feat: file-access confinement for `clet md` (security boundary) by Copilot · Pull Request #96 · gui-cs/clet

Copilot · 2026-05-06T20:00:56Z

clet md FILE is an arbitrary file-read primitive. In agent contexts, positional args may be attacker-influenced via indirect prompt injection (e.g. clet md ~/.aws/credentials), exfiltrating content through rendered ANSI or --cat stdout.

Changes

`FileAccessPolicy` (new, `src/Clet/Hosting/FileAccessPolicy.cs`)

Default-deny policy enforced on both the --cat path (AliasDispatcher.ResolveViewerContent) and TUI path (MarkdownClet.ExpandFiles):

Extension allowlist: .md, .markdown, .txt
Working directory confinement (full-path normalized comparison)
Per-file 16 MiB / aggregate 32 MiB / glob 128-file caps
Binary rejection (NUL in first 8 KiB)

Escape hatches (`CommandLineRoot` parsing)

--allow-file <path> (repeatable) — bypasses extension + cwd checks
--allow-binary — disables NUL detection

# Refused by default:
clet md /etc/passwd

# Explicit opt-in:
clet md --allow-file /etc/passwd /etc/passwd

Surface 2: `pick-file`/`pick-directory` `--root`

Documented honestly as starting directory, not a sandbox. Help text updated to: "Starting directory (not a sandbox — user can navigate freely)."

Documentation

docs/threat-model.md "File access scope" rewritten with full confinement model
specs/decisions.md D-032 appended (renumbered from D-030 → D-031 → D-032 to avoid conflicts with terminal escape sanitization and link policy entries)

Tests

FileAccessPolicyTests — extension/cwd/binary/size/glob unit coverage
FileAccessPolicySmokeTests — process-level refusal and bypass verification

- Add FileAccessPolicy with extension allowlist, cwd confinement, size caps, binary rejection - Add --allow-file and --allow-binary CLI flags - Integrate policy into AliasDispatcher.ResolveViewerContent and MarkdownClet.ExpandFiles - Document --root as starting-only (not sandbox) for pick-file/pick-directory - Add D-030 decisions entry - Update docs/threat-model.md "File access scope" section - Add unit tests (FileAccessPolicyTests) and smoke tests (FileAccessPolicySmokeTests) Agent-Logs-Url: https://github.com/gui-cs/clet/sessions/02d84ff1-fcf6-4d66-989b-67fecf6fd033 Co-authored-by: tig <585482+tig@users.noreply.github.com>

…move duplicate check Agent-Logs-Url: https://github.com/gui-cs/clet/sessions/02d84ff1-fcf6-4d66-989b-67fecf6fd033 Co-authored-by: tig <585482+tig@users.noreply.github.com>

…ariable' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

…ne' may silently drop its earlier arguments' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

+        // Create a .md file and run from its directory
+        string tmpDir = Path.Join (Path.GetTempPath (), $"clet-test-{Guid.NewGuid ()}");
+        Directory.CreateDirectory (tmpDir);
+        string mdFile = Path.Combine (tmpDir, "test.md");


+    public void AllowedExtension_InWorkingDirectory_Passes ()
+    {
+        string cwd = Path.GetTempPath ();
+        string file = Path.Combine (cwd, "readme.md");


+    [Fact]
+    public void AllowFile_BypassesExtensionAndCwdChecks ()
+    {
+        string cwd = Path.Combine (Path.GetTempPath (), "clet-test-cwd2");


tig · 2026-05-06T20:27:33Z

@copilot tests are failing

…CS0103 build error Agent-Logs-Url: https://github.com/gui-cs/clet/sessions/7731e404-c52b-4351-ba8b-c7560fb94836 Co-authored-by: tig <585482+tig@users.noreply.github.com>

Copilot · 2026-05-06T20:29:59Z

@copilot tests are failing

Fixed in 921f4c2. The CI error was CS0103: The name 'SecurityException' does not exist in the current context — an earlier auto-fix commit introduced SecurityException without qualifying it. Changed to System.Security.SecurityException to resolve.

tig · 2026-05-06T20:32:44Z

@copilot resolve the merge conflicts in this pull request

…d-file-access-issue # Conflicts: # specs/decisions.md Co-authored-by: tig <585482+tig@users.noreply.github.com>

Copilot · 2026-05-06T20:35:08Z

@copilot resolve the merge conflicts in this pull request

Resolved in 59f7585. The conflict was in specs/decisions.md where both branches added a D-030 entry. Kept develop's D-030 (terminal escape sanitization) and renumbered the file-access confinement entry to D-031.

tig · 2026-05-06T21:19:42Z

@copilot resolve the merge conflicts in this pull request

…d-file-access-issue # Conflicts: # specs/decisions.md Co-authored-by: tig <585482+tig@users.noreply.github.com>

Copilot · 2026-05-06T21:21:37Z

@copilot resolve the merge conflicts in this pull request

Resolved in 600741b. The conflict was again in specs/decisions.md — develop added D-031 (SurfaceOnly link policy). Renumbered the file-access confinement entry to D-032.

