fix: reject executable pi configuration

backend/test/list-models.test.ts

@@ -20,6 +20,9 @@ function enabled(...ids: string[]) {
   return () => ({ ids, warnings: [], source: "/test/settings.json" });
 }
 
+const noManagedModels = { readModelsStore: () => undefined };
+const MANAGED_CONFIG_ERROR = "Pi provider/model configuration is invalid";
+
 test("createPiModelLister returns mapped PiModel[] from get_available_models", async () => {
   const script = scriptWith([
     { provider: "zai", id: "glm-5.2", name: "GLM 5.2", reasoning: true, extra: "ignored" },
@@ -27,6 +30,7 @@ test("createPiModelLister returns mapped PiModel[] from get_available_models", a
   ]);
   try {
     const lister = createPiModelLister(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
+      ...noManagedModels,
       loadEnabledModels: enabled("zai/glm-5.2", "anthropic/claude-opus-4-8"),
       spawnFn: () => spawn("node", [FAKE, script]) as any,
     });
@@ -45,6 +49,7 @@ test("createPiModelLister caches within ttl (spawns once for two calls)", async
   try {
     let spawns = 0;
     const lister = createPiModelLister(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
+      ...noManagedModels,
       loadEnabledModels: enabled("zai/glm-5.2"),
       spawnFn: () => { spawns++; return spawn("node", [FAKE, script]) as any; },
       ttlMs: 10_000,
@@ -69,6 +74,7 @@ test("production model-list spawn preserves PATH and passes the portable data ro
       PI_BIN: "/usr/local/bin/pi",
       THT_DATA_ROOT: "/data",
     }), {
+      ...noManagedModels,
       loadEnabledModels: enabled("test/unavailable"),
       spawnFn: (...args: any[]) => {
         calls.push(args);
@@ -101,6 +107,7 @@ test("model-list spawn scrubs ambient provider credentials and generic secret me
   process.env.CLOUDFLARE_ACCOUNT_ID = "must-not-leak";
   try {
     const lister = createPiModelLister(loadConfig({ PI_BIN: "/usr/local/bin/pi" }), {
+      ...noManagedModels,
       loadEnabledModels: enabled("test/unavailable"),
       spawnFn: (...args: any[]) => {
         calls.push(args);
@@ -135,6 +142,7 @@ test("model listing does not require PI_PROVIDER or read the generic credential"
       PI_BIN: "/usr/local/bin/pi",
       THT_MODEL_API_KEY_FILE: "/missing-and-must-not-be-read",
     }), {
+      ...noManagedModels,
       loadEnabledModels: enabled("zai/glm-5.2"),
       spawnFn: (...args: any[]) => {
         calls.push(args);
@@ -158,6 +166,7 @@ test("returns only enabled available models in enabledModels order", async () =>
   ]);
   try {
     const lister = createPiModelLister(loadConfig({}), {
+      ...noManagedModels,
       loadEnabledModels: enabled(
         "zai/glm-5.2",
         "deepseek/deepseek-v4-flash",
@@ -179,6 +188,7 @@ test("empty enabled model scope fails closed without spawning Pi", async () => {
   let spawns = 0;
   const warnings: string[] = [];
   const lister = createPiModelLister(loadConfig({}), {
+    ...noManagedModels,
     loadEnabledModels: () => ({ ids: [], warnings: ["scope invalid"] }),
     warn: (message) => warnings.push(message),
     spawnFn: () => { spawns += 1; throw new Error("must not spawn"); },
@@ -195,6 +205,7 @@ test("warns and returns empty when enabled identifiers are unavailable", async (
   const warnings: string[] = [];
   try {
     const lister = createPiModelLister(loadConfig({}), {
+      ...noManagedModels,
       loadEnabledModels: enabled("zai/glm-5.2"),
       warn: (message) => warnings.push(message),
       spawnFn: () => spawn("node", [FAKE, script]) as any,
@@ -205,3 +216,123 @@ test("warns and returns empty when enabled identifiers are unavailable", async (
     rmSync(path.dirname(script), { recursive: true, force: true });
   }
 });
+
+const executableModelsConfigCases: Array<[string, unknown]> = [
+  ["nested provider headers", {
