Cross-chat prompt injection: the privacy tier is the only boundary

[Broccolito]

What this does

An agent may now inject a prompt into any conversation it can see — a subagent it spawned, a sibling, or a chat the user opened and it has never touched. The privacy tier is the only boundary; lineage is not.

The write rule in privacy/visibility.rs was may_write(c, t, lineage) = visible_to(c, t) && lineage != Other. It is now may_write(c, t) = visible_to(c, t), and Lineage / lineage_of are deleted rather than left as an unread argument (they had one production caller between them).

The disclosure this made load-bearing

requires_first_crossing_approval shipped wired to nothing. tests/privacy_guard_wiring.rs carried it as Status::Unwired("OPERATOR DECISION OUTSTANDING … the state it needs was never built"). Widening the write rule is what settled that decision: a private chat's reachable public targets are no longer only the ones it spawned — it can now write into any public conversation on the machine, one the user opened and is reading.

So the disclosure is built:

• privacy/crossing.rs — the (caller, target) ledger the predicate always needed. Asking never records; only a landed write does, so a denied approval cannot buy silence for the retry.
• WorkspaceCrossingInspector — raises a RequireApproval showing the exact payload, in every permission mode including Fully Automatic, for workspace_send_prompt and workspace_set_tools.

Real-time reflection (§3c) — a genuine gap in all three modes

• note publishes the durable row onto the session bus itself.
• turn's injected prompt is published by Agent::reply where it becomes durable. The MessagesPersisted ordering invariant is a convention and a test net, not a mechanism #66 deliberately never yields a Message for a user prompt, on the premise that the client authored it and already holds it — false for an injection, and nothing else carried the body.
• steer already reached the bus through the target's own drain loop. A second publish would double-render a row that is not durable yet, so it is pinned by test rather than duplicated.
• A publish is a no-op with no subscriber, and a tab the user opened has no subscriber. Every accepted injection now sends an observe frame asking that window to attach one, routed with gui_command_near so it reaches the window actually holding the conversation. Deliberately unordered against the publish: an observer's first frame is a full snapshot, so the message renders whichever arrives first.

ensure_spawn_extension

Now grants workspace_send_prompt and workspace_list.

workspace_list is the entry that needs justifying. For: without it the injection tool's one required argument is unobtainable — an agent knows its children's ids from spawn results and no others — so a grant that advertises send_prompt without it produces a model that tries and fails rather than one that does not try.

Against, and this is the real cost: workspace_list is a targeting oracle. A row carries the conversation's LLM-generated name, its working directory, its enabled extensions and its GUI placement, and scope:"all" returns every same-tier conversation on the machine. A user who turned on "delegate to subagents" did not knowingly turn on "enumerate my chats and their tool grants" — and the enumeration is what makes an injection aimable: a chat can find one whose extensions include developer and inject text that runs there, in that conversation's permission context.

Three things bound it, and none of them is the lineage rule that was removed: appears_in_list still omits private rows rather than redacting them, so the discovery surface is exactly what this capability may already read in full; the delegation tier exists only in BioRouterMode::Auto; and every injection is provenance-stamped and toasted on the target's tab. The trade is recorded at the decision site in agent.rs as well as here.

Still excluded: workspace_set_tools, workspace_open.

Defects found by the adversarial review and the drive-through

Four, all fixed with a regression that fails without the fix:

1. Ledger poisoning. workspace_set_tools { set_knowledge_bases: [] } is an accepted, payload-free change that raised no card — and recorded the crossing, silently consuming the pair's one disclosure. The record half now asks the same crossing_payload the inspector does.
2. execute_code bypassed the disclosure entirely. A script's inner tool calls go straight to dispatch_tool_call, which no inspector sees. Worse than one skipped card: the handler then records the pair, so every later inspected write was silent too. Third boundary refusal added, beside the existing global-memory and session-store ones.
3. The observe frame went to the wrong window (gui_command resolves to the focused one), so a conversation open in a background window never got its live feed — exactly the case §3c exists for.
4. An injected message made an idle chat claim a running turn. Measured live: /active_work empty, target tab at "Thinking · 29s" with a stop button, indefinitely, because no turn existed to publish a terminal.

Two UX fixes requested during review

• Biorouter's own bundled extensions no longer announce themselves. A first run produced six "Extension installed" toasts for developer, computercontroller, autovisualiser, memory, knowledge, agent_drafter — things the user had never heard of on a screen where they had set nothing up.
• Toasts now actually expire. react-toastify defaults pauseOnFocusLoss to true, so every dismissal timer stopped while the window was not frontmost. They were not sticky by configuration; their 5s timer simply never ran.

Verification

cargo test -p biorouter / -p biorouter-server / -p biorouter-mcp / -p biorouter-cli (isolated HOME), npm run test:run (3737 tests, 366 files), ./scripts/clippy-lint.sh, just check-everything — all green. The two too_many_lines baseline hits were fixed by extracting, not by widening the baseline.

Every new regression was verified to fail without its fix.

GUI drive-through (isolated root, driven over CDP): two chats side by side, note/turn/steer each rendering live with navigation.length === 1; the public→private refusal; the private→public approval showing the payload, denied then approved; .br-tab__dot on a data-active="true" tab together with data-working="true" on the composer; and the model's own listing of workspace__workspace_send_prompt.

CLI drive-through: session list, a CLI-driven agent injecting into a chat whose GUI tab reflected it live, and the tier refusal reading correctly in a terminal.

Docs

R6 and DR-5 are retired, §7's nine-column matrix collapses to four, and the execution plan's Task 63 — which planned to refuse this write and delete these predicates — is marked superseded with the original struck through rather than deleted.

Known limits, stated rather than left to be found

• The approval is per (caller, target) pair, not per payload: approving one write from A into B stops the asking for that pair. docs/extensions/built-in/workspace.md now says so plainly.
• workspace_open { new: { prompt } } mints a public session and seeds it with caller text, with no crossing disclosure — a session that does not exist yet has no pair to key on. Pre-existing, out of this PR's scope, and now named explicitly in privacy-tiers.md's open items.
• workflow_inspectors registers neither workspace inspector. Not reachable today; commented so the next person to route the workspace surface through it adds them in the same change.