Clicking a relative .md link in the viewer navigates to that file in-place, subject to the same FileAccessPolicy confinement as file loading (CWD sandbox, extension allowlist, size/binary checks). Links outside the sandbox or to non-markdown files remain SurfaceOnly (shown in status bar). HTTP/HTTPS/mailto links are always SurfaceOnly. Also fix integration test that used .tmp extension in temp dir, now creates .md file in CWD to satisfy FileAccessPolicy. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

--allow-file now accepts directories in addition to files. When a directory is given, any file under that tree bypasses the extension and CWD confinement checks (size/binary checks still apply). This makes the common case natural: clet md ../Terminal.Gui/README.md --allow-file ../Terminal.Gui Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Replace the plain-text status shortcut with a Link CommandView. When the user hovers a hyperlink in the markdown, the URL appears in the status bar as a clickable link — clicking it opens in the default browser. When viewing a file, the link shows the filename with no URL (not clickable). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Toggle MouseHighlightStates between In (when a clickable URL is shown) and None (when showing a filename or status text). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Clicking an http:// or https:// link in clet md now opens it in the default browser via Link.OpenUrl. These are safe — worst case the user sees a webpage. The URL is still shown in the status bar. Local .md file navigation (within CWD sandbox) will come when PR #96 merges. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Merge develop which includes PR #96 (FileAccessPolicy, local .md link navigation, --allow-file directory support). MarkdownClet LinkClicked now: 1. Navigates local .md files within the sandbox (from #96) 2. Opens http/https links in the default browser (safe) 3. Shows the URL in the status bar as a clickable link Resolve decisions.md conflict: linear-range is D-032, file-access confinement is D-033. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Initial plan

57864aa

Copilot AI assigned Copilot and tig May 6, 2026

Copilot started work on behalf of tig May 6, 2026 20:01 View session

Copilot AI linked an issue May 6, 2026 that may be closed by this pull request

Security: file-access boundary — clet md confinement + pick-file/pick-directory --root verification #93

Closed

12 tasks

Copilot AI and others added 2 commits May 6, 2026 20:09

Copilot AI changed the title ~~[WIP] Fix security issue with clet md file access~~ feat: file-access confinement for clet md (security boundary) May 6, 2026

Copilot finished work on behalf of tig May 6, 2026 20:13

Copilot AI requested a review from tig May 6, 2026 20:13

github-code-quality Bot found potential problems May 6, 2026

View reviewed changes

tig approved these changes May 6, 2026

View reviewed changes

tig marked this pull request as ready for review May 6, 2026 20:18

tig and others added 10 commits May 6, 2026 14:18

Potential fix for pull request finding 'Useless assignment to local v…

dffd97d

…ariable' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

Potential fix for pull request finding 'Useless assignment to local v…

392b8f1

…ariable' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

Potential fix for pull request finding 'Useless assignment to local v…

fb50b66

…ariable' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

Potential fix for pull request finding 'Useless assignment to local v…

922b2e7

…ariable' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

Potential fix for pull request finding 'Useless assignment to local v…

70f7a98

…ariable' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

Potential fix for pull request finding 'Useless assignment to local v…

4979a8d

…ariable' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

Potential fix for pull request finding 'Generic catch clause'

c1a37c5

Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

Potential fix for pull request finding 'Call to 'System.IO.Path.Combi…

2c8e1d3

…ne' may silently drop its earlier arguments' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

Potential fix for pull request finding 'Call to 'System.IO.Path.Combi…

af890c9

…ne' may silently drop its earlier arguments' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

Potential fix for pull request finding 'Generic catch clause'

ba4c57d

Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

tig approved these changes May 6, 2026

View reviewed changes

github-code-quality Bot found potential problems May 6, 2026

View reviewed changes

Copilot started work on behalf of tig May 6, 2026 20:27 View session

Copilot finished work on behalf of tig May 6, 2026 20:30

Copilot AI requested a review from tig May 6, 2026 20:30

Copilot started work on behalf of tig May 6, 2026 20:32 View session

Merge remote-tracking branch 'origin/develop' into copilot/fix-clet-m…

59f7585

…d-file-access-issue # Conflicts: # specs/decisions.md Co-authored-by: tig <585482+tig@users.noreply.github.com>

Copilot finished work on behalf of tig May 6, 2026 20:35

Copilot started work on behalf of tig May 6, 2026 21:19 View session

tig mentioned this pull request May 6, 2026

md: add local markdown link navigation within CWD sandbox #102

Closed

5 tasks

Merge remote-tracking branch 'origin/develop' into copilot/fix-clet-m…

600741b

…d-file-access-issue # Conflicts: # specs/decisions.md Co-authored-by: tig <585482+tig@users.noreply.github.com>

Copilot finished work on behalf of tig May 6, 2026 21:22

tig approved these changes May 6, 2026

View reviewed changes

tig mentioned this pull request May 6, 2026

Make md be a browser, not just a viewer #104

Closed

tig and others added 2 commits May 6, 2026 15:45

Enable mouse highlight on status link when showing a URL

0ef660b

Toggle MouseHighlightStates between In (when a clickable URL is shown) and None (when showing a filename or status text). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tig merged commit b0791b7 into develop May 6, 2026
5 checks passed

Conversation

Copilot AI commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

FileAccessPolicy (new, src/Clet/Hosting/FileAccessPolicy.cs)

Escape hatches (CommandLineRoot parsing)

Surface 2: pick-file/pick-directory --root

Documentation

Tests

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tig commented May 6, 2026

Uh oh!

Copilot AI commented May 6, 2026

Uh oh!

tig commented May 6, 2026

Uh oh!

Copilot AI commented May 6, 2026

Uh oh!

tig commented May 6, 2026

Uh oh!

Copilot AI commented May 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented May 6, 2026 •

edited

Loading

`FileAccessPolicy` (new, `src/Clet/Hosting/FileAccessPolicy.cs`)

Escape hatches (`CommandLineRoot` parsing)

Surface 2: `pick-file`/`pick-directory` `--root`