fix(security): stop PowerShell sinks from executing untrusted text - #3359

Summary

Two Windows code paths pasted attacker-influenced text into a PowerShell command string, so an apostrophe in a filename or a notification message became code the machine ran. Both now keep the command constant and pass their values out-of-band.

Why

Upload a .pptx through the Agent UI whose name contains an apostrophe, and the rest of the name ran as PowerShell the moment the document was indexed — no tool call, no model decision, no confirmation modal. Receiving and indexing a shared deck was the whole attack. The same class sat one step behind a tool argument in notify_desktop, whose PowerShell fallback is the only path on every Windows install because plyer is in no dependency list; prompt-injected content steering that tool's message got code execution with no click.

After this change, a quote in either place is inert text. The apostrophe still survives in the document's display name — the fix is in how the value travels, not in rejecting the name.

Linked issue

Closes #3357

Changes

• Neither PowerShell sink interpolates any more. convert_pptx_to_pdf and notify_desktop each send a fixed module-level script and hand their values to the child through its environment, where they are values and never code.
• _sanitize_stem also replaces the apostrophe and backtick — defense in depth, so an uploaded name can't become code even if a future caller forgets the rule above.
• notify_desktop joins the confirmation-gated set. It spawns a PowerShell child on a model's say-so; that belongs with the other process-spawning tools. This changes tool gating, an LLM-affecting surface — see Evidence.
• The gate applies on every platform — a deliberate call, not a side effect. Only Windows spawns a process today, so on macOS/Linux the prompt precedes a call that errors anyway (plyer is in no dependency list). Gating everywhere still wins: the set is keyed on tool name, not host, so a platform-conditional entry would be a new mechanism and would silently stop applying the day a non-Windows backend becomes reachable. The reasoning is recorded on the set entry rather than left to be rediscovered.
• eval/scenarios/web_system/desktop_notification.yaml follows the code. It counted "cannot send notifications" as a failure, which is exactly what a gated tool returns on a surface with no one to ask. It now passes on the refusal path — and fails if the agent narrates an approval it never got. GAIA_AUTO_APPROVE_TOOLS=1 exercises the tool body instead.
• The regression tests now actually run in CI. A module-level importorskip raised Skipped during collection and took the whole file with it, including the PPTX half that needs no agent package. Scoped to the one class that needs the chat wheel, and added to test_gaia_agent.yml — the lane that installs it.

Test plan

• pytest tests/unit/test_powershell_command_injection.py — 10 regression tests. Each asserts the rendered command is byte-for-byte the constant when the input carries a breakout payload; asserting only "the subprocess was invoked" would not have caught either bug, which is why both shipped.
• Both CI lanes reproduced locally, showing the tests execute rather than skip. With the chat wheel uninstalled (the test_unit.yml shape, -e ".[api]"): 8 passed, 2 skipped — the PPTX-filename half, _sanitize_stem, and the gating check all run; only the two notification tests skip. With it installed (the test_gaia_agent.yml shape): 10 passed.
• The same file on unpatched upstream/main: 8 of 10 fail. The 2 that pass are the deliberate controls (a benign filename, the pre-existing illegal-character set).
• pytest tests/unit/rag tests/unit/agents tests/unit/api/test_sse_confirmation_gate.py hub/agents/chat/python/tests hub/agents/gaia/python/tests — 1039 passed, 50 skipped.
• pytest tests/test_eval.py — 140 passed, and gaia eval agent --audit-only reports blocked_scenarios: [] after the scenario edit.
• python util/lint.py --all — Black, isort, Flake8, Bandit, import validation, agent conventions all pass. Pylint reports 9 errors, all pre-existing POSIX-only os members (killpg, geteuid) flagged on Windows in files this PR does not touch.
• pytest tests/integration/test_documents_router.py — 11 passed; 1 failure + 2 errors are identical with and without this change (they need a running Lemonade embedder).

Evidence

CLI / probe — before → after, both executed on Windows 11 + PowerShell 5.1.

