Claude (noether)
3982706ebb
FINDING 1 (security) — the Go daemon accepted netstrings the Python reference REJECTS and then EXECUTED them, so a malformed frame that fails closed on a Python hop ran on a Go hop. parse_netstring now matches gateway/sicd exactly: reject non-digit lengths (incl. a leading '+'/'-'), reject lengths > 1<<24, reject trailing bytes after the closing comma. The three cases now exit 1 with a diagnostic instead of exec'ing. Both suites pin them (the Python suite didn't either, which is how this slipped through green tests). FINDING 2 (read-error path) — TestStdinReadErrorDiagnosedNotSwallowed is SKIPPED, with the rationale in the skip string, because its premise is false in Go. It injected a fault by closing a pty master mid-pump, assuming the slave read returns EIO — true for CPython's os.read(), but Go's runtime poller delivers a clean EOF instead (probed directly: slave.Read -> io.EOF, io.Copy -> nil; a socketpair peer close is EOF too — SO_LINGER/RST is TCP-only). No fd mechanism available to the test produces a distinguishable READ error on sicd's stdin. That is not a gap in main.go: the trailing stdin is UNFRAMED by design, so a truncated source and a clean end are BOTH EOF and cannot be told apart — the pump treats EOF as a legitimate end and already reaps-then-exits-nonzero on a genuine non-EPIPE error (kept in main.go), which just doesn't arise via pty/socket close in Go. Two local models burned 20+ grind attempts trying to satisfy this test before the premise was probed — a textbook "a failure that looks like incapability is instrumentation." Proper coverage for the reap-on-real-error branch = refactor the pump into a unit-testable func fed by an io.Reader that returns a non-EOF error; left as a follow-up. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
sic
Run a command on a remote host without a shell re-parsing its arguments.
ssh host touch 'a b' creates two files: ssh joins its arguments with spaces
and hands the result to the remote login shell, which splits it again. sic host touch 'a b' creates one file named a b. sic sends the argument vector to a
daemon on the host as length-prefixed fields, and the daemon calls execvp on
it. No shell parses the arguments.
Components
sic— client. Takes argv on the command line, frames it as netstrings, pipes the frame oversshtosicd.sicd— daemon on the target host. Reads netstrings from stdin and runs the command.
Both are single static Go binaries (cmd/sic, cmd/sicd). A Python reference
implementation of the daemon is in gateway/sicd.
Wire format
Each field is a netstring: <length>:<bytes>,. A frame is a mode field, zero or
more argument fields, and an empty terminator:
<mode> <arg>* 0:,
argv = ["touch", "a b"] is 4:exec,5:touch,3:a b,0:,. The length prefix means
no byte needs escaping and no delimiter can collide with the payload.
| mode | selector | behaviour |
|---|---|---|
exec (default) |
4:exec, |
execvp(argv), no shell. Arguments are passed through unchanged. |
sh |
2:sh, |
one field passed to sh -c. Pipes, redirects, and globs work. |
Usage
sic <host> <command> [arg ...]
sic --sh <host> '<shell string>'
sic <host> -- <command> [arg ...] # explicit separator
sic host1 echo hello world
sic host1 touch 'a b' # one file named "a b"
sic host1 echo '$HOME' # literal, no expansion
sic --sh host1 'echo hi | wc -c'
Build
go build -o bin/sic ./cmd/sic
go build -o bin/sicd ./cmd/sicd
Install
Client:
cp bin/sic ~/bin/sic
Daemon on each target host. sicd runs what it is sent, so it must only be
reachable over an authenticated transport. Pin it to a dedicated ssh key so the
target can run nothing else with that key:
scp bin/sicd host:/tmp/sicd
ssh host 'sudo install -m755 /tmp/sicd /usr/local/bin/sicd'
# ~/.ssh/authorized_keys on the target:
# command="sicd",no-port-forwarding,no-pty ssh-ed25519 AAAA...
Do not listen on a TCP or message-bus port.
Test
printf '4:exec,2:id,0:,' | ssh host sicd
sic host echo hello world
See also
docs/design.md— wire format, exec modes, transport and security, prior art.demos/quoting-hell.py— six cases run both ways, plainsshversussic.SKILL.md,SKILL-bg.md— agent skill definitions (foreground and background).