From f064daef09f81fcce0bd998f8762abc029355e31 Mon Sep 17 00:00:00 2001 From: mptyl Date: Sun, 12 Jul 2026 08:05:51 +0200 Subject: [PATCH] fix(backend): harden provider credential isolation --- backend/src/pi/list-models.ts | 6 +- backend/src/pi/pi-process-manager.ts | 72 ++----------- backend/src/pi/provider-credentials.ts | 120 ++++++++++++++++++++++ backend/test/list-models.test.ts | 42 +++++++- backend/test/pi-process-manager.test.ts | 29 ++++++ backend/test/provider-credentials.test.ts | 76 ++++++++++++++ 6 files changed, 275 insertions(+), 70 deletions(-) create mode 100644 backend/src/pi/provider-credentials.ts create mode 100644 backend/test/provider-credentials.test.ts diff --git a/backend/src/pi/list-models.ts b/backend/src/pi/list-models.ts index cb8b31d4..fc5192b3 100644 --- a/backend/src/pi/list-models.ts +++ b/backend/src/pi/list-models.ts @@ -1,6 +1,7 @@ import { spawn as nodeSpawn, type ChildProcessWithoutNullStreams } from "node:child_process"; import type { AppConfig } from "../config.js"; import { RpcClient } from "../rpc/rpc-client.js"; +import { buildPiChildEnv } from "./provider-credentials.js"; export interface PiModel { provider: string; @@ -34,7 +35,10 @@ export function createPiModelLister(cfg: AppConfig, opts: Opts = {}): () => Prom return async function listModels(): Promise { if (cache && now() - cache.at < ttlMs) return cache.models; - const env: NodeJS.ProcessEnv = { ...process.env }; + const env = buildPiChildEnv({ + provider: cfg.defaults.provider, + credentialFile: cfg.modelApiKeyFile, + }); delete env.THT_DATA_ROOT; if (cfg.dataRoot !== undefined) env.THT_DATA_ROOT = cfg.dataRoot; const child = spawnFn(cfg.piBin, ["--mode", "rpc"], { cwd: cfg.harnessDir, env }); diff --git a/backend/src/pi/pi-process-manager.ts b/backend/src/pi/pi-process-manager.ts index 10eda124..94b3d3e6 100644 --- a/backend/src/pi/pi-process-manager.ts +++ b/backend/src/pi/pi-process-manager.ts @@ -1,9 +1,9 @@ import { spawn as nodeSpawn, type ChildProcessWithoutNullStreams } from "node:child_process"; -import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync } from "node:fs"; import type { AppConfig } from "../config.js"; import { RpcClient } from "../rpc/rpc-client.js"; import { SessionBridge } from "../bridge/session-bridge.js"; import type { ThtRunner } from "../tht/tht-runner.js"; +import { buildPiChildEnv, canonicalPiProvider } from "./provider-credentials.js"; export interface SessionRuntime { rpc: RpcClient; @@ -18,51 +18,6 @@ type SpawnFn = ( options: { cwd: string; env: NodeJS.ProcessEnv }, ) => ChildProcessWithoutNullStreams; -const PROVIDER_KEY_ENV: Readonly> = { - anthropic: "ANTHROPIC_API_KEY", - openai: "OPENAI_API_KEY", - gemini: "GEMINI_API_KEY", - google: "GEMINI_API_KEY", - deepseek: "DEEPSEEK_API_KEY", - zai: "ZAI_API_KEY", - groq: "GROQ_API_KEY", - mistral: "MISTRAL_API_KEY", - openrouter: "OPENROUTER_API_KEY", - xai: "XAI_API_KEY", - cerebras: "CEREBRAS_API_KEY", - cohere: "COHERE_API_KEY", -}; -const LOCAL_PROVIDERS = new Set(["ollama", "lmstudio", "local", "aritmolab"]); -const PROVIDER_ENV_NAMES = new Set(Object.values(PROVIDER_KEY_ENV)); - -function normalizedProvider(provider: string | undefined): string | undefined { - const value = provider?.trim().toLowerCase(); - return value || undefined; -} - -function readModelCredential(file: string): string { - let fd: number | undefined; - try { - const before = lstatSync(file); - if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1) throw new Error(); - fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW); - const info = fstatSync(fd); - const mode = info.mode & 0o777; - const ownedStrict = info.uid === process.getuid?.