fix: comprehensive exec security hardening — sandbox, env filter, concurrency, admin-only YOLO - #31
Merged
Merged
Conversation
Adding .gitkeep for PR creation (default mode). This file will be removed when the task is complete. Issue: #10
This reverts commit b7176ae.
- Add security controls schema (yolo_confirmation, sandbox_dir, env_whitelist, max_concurrent) to capablities.exec configuration - Add "ton" to tsup externals to resolve build issues
…ltering, admin-only yolo Applies 8 remediation items from issue #10: - Admin confirmation required for yolo mode (run.ts) - Allowlist validation enforcement (run.ts) - Privilege dropping via cwd sandbox + env whitelist (runner.ts, run.ts, install.ts, service.ts, status.ts) - Removed detached: true from spawn (runner.ts) - MAX_CONCURRENT_PROCESSES concurrency limiter (concurrency.ts) - Environment variable whitelist filtering for all exec tools - Sandbox directory creation for restricted working directory - Pre-execution audit logging with proper status tracking Files changed: - New: concurrency.ts — concurrency Limiter singleton - runner.ts: security opts (cwd/env), removed detached: true, ensureSandboxDir - run.ts: admin-only yolo mode, env whitelist, sandbox, admin notification - install.ts: concurrency, sandbox, env filtering, security opts - service.ts: same security controls as install.ts - status.ts: same security controls with try/finally for re-entry - types.ts: added RunSecurityOptions interface - configurable-keys.ts: added 4 exec security config entries - tools.test.ts: updated for new security model
- Remove unused `Config` import and unused `acquired` variable in exec tool files (install.ts, service.ts, status.ts) - Update vitest and @vitest/coverage-v8 to ^4.1.8 to fix critical CVE GHSA-5xrq-8626-4rwp - Exclude src/webui from tsconfig.json (webui is built by Vite, not tsc)
- run.ts: Remove unreachable YOLO admin-gating block (mode "yolo" already handled by early return on line 55; TypeScript correctly narrows type to "allowlist | "off" after that check) - run.ts: Remove unused isUserAdmin/notifyAdmin functions and Config/ToolContext imports - onboard.ts: Add missing security field to both exec config objects (lines ~1016 and ~1212) — required by updated ExecObject schema Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
CI / Lint job requires `prettier --check` to pass. Format 4 files that were missing formatting from the PR #29 rebase. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Rebased version of security hardening for issue #10. Builds on the simplified YOLO disable from PR #30 and adds deeper security controls.
Security Changes
What's new vs PR #30 (already merged)
PR #30 simply disabled YOLO mode. This PR adds:
Conflict Resolution
Resolved 3 merge conflicts by merging both approaches — PR #30's sanitizeEnv + PR #29's RunSecurityOptions sandbox/env whitelist.
Fixes #10