[Bug] Desktop 0.2.1-rc.2: persistent terminal leaks PSReadLine prediction ghosts (shell history) into the model context

[CNyaotian-Lunar]

Desktop 0.2.1-rc.2：持久终端把 PSReadLine 的预测「幽灵补全」当成输入显示（可能暴露 shell 历史）

摘要

实验性「持久终端」在 Windows + PowerShell 下，terminal_send 返回给模型的 viewport 会混入 PSReadLine inline prediction 的幽灵补全文本（faint/italic 的预览补全），以及每条命令的逐字符重绘帧。

因此看到的「旧命令重复出现」不是跨 session 泄漏（见文末更正），而是：

1. PSReadLine 从 OS 级共享的 ConsoleHost_history.txt 里取历史做 inline prediction；
2. 预测的幽灵文本以 faint/italic ANSI 样式渲染；
3. TerminalSanitizer 删除全部 ANSI 后，把幽灵文本与重绘帧当纯文本拼接。

影响：模型侧 viewport 被污染；幽灵可能包含 shell 历史里的敏感命令（实测出现过 ssh-add $env:USERPROFILE\.ssh\id_ed25519），等于是把历史命令发给模型提供商。

严重度 P1（信息暴露 / 数据外发；不影响命令执行）。

为什么不是 P2：真实终端里用户本来就能看到幽灵补全，那不算新增暴露。但 DSH 把幽灵文本当作「输入」收进 viewport，模型会读到它，并随下一次 LLM 请求发送到提供商端 —— 这是 DSH 独有的外发路径。

环境

• DSH Desktop 0.2.1-rc.2（Windows 11 x64）
• Electron 44.7.0 / Node 24.21.0
• profile：desktop

复现

1. 打开「持久终端」（@deepseek-ai/dsh-experimental-terminal-bundle）。
2. terminal_send "echo AAA"。
3. viewport 里出现：echo a×5（历史里的旧命令，作为预测幽灵）+ echo A…echo AAA（逐字符重绘）+ AAA。

决定性实验

新开一个 session，先执行：

Set-PSReadLineOption -PredictionSource None

再发 echo ZZZ，viewport 变成：

e
ec
ech
echo
echo 
echo Z
echo ZZ
echo ZZZ

没有任何幽灵文本 ⇒ 根因确认是 inline prediction。

旁证

• ConsoleHost_history.txt 里含测试命令（echo a 8 次、echo BBB、Get-Date 等）；
• 新 session 的 Get-History 只有 2 条（启动命令 + 本次命令）⇒ 不是 shell 进程复用；
• terminal_read 历史隔离正常；
• 进程列表确认每次 terminal_open 都是新 pwsh 进程。

根因（三层叠加）

1. PSReadLine inline prediction：交互式 pwsh 默认 PredictionSource = HistoryAndPlugin（非交互 -Command 查询会显示 None，容易误判为已关闭）。新 session 加载 OS 级共享的 ConsoleHost_history.txt，把前缀匹配的历史命令画成 InlinePrediction（faint/italic）。
2. TerminalSanitizer 是流过滤器，不是屏幕（sanitize.ts:20-24 自己写了 emulation deferred）：
   • CSI 分支（:84-95）跳过参数、丢弃光标定位 ⇒ 逐键重绘的 6 帧拼在同一行（不是各占一行）；
   • normalizeTerminalText（:186-188）把每个 \r 改写成 \n，但 raw 流里 CR 只出现在每次渲染结束时 ⇒ 只影响行提交，拆不开帧；
   • \x08 原样透传（不处理），但当前路径 BS=0 次，与本案无关。
     ⇒ 任何 sanitizer 改写都删不掉幽灵：终端擦除是「另一次重绘」，不是撤回；「屏幕上还剩什么」是屏幕属性。
3. 结构性污染（不是竞态）：startSend 在 write 之前就 this.active = operation（session.ts:346），appendOutput 无条件 this.active?.append(text)（:537）⇒ 写入前到达的任何字节都会进新 send 的 viewport。竞态只影响结算时机（且 :393 在 write 前还有第二次 resetReadinessEvidence，普通 send 的宽窗口不成立）。