() && (mode === 0o400 || mode === 0o600); - const dockerSecret = file.startsWith("/run/secrets/") && mode === 0o444; - if (!info.isFile() || info.nlink !== 1 || (!ownedStrict && !dockerSecret) || info.size > 16_384) { - throw new Error(); - } - const value = readFileSync(fd, "utf8"); - if (!value || /\s/.test(value)) throw new Error(); - return value; - } catch { - throw new Error("model provider credential is unavailable"); - } finally { - if (fd !== undefined) closeSync(fd); - } -} - export class PiProcessManager { private runtimes = new Map(); private spawnFn: ( @@ -82,26 +37,13 @@ export class PiProcessManager { private spawnPi( spawnFn: SpawnFn, sessionId: string, author: string, provider: string | undefined, ): ChildProcessWithoutNullStreams { - const env: NodeJS.ProcessEnv = { - ...process.env, - THT_SESSION: sessionId, - THT_AUTHOR: author, - }; + const env = buildPiChildEnv({ + provider, + credentialFile: this.cfg.modelApiKeyFile, + additions: { THT_SESSION: sessionId, THT_AUTHOR: author }, + }); delete env.THT_DATA_ROOT; - delete env.PI_PROVIDER_API_KEY; - delete env.THT_MODEL_API_KEY_FILE; - for (const name of PROVIDER_ENV_NAMES) delete env[name]; if (this.cfg.dataRoot !== undefined) env.THT_DATA_ROOT = this.cfg.dataRoot; - const normalized = normalizedProvider(provider); - if (normalized && !LOCAL_PROVIDERS.has(normalized)) { - const envName = PROVIDER_KEY_ENV[normalized]; - if (!envName || !this.cfg.modelApiKeyFile) { - throw new Error("model provider credential is unavailable"); - } - env[envName] = readModelCredential(this.cfg.modelApiKeyFile); - } else if (this.cfg.modelApiKeyFile && !normalized) { - throw new Error("model provider credential is unavailable"); - } // pi 0.73 removed `--approve`: rpc mode is headless and its argv is intentionally minimal. const child = spawnFn(this.cfg.piBin, ["--mode", "rpc"], { cwd: this.cfg.harnessDir, @@ -132,7 +74,7 @@ export class PiProcessManager { throw new Error("max Pi processes reached"); } const author = o.author ?? "dev@local"; - const provider = o.provider ?? this.cfg.defaults.provider; + const provider = canonicalPiProvider(o.provider ?? this.cfg.defaults.provider); const child = this.spawnFn(sessionId, author, provider); const rpc = new RpcClient(child); const bridge = new SessionBridge(rpc); diff --git a/backend/src/pi/provider-credentials.ts b/backend/src/pi/provider-credentials.ts new file mode 100644 index 00000000..66cbde7b --- /dev/null +++ b/backend/src/pi/provider-credentials.ts @@ -0,0 +1,120 @@ +import { + closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, + type Stats, +} from "node:fs"; + +/** Audited against @earendil-works/pi-ai 0.80.3 auth plus its locked AWS credential chain. */ +export const PI_0803_CREDENTIAL_ENV_NAMES = Object.freeze([ + "AI_GATEWAY_API_KEY", "ANTHROPIC_API_KEY", "ANTHROPIC_OAUTH_TOKEN", "ANT_LING_API_KEY", + "AWS_ACCESS_KEY_ID", "AWS_BEARER_TOKEN_BEDROCK", "AWS_CONFIG_FILE", + "AWS_CONTAINER_AUTHORIZATION_TOKEN", "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE", + "AWS_CONTAINER_CREDENTIALS_FULL_URI", "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", "AWS_PROFILE", + "AWS_ROLE_ARN", "AWS_ROLE_SESSION_NAME", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", + "AWS_SHARED_CREDENTIALS_FILE", "AWS_WEB_IDENTITY_TOKEN_FILE", "AZURE_OPENAI_API_KEY", + "CEREBRAS_API_KEY", "CLOUDFLARE_ACCOUNT_ID", "CLOUDFLARE_API_KEY", + "CLOUDFLARE_GATEWAY_ID", "COPILOT_GITHUB_TOKEN", "DEEPSEEK_API_KEY", "FIREWORKS_API_KEY", + "GCLOUD_PROJECT", "GEMINI_API_KEY", "GOOGLE_APPLICATION_CREDENTIALS", "GOOGLE_CLOUD_API_KEY", + "GOOGLE_CLOUD_LOCATION", "GOOGLE_CLOUD_PROJECT", "GROQ_API_KEY", "HF_TOKEN", + "KIMI_API_KEY", "MINIMAX_API_KEY", "MINIMAX_CN_API_KEY", "MISTRAL_API_KEY", + "MOONSHOT_API_KEY", "NVIDIA_API_KEY", "OPENCODE_API_KEY", "OPENAI_API_KEY", + "OPENROUTER_API_KEY", "TOGETHER_API_KEY", "XAI_API_KEY", "XIAOMI_API_KEY", + "XIAOMI_TOKEN_PLAN_AMS_API_KEY", "XIAOMI_TOKEN_PLAN_CN_API_KEY", + "XIAOMI_TOKEN_PLAN_SGP_API_KEY", "ZAI_API_KEY", "ZAI_CODING_CN_API_KEY", +]); + +const PROVIDER_KEY_ENV: Readonly> = { + "amazon-bedrock": "AWS_BEARER_TOKEN_BEDROCK", + "ant-ling": "ANT_LING_API_KEY", + anthropic: "ANTHROPIC_API_KEY", + "azure-openai-responses": "AZURE_OPENAI_API_KEY", + cerebras: "CEREBRAS_API_KEY", + "cloudflare-ai-gateway": "CLOUDFLARE_API_KEY", + "cloudflare-workers-ai": "CLOUDFLARE_API_KEY", + deepseek: "DEEPSEEK_API_KEY", fireworks: "FIREWORKS_API_KEY", + "github-copilot": "COPILOT_GITHUB_TOKEN", google: "GEMINI_API_KEY", + "google-vertex": "GOOGLE_CLOUD_API_KEY", groq: "GROQ_API_KEY", huggingface: "HF_TOKEN", + "kimi-coding": "KIMI_API_KEY", minimax: "MINIMAX_API_KEY", "minimax-cn": "MINIMAX_CN_API_KEY", + mistral: "MISTRAL_API_KEY", moonshotai: "MOONSHOT_API_KEY", "moonshotai-cn": "MOONSHOT_API_KEY", + nvidia: "NVIDIA_API_KEY", openai: "OPENAI_API_KEY", opencode: "OPENCODE_API_KEY", + "opencode-go": "OPENCODE_API_KEY", openrouter: "OPENROUTER_API_KEY", together: "TOGETHER_API_KEY", + "vercel-ai-gateway": "AI_GATEWAY_API_KEY", xai: "XAI_API_KEY", xiaomi: "XIAOMI_API_KEY", + "xiaomi-token-plan-ams": "XIAOMI_TOKEN_PLAN_AMS_API_KEY", + "xiaomi-token-plan-cn": "XIAOMI_TOKEN_PLAN_CN_API_KEY", + "xiaomi-token-plan-sgp": "XIAOMI_TOKEN_PLAN_SGP_API_KEY", zai: "ZAI_API_KEY", + "zai-coding-cn": "ZAI_CODING_CN_API_KEY", +}; +const LOCAL_PROVIDERS = new Set(["ollama", "lmstudio", "local", "aritmolab", "faux"]); + +export function canonicalPiProvider(provider: string | undefined): string | undefined { + const value = provider?.trim().toLowerCase(); + if (!value) return undefined; + if (value === "gemini") return "google"; + return value; +} + +export interface CredentialFsOps { + lstat(path: string): Stats; + open(path: string, flags: number): number; + fstat(fd: number): Stats; + read(fd: number): string; + close(fd: number): void; +} +const realFs: CredentialFsOps = { + lstat: lstatSync, open: openSync, fstat: fstatSync, + read: (fd) => readFileSync(fd, "utf8"), close: closeSync, +}; + +function validSecretStat(info: Stats, docker: boolean): boolean { + const mode = info.mode & 0o777; + if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.size > 16_384) return false; + if (docker) return info.uid === 0 && mode === 0o444; + return info.uid === process.getuid?.() && (mode === 0o400 || mode === 0o600); +} + +function readCredential(file: string, fs: CredentialFsOps): string { + let fd: number | undefined; + try { + const docker = file.startsWith("/run/secrets/") && !file.slice("/run/secrets/".length).includes("/"); + if (file.startsWith("/run/secrets/") && !docker) throw new Error(); + if (docker) { + const parent = fs.lstat("/run/secrets"); + if (!parent.isDirectory() || parent.uid !