Repository navigation
fix(agents-md): security hardening dropped from #5087 merge - #5096
Merged
senamakel merged 3 commits intoJul 21, 2026
Merged
Conversation
The project-layer AGENTS.md lives in the user/project-controlled action dir, so a checkout could symlink it to a secret outside the root (e.g. ~/.ssh/id_rsa) or a blocking device and have its bytes read into the system prompt and sent to the inference provider. Refuse symlinks, require a regular file, and require the canonical path to stay under its root (validate_path_within_root) before reading. Adds a unix symlink-rejection test.
The full-body prompt debug log was taken whenever PROFILE.md + MEMORY.md were both omitted (common for narrow specialists), but AGENTS.md instruction layers can land in the prompt independently and would then be logged verbatim. Add AGENTS.md presence to the redaction trigger so its user/project content is hashed, not printed.
Contributor
|
Caution Review failedAn error occurred during the review process. Please try again later. 📝 WalkthroughWalkthroughThe changes harden ChangesAGENTS.md security and prompt redaction
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested labels: Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
coderabbitai
Bot
added
agent
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/openhuman/agent/prompts/agents_md.rs`:
- Around line 80-128: Eliminate the check-to-open race in the AGENTS.md loading
flow by changing the path-based validation around the loader function to open
the file relative to the trusted root directory handle with platform-appropriate
no-follow semantics, then validate the opened handle’s type before reading it.
Preserve rejection of symlinked or non-regular files and add a regression test
through an injectable filesystem/open seam that replaces the checked file before
opening, confirming the symlink is rejected.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 6f18ee40-61c3-4138-9227-41cda38ea05c
📒 Files selected for processing (2)
src/openhuman/agent/harness/session/turn/core.rssrc/openhuman/agent/prompts/agents_md.rs
The prior symlink_metadata check + later File::open by path left a TOCTOU window: a writable action dir could swap the checked regular AGENTS.md for a symlink before open, and File::open would follow it to a target outside the root. Open with O_NOFOLLOW (Unix) so the kernel atomically refuses a final-component symlink at open time (no window), plus O_NONBLOCK so a substituted FIFO/device can't block; then fstat the opened handle and require a regular file. validate_path_within_root stays as parent-component defence in depth. Adds a FIFO-rejection regression test; the symlink test now exercises the race-free path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
fix(agents-md): reject symlinked/escaping AGENTS.md before reading— addresses the codex P1 review thread on feat(prompts): load AGENTS.md project instructions into the system prompt #5087.fix(agents-md): redact system-prompt debug log when AGENTS.md present— addresses the codex P2 review thread on feat(prompts): load AGENTS.md project instructions into the system prompt #5087.Problem
AGENTS.mdcould be a symlink pointing at a secret outside the root; the loader would read it and the content would flow into the system prompt (and on to the inference provider).mainbecause the merge happened before the head ref propagated.Solution
AGENTS.mdand validates the canonical path stays under its root (validate_path_within_root) before reading; Unix regression test added.Submission Checklist
## Related— no matrix rows affectedCloses #NNN— follow-up to PR feat(prompts): load AGENTS.md project instructions into the system prompt #5087 review threads, no standalone issueImpact
Related
AI Authored PR Metadata (required for Codex/Linear PRs)
Linear Issue
Commit & Branch
Validation Run
pnpm --filter openhuman-app format:check— no frontend changespnpm typecheck— no TypeScript changescargo test --lib agents_md(23 passed)GGML_NATIVE=OFF cargo checkclean,cargo fmt --checkcleanapp/src-tauriuntouchedValidation Blocked
command:N/Aerror:N/Aimpact:N/ABehavior Changes
Parity Contract
Duplicate / Superseded PR Handling
Summary by CodeRabbit
Security Enhancements
AGENTS.md.AGENTS.mdfiles that are symlinks or located outside the permitted directory.Bug Fixes