GHSA-r8fh-9r4w-rf4q: 
Rust vulnerability analysis and mitigation

Fixed in 0.2.0-preview.23; upgrade to it.

Impact

kule agents try NAME, and Try it in the app's agent editor, run a profile once in an empty folder before it is approved. The run is set up like an approved one: trial::try_in (crates/kule-acp/src/trial.rs:143-145) opens the profile's hosts, starts the proxy with profile.agent_keys(..) and launches with launch_for, which applies the whole profile. trial() checks only check_draft (trial.rs:108-110), never the approval. So a profile that came from elsewhere and is still held (a *.kule-profile.json import, an extension's profile, an agents.toml someone shared) gets on a trial, with no approval:

• the variables it names in pass_env, as they are (seen, below);
• through the proxy, the values behind keys, keychain and login_file, put into requests to the hosts the profile itself names (profile.rs:1310-1348; by reading, not run);
• reveal_on_macos and, on Linux, devices. In the app the hint under the form reads "opened no wider than above", but the form does not show keychain, login_file, reveal_on_macos, outside or carry; they travel from the saved profile unseen (crates/kule-desktop/ui/app.js, formProfile). The trial is offered as the step before approval (kule agents add prints "next: kule agents try ID --apply, then kule agents approve ID").

Seen

macOS, a Kule home of its own, a made-up variable:

$ cat agents.toml
[[agent]]
name = "probe"
command = ["/bin/sh", "-c", "echo seen=$KULE_CANARY >&2"]
pass_env = ["KULE_CANARY"]
$ kule --home H agents show probe
held: not approved as it stands; ...
$ KULE_CANARY=fake-canary-value-123 kule --home H agents try probe
trying probe in an empty folder (up to two minutes)…
it did not answer: ACP: Incoming transport closed ...
log      seen=fake-canary-value-123
$ ls H            # no agents-approved.json
agents.toml  tasks  trash  trials

Fix

A trial of a profile that is not approved as it stands runs without the person's values: no pass_env variables, no keys from the environment, the keychain or a login file, no carry, login, reveal_on_macos or devices; the trial says what it withheld. The app's agent form shows every field a profile opens. Found in the 2026-11-13 review, on main at bbf354f (0.2.0-preview.22).