Constrain service session capabilities - #1111
Merged
Merged
Conversation
A service turns a request body into a prompt, so prompt injection is the normal case for a service session and the attacker writes the text. Those sessions nonetheless held smith's full daemon-control surface: a request could ask the agent to enumerate every session on the machine, read their transcripts, drive them with synthesized input, or delete them. Verified against a live daemon: a service session prompted only over HTTP called agentd_list_sessions and returned every session id including the orchestrator's, then called agentd_send_input against another session with attacker-chosen text. Only the interactive approval gate stopped the write — a prompt shown to a human who is not necessarily watching, on a session a stranger created. Enumeration needed no approval at all. Confine service sessions at creation instead. Tools that reach outside the session, and injected fleet access for harnesses that take it that way, are withheld unless the service definition re-grants them; the capability is absent from the tool surface rather than gated at call time. Skills and the session's own working tools are unaffected. Filesystem and network stay with the harness sandbox, which a service definition must not be able to relax. Limits are preserved across edits to unrelated fields.
This was referenced Aug 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary: service-created sessions default to denying fleet-control tools and Construct MCP, while retaining opt-in controls and skills behavior; preserve configured sandbox limits across unrelated edits. Verification: cargo test -p construct-daemon service, cargo test -p construct-adapter-smith tools, cargo build. Relevant binary: construct at target/debug/construct.