hardening: default sessions, headless-safe permissions, symlink boundary guard, PTY smoke tests

Author: TinyCode

.github/workflows/ci.yml

@@ -23,8 +23,10 @@ jobs:
 
       # Some npm versions gate install scripts; esbuild needs its postinstall
       # to wire the platform binary used by tsx and vitest.
+      # Some npm versions gate install scripts; esbuild and node-pty both need
+      # their postinstall steps (platform binary wiring / native compile).
       - name: Install dependencies
-        run: npm install && npm rebuild esbuild
+        run: npm install && npm rebuild esbuild && npm rebuild node-pty
 
       - name: Typecheck
         run: npm run typecheck

ARCHITECTURE.md

@@ -84,7 +84,12 @@ uniform surface.
 | `find` | glob (`**` crosses dirs), sorted relative paths |
 | `ls` | type markers + sizes, dirs first |
 
-All path-taking tools enforce the project boundary (`requirePathInsideProject`) before any I/O.
+All path-taking tools enforce the project boundary through `resolveWorkspacePath`
+(src/tools/paths.ts) before any I/O: the lexical path is resolved, then **canonicalized with
+`fs.realpathSync` on both sides** (existing target — or nearest existing ancestor for new
+files — versus canonical project root). Symlink escapes (`link -> /etc/hosts`, writing through
+a symlinked directory, broken symlinks) are rejected with a model-friendly
+`Path resolves outside project directory: …` error while ordinary relative paths keep working.
 
 ## 4. Tool execution flow
 
@@ -116,10 +121,22 @@ Three layers (src/permissions):
    Unknown verbs are treated as `write`.
 2. **rules.ts** — per-tool defaults: reads inside the project → ALLOW; writes anywhere and
    reads outside → ASK; bash routes through the classifier; unknown tools → ASK.
-3. **manager.ts** — the runtime gate. ASK verdicts consult session-scoped "always allow"
-   patterns (e.g. `bash: npm install …` family), then `mode` (`auto` approves everything),
-   then the host's prompt callback. No callback ⇒ safe deny. The TUI dialog offers
-   *Allow once / Always allow this pattern / Deny*.
+3. **manager.ts** — the runtime gate. Order of evaluation:
+
+```
+hard DENY rule (catastrophic shell: rm -rf /, mkfs, raw disk write, …)
+  → refused unconditionally; auto mode and dialogs can never override it
+ALLOW verdict → run
+ASK verdict   → remembered "always allow" pattern?
+                → mode === "auto"?            approved
+                → prompt callback available?  dialog decides
+                → otherwise                   safe DENY
+```
+
+Semantics differ by surface: the TUI shows the dialog (*Allow once / Always allow this
+pattern / Deny*); headless `-p` has no dialog, so its default is deny-on-ASK and automation
+requires the explicit `--permission-mode auto` opt-in. SIGINT and the Ctrl+C binding share
+the same interrupt logic so ISIG terminals behave identically.
 
 ## 6. Context engineering
 
@@ -138,6 +155,12 @@ Three layers (src/permissions):
 
 ## 7. Session
 
+Every interactive launch owns a session from message one: plain `tinycode` maps to
+`{mode:"new"}`, `--continue` attaches the newest session whose stored cwd matches (never
+another project's; falls back to a new session with a note when none matches), `--session <id>`
+attaches exactly that id. `/new` rotates the id and clears the live transcript — Pi's
+`Agent.reset()` preserves systemPrompt/model/tools/hooks, so tool calling continues seamlessly.
+
 One JSONL file per session in `<dataHome>/sessions/<id>.jsonl` (id = UUIDv7):
 
 ```jsonl
@@ -147,11 +170,11 @@ One JSONL file per session in `<dataHome>/sessions/<id>.jsonl` (id = UUIDv7):
 {"type":"message","message":{ …toolResult… }}
 ```
 
-Writes are synchronous appends; a torn final line (crash mid-append) is skipped on load.
-The header is rewritten once when the first real prompt lands so `/sessions` shows titles.
-`--continue` attaches the newest session for the cwd; `--session <id>` any other; attach
-restores the transcript verbatim into the live `Agent`. Tests redirect storage via
-`TINYCODE_HOME`.
+Writes are synchronous appends — files are never truncated after creation (the first real
+prompt adds the title by rewriting the not-yet-valuable header line only). `attach()` is
+strictly read-only: it restores the transcript into the live `Agent` and keeps appending to
+the same file, so a crash during resume cannot destroy history. A torn final line (crash
+mid-append) is skipped on load. Tests redirect storage via `TINYCODE_HOME`.
 
