fix: reject executable pi configuration

backend/test/pi-provider-smoke.test.ts

@@ -24,6 +24,26 @@ function rpcChild(onCommand: (command: any, emit: (message: unknown) => void) =>
   return child;
 }
 
+function successfulProviderChild() {
+  return rpcChild((command, emit) => {
+    if (command.type === "set_model" || command.type === "set_thinking_level") {
+      emit({ type: "response", id: command.id, success: true });
+    }
+    if (command.type === "prompt") {
+      emit({
+        type: "message_end",
+        message: { role: "assistant", stopReason: "stop", content: "must-not-be-returned" },
+      });
+      emit({
+        type: "agent_end",
+        messages: [{ role: "assistant", stopReason: "stop", content: "must-not-be-returned" }],
+      });
+    }
+  });
+}
+
+const MANAGED_CONFIG_ERROR = "Pi provider/model configuration is invalid";
+
 // Catches an isolated smoke agent that copies auth.json but drops the selected custom
 // provider/model from models.json, causing set_model to fail before the real request.
 test("provider smoke reaches the selected custom provider from an isolated models.json", async () => {
@@ -61,23 +81,30 @@ test("provider smoke reaches the selected custom provider from an isolated model
         providers: {
           "custom-openai": {
             baseUrl: "https://selected.invalid/v1",
+            apiKey: "$CUSTOM_OPENAI_API_KEY",
             api: "openai-completions",
+            headers: { "X-Literal-Bang": "$!literal-value" },
             models: [{ id: "selected-model", name: "Selected model", reasoning: true }],
           },
         },
       });
+      expect(JSON.parse(readFileSync(`${isolatedAgentDir}/auth.json`, "utf8"))).toEqual({
+        "custom-openai": { type: "api_key", key: "${CUSTOM_OPENAI_API_KEY}" },
+      });
       return child;
     },
     authProviders: () => new Set(["custom-openai"]),
     readAuthStore: () => JSON.stringify({
-      "custom-openai": { type: "api_key", key: "test-only" },
-      unrelated: { type: "api_key", key: "must-not-enter-isolated-context" },
+      "custom-openai": { type: "api_key", key: "${CUSTOM_OPENAI_API_KEY}" },
+      unrelated: { type: "api_key", key: "!must-not-run-or-enter-isolated-context" },
     }),
     readModelsStore: () => JSON.stringify({
       providers: {
         "custom-openai": {
           baseUrl: "https://selected.invalid/v1",
+          apiKey: "$CUSTOM_OPENAI_API_KEY",
           api: "openai-completions",
+          headers: { "X-Literal-Bang": "$!literal-value" },
           models: [
             { id: "selected-model", name: "Selected model", reasoning: true },
             { id: "unrelated-model", name: "Must not enter isolated context" },
@@ -101,6 +128,105 @@ test("provider smoke reaches the selected custom provider from an isolated model
   expect(isolatedAgentDir && existsSync(dirname(isolatedAgentDir))).toBe(false);
 });
 
+const selectedExecutableConfigCases: Array<{
+  name: string;
+  selectedAuth?: unknown;
+  selectedProvider: Record<string, unknown>;
+}> = [
+  {
+    name: "selected auth credential",
+    selectedAuth: {
+      type: "api_key",
+      key: "!sensitive-credential-command /private/credential-path",
+    },
+    selectedProvider: {},
+  },
+  {
+    name: "selected provider apiKey",
+    selectedProvider: {
+      apiKey: "!sensitive-api-key-command /private/key-path",
+    },
+  },
+  {
+    name: "nested selected-provider headers",
+    selectedProvider: {
+      headers: { Authorization: "!sensitive-header-command /private/header-path" },
+    },
+  },
+  {
+    name: "selected model object",
+    selectedProvider: {
+      models: [{
+        id: "selected-model",
+        name: "!sensitive-model-command /private/model-path",
+      }],
+    },
+  },
+  {
+    name: "selected model override",
+    selectedProvider: {
+      modelOverrides: {
+        "selected-model": {
+          headers: { "X-Override": "!sensitive-override-command /private/override-path" },
+        },
+      },
+    },
+  },
+  {
+    name: "array nested in selected provider configuration",
+    selectedProvider: {
+      compat: {
+        nested: ["literal", { value: "!sensitive-array-command /private/array-path" }],
+      },
+    },
+  },
+];
+
+// Catches a defense that validates only known top-level fields or waits until after the isolated
+// Pi process starts. Every selected value crossing into auth.json/models.json must be declarative.
+test.each(selectedExecutableConfigCases)(
+  "provider smoke rejects executable config in $name before isolated Pi spawn",
+  async ({ selectedAuth, selectedProvider }) => {
+    const child = successfulProviderChild();
+    const spawnFn = vi.fn(() => child);
+    const smoke = createPiProviderSmoke(loadConfig({}), {
+      spawnFn,
+      authProviders: () => new Set(["custom-openai"]),
+      readAuthStore: () => JSON.stringify({
+        "custom-openai": selectedAuth ?? { type: "api_key", key: "test-only" },
+        unrelated: { type: "api_key", key: "!must-not-contaminate-selected-provider" },
+      }),
+      readModelsStore: () => JSON.stringify({
+        providers: {
+          "custom-openai": {
+            baseUrl: "https://selected.invalid/v1",
+            api: "openai-completions",
+            models: [{ id: "selected-model", name: "Selected model" }],
+            ...selectedProvider,
+          },
+          unrelated: {
+            apiKey: "!must-not-contaminate-selected-provider",
+            models: [{ id: "unrelated-model" }],
+          },
+        },
+      }),
+    });
+
+    let caught: unknown;
+    try {
+      await smoke({
+        provider: "custom-openai", model: "selected-model", reasoning: "medium", timeoutMs: 750,
+      });
+    } catch (error) {
+      caught = error;
+    }
+    expect(caught).toBeInstanceOf(Error);
+    expect((caught as Error).message).toBe(MANAGED_CONFIG_ERROR);
+    expect(String(caught)).not.toMatch(/sensitive|private|command|path/i);
+    expect(spawnFn).not.toHaveBeenCalled();
+  },
+);
+
 // Catches a provider smoke process that runs from the trusted harness or leaves Pi tools,
 // extensions, skills, context files, templates, themes, or session persistence enabled.
 test("provider smoke makes one configured request from an isolated no-capability Pi process", async () => {