feat(quarantine): static scan + review gate for remote installs (SPEC-005 Part B, fixes #52) - #64
Merged
Merged
Conversation
…-005 Part B, fixes #52) Remote content is guilty until reviewed: - pull/update park fetched artifacts in .agents/.quarantine/ (dot-dir: invisible to sync and index by construction) after a static scan — net-exec (curl|bash), credential access + network, obfuscation (base64 blobs, zero-width/bidi Unicode), prompt-injection phrasing - `sync-agents quarantine` lists pending artifacts with findings; `approve <name>|--all` promotes (CRITICAL findings block without --force; forced approvals recorded in sources.lock as approved_with_findings); `reject` deletes - tree entries quarantine as a unit; the entry lock applies only when the last artifact is approved — a half-approved tree never reads as current - `--trust` bypasses the gate per invocation (scan still prints); `quarantine = off` in .agents/config disables (default ON) Part A (fetch hardening) shipped in #62; Part C (sandboxed exec wrapper) remains future work. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
🤖 AI Code Review CompleteReview performed on changed files. Check inline comments for specific findings. Severity Levels:
|
Repo-wide coverage dipped to 69.6% (gate: 70%) because the new CmdQuarantine/CmdApprove/CmdReject wrappers and ReadConfigQuarantine were exercised only through the source package. Drives pull → quarantine → approve → current through the App layer with an in-memory fetcher. Total now 71.7%. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
🤖 AI Code Review CompleteReview performed on changed files. Check inline comments for specific findings. Severity Levels:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes out #52 / SPEC-005 Part B — remote content is guilty until a human reviews it (the ClawHub supply-chain posture, now default).
Flow
What ships
scan.go): net-then-execute (curl|bash,iwr|iex, base64→sh), credential access (upgraded to CRITICAL when the same file talks to the network), obfuscation (≥120-char base64 blobs, zero-width/bidi Unicode = CRITICAL), prompt-injection phrasing ("ignore previous instructions" = CRITICAL), exec-surface info notes, binary-file flags. Dumb by design — regexes force a human look, they don't adjudicate.quarantine.go): artifact +pending.json(origin, entry-level lock record, findings) under.agents/.quarantine/<bucket>/…. Empty quarantine leaves zero residue.sources.lockasapproved_with_findings(auditable), and tree entries only lock when their last artifact is approved — a half-approved tree never reads as current.--truston pull/update (scan still prints to stderr),quarantine = offin.agents/config(default ON).quarantine/approve/reject(+--globaleverywhere).Tests
9 new go tests: scanner heuristic table, gate-not-install (live tree + lock untouched), approve happy/blocked/forced-with-audit, reject, trust-prints-findings, tree partial-approve lock semantics. Source package coverage now 72.5%. Full suite green (go + all bats — package-level default stays off, so SPEC-003's tests run unchanged; the CLI wires the default ON from config).
Remaining from SPEC-005
Part C (sandboxed exec wrapper:
sandbox-exec/bwrap) stays future work — quarantine + lockfile + hardened fetch kill ~90% of the install-time risk. Also future: routing legacyimportthrough the same gate (it scans nothing today; it's already a thin wrapper slated to fold intosource add).🤖 Generated with Claude Code