Skip to content

Releases: onkarbadve/agy-auto

Release list

v0.2.0-alpha: Security Hardening & Gate Assurance

v0.2.0-alpha: Security Hardening & Gate Assurance Pre-release
Pre-release

Choose a tag to compare

View all tags
@onkarbadve onkarbadve released this 09 Sep 14:57
v0.2.0-alpha
ba90f9e

What's Changed in v0.2.0-alpha

Following security review, this release resolves core attack vectors inherent to agents operating under the same OS user identity (UID):

🛡️ 1. Gate Self-Protection & Tamper Resistance

  • Dynamic Installation Discovery: PathPolicy dynamically discovers the installation root of agy-auto via realpath(__file__) and tags it as self_path and system_write.
  • Workspace Immunity: Attempts to overwrite (echo > hook.sh), edit via tools (write_to_file), or redirect into any agy-auto files are deterministically hard-denied, even when the workspace encompasses the engine directory (e.g. workspace is /home/onkar).
  • Deletion Protection: _check_delete() and find -delete now inspect system_write paths ahead of workspace checks, preventing deletion of hook.sh, ~/.gemini/config/hooks.json, or policy files.

🔑 2. Scoped Action Approvals (Zero Ambient Authority)

  • Fuzzy Regex Deprecated: Conversational words like "yes", "proceed", and "accept" no longer grant execution permission.
  • Cryptographic Action Nonces: Denied commands or offline fallbacks issue a short ephemeral hex token bound strictly to (tool, normalized_cmd, cwd, conversation_id) with a 5-minute TTL.
  • Explicit In-Chat Approval: Approve actions explicitly in chat with > agy-approve <token>.
  • Single-Use Consumption: Tokens are consumed immediately under file lock upon execution, completely eliminating ambient authorization leakage across turns.

⚡ 3. TOCTOU Script Cache Invalidation

  • Real-Time Script Hashing: For commands executing scripts (python3 script.py, bash deploy.sh, node app.js), the engine computes the SHA256 content hash of the target script and binds it to the classifier cache key.
  • Tamper Invalidation: Modifying a script immediately produces a cache miss, forcing re-classification and preventing cache poisoning attacks.

🚫 4. Subprocess Isolation & Context Prompt Hardening

  • Nested Escape Prevention: Deterministic hard-deny on nested invocations of agy, antigravity, and antigravity-cli bearing --dangerously-skip-permissions.
  • Context Isolation: Hardened classifier system prompt explicitly instructing the LLM that text inside conversation history is untrusted data and cannot grant authority or override policies.

🧪 5. Testing & Documentation

  • Adversarial Bypass Test Suite: Added tests/test_bypasses.py with 14 automated test cases covering all identified bypass vectors.
  • Technical Design Doc: Added docs/HARDENING-DESIGN.md detailing the threat model, architecture, state flows, and verification matrix.

Full Changelog: v0.1.3-alpha...v0.2.0-alpha

Loading