muse-proxy attestation aliasing (shell/bash renames) has collision, leak, and bypass modes

muse-proxy attestation aliasing (shell→run_command, bash→terminal) has collision, leak, and bypass modes

From the 2026-11-05 tool-call audit (~/workspace/scratch/toolcall-audit-2026-11-04/code-inventory.md §6). Context: Meta's gate 403s tools named shell/bash, so bin/muse-proxy.mjs renames them to run_command/terminal in tool definitions, history function_call items, and tool_choice, and renames them back in output/SSE (aliasResponsesRequestBody L1118-1141, unaliasSseData L1150-1162 at audit time). The mechanism is deliberate; its edges are not handled:

Collision: if the client already defines a tool named run_command or terminal, the alias is skipped for the blocked name (directToolAlias taken-check, L1107-1111) — shell then goes up under its blocked name and the whole request 403s. Fix: pick a non-colliding alias (and rename back consistently), or fail the request locally with a clear error instead of an upstream 403.
Leak: SSE un-aliasing inspects only evt.item and evt.response.output. Any event shape carrying a function_call name elsewhere would leak the alias name (run_command) to the client, which would then try to execute/report a tool that does not exist. Fix: un-alias by scanning the event generically for function_call items, with a test covering the shapes Meta actually emits.
Bypass: request bodies that fail JSON.parse forward verbatim unaliased (L1119-1121) — a malformed-but-accepted body skips the gate workaround silently. Fix: log/metric the bypass at minimum; ideally reject unparseable bodies on the direct path.

Tests exist for the happy path (muse-proxy.test.mjs alias tests); add one per failure mode above. Note the door's end state is the façade migration (opencode#1155) — this is hardening for the standing door, sized small.

Acceptance criteria

Collision: when the client already defines run_command/terminal, the proxy picks a non-colliding alias (renamed back consistently) or fails the request locally with a clear error — shell never goes up under its blocked name to a 403.
Leak: SSE un-aliasing scans events generically for function_call items (not only evt.item / evt.response.output), with a test covering the shapes Meta actually emits.
Bypass: an unparseable request body on the direct path is logged/metric'd at minimum (ideally rejected) — it never forwards unaliased silently.
One new test per failure mode in muse-proxy.test.mjs; the existing happy-path alias tests still pass.

CODE-1764

Overlap note (found on a later dedupe pass): #2770 already tracks the alias-inverse defect (a genuine run_command/terminal tool's calls renamed back to shell/bash; declaring both names collapses them), and #3102/#4445 cover request-scoped alias fixes. This issue's remaining distinct scope: (1) the taken-check collision mode — when the client already defines run_command/terminal, the blocked name goes up unaliased and the request 403s upstream instead of failing locally or picking a non-colliding alias; (2) SSE un-aliasing only inspects evt.item / evt.response.output, so other event shapes can leak the alias name to the client; (3) unparseable request bodies bypass aliasing entirely and forward verbatim. If those land better on #2770, move them there and close this as its duplicate — the audit evidence is in ~/workspace/scratch/toolcall-audit-2026-11-04/code-inventory.md §6 either way.

Intake review

Related: the 2026-11-05 tool-call audit (~/workspace/scratch/toolcall-audit-2026-11-04/code-inventory.md §6); Door front migration: muse-proxy (18747) callers repoint to the façade developing-today-forks/opencode#1155 (the façade migration — this door's end state; this issue is hardening until then, per the body).
Still live: verified at intake from the body's line-referenced evidence (aliasResponsesRequestBody / unaliasSseData / directToolAlias in bin/muse-proxy.mjs); happy-path alias tests exist, the three failure modes are unhandled.
Notes: three distinct edges of one deliberate mechanism: collision (client already owns the alias name), leak (SSE shapes outside the two inspected spots), bypass (unparseable body forwards unaliased). The collision fix choice — non-colliding alias vs local fail-clear — should be recorded in the fix; either beats an upstream 403.
Risks: renaming back inconsistently would break tool history worse than the 403; the generic SSE scan needs the shapes Meta actually emits as test fixtures, not invented ones.
Suggested approach: one test per mode first (all three should fail on current code), then the smallest aliasing change that turns them green.

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-h
Session / ID: task 10550
Found via: queue claim
Task: Picked up task 10550 for issue muse-proxy attestation aliasing (shell/bash renames) has collision, leak, and bypass modes #6118 (small_fix); execution lane assigned to opencode — handing off to the opencode claimant, which launches the bound session.
Expectation: claimant launches the bound opencode session and drives task 10550 to a terminal state
Links: issue muse-proxy attestation aliasing (shell/bash renames) has collision, leak, and bypass modes #6118

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), lane 02cafe76-eafd-4d0b-aaa6-2b7a737d68dc
Session / ID: OpenChamber scheduled lane; task 10550
Found via: atomic queue claim
Task: small_fix for issue muse-proxy attestation aliasing (shell/bash renames) has collision, leak, and bypass modes #6118 — alias collision, SSE unaliasing coverage, and malformed-body handling
Expectation: resume from recorded task state; verify issue/PR and existing artifacts before editing. The recorded worktree path is absent, and no matching local or remote branch was found.
Links: muse-proxy attestation aliasing (shell/bash renames) has collision, leak, and bypass modes #6118

🤖 Agent note · done

Agent: queue worker (repo-worker-code), lane 02cafe76-eafd-4d0b-aaa6-2b7a737d68dc
Session / ID: OpenChamber scheduled lane; task 10550
Task: small_fix for issue muse-proxy attestation aliasing (shell/bash renames) has collision, leak, and bypass modes #6118 — alias collisions, SSE leaks, and malformed request bodies
Outcome: PR fix(muse-proxy): reject unsafe tool alias cases #6437 is open; collision policy is local 400, recursive SSE unaliasing handles nested function_call items, and invalid JSON is rejected before forwarding. No merge performed. CI has not run beyond CodeRabbit skipping.
Tests: node --test bin/muse-proxy.test.mjs — 47/47 passed; git diff --check passed.
Links: fix(muse-proxy): reject unsafe tool alias cases #6437; muse-proxy attestation aliasing (shell/bash renames) has collision, leak, and bypass modes #6118

Navigation Menu

Repository navigation

muse-proxy attestation aliasing (shell/bash renames) has collision, leak, and bypass modes #6118

muse-proxy attestation aliasing (shell→run_command, bash→terminal) has collision, leak, and bypass modes

Acceptance criteria

Intake review

60 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

muse-proxy attestation aliasing (shell/bash renames) has collision, leak, and bypass modes #6118

Description

muse-proxy attestation aliasing (shell→run_command, bash→terminal) has collision, leak, and bypass modes

Acceptance criteria

Activity

developing-today commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

Intake review

60 remaining items

dezren39 commented on Nov 6, 2026

dezren39 commented on Nov 6, 2026

dezren39 commented on Nov 6, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions