Adom Bridge
Public Made by Adomby adom
Adom Bridge unleashes your AI onto your full PC: full power, full safety. The AI breaks out of the container it runs in and onto your real machine, managing and running your entire laptop as you: launch apps, move files, drive any window, control KiCad, Fusion 360 or your real signed-in browser. Works with any AI, cloud or local (Claude Desktop, Claude Code, Codex), no Hydrogen required. Bridge and its bridges are an operating system for AI, with managed Node and Python runtimes, and a human-onl
serve --supervise re-execs the relay with --token in argv, exposing the secret to every process in the container
Version: AD 1.9.213 (container-side relay).
Impact: defeats the point of supplying the token via the environment; puts a freshly rotated secret in ps output.
What happens
serve --token documents [env: ADOM_AUTH_TOKEN=], so a caller can keep the secret out of the process table by exporting it instead of passing a flag. That works for a plain serve. With --supervise it does not:
$ export ADOM_AUTH_TOKEN=<secret> # deliberately NOT on the command line
$ nohup setsid adom-desktop serve --supervise &
$ ps -eo args
adom-desktop serve --supervise-daemon --ws-port 8765 --http-port 8766 --token <SECRET IN CLEAR>
adom-desktop serve --ws-port 8765 --http-port 8766 --token <SECRET IN CLEAR> --force-bind
The watchdog materialises the env var into --token on the argv of both the daemon and the child. /proc/*/cmdline is world-readable, so any process in the container can read it, and it lands in any log or transcript that captures ps.
I had to treat a just-rotated token as burned and rotate again because of this.
Why it matters beyond hygiene
Rotation runbooks are written to keep secrets out of argv (they also leak into shell history, bash -c wrappers over SSH, and process listings captured by monitoring). --supervise is precisely the mode recommended for containers — the guidance and the implementation point in opposite directions.
Asks
- Pass the token to the supervised child via the environment (or a pipe / an fd), not argv.
- If argv is unavoidable for the re-exec, support
--token-file <path>so neither argv nor the environment holds the secret, and document it as the recommended form for containers. - Redact the token in anything AD itself prints about the supervised command line.