From c900c4f89a8069d002d07e9ce7f8621867cbd14c Mon Sep 17 00:00:00 2001 From: ScriptedAlchemy Date: Wed, 16 Sep 2026 22:16:53 +0000 Subject: [PATCH 1/2] fix: isolate relay workers by desktop keyring session --- .changeset/relay-keyring-session.md | 5 +++++ src/core/relay/profile.js | 3 +++ test/relay-worker.test.js | 2 ++ 3 files changed, 10 insertions(+) create mode 100644 .changeset/relay-keyring-session.md diff --git a/.changeset/relay-keyring-session.md b/.changeset/relay-keyring-session.md new file mode 100644 index 0000000..bc19c38 --- /dev/null +++ b/.changeset/relay-keyring-session.md @@ -0,0 +1,5 @@ +--- +"grok-bot-cli": patch +--- + +Isolate relay workers by their desktop keyring environment so headless MCP callers cannot replace the authenticated worker used by desktop CLI callers. diff --git a/src/core/relay/profile.js b/src/core/relay/profile.js index 39a18be..9b2070d 100644 --- a/src/core/relay/profile.js +++ b/src/core/relay/profile.js @@ -30,6 +30,9 @@ export function relayProfile(env = process.env) { "GROK_BOT_ALLOW_ANY_GATEWAY", "GROK_BOT_TEST", "NODE_ENV", + // Secret Service credentials depend on the caller's desktop session. + "DBUS_SESSION_BUS_ADDRESS", + "DISPLAY", ]; return digest( JSON.stringify([ diff --git a/test/relay-worker.test.js b/test/relay-worker.test.js index d00df70..3a3f172 100644 --- a/test/relay-worker.test.js +++ b/test/relay-worker.test.js @@ -25,6 +25,8 @@ test("profile shares hosts but isolates endpoint, auth overrides and caller rest { GROK_BOT_GATEWAY_HEADERS: '{"x-route":"secret"}' }, { CODEX_APP_SERVER_SOCK: "/other.sock" }, { GROK_BOT_TEST: "0" }, + { DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/1000/bus" }, + { DISPLAY: ":0" }, ]) assert.notEqual(base, relayProfile({ ...env, ...extra })); assert.ok( From 1e70125ca55c7c5edcdabc68f11bdb92c4a20a56 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 17 Sep 2026 00:02:33 +0000 Subject: [PATCH 2/2] ci: retrigger Package CI and Changeset The windows-latest runs were cancelled while still queued and never executed. This token cannot rerun Actions, so push a no-op commit to start new checks. Co-authored-by: Zack Jackson