mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(backend): harden provider credential isolation

Browse Source
This commit is contained in:
marcopan
2026-07-12 08:05:51 +02:00
parent 32e73d66b5
commit f064daef09
6 changed files with 275 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/pi/pi-process-manager.ts
+7 -65
View File
@@ -1,9 +1,9 @@
import { spawn as nodeSpawn, type ChildProcessWithoutNullStreams } from "node:child_process";
import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync } from "node:fs";
import type { AppConfig } from "../config.js";
import { RpcClient } from "../rpc/rpc-client.js";
import { SessionBridge } from "../bridge/session-bridge.js";
import type { ThtRunner } from "../tht/tht-runner.js";
import { buildPiChildEnv, canonicalPiProvider } from "./provider-credentials.js";
export interface SessionRuntime {
rpc: RpcClient;
@@ -18,51 +18,6 @@ type SpawnFn = (
options: { cwd: string; env: NodeJS.ProcessEnv },
) => ChildProcessWithoutNullStreams;
const PROVIDER_KEY_ENV: Readonly<Record<string, string>> = {
anthropic: "ANTHROPIC_API_KEY",
openai: "OPENAI_API_KEY",
gemini: "GEMINI_API_KEY",
google: "GEMINI_API_KEY",
deepseek: "DEEPSEEK_API_KEY",
zai: "ZAI_API_KEY",
groq: "GROQ_API_KEY",
mistral: "MISTRAL_API_KEY",
openrouter: "OPENROUTER_API_KEY",
xai: "XAI_API_KEY",
cerebras: "CEREBRAS_API_KEY",
cohere: "COHERE_API_KEY",
};
const LOCAL_PROVIDERS = new Set(["ollama", "lmstudio", "local", "aritmolab"]);
const PROVIDER_ENV_NAMES = new Set(Object.values(PROVIDER_KEY_ENV));
function normalizedProvider(provider: string | undefined): string | undefined {
const value = provider?.trim().toLowerCase();
return value || undefined;
}
function readModelCredential(file: string): string {
let fd: number | undefined;
try {
const before = lstatSync(file);
if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1) throw new Error();
fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
const info = fstatSync(fd);
const mode = info.mode & 0o777;
const ownedStrict = info.uid === process.getuid?.() && (mode === 0o400 || mode === 0o600);
const dockerSecret = file.startsWith("/run/secrets/") && mode === 0o444;
if (!info.isFile() || info.nlink !== 1 || (!ownedStrict && !dockerSecret) || info.size > 16_384) {
throw new Error();
}
const value = readFileSync(fd, "utf8");
if (!value || /\s/.test(value)) throw new Error();
return value;
} catch {
throw new Error("model provider credential is unavailable");
} finally {
if (fd !== undefined) closeSync(fd);
}
}
export class PiProcessManager {
private runtimes = new Map<string, SessionRuntime>();
private spawnFn: (
@@ -82,26 +37,13 @@ export class PiProcessManager {
private spawnPi(
spawnFn: SpawnFn, sessionId: string, author: string, provider: string | undefined,
): ChildProcessWithoutNullStreams {
const env: NodeJS.ProcessEnv = {
...process.env,
THT_SESSION: sessionId,
THT_AUTHOR: author,
};
const env = buildPiChildEnv({
provider,
credentialFile: this.cfg.modelApiKeyFile,
additions: { THT_SESSION: sessionId, THT_AUTHOR: author },
});
delete env.THT_DATA_ROOT;
delete env.PI_PROVIDER_API_KEY;
delete env.THT_MODEL_API_KEY_FILE;
for (const name of PROVIDER_ENV_NAMES) delete env[name];
if (this.cfg.dataRoot !== undefined) env.THT_DATA_ROOT = this.cfg.dataRoot;
const normalized = normalizedProvider(provider);
if (normalized && !LOCAL_PROVIDERS.has(normalized)) {
const envName = PROVIDER_KEY_ENV[normalized];
if (!envName || !this.cfg.modelApiKeyFile) {
throw new Error("model provider credential is unavailable");
}
env[envName] = readModelCredential(this.cfg.modelApiKeyFile);
} else if (this.cfg.modelApiKeyFile && !normalized) {
throw new Error("model provider credential is unavailable");
}
// pi 0.73 removed `--approve`: rpc mode is headless and its argv is intentionally minimal.
const child = spawnFn(this.cfg.piBin, ["--mode", "rpc"], {
cwd: this.cfg.harnessDir,
@@ -132,7 +74,7 @@ export class PiProcessManager {
throw new Error("max Pi processes reached");
}
const author = o.author ?? "dev@local";
const provider = o.provider ?? this.cfg.defaults.provider;
const provider = canonicalPiProvider(o.provider ?? this.cfg.defaults.provider);
const child = this.spawnFn(sessionId, author, provider);
const rpc = new RpcClient(child);
const bridge = new SessionBridge(rpc);