mosaicstack/stack
1
0
Fork 1
Code Issues 246 Pull Requests 7 Actions Packages Projects Releases 15 Wiki Activity

#1156-A: require command authorization and system-override DI #1179

New Issue
Open
opened 2026-08-13 00:29:52 +00:00 by mos-dt-0 · 0 comments
mos-dt-0 commented 2026-08-13 00:29:52 +00:00
Collaborator
Copy Link
Copy Source

Child of #1156. Security-critical fail-loud remediation; schedule first.

Findings

FL-01 — required command authorization is optional/fail-open

CommandExecutorService injects CommandAuthorizationService optionally and calls authorization?.authorize(...). Missing wiring yields undefined, so commands proceed. Required authorization absence grants execution.

FL-11 — required system-override instruction authority is optional

AgentService accepts missing SystemOverrideService. /system may report a stored override while prompt execution silently omits it, changing instruction authority.

Binding outcome

  • Both dependencies become required DI wiring; missing bindings fail real module compilation/startup.
  • No optional chaining/default/null sentinel can convert absence into command success or omitted instruction authority.
  • Red-first tests compile real Nest module graphs without each binding and prove startup/DI refusal; direct executor/session tests prove zero command/provider/session effect on absence.
  • Existing legitimate optional test seams remain explicit and separate.
  • Full focused Gateway tests/typecheck/lint/build, independent exact-head verifier and focused security review required.

This child binds before native stage. If either fix requires a broad unrelated module rewrite, split the child rather than widening it.

Child of #1156. Security-critical fail-loud remediation; schedule first. ## Findings ### FL-01 — required command authorization is optional/fail-open `CommandExecutorService` injects `CommandAuthorizationService` optionally and calls `authorization?.authorize(...)`. Missing wiring yields `undefined`, so commands proceed. Required authorization absence grants execution. ### FL-11 — required system-override instruction authority is optional `AgentService` accepts missing `SystemOverrideService`. `/system` may report a stored override while prompt execution silently omits it, changing instruction authority. ## Binding outcome - Both dependencies become required DI wiring; missing bindings fail real module compilation/startup. - No optional chaining/default/null sentinel can convert absence into command success or omitted instruction authority. - Red-first tests compile real Nest module graphs without each binding and prove startup/DI refusal; direct executor/session tests prove zero command/provider/session effect on absence. - Existing legitimate optional test seams remain explicit and separate. - Full focused Gateway tests/typecheck/lint/build, independent exact-head verifier and focused security review required. This child binds before native stage. If either fix requires a broad unrelated module rewrite, split the child rather than widening it.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
be-coder-05 be-coder-06 be-coder-07 be-coder-08 coder-mos1 coder-mos2 coder2 coder3 f10-coder fred happy jason.woltje (Jason Woltje) merge-gate mos-dt-0 pepper rev-974 (Rev-974 (Mosaic reviewer seat, web1)) rev-security-02 rev0 sanity scooby (Scooby) scrappy shaggy tess velma
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1179