== 0 || (parent.mode & 0o022) !== 0) throw new Error(); + } + const before = fs.lstat(file); + if (!validSecretStat(before, docker)) throw new Error(); + fd = fs.open(file, constants.O_RDONLY | constants.O_NOFOLLOW); + const opened = fs.fstat(fd); + if (!validSecretStat(opened, docker) || before.dev !== opened.dev || before.ino !== opened.ino) throw new Error(); + const value = fs.read(fd); + if (!value || /\s/.test(value)) throw new Error(); + return value; + } catch { + throw new Error("model provider credential is unavailable"); + } finally { + if (fd !== undefined) { + try { fs.close(fd); } catch { /* sanitized by design */ } + } + } +} + +export function buildPiChildEnv(opts: { + ambient?: NodeJS.ProcessEnv; + provider?: string; + credentialFile?: string; + additions?: NodeJS.ProcessEnv; + fsOps?: CredentialFsOps; +}): NodeJS.ProcessEnv { + const env = { ...(opts.ambient ?? process.env), ...opts.additions }; + delete env.PI_PROVIDER_API_KEY; + delete env.THT_MODEL_API_KEY_FILE; + for (const name of PI_0803_CREDENTIAL_ENV_NAMES) delete env[name]; + const provider = canonicalPiProvider(opts.provider); + if (provider && !LOCAL_PROVIDERS.has(provider)) { + const envName = PROVIDER_KEY_ENV[provider]; + if (!envName || !opts.credentialFile) throw new Error("model provider credential is unavailable"); + env[envName] = readCredential(opts.credentialFile, opts.fsOps ?? realFs); + } else if (opts.credentialFile && !provider) { + throw new Error("model provider credential is unavailable"); + } + return env; +} diff --git a/backend/test/list-models.test.ts b/backend/test/list-models.test.ts index 7a6788e1..f8cef6bd 100644 --- a/backend/test/list-models.test.ts +++ b/backend/test/list-models.test.ts @@ -1,6 +1,6 @@ import { test, expect } from "vitest"; import { spawn } from "node:child_process"; -import { mkdtempSync, writeFileSync, rmSync } from "node:fs"; +import { chmodSync, mkdtempSync, writeFileSync, rmSync } from "node:fs"; import { tmpdir } from "node:os"; import { join } from "node:path"; import path from "node:path"; @@ -82,13 +82,16 @@ test("production model-list spawn preserves PATH and passes the portable data ro } }); -test("model-list spawn omits ambient THT_DATA_ROOT when config does not provide one", async () => { +test("model-list spawn scrubs ambient provider credentials and generic secret metadata", async () => { const script = scriptWith([]); const calls: any[][] = []; const previousDataRoot = process.env.THT_DATA_ROOT; const previousCredential = process.env.PI_PROVIDER_API_KEY; process.env.THT_DATA_ROOT = "/ambient-must-not-leak"; - process.env.PI_PROVIDER_API_KEY = "still-inherited"; + process.env.PI_PROVIDER_API_KEY = "must-not-leak"; + process.env.OPENAI_API_KEY = "must-not-leak"; + process.env.AWS_SECRET_ACCESS_KEY = "must-not-leak"; + process.env.CLOUDFLARE_ACCOUNT_ID = "must-not-leak"; try { const lister = createPiModelLister(loadConfig({ PI_BIN: "/usr/local/bin/pi" }), { spawnFn: (...args: any[]) => { @@ -98,12 +101,43 @@ test("model-list spawn omits ambient THT_DATA_ROOT when config does not provide }); await lister(); expect(calls[0][2].env).not.toHaveProperty("THT_DATA_ROOT"); - expect(calls[0][2].env.PI_PROVIDER_API_KEY).toBe("still-inherited"); + expect(calls[0][2].env).not.toHaveProperty("PI_PROVIDER_API_KEY"); + expect(calls[0][2].env).not.toHaveProperty("OPENAI_API_KEY"); + expect(calls[0][2].env).not.toHaveProperty("AWS_SECRET_ACCESS_KEY"); + expect(calls[0][2].env).not.toHaveProperty("CLOUDFLARE_ACCOUNT_ID"); } finally { if (previousDataRoot === undefined) delete process.env.THT_DATA_ROOT; else process.env.THT_DATA_ROOT = previousDataRoot; if (previousCredential === undefined) delete process.env.PI_PROVIDER_API_KEY; else process.env.PI_PROVIDER_API_KEY = previousCredential; + delete process.env.OPENAI_API_KEY; + delete process.env.AWS_SECRET_ACCESS_KEY; + delete process.env.CLOUDFLARE_ACCOUNT_ID; + rmSync(path.dirname(script), { recursive: true, force: true }); + } +}); + +test("model-list spawn loads only the selected canonical provider credential", async () => { + const script = scriptWith([]); + const secret = join(path.dirname(script), "model-key"); + writeFileSync(secret, "selected-secret", { mode: 0o600 }); + chmodSync(secret, 0o600); + const calls: any[][] = []; + const lister = createPiModelLister(loadConfig({ + PI_PROVIDER: "Gemini", + THT_MODEL_API_KEY_FILE: secret, + }), { + spawnFn: (...args: any[]) => { + calls.push(args); + return spawn("node", [FAKE, script]) as any; + }, + }); + try { + await lister(); + expect(calls[0][2].env.GEMINI_API_KEY).toBe("selected-secret"); + expect(calls[0][2].env).not.toHaveProperty("THT_MODEL_API_KEY_FILE"); + expect(JSON.stringify(calls[0].slice(0, 2))).not.toContain("selected-secret"); + } finally { rmSync(path.dirname(script), { recursive: true, force: true }); } }); diff --git a/backend/test/pi-process-manager.test.ts b/backend/test/pi-process-manager.test.ts index 2a1272da..6ec5b6c5 100644 --- a/backend/test/pi-process-manager.test.ts +++ b/backend/test/pi-process-manager.test.ts @@ -212,6 +212,35 @@ test.each([ } }); +test.each([["OpenAI", "openai"], ["gemini", "google"]])( + "set_model uses canonical packaged provider ID for %s", async (provider, canonical) => { + const secret = path.resolve(__dirname, `.canonical-key-${process.pid}-${provider}`); + writeFileSync(secret, "provider-secret", { mode: 0o600 }); + const child = recordingChild(); + child.stderr.resume = () => {}; + child.stdin.write = (data: unknown) => { + const request = JSON.parse(String(data)); + child._writes.push(String(data)); + if (request.id) { + queueMicrotask(() => child.stdout.emit("data", `${JSON.stringify({ + type: "response", id: request.id, success: true, + })}\n`)); + } + return true; + }; + const mgr = new PiProcessManager(loadConfig({ THT_MODEL_API_KEY_FILE: secret }), { + spawnFn: () => child as any, + }); + try { + await mgr.spawnFor("canonical-provider", { provider, model: "model-id" }); + expect(child._writes.join("")).toContain(`\"provider\":\"${canonical}\"`); + } finally { + mgr.teardown("canonical-provider"); + await import("node:fs/promises").then((fs) => fs.unlink(secret)); + } + }, +); + test("local providers spawn without a model key and scrub ambient generic credentials", async () => { vi.stubEnv("PI_PROVIDER_API_KEY", "ambient-secret"); vi.stubEnv("THT_MODEL_API_KEY_FILE", "/ambient/secret-path"); diff --git a/backend/test/provider-credentials.test.ts b/backend/test/provider-credentials.test.ts new file mode 100644 index 00000000..cd484a49 --- /dev/null +++ b/backend/test/provider-credentials.test.ts @@ -0,0 +1,76 @@ +import { expect, test } from "vitest"; +import { readFileSync } from "node:fs"; +import path from "node:path"; +import { + PI_0803_CREDENTIAL_ENV_NAMES, + buildPiChildEnv, + canonicalPiProvider, +} from "../src/pi/provider-credentials.js"; + +test("canonical provider aliases resolve to packaged Pi 0.80.3 