 ## 8. Skills
 

README.md

@@ -92,9 +92,14 @@ cd tinycode && npm install && npm run build
 npm run dev                                  # full-screen terminal agent (needs a provider key)
 ANTHROPIC_API_KEY=sk-… npm run dev           # e.g. Anthropic — keys come from env only
 TINYCODE_MODEL=mock npm run dev              # offline: scripted mock model, zero setup
-tinycode -p "describe this project"          # one-shot non-interactive mode
+tinycode -p "describe this project"          # one-shot mode (read-only by default)
+tinycode -p "refactor x" --permission-mode auto   # explicit opt-in to unattended writes
 ```
 
+> **Non-interactive safety:** `-p` runs headless — there is no approval dialog. ASK-level
+> operations are therefore **denied** unless you explicitly pass `--permission-mode auto`
+> (or set `TINYCODE_PERMISSION_MODE=auto`). Read-only commands run normally.
+
 Supported providers include Anthropic, OpenAI, Groq, DeepSeek, Mistral, OpenRouter,
 Google and [more](https://github.com/earendil-works/pi) — everything Pi's catalog covers.
 
@@ -108,8 +113,9 @@ Google and [more](https://github.com/earendil-works/pi) — everything Pi's cata
 - **Permissions** — reads inside the project flow freely; writes, installs and dangerous shell
   commands open an approval dialog (*Allow once / Always allow this pattern / Deny*).
   A heuristic classifier routes `npm test` vs `rm -rf` vs `curl … | sh`.
-- **Sessions** — append-only JSONL under `~/.tinycode/sessions`; resume with `--continue`,
-  `--session <id>` or `/resume`. Crash-tolerant by design.
+- **Sessions** — every interactive launch owns a live session (append-only JSONL under
+  `~/.tinycode/sessions`). Resume with `--continue` (newest session *of the current
+  directory only*), `--session <id>` or `/resume`; `/new` starts fresh at any time.
 - **Context engineering** — oversized tool results truncate head+tail with full output saved
   as artifacts; past a token budget, old turns compact into a `<conversation-summary>`
   while recent messages stay verbatim.
@@ -143,6 +149,16 @@ Google and [more](https://github.com/earendil-works/pi) — everything Pi's cata
 Environment: provider API keys, `TINYCODE_MODEL=provider/model` (or `mock`),
 `TINYCODE_PERMISSION_MODE=ask|auto`, `TINYCODE_HOME` (data-dir redirect used by tests).
 
+## Security notes
+
+TinyCode's permission system is an **approval layer + workspace path guard, not an OS sandbox**:
+
+- File tools enforce the project boundary with symlink-aware canonicalization (`realpath`
+  both sides), so `link -> /etc/hosts` cannot be used to escape the workspace.
+- Shell commands pass a risk classifier plus the same approval flow; they are not confined —
+  an approved `bash` call can do anything your user can.
+- Running genuinely untrusted code/tasks requires an external sandbox (container, VM).
+
 ## Documentation
 
 | Doc | Contents |

package-lock.json

@@ -28,13 +28,15 @@
   "devDependencies": {
     "@types/node": "^24.0.0",
     "eslint": "^9.30.0",
+    "node-pty": "^1.1.0",
+    "tsx": "^4.20.0",
     "typescript": "^5.8.0",
     "typescript-eslint": "^8.35.0",
-    "tsx": "^4.20.0",
     "vitest": "^3.2.0"
   },
   "allowScripts": {
-    "esbuild@0.28.2": true
+    "esbuild@0.28.2": true,
+    "node-pty@1.1.0": true
   },
   "keywords": [
     "ai",

package.json

@@ -2,8 +2,7 @@ import fs from "node:fs";
 import { buildHarnessFromCli, printHelp, printVersion, reportError } from "./commands.js";
 import { CliArgsError, parseArgs } from "./args.js";
 import { TuiApp } from "../tui/app.js";
-import { sessionsDir } from "../config/loader.js";
-import { SessionManager } from "../session/manager.js";
+import { resolveInteractiveSession, type SessionOption } from "./sessions.js";
 import type { AgentMessage } from "@earendil-works/pi-agent-core";
 
