feat(