IDs", () => { + expect(canonicalPiProvider(" OpenAI ")).toBe("openai"); + expect(canonicalPiProvider("gemini")).toBe("google"); + expect(canonicalPiProvider("Google")).toBe("google"); + expect(() => buildPiChildEnv({ + ambient: {}, provider: "cohere", credentialFile: "/unused", + })).toThrow("model provider credential is unavailable"); +}); + +test("credential scrub list matches the audited Pi AI 0.80.3 provider definitions", () => { + const lock = JSON.parse(readFileSync(path.resolve("../docker/pi-runtime/package-lock.json"), "utf8")); + expect(lock.packages["node_modules/@earendil-works/pi-coding-agent/node_modules/@earendil-works/pi-ai"].version) + .toBe("0.80.3"); + expect(PI_0803_CREDENTIAL_ENV_NAMES).toEqual([ + "AI_GATEWAY_API_KEY", "ANTHROPIC_API_KEY", "ANTHROPIC_OAUTH_TOKEN", "ANT_LING_API_KEY", + "AWS_ACCESS_KEY_ID", "AWS_BEARER_TOKEN_BEDROCK", "AWS_CONFIG_FILE", + "AWS_CONTAINER_AUTHORIZATION_TOKEN", "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE", + "AWS_CONTAINER_CREDENTIALS_FULL_URI", "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", "AWS_PROFILE", + "AWS_ROLE_ARN", "AWS_ROLE_SESSION_NAME", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", + "AWS_SHARED_CREDENTIALS_FILE", "AWS_WEB_IDENTITY_TOKEN_FILE", "AZURE_OPENAI_API_KEY", + "CEREBRAS_API_KEY", "CLOUDFLARE_ACCOUNT_ID", "CLOUDFLARE_API_KEY", + "CLOUDFLARE_GATEWAY_ID", "COPILOT_GITHUB_TOKEN", "DEEPSEEK_API_KEY", "FIREWORKS_API_KEY", + "GCLOUD_PROJECT", "GEMINI_API_KEY", "GOOGLE_APPLICATION_CREDENTIALS", "GOOGLE_CLOUD_API_KEY", + "GOOGLE_CLOUD_LOCATION", "GOOGLE_CLOUD_PROJECT", "GROQ_API_KEY", "HF_TOKEN", + "KIMI_API_KEY", "MINIMAX_API_KEY", "MINIMAX_CN_API_KEY", "MISTRAL_API_KEY", + "MOONSHOT_API_KEY", "NVIDIA_API_KEY", "OPENCODE_API_KEY", "OPENAI_API_KEY", + "OPENROUTER_API_KEY", "TOGETHER_API_KEY", "XAI_API_KEY", "XIAOMI_API_KEY", + "XIAOMI_TOKEN_PLAN_AMS_API_KEY", "XIAOMI_TOKEN_PLAN_CN_API_KEY", + "XIAOMI_TOKEN_PLAN_SGP_API_KEY", "ZAI_API_KEY", "ZAI_CODING_CN_API_KEY", + ]); + expect(PI_0803_CREDENTIAL_ENV_NAMES).not.toContain("COHERE_API_KEY"); +}); + +test("credential file replacement between lstat and open is rejected before read", () => { + let reads = 0; + const stat = (ino: number) => ({ + dev: 7, ino, uid: process.getuid?.() ?? 0, mode: 0o100600, nlink: 1, size: 6, + isFile: () => true, isDirectory: () => false, isSymbolicLink: () => false, + }); + expect(() => buildPiChildEnv({ + ambient: {}, provider: "openai", credentialFile: "/safe/key", + fsOps: { + lstat: () => stat(1) as any, + open: () => 9, + fstat: () => stat(2) as any, + read: () => { reads += 1; return "secret"; }, + close: () => undefined, + }, + })).toThrow("model provider credential is unavailable"); + expect(reads).toBe(0); +}); + +test("Docker secrets require a secure root-owned /run/secrets parent and 0444 file", () => { + const stat = (kind: "parent" | "file") => ({ + dev: 7, ino: 1, uid: kind === "parent" ? 1000 : 0, + mode: kind === "parent" ? 0o40755 : 0o100444, nlink: 1, size: 6, + isFile: () => kind === "file", isDirectory: () => kind === "parent", + isSymbolicLink: () => false, + }); + expect(() => buildPiChildEnv({ + ambient: {}, provider: "openai", credentialFile: "/run/secrets/model-key", + fsOps: { + lstat: (file) => stat(file === "/run/secrets" ? "parent" : "file") as any, + open: () => 9, fstat: () => stat("file") as any, read: () => "secret", close: () => undefined, + }, + })).toThrow("model provider credential is unavailable"); +});