结果：预测文本 + 逐字符重绘帧被拼接进 viewport / motd / read 历史。

影响

安全（数据外发）

• 幽灵补全文本进入 terminal_send 的 viewport ⇒ 成为模型上下文的一部分 ⇒ 随下一次 LLM 请求发送到模型提供商端；
• 幽灵内容来自 ConsoleHost_history.txt，可能包含凭据相关命令、内网地址、私有路径；
• 「按前缀逐条命中」不是缓解：它把「全量 dump」变成「按前缀查询的 oracle」——模型主动输入 ssh / export / curl 之类前缀，就能定向钓出历史命令，且不提交、不执行、不产生「读文件」类审计；
• 实测：pty-7 的 terminal_send 返回里出现过 ssh-add $env:USERPROFILE\.ssh\id_ed25519（原始记录：out\terminal-cross-session-evidence.md）；
• 触发不需要用户做任何异常操作，默认预测源 + submit=false 即可；暴露是持续的（上下文重发 + history 持续追加）；
• 用户没有同意把 shell 历史发给模型提供商；「用户能在终端里看到幽灵」不构成同意 —— 用户看到的是一行，模型收到的是 sanitizer 拼接的多帧文本，两者不等价。

可用性

• 模型侧 terminal_send viewport、terminal_open motd、terminal_read 历史被重复文本与幽灵补全污染；
• 长命令 token 放大；
• 可能误导模型以为输入重复提交；
• 不影响命令执行与真实终端观感。

建议

1. 最小止血：在 PWSH_PROMPT_SETUP 里加 Set-PSReadLineOption -PredictionSource None（core 一行）；
2. 结构性修复：模型侧 viewport 改用 @xterm/headless 屏幕快照（包已依赖它），或解析 SGR 维护样式状态后按样式过滤 —— 后者可行，只是当前实现没做；
3. shellArgs 用法注意：非空会整体替换方言默认（config.ts:86-88），要重复 -NoLogo -NoProfile。

更正说明

初版把现象写成「新 session 带上一次关闭 session 的输入（跨会话泄漏 / 隔离问题）」。经复核，这个定性是错的：新 session 的 shell 是新进程、Get-History 干净、PTY 无复用；「旧命令」来自 PSReadLine 预测（读全局 history 文件）。关闭 prediction 后幽灵消失，实锤。

---

English summary

On Desktop 0.2.1-rc.2 (Windows/PowerShell), the experimental persistent terminal returns PSReadLine inline-prediction "ghost" completions (faint/italic) and per-character redraw frames as if they were typed input. After TerminalSanitizer strips all ANSI, both get concatenated into the model-facing viewport/motd/history.

This is not cross-session leakage (corrected): each terminal_open spawns a new pwsh, Get-History is clean, and PTY buffers are not reused. The "old commands" come from PSReadLine prediction reading the OS-level shared ConsoleHost_history.txt. Proof: running Set-PSReadLineOption -PredictionSource None makes echo ZZZ render as plain progressive redraw with no ghost text.

Impact: polluted model-side output, inflated tokens, and possible exposure of sensitive history entries (observed ssh-add $env:USERPROFILE\.ssh\id_ed25519 as a ghost completion). Execution itself is unaffected. Severity P2.

Suggested fix: disable PredictionSource at startup, and/or make the sanitizer preserve semantics (distinguish ghost text and redraw frames) or use the bundled @xterm/headless for a screen snapshot.

---

[argszero]

Thanks for the correction pass — the negative result (PredictionSource None ⇒ ghosts gone, staircase stays) is the right kind of evidence, and it holds. I read the terminal path at 687f282e86 and can sharpen two things: why a ghost survives at all, and which of your three suggestions are actually available. Your first is available today at the operator layer; your second is not available as stated; the third is the only structurally sound one.

