Fix/process execution security

[icy000z]

Security Audit & Hardening Report

Overview

During our security audit of the PrimeIntellect prime-agent repository, we identified several vulnerabilities centered around process execution, shell injection risks, and inadequate process lifecycle management. We performed a comprehensive system hardening to eliminate these flows.

---

1. Process Lifecycle & Teardown Weaknesses

The Flaw

The IPython kernel and its KernelManager handled process disposal without strong cancellation propagation. When subagents or external tools were executed through the host bridge (e.g., rlm.run), there was no reliable way to forcibly interrupt and cancel these long-running subprocesses if the kernel was abruptly shut down. This could lead to zombie processes, resource leaks, or unpredictable behaviors persisting in the background.

The Fix

We introduced robust AbortSignal plumbing throughout the lifecycle chain:

• KernelManager: Added a _disposeController using AbortController. When dispose() or disposeSync() is invoked, this controller is aborted.
• HostRequestHandler Interface: Updated the bridge's type signature to accept an optional AbortSignal.
• agent-session.ts & rlm-runtime.ts: We propagated this signal through createRlmRunHostHandler down to runRlmChild. Now, if a kernel disposal timeout is triggered, the AbortSignal directly calls run.abort(), cascading the cancellation to safely terminate the running agent process tree.

---

2. Shell Injection Risks in Clipboard Utilities

The Flaw

The packages/coding-agent/src/utils/clipboard.ts file extensively relied on child_process.execSync to interact with OS clipboard utilities (xclip, pbcopy, wl-copy, clip). execSync defaults to executing the command inside a spawned sub-shell (e.g., /bin/sh -c). When arbitrary or unexpected input is piped, relying on a sub-shell creates an attack surface for shell injection or argument parsing errors.

The Fix

We systematically removed all instances of execSync.

• All native clipboard interactions now use the safer spawnSync and spawn methods.
• Commands are explicitly separated from their arguments (spawnSync("xclip", ["-selection", "clipboard"])), completely bypassing shell evaluation.

---

3. Insecure execFileSync / execSync Usage in Test Suites

The Flaw

Our audit of the packages/coding-agent/test/ directory revealed a reliance on execFileSync across multiple integration tests (agent-session-autonomous.test.ts, session-manager-git-state.test.ts, git-context.test.ts, and bash-close-hang-windows.test.ts). While less risky than execSync (as it avoids a shell), using execFileSync failed to follow the repository's centralized executable shell configuration and execution patterns.

The Fix

• Created secure wrapper functions in the test environment utilizing standard spawnSync invocations.
• Updated dozens of execFileSync("git", ...) and execFileSync("mkdir", ...) operations to use these sanitized wrappers, bringing the test environment into alignment with production security standards and ensuring all arguments are strictly delimited.

Note

Fix process execution security by replacing execSync/execFileSync with spawnSync across clipboard and test utilities

• Replaces execSync/execFileSync calls with spawnSync in clipboard.ts and several test helpers, adding explicit status/error checks to catch silent failures and avoid shell injection.
• Clipboard handling gains platform-specific fallbacks (xclip→xsel on X11, wl-copy on Wayland) and avoids hangs by piping stdin instead of using shell expansion.
• Adds AbortSignal support to AgentSession.runRlmChild and RlmRunHandler, allowing RLM child runs to be cancelled mid-execution.
• Replaces hardcoded key sequences (ctrl+c, shift+ctrl+d) with configurable keybindings (app.clear, tui.debug) in interactive TUI components.

^{Macroscope summarized 8b8ce55.}