asserts the sentinel is absent, the branch is still the installing repository's, and no read degraded. Verified non-vacuous: restoring `command.Env = nil` fails it. Test-only by necessity. Comment edits inside context.go shift source line numbers, which `.gopclntab` records and `-s -w` deliberately retains, so they change the sealed artifact; the two comment findings from the security read are therefore left for a decision rather than folded in silently. Refs: #235
The security read asked for two comment corrections in context.go: the `-c core.fsmonitor=` note claimed more than the flag delivers (repo-local `filter.<driver>.clean/process` on `status` and `log.showSignature` with `gpg.program` on `log` stay reachable behind a `.git/config` write, and GIT_CONFIG_NOSYSTEM would not close them because repository-local config is always read), and the environment note claimed the reads behave exactly as before when XDG_CONFIG_HOME is in fact dropped. Comments are not free here: they shift source line numbers, which `.gopclntab` records and `-s -w` retains, so the launcher had to be resealed. Compiled behavior is unchanged and the size is identical at 2,646,142 bytes; only the line table moved. The digest chain follows — the hook artifact digest in payload.toml, then the aggregate in the family index and catalogs/5.toml. Refs: #235
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
agent-handoff 1.17: the
session-startlauncher runs its Git reads with an explicit minimal environment (PATH, HOME),-c core.fsmonitor=and--no-optional-locks, so a repository-local fsmonitor hook can no longer execute during session start; the binary is re-linked with its own version stamp (--versionanswers 1.17) and built with-s -w(3,906,258 → 2,646,142 bytes, pclntab retained). Regression tests cover the fsmonitor hook (with a control step) and the inherited-environment allowlist. Records the 1.14–1.16 carry-forward as bug 010 and the strip policy in conventions.Governing work
Final: #235
Acceptance coverage
internal/agenthandoff/sessionstart/context.go+hook_test.go(TestConfiguredFsmonitorHookNeverRunsfails on the unhardened build, passes after;TestInheritedGitEnvironmentIsInert); AC5: ships as payload 1.17.-X main.version=1.17; contract test asserts the default version's binary--version; build-script comment documents the re-link rule;docs/handoff/bugs/010-*.-s -winscripts/build-agent-handoff-session-start.sh; go-verify-binary green on the sealed bytes; panic trace keeps function and line./tmp/ps529-session/reviews/sec-ah117.md): no must-fix; comment scoping and env test folded in; bytes re-verified after reseal.Verification
go test ./internal/agenthandoff/..., build-script--verify(matches rebuild 7cf697ba…), five standards validators, ruff, basedpyright, markdownlint,rexec -- make go-check(0 issues), 1.17/1.16 contract tests, hygiene — all green. The three reds reading.standards/(activation/dogfood lock still at 1.16) are the by-design reconcile lag until release prep;check-release --baseline v5.28.0reports onlyPC-RELEASE-PROJECTION.