1. Nothing in the package disables prediction — grep-verified. DEFAULT_PWSH_ARGS = ['-NoLogo', '-NoProfile'] (terminal-bash/src/config.ts:67), the prompt bootstrap PWSH_PROMPT_SETUP (src/index.ts:98-99) only defines prompt, and childEnvironment (src/index.ts:71-82) sets TERM, the pagers, NO_COLOR and the DSH_* ids. Set-PSReadLineOption / PredictionSource: zero hits in the package. Your note that HistoryAndPlugin is the interactive default while a -Command probe reports None is worth keeping in the report verbatim — it is precisely the false negative a maintainer would otherwise trust.

2. Why the ghost survives — it is not "the sanitizer cannot tell faint from typed". TerminalSanitizer is a stream filter, not a screen, and says so (src/sanitize.ts:20-24: "Full terminal emulation is deliberately deferred; ordinary line output and the private prompt marker are the supported contract"). Two consequences follow, and they are stronger than the style argument:

• normalizeTerminalText (src/sanitize.ts:186-188) rewrites every \r to \n, and tests/sanitize.spec.ts:24-26 pins it ('a\r\nb\rc\x07' → 'a\nb\nc'). A real terminal reads a bare \r as "column 0, overwrite", so PSReadLine's per-keystroke re-render is one line; here each re-render becomes its own line — your staircase, exactly. (If a redraw used CSI cursor positioning instead, the CSI is dropped at :84-95 and the frames concatenate on one line. Either way no frame is ever retracted.)
• \x08 is not handled at all: normalizeTerminalText removes only \r\n, \r and \x07, so a backspace-based erase arrives in the model text as a raw control character and erases nothing.

⇒ No rewrite of the sanitizer can delete a ghost, because "which text is still on screen" is a property of a screen, and erasure in a terminal is another redraw rather than a retraction. That is the whole reason your suggestion 3 is the only one that can work.

3. The faint/italic distinction is destroyed before any decision could use it. The CSI branch (src/sanitize.ts:84-95) skips to the final byte; it never parses parameters, so faint (SGR 2) and italic (SGR 3) are gone by the time the text is appended. Filtering by style would require retaining SGR state first — and even then a filter can only choose not to emit; it cannot retract what an earlier erase was going to remove. NO_COLOR=1 is set for the pwsh dialect (src/index.ts:79), but that governs colour, not how an inline prediction is rendered.

4. Your race window is real, and it has a second consequence. startSend assigns this.active = operation (src/session.ts:346) and calls void this.beginSend(...) (:361); beginSend yields at await this.terminal.inspectForeground() (:371), and appendOutput writes to this.active?.append(text) (:537). Frames delivered during that await land in the new operation's buffer and come back as its viewport (:197). What you did not name: resetReadinessEvidence() runs at :347, before the window closes — and pwsh readiness settles on a prompt marker plus its printable tail, so a stale prompt from the previous command can satisfy the new send's readiness. One window, two defects: the wrong text, and possibly an early settle.

5. What works today, without a rebuild. Both options are safe because the prompt bootstrap is typed into the PTY after spawn (src/index.ts:135-136), not passed as argv, so customising argv cannot disturb readiness detection:

• type Set-PSReadLineOption -PredictionSource None as the first terminal_send of each session; or
• set shellArgs: ['-NoLogo', '-NoProfile', '-NoExit', '-Command', 'Set-PSReadLineOption -PredictionSource None'] — note a non-empty shellArgs replaces the dialect default wholesale (src/config.ts:86-88), so repeat both flags.

Either closes the history half. The staircase stays, since it is a property of the filter, not of PSReadLine.

