Fix reusable approval, cancellation, and share-title vulnerabilities

[ross0x01]

Summary

• bind reusable Agent terminal approvals to both sandbox identity and working directory, and clear stale grants when a task moves or its project is deleted
• require a fresh approval for cmd.exe control syntax hidden inside POSIX single quotes; this shared boundary covers Local, Desktop execute, and Desktop PTY paths
• confirm Local cancellation only after the Unix process group is gone, while still escalating resistant descendants to SIGKILL
• snapshot shared-chat titles at fork time and expose live source titles only while the viewer remains authorized

Compatibility

• commands are never blocked by the new Windows rule; unsafe edge cases simply prompt for fresh approval
• ordinary reusable approvals continue working in the same sandbox and working directory, including legacy grants outside project-folder contexts
• project moves keep working; only prior terminal authority is reset when the execution context changes
• fork labels remain populated, and live source-title updates continue while the source is owned by the viewer or actively shared
• no Desktop/Rust executor code changed

Validation

• corepack pnpm test --runInBand (296 suites, 2914 tests)
• corepack pnpm typecheck
• changed-file ESLint and Prettier checks
• corepack pnpm --dir packages/local build
• corepack pnpm exec next build
• cargo test was unavailable locally because the Rust toolchain is not installed; CI should validate the unchanged Desktop crate

Manual verification

• approve a harmless terminal prefix in Agent mode, repeat it in the same project folder, then move the task to another folder-backed project; the moved task should ask again
• on Windows Local or Desktop, approve a harmless command and then submit a command containing an ampersand or pipe inside single quotes; it should ask again and still run after approval
• cancel a Local command with a child process that ignores SIGTERM; cancellation should wait for the process group and leave no descendant running
• fork a shared task, revoke the original share, rename the original, and confirm the fork keeps its fork-time source label

Summary by CodeRabbit

• Bug Fixes
  • Preserved the original source title when shared-chat access is revoked, including for older forked chats.
  • Prevented stale approval permissions from carrying over when chats or tasks are removed from projects.
  • Improved command cancellation confirmation, including process-tree handling on Unix systems.
  • Strengthened safeguards around shell commands and reusable approval grants.
• Improvements
  • Approval grants now respect the active project working directory, reducing unintended reuse across projects.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hackerai	Ready	Preview, Comment	Jul 23, 2026 4:11pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6fa20cc8-abfc-484d-bc6f-5d05a73a56ef

📥 Commits

Reviewing files that changed from the base of the PR and between b5c7e12 and 6340abc.

📒 Files selected for processing (19)

• convex/__tests__/chats.getUserChats.test.ts
• convex/__tests__/chats.saveChat.test.ts
• convex/__tests__/projects.test.ts
• convex/__tests__/sharedChats.fork.test.ts
• convex/chats.ts
• convex/lib/__tests__/branchedChatTitle.test.ts
• convex/lib/branchedChatTitle.ts
• convex/projects.ts
• convex/schema.ts
• convex/sharedChats.ts
• lib/api/__tests__/agent-long-contracts.test.ts
• lib/chat/__tests__/agent-approval-grants.test.ts
• lib/chat/agent-approval-grants.ts
• packages/local/src/__tests__/command-cancellation.test.ts
• packages/local/src/command-cancellation.ts
• packages/local/src/index.ts
• trigger/__tests__/agent-approval-sandbox-grants.test.ts
• trigger/agent-long.ts
• types/agent.ts

---

📝 Walkthrough

Walkthrough

The PR preserves fork-time chat titles after share revocation, clears approval grants during project changes, scopes reusable approvals by working directory, tightens Windows command parsing, and makes command cancellation process-tree aware.

Changes

Chat metadata and project state

Layer / File(s)	Summary
Fork title snapshot contract convex/schema.ts, convex/sharedChats.ts, convex/__tests__/sharedChats.fork.test.ts	Forked chats store the source title in branched_from_title, with coverage for the inserted metadata.
Branched title resolution and retrieval convex/lib/branchedChatTitle.ts, convex/chats.ts, convex/projects.ts, convex/__tests__/chats.getUserChats.test.ts, convex/__tests__/projects.test.ts	Chat and project-thread queries resolve live or snapshot titles based on source visibility, including legacy fallback behavior.
Project transition approval cleanup convex/chats.ts, convex/projects.ts, convex/__tests__/chats.saveChat.test.ts, convex/__tests__/projects.test.ts	Project moves and deletion detachments clear agent_approval_grants; unchanged project assignments preserve them.

Working-directory approval scoping

Layer / File(s)	Summary
Versioned approval scope format types/agent.ts	Approval target-prefix payloads support legacy and working-directory-aware formats with version-specific matching.
Working-directory grant wiring trigger/agent-long.ts, trigger/__tests__/agent-approval-sandbox-grants.test.ts, lib/api/__tests__/agent-long-contracts.test.ts	Grant restoration, reuse, persistence, and requester construction propagate and compare workingDirectory.
Command approval reuse parsing lib/chat/agent-approval-grants.ts, lib/chat/__tests__/agent-approval-grants.test.ts	Additional Windows control characters inside single quotes disable automatic approval reuse while harmless quoted arguments remain eligible.

Process-tree cancellation confirmation

Layer / File(s)	Summary
Termination confirmation and integration packages/local/src/command-cancellation.ts, packages/local/src/index.ts, packages/local/src/__tests__/command-cancellation.test.ts	Cancellation checks process-group termination on Unix, polls configurable completion state, and wires the process-tree predicate into command cancellation tests.

Estimated code review effort: 4 (Complex) | ~60 minutes

Possibly related PRs

• hackerai-tech/hackerai#57: Adds related branched_from_title handling across chat backend and UI code.
• hackerai-tech/hackerai#178: Also changes getUserChats branched-title enrichment.
• hackerai-tech/hackerai#519: Modifies the shared-chat fork flow in convex/sharedChats.ts.

Suggested labels: codex, aardvark

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main security fixes around approvals, cancellation, and shared-chat title handling.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-weekly-security-findings

---

_{Comment @coderabbitai help to get the list of available commands.}