3 people 12745352aa CC capability lockdown: shared credential mount + curl|sh RCE closed (+5 hardenings spec'd) (#302) ...

* fix(security): lock down shared Claude Code credential mount + curl|sh RCE

Audit of Claude Code capabilities reachable inside a spawned agent
container turned up two live gaps against the shared harness state:

- Every agent container bind-mounts the host's ~/.claude (OAuth store) and
  ~/.claude.json read-write (_build_mount_args) — the shared subscription
  auth used by the whole fleet. Nothing denied the native Read tool or the
  bash-guard hook from reading .credentials.json / .claude.json, so any
  role could exfiltrate the harness's own Claude Code auth. Deny both at
  the settings.json layer (absolute // form, per the #167 gotcha) and in
  the bash-guard hook's credential-exfil checks (cat/grep/source/base64/
  interpreter one-liners), mirroring the existing .netrc/.git-credentials
  treatment.
- The bash-guard hook only blocked curl/wget to github.com or internal
  hosts; `curl <any other host>/install.sh | bash` (or `bash <(curl ...)`,
  `eval "$(curl ...)"`) executed untrusted remote code unchecked. New
  checks deny piping a fetch into an actual shell (sh/bash/zsh/dash/ksh)
  while leaving non-executing consumers (tar, jq, -o file) untouched.

Also add --disable-slash-commands to every container agent spawn: skills
resolve independently of the --tools allowlist, so a contaminated shared
~/.claude could otherwise leak host skills/plugins into an agent session.
No RoboCo role's workflow uses a Claude Code skill.

64 -> 78 shell bash-guard cases, 54 -> 71 pytest bash-guard cases, plus a
new 5-case settings/CLI test module. ruff/mypy/xenon B clean.

* docs: changelog for the CC capability lockdown

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

2026-07-03 03:05:37 +02:00

..

bash-guard-tests.sh

CC capability lockdown: shared credential mount + curl|sh RCE closed (+5 hardenings spec'd) (#302)

2026-07-03 03:05:37 +02:00