6. The oracle argument is the strongest part of the report — keep it. submit: false only drops the trailing \r (src/session.ts:391), so a terminal_send that types ssh and submits nothing returns the matching history entry: exfiltration by prefix, no command executed, no file read, no audit line. That answers the "the user can see ghosts in their own terminal anyway" counter better than the severity label does: the user sees one line on their own screen; the provider receives the sanitized multi-frame stream, and those are not the same disclosure.

7. Where the fix belongs. The cheap half is one line in the prompt bootstrap — core. The structural half is your suggestion 3, and the package already depends on @xterm/headless (terminal-bash/package.json:46), with the sanitiser docstring calling emulation deferred rather than rejected; that reads like the intended landing place rather than a new direction.

Plugin-mountability, since it decides whether this could ship outside core: TerminalSessionService.registerBackend rejects a duplicate type (packages/terminal/terminal/src/index.ts:125-139, DUPLICATE_BACKEND), so a plugin cannot replace the shell backend in place. It can register a new type and shadow ctx.terminals.spawn to route shell to it, so a screen-model backend is mountable without touching core — but backendType is the terminal plugin's own config, so a plugin carrying this half would need a shadow merely to be selected. I would argue for core on that basis.

[CNyaotian-Lunar]

@argszero 感谢这轮回复 —— 流过滤器 vs 屏幕、shellArgs 替换默认、oracle 这三点都很受用，方向也更准了。下面是复核后的修正（我们自己另拉了两路独立核对，不是照单全收）：

中文

• 「\r→\n 让逐键重绘每帧独立成行」不成立：raw 流里 CR 只出现在每次渲染结束时（同参数实测全文 2 个 CR），帧之间是 ESC[row;colH。所以 \r→\n 只影响行提交，拆不开帧；真因是 CSI 被丢弃后帧拼成同一行（这也纠正了我们上一版报告里"光标定位变成换行"的错误）。
• 「旧文本进 viewport」是结构性的，不是竞态：session.ts:346 在 write 之前就把 active 挂上，appendOutput 无条件 this.active?.append（:537）⇒ 写入前到达的任何字节都会进新 send。竞态只影响结算时机；而且 :393 在 write 前还有第二次 resetReadinessEvidence，普通 terminal_send 的宽窗口不成立（整段敞开的只有 text==='' 的 send）。
• \x08：是原样透传（不是"忽略"），且当前路径 BS=0 次，与本案无关。
• 「按样式过滤不可行」过头：可以解析 SGR 维护样式状态，或直接从每 session 已有的 @xterm/headless buffer 取文本 —— 是"没做"，不是"不可行"。
• oracle 论证保留：这段仍然是报告里最能说明问题性质的部分。

English

Thanks — the "stream filter vs a screen" framing, the shellArgs replacement caveat and the oracle argument were all directly useful, and they made the report more accurate. One correction pass after two independent reviews on our side (we did not take it on trust):

• "\r→\n makes each keypress re-render its own line" does not hold. In the raw stream CR appears only at the end of each render (2 CRs total in the capture), and frames are separated by ESC[row;colH. So \r→\n only affects line commits; the frames cannot be split that way. The real cause is CSI being dropped, so frames concatenate on one line — which also corrects our earlier report's "cursor positioning becomes a newline" wording.
• "Old text lands in the new viewport" is structural, not a race. session.ts:346 assigns active before write, and appendOutput appends unconditionally (:537), so any byte arriving before the write enters the new send. The race only affects settle timing; and :393 runs a second resetReadinessEvidence before the write, so the wide window does not exist for ordinary terminal_send (only for text === '' sends).
• \x08 is passed through verbatim, not ignored — and BS count is 0 on this path, so it is unrelated to this report.
• "Filtering by style is not feasible" overstates it. SGR can be parsed to maintain style state, or the text can be read from the per-session @xterm/headless buffer. It is unimplemented, not infeasible.
• The oracle argument stays — it remains the strongest part of the report.