Security hardening: env isolation, permissions, input validation, path safety

[nobugpal]

Security hardening: env isolation, permissions, input validation, path safety

Summary of Changes

This PR applies four independent security hardening improvements to the Shannon CLI.

1. Restrict forwarded environment variables (env.ts)

Problem: The FORWARD_VARS list included API keys and bearer tokens that were forwarded to Docker containers as environment variables. These were visible via docker inspect and inside the container's /proc/*/environ.

Fix: Removed credential variables (ANTHROPIC_API_KEY, CLAUDE_CODE_OAUTH_TOKEN) from FORWARD_VARS. Only infrastructure configuration variables are now forwarded. Credentials continue to reach the worker through the existing providerConfig mechanism in claude-executor.ts.

2. Harden workspace directory permissions (start.ts)

Problem: Workspace directories and subdirectories were created with world-writable permissions (0o777), allowing any local user to modify audit logs, exploitation queue files, and session state.

Fix: Changed permissions from 0o777 to 0o755 (owner can write, others read-only). The container user (UID-remapped via entrypoint) retains write access.

3. Add input validation for workspace ID (logs.ts)

Problem: The shannon logs command accepted arbitrary workspaceId strings that were joined directly into file system paths, allowing path traversal.

Fix: Added a WORKSPACE_ID_PATTERN validation that only allows alphanumeric characters, hyphens, underscores, and dots. Path separators (/, \) and traversal sequences (..) are rejected.

4. Add path safety checks for --repo and --config (paths.ts)

Problem: The resolveRepo() and resolveConfig() functions accepted arbitrary paths with no validation, allowing system directories (e.g., /etc, /var/lib/docker) to be mounted into the worker container.

Fix: Added a blocklist of system-critical directories and sensitive home subdirectories (.ssh, .aws, .config, etc.) that cannot be mounted. A warning is also emitted when mounting paths outside the expected workspace directory.

Testing

• Verified no credential variables appear in docker inspect output
• Verified workspace directory permissions are 0o755 (not world-writable)
• Verified path traversal sequences are rejected by logs command
• Verified system directories (/etc, ~/.ssh, etc.) are blocked from mount
• Verified legitimate paths (/tmp/my-repo, ~/Projects/myapp) are allowed
• TypeScript syntax verified for all four modified files