Protected paths
Controlled tools block reads and writes to files such as .env, auth.json, local trust files, profile locks, and sensitive settings.
Policy enforcement, not an OS sandbox
Controlled tool surfaces fail closed when profiles, integrity locks, permissions, or verification evidence are invalid.
Shell hardening
The guard uses shell parsing and controlled-command rules to catch globs, braces, redirects, bare-word symlinks, and xargs composition before runtime expansion.
Secret redaction
Text tool output passes through a redactor for provider tokens, secret keyword patterns, and common sensitive values. Current benchmarks are synthetic and internal; the model continues to evolve.
Capability lock
Capability packs have digests and tamper detection. An invalid lock fails closed and never expands permissions automatically.
Human-action gate
Destructive or external-provider actions require explicit operator confirmation even in full-access mode. The gate covers direct tools, decoded MCP proxy calls, GitHub CLI writes, and non-GET HTTP shell forms.
Verification evidence
A completed handoff requires observed bash results, not an unsupported statement that tests passed.
Important boundary
The guard depends on controlled tool paths and the shell syntax it can observe. It cannot stop another process running with the same OS permissions outside the guard, and it does not replace operating-system sandboxing.
- Symlinks, encodings, nested payloads, shell expansion, or newly introduced tools can affect coverage.
- Redaction is a leak-reduction backstop, not permission to place real secrets in prompts or outputs.
- The context index is a local cache containing source bodies. Owner-only mode limits cross-account access, but processes under the same OS account must still be trusted.
- Untrusted workloads require a container or VM with filesystem, process, network, and credential boundaries.
Redaction still requires independent audit
Current benchmarks are synthetic internal regression and release gates, not an external security audit. The project publishes its threat model and attack-vector map. Broader parser fuzzing, third-party review, and LTS guarantees remain higher assurance levels that are not currently claimed. Published npm packages do include signed provenance through GitHub Actions and Sigstore.
Dependency gates separate two trees
Releases audit the small terminal-helper dependency tree separately from the exact Pi host and pinned add-ons. The helper tree is clean. The current Pi host tree has one high and eleven moderate advisories; the project reports those numbers instead of claiming zero runtime vulnerabilities.
The high advisory is GHSA-mh99-v99m-4gvg in brace-expansion, a denial-of-service issue rather than privilege escalation or data exposure. The published Pi host shrinkwrap pins the affected version and overrides cannot replace it. The release gate exempts only this named advisory with a source-controlled rationale and expires the exemption on 2026-08-25 or when upstream publishes a fix. Every other high or critical advisory still blocks release.
The eleven moderate findings belong to two upstream advisories: encoded-backslash path traversal on Windows in a Hono adapter and a protobuf parser denial of service. Native Windows and WSL2 are not team rollout targets, but both findings remain tracked.