Before, a payload in the filename escapes the literal and the injected statement really runs (the probe writes a marker instead of launching calc):

$x = 'C:\docs\quarterly'; Set-Content -LiteralPath '...\C3_MARKER.txt' -Value C3_INJECTED; '.pptx'; ...
rc: 0 marker written: True -> C3_INJECTED

...and the same for the notification message:

$null = @('hi'); Set-Content -LiteralPath '...\C2_MARKER.txt' -Value C2_INJECTED; ('x', 'title')
rc: 0 marker written: True -> C2_INJECTED

After, both commands are constants that PowerShell's own parser accepts, and the payload arrives as data:

$ErrorActionPreference = 'Stop'; $in = $env:GAIA_PPTX_CONVERT_IN; $out = $env:GAIA_PPTX_CONVERT_OUT; ...
-> PARSE OK
Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show([string]$env:GAIA_NOTIFY_MESSAGE, [string]$env:GAIA_NOTIFY_TITLE)
-> PARSE OK
PPTX_IN=[C:\docs\quarterly'; Set-Content -LiteralPath '...\AFTER_MARKER.txt' -Value PWNED; '.pptx]
TYPE=String marker written (must be False): False

Launching the real notify_desktop command with the payload as its title shows it rendered as text, not executed:

child alive (MessageBox displayed): True | exit code: None
MessageBox window title: "t'); calc; ('"

Agent eval — the harness now runs; a valid-for-this-branch result is still outstanding.

An earlier revision of this section blamed an exhausted judge account for an HTTP 400. That diagnosis was wrong — see #3367 . A stale ANTHROPIC_API_KEY in the parent checkout's .env reaches the eval process because load_dotenv() walks up the directory tree, which flips runner.py:949 into passing --bare, and --bare restricts auth to that key and never reads the working OAuth session. Unsetting the shell variable does not help; only an explicit empty value does, because load_dotenv() will not override a variable that is already present:

ANTHROPIC_API_KEY= gaia eval agent --category tool_selection

With that, the harness runs properly: 5 real judged scenarios where the same command previously produced 5 instant ERRORED. Recorded here so the next contributor who meets that 400 does not spend an afternoon on it.

The run so far is not yet evidence for this branch, so no scorecard is quoted. gaia eval agent --backend only reaches the prompt text (runner.py:501); the MCP server that carries every request is launched from eval/mcp-config.json with --stdio and no --backend, so it uses its hardcoded http://localhost:4200 default. On this multi-worktree machine that port was served by a different branch (87b9479c), which has no confirmation gate — and the judge's trace duly reported notify_desktop returning success with no denial, which is impossible here. A correctly-routed re-run is queued; its numbers will replace this paragraph.

What the eval would have been checking is instead established directly: the model-facing surface is byte-identical. Hashing (system prompt, registered tool set) for all 15 profilespec_characterization rows before and after the change gives no diff, because the confirmation set is read only by _execute_tool and never reaches prompt or schema assembly. The model sees exactly the tools, docstrings and prompt it saw before; what changed is what happens at call time.

The hash check below is corroboration, not a substitute — it covers the prompt surface only and does not exercise the changed call-time behaviour. Nothing about hashing a prompt says what happens when the model actually calls notify_desktop, and that is precisely the behaviour this PR changes. Two things carry that half instead: tests/unit/api/test_sse_confirmation_gate.py parametrizes over the whole base set and passes with notify_desktop in it (the tool body never runs when the surface cannot approve), and eval/scenarios/web_system/desktop_notification.yaml has been updated so the refusal path is the expected outcome rather than a failure — it now also fails if the agent reports a notification as sent when the tool returned a denial.

Which scenarios actually touch this change: desktop_notification is category web_system, not tool_selection — grep -rl notify_desktop eval/scenarios/tool_selection/ returns nothing. So a tool_selection pass shows the gate causes no collateral regression; it does not exercise the gate. Only the web_system scenario does, and it is run separately. A clean tool_selection score must not be read as coverage of the gating change.

On that surface the denial arrives via timeout rather than an outright refusal: the Agent UI's handler (gaia/ui/sse_handler.py) can collect an approval — it raises a permission modal and blocks — but nothing answers it under the harness, so the prompt expires at TOOL_CONFIRM_TIMEOUT_SECONDS (60s) and the call is denied. The outright-refusal path belongs to gaia/api/sse_handler.py, the sidecar's /query. An earlier revision of this body conflated the two.

• Agent exposed in the Agent UI — N/A. No UI surface changed; documents.py is touched only in _sanitize_stem, whose behaviour is covered by direct unit tests (the router's own suite needs a live embedder).
• MCP tools / servers — N/A. No MCP tool or server definition changed.
• CLI — the probe output above, plus the lint and pytest runs in the test plan.
• HTTP API / REST — N/A. No endpoint, request shape or response shape changed.

Checklist

• I have linked a GitHub issue above (Closes #3357).
• I have described why this change is being made, not just what changed.
• I have run linting and tests locally (python util/lint.py --all, pytest tests/unit/).
• I have attached real-world evidence matched to the surface I changed, or marked each surface N/A.
• I have updated documentation if user-visible behavior changed — docs/guides/gaia.mdx and the flagship's SKILL.md both said "six gated tools" and now say seven; the flagship's CHANGELOG.md carries the security entry.