Problem
On current origin/main, the Pi backend starts from ...process.env, and sanitizeHostEnv() explicitly forwards TANGLE_API_KEY, OPENAI_API_KEY, ANTHROPIC_API_KEY, GH_TOKEN, and other provider credentials into the agent process. Pi exposes Bash, so an untrusted task can read or exfiltrate the same key the bridge uses for model inference. Runtime-side AgentProfile validation cannot enforce a boundary after the provider credential enters the tool subprocess environment.
Observed source path:
src/backends/pi.ts: child env starts from process.env.src/executors/host.ts: PROXIED_ENV_KEYS and prefixes admit provider/API credentials.- The same sanitizer is used by host and scoped-host spawners.
Required design
Keep inference authentication in a trusted local transport owned by cli-bridge. The agent subprocess should receive only a scoped local endpoint/token that cannot be used outside that one run, or another mechanism with the same property. Removing one key name is insufficient because provider-specific aliases and future keys would recreate the leak.
Completion criteria
- A real Pi child with Bash cannot observe the daemon provider credential through
env, /proc/self/environ, or descendant subprocesses.
- The same run still completes a model turn successfully through the trusted local authenticated transport.
- The protection covers every host/scoped-host backend, provider aliases, and descendants; no denylist-only solution.
- A regression test plants sentinel values in all credential-shaped daemon variables and proves the child sees none.
- A live smoke proves inference succeeds while the sentinel credential remains absent from the child.
- The execution/materialization acknowledgement states the endpoint/API mode actually used, without exposing secrets.
- Failure to establish the isolated transport refuses the run before the agent process starts; no ambient-key fallback.
This blocks proving agent-runtime#728 as an actual model-execution boundary for Pi/GLM/DeepSeek.
Problem
On current origin/main, the Pi backend starts from
...process.env, andsanitizeHostEnv()explicitly forwardsTANGLE_API_KEY,OPENAI_API_KEY,ANTHROPIC_API_KEY,GH_TOKEN, and other provider credentials into the agent process. Pi exposes Bash, so an untrusted task can read or exfiltrate the same key the bridge uses for model inference. Runtime-side AgentProfile validation cannot enforce a boundary after the provider credential enters the tool subprocess environment.Observed source path:
src/backends/pi.ts: child env starts fromprocess.env.src/executors/host.ts:PROXIED_ENV_KEYSand prefixes admit provider/API credentials.Required design
Keep inference authentication in a trusted local transport owned by cli-bridge. The agent subprocess should receive only a scoped local endpoint/token that cannot be used outside that one run, or another mechanism with the same property. Removing one key name is insufficient because provider-specific aliases and future keys would recreate the leak.
Completion criteria
env,/proc/self/environ, or descendant subprocesses.This blocks proving agent-runtime#728 as an actual model-execution boundary for Pi/GLM/DeepSeek.