security: register SLACK + GMAIL WATCH in the daemon structural-header set - #69
Merged
Merged
Conversation
…r set sanitizeForPtyInjection quotes forged daemon containment headers (`=== AGENT MESSAGE`, `=== TELEGRAM`, …) that appear at line-start in unfenced context- preview fields (reply-context, last-sent, recent-history), so untrusted text cannot impersonate the daemon in the recipient PTY. The quote pattern is built FROM DAEMON_STRUCTURAL_HEADERS — but the set had not been extended when the SLACK transport and the GMAIL WATCH notification began injecting their own `=== SLACK …` / `=== GMAIL WATCH: …` headers, so a forged copy of those two markers passed through un-quoted while the older headers were caught. Fix: register SLACK and GMAIL WATCH. `SLACK` also covers `=== SLACK CONNECTION DEAD` via the \b rule; `TELEGRAM` already covers its media variants. Tests: - forge casualties for SLACK, SLACK CONNECTION DEAD, GMAIL WATCH (each now quoted); prose containing the bare words (no `=== ` opener) stays untouched; an unregistered `=== MADE UP` header is NOT quoted (closed set, not any word). - anti-drift census: reads src/daemon/**/*.ts, extracts every emitted `=== HEADER` marker, and fails naming any marker not registered in the set — so the set can never silently lag the emitted headers again (this test is RED on the pre-fix set, naming GMAIL WATCH / SLACK / SLACK CONNECTION DEAD). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WHgtUKEyT27odfUsRhjgoT
noogalabs
force-pushed
the
fix/pty-neutralizer-header-drift
branch
from
August 28, 2026 20:54
5b6cd57 to
ada9c8f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
sanitizeForPtyInjectionneutralizes forged daemon containment headers (=== AGENT MESSAGE,=== TELEGRAM, …) at line-start in unfenced context-preview fields (reply-context, last-sent, recent-history), so untrusted text can't impersonate the daemon in the recipient PTY. The quote pattern is built fromDAEMON_STRUCTURAL_HEADERS.The set was never extended when the SLACK transport and the GMAIL WATCH notification began injecting
=== SLACK …/=== GMAIL WATCH: …headers — a forged copy of those markers passed through un-quoted while the older headers were caught.Fix
Register
SLACKandGMAIL WATCH.SLACKalso covers=== SLACK CONNECTION DEADvia the\brule;TELEGRAMalready covers its media variants. One-line set change — the pattern is already set-driven.Tests (proof discipline)
===opener) stays byte-identical; an unregistered=== MADE UPheader is not quoted (closed set).src/daemon/**/*.ts, extracts every emitted=== HEADERmarker, fails naming any not registered. RED on the pre-fix set (GMAIL WATCH/SLACK/SLACK CONNECTION DEAD), green after — the set can't silently lag emitted headers again.validate + fast-checker + slack-listener suites: 228 passing.
tscclean. leak-guard clean.