 async function main(): Promise<number> {
@@ -42,13 +41,9 @@ async function main(): Promise<number> {
     return runPrintMode(cwd, args.prompt, args);
   }
 
-  // Interactive TUI.
+  // Interactive TUI — always owns a session (new or attached).
   try {
-    const session = args.continueLast
-      ? await resolveLatestSession(cwd)
-      : args.sessionId
-        ? ({ mode: "attach", id: args.sessionId } as const)
-        : undefined;
+    const session: SessionOption = resolveInteractiveSession(args, cwd);
     const harness = await buildHarnessFromCli({
       cwd,
       modelFlag: args.model,
@@ -65,7 +60,15 @@ async function main(): Promise<number> {
       subAgents: harness.subAgents,
       projectRoot: cwd,
     });
-    await app.run();
+    // Real terminals with ISIG deliver Ctrl+C as SIGINT; route it through the
+    // same interrupt logic as the in-app keybinding.
+    const onSigint = () => app.handleInterrupt();
+    process.on("SIGINT", onSigint);
+    try {
+      await app.run();
+    } finally {
+      process.off("SIGINT", onSigint);
+    }
     await harness.shutdown();
     return 0;
   } catch (error) {
@@ -80,15 +83,17 @@ async function runPrintMode(
   args: ReturnType<typeof parseArgs>,
 ): Promise<number> {
   try {
-    const session = args.continueLast
-      ? await resolveLatestSession(cwd)
+    // Headless runs persist only when explicitly resuming; ASK verdicts deny
+    // because there is no dialog — auto-approval requires an explicit opt-in.
+    const session: SessionOption | undefined = args.continueLast
+      ? resolveInteractiveSession(args, cwd)
       : args.sessionId
-        ? ({ mode: "attach", id: args.sessionId } as const)
+        ? { mode: "attach", id: args.sessionId }
         : undefined;
     const harness = await buildHarnessFromCli({
       cwd,
       modelFlag: args.model,
-      permissionMode: args.permissionMode ?? "auto",
+      permissionMode: args.permissionMode ?? "ask",
       mock: args.mock,
       session,
     });
@@ -124,19 +129,6 @@ function extractFinalText(messages: readonly AgentMessage[]): string {
   return "";
 }
 
-/** Resolve the most recent session for --continue. */
-async function resolveLatestSession(
-  cwd: string,
-): Promise<{ mode: "attach"; id: string } | undefined> {
-  const manager = new SessionManager(sessionsDir());
-  const latest = manager.list().find((session) => session.cwd === cwd);
-  if (!latest) {
-    process.stderr.write("tinycode: no previous session to continue.\n");
-    process.exit(2);
-  }
-  return { mode: "attach", id: latest.id };
-}
-
 /** --list-models: show models whose providers have credentials configured. */
 async function listModels(cwd: string): Promise<number> {
   try {

src/cli/index.ts

@@ -0,0 +1,44 @@
+import type { CliArgs } from "./args.js";
+import { SessionManager } from "../session/manager.js";
+import type { SessionSummary } from "../session/types.js";
+import { sessionsDir } from "../config/loader.js";
+
+/**
+ * Session option resolution for CLI entry points.
+ *
+ * Lifecycle:
+ *   tinycode                → new session (always)
+ *   tinycode --continue     → newest session whose stored cwd matches
+ *   tinycode --session <id> → that exact session
+ *
+ * `--continue` never resumes another project's session; when nothing matches
+ * it falls back to a fresh one with a note instead of failing the launch.
+ */
+export type SessionOption = { mode: "new" } | { mode: "attach"; id: string };
+
+export function pickLatestSessionForCwd(
+  manager: SessionManager,
+  cwd: string,
+): SessionSummary | undefined {
+  return manager.list().find((session) => session.cwd === cwd);
+}
+
+export function resolveInteractiveSession(
+  args: Pick<CliArgs, "continueLast" | "sessionId">,
+  cwd: string,
+  stderr: (line: string) => void = (line) => process.stderr.write(`${line}\n`),
+): SessionOption {
+  if (args.continueLast) {
+    const latest = pickLatestSessionForCwd(new SessionManager(sessionsDir()), cwd);
+    if (!latest) {
+      stderr("tinycode: no previous session to continue — starting a fresh one.");
+      return { mode: "new" };
+    }
+    return { mode: "attach", id: latest.id };
+  }
+  if (args.sessionId) {
+    return { mode: "attach", id: args.sessionId };
+  }
+  // Plain interactive launch owns a live session from the first message.
+  return { mode: "new" };
+}

src/cli/sessions.ts

@@ -41,6 +41,26 @@ export function resolveToolPath(
 
 const READ_ONLY_TOOLS = new Set(["read", "grep", "find", "ls"]);
 
+/**
+ * Hard DENY for catastrophic shell commands. These are refused outright —
+ * auto mode, remembered patterns, and user approval never override them.
+ * Deliberately tiny: only commands whose damage is unrecoverable.
+ */
+const HARD_DENY_BASH: Array<{ label: string; test: RegExp }> = [
+  { label: "recursive force-delete of filesystem root", test: /\brm\s+[^\n]*\s\/\*?\s*(?:&&|$|;)/ },
+  { label: "delete home directory", test: /\brm\s+[^\n]*\s(~|\$HOME)(?:\s|$)/ },
+  { label: "format filesystem", test: /\bmkfs(\.\w+)?\b/ },
+  { label: "raw disk write", test: /\bdd\b[^\n]*\bof=\/dev\/(disk|sd|nvme|mmcblk)/ },
+  { label: "world-writable root", test: /\bchmod\s+-R\s+777\s+\// },
+];
+
+export function findHardDeny(command: string): string | undefined {
+  for (const rule of HARD_DENY_BASH) {
+    if (rule.test.test(command)) return rule.label;
+  }
+  return undefined;
+}
+
 export function evaluateRules({
   toolName,
   input,
@@ -63,6 +83,10 @@ export function evaluateRules({
 
   if (toolName === "bash") {
     const command = String(input.command ?? "");
+    const denied = findHardDeny(command);
+    if (denied) {
+      return { action: "deny", reason: `catastrophic command refused: ${denied}` };
+    }
     const { insideProject } = resolveToolPath(
       projectRoot,
       typeof input.cwd === "string" ? input.cwd : undefined,

src/permissions/rules.ts

@@ -30,27 +30,22 @@ export class SessionManager {
     return this.currentId;
   }
 
-  /** Attach to an existing session (used by --continue / --session). */
-  attach(id: string, cwd: string, model: string): { messages: AgentMessage[] } {
+  /**
+   * Attach to an existing session (used by --continue / --session / /resume).
+   *
+   * The file is left untouched — attach is read-only. Rewriting the header
+   * plus full history here would risk truncating the session if the process
+   * died between truncate and re-append; the stored header stays canonical.
+   */
+  attach(id: string, _cwd: string, _model: string): { messages: AgentMessage[] } {
     const loaded = this.storage.load(id);
     if (!loaded) throw new Error(`Session not found: ${id}`);
     this.currentId = id;
     const firstUser = loaded.messages.find((message) => message.role === "user");
     if (firstUser && firstUser.role === "user" && typeof firstUser.content === "string") {
       this.lastUserText = firstUser.content.replace(/\s+/g, " ").slice(0, 80);
     }
-    // Rewrite the file: refreshed header (model may have changed) + full history.
-    this.storage.create({
-      id,
-      cwd,
-      createdAt: loaded.header.createdAt,
-      model,
-      title: loaded.header.title ?? this.lastUserText,
-    });
-    for (const message of loaded.messages) {
-      this.storage.appendMessage(id, message);
-    }
-    this.meta = { cwd, model, createdAt: loaded.header.createdAt, titleSet: true };
+    this.meta = { cwd: loaded.header.cwd, model: loaded.header.model, createdAt: loaded.header.createdAt, titleSet: true };
     return { messages: loaded.messages };
   }