+    providers: {
+      selected: {
+        headers: { Authorization: "!sensitive-header-command /private/header-path" },
+      },
+    },
+  }],
+  ["provider apiKey", {
+    providers: {
+      selected: { apiKey: "!sensitive-api-key-command /private/key-path" },
+    },
+  }],
+  ["selected model objects", {
+    providers: {
+      selected: {
+        models: [{ id: "model", name: "!sensitive-model-command /private/model-path" }],
+      },
+    },
+  }],
+  ["selected model overrides", {
+    providers: {
+      selected: {
+        modelOverrides: {
+          model: { headers: { "X-Override": "!sensitive-override-command /private/override-path" } },
+        },
+      },
+    },
+  }],
+  ["nested arrays", {
+    providers: {
+      selected: {
+        compat: { nested: ["literal", { value: "!sensitive-array-command /private/array-path" }] },
+      },
+    },
+  }],
+];
+
+// Catches Task 8 model discovery delegating raw managed models.json values to Pi. Pi 0.80.3
+// executes leading-! values at request time, so the complete managed store must be rejected before
+// it can become an authoritative source of API choices.
+test.each(executableModelsConfigCases)(
+  "managed models ingestion rejects executable strings in %s",
+  async (_name, modelsConfig) => {
+    let spawns = 0;
+    const lister = createPiModelLister(loadConfig({}), {
+      loadEnabledModels: enabled("selected/model"),
+      readModelsStore: () => JSON.stringify(modelsConfig),
+      spawnFn: () => {
+        spawns += 1;
+        throw new Error("unsafe model-list spawn");
+      },
+    });
+
+    let caught: unknown;
+    try {
+      await lister();
+    } catch (error) {
+      caught = error;
+    }
+    expect(caught).toBeInstanceOf(Error);
+    expect((caught as Error).message).toBe(MANAGED_CONFIG_ERROR);
+    expect(String(caught)).not.toMatch(/sensitive|private|command|path/i);
+    expect(spawns).toBe(0);
+  },
+);
+
+// Selection-time smoke filtering intentionally ignores unrelated providers, but the full
+// installation-owned models.json is invalid at the model-choice ingestion boundary.
+test("managed models ingestion rejects an executable string in an unrelated provider", async () => {
+  let spawns = 0;
+  const lister = createPiModelLister(loadConfig({}), {
+    loadEnabledModels: enabled("selected/model"),
+    readModelsStore: () => JSON.stringify({
+      providers: {
+        selected: { models: [{ id: "model" }] },
+        unrelated: { apiKey: "!sensitive-unrelated-command /private/unrelated-path" },
+      },
+    }),
+    spawnFn: () => {
+      spawns += 1;
+      throw new Error("unsafe model-list spawn");
+    },
+  });
+
+  await expect(lister()).rejects.toThrow(MANAGED_CONFIG_ERROR);
+  expect(spawns).toBe(0);
+});
+
+test("managed models ingestion revalidates the store before serving a cached choice", async () => {
+  const script = scriptWith([
+    { provider: "selected", id: "model", name: "Selected model", reasoning: true },
+  ]);
+  let managedModels = JSON.stringify({
+    providers: { selected: { models: [{ id: "model" }] } },
+  });
+  let spawns = 0;
+  try {
+    const lister = createPiModelLister(loadConfig({}), {
+      loadEnabledModels: enabled("selected/model"),
+      readModelsStore: () => managedModels,
+      spawnFn: () => {
+        spawns += 1;
+        return spawn("node", [FAKE, script]) as any;
+      },
+      ttlMs: 10_000,
+    });
+
+    await expect(lister()).resolves.toHaveLength(1);
+    managedModels = JSON.stringify({
+      providers: { selected: { headers: { Authorization: "!new-unsafe-value" } } },
+    });
+
+    await expect(lister()).rejects.toThrow(MANAGED_CONFIG_ERROR);
+    expect(spawns).toBe(1);
+  } finally {
+    rmSync(path.dirname(script), { recursive: true, force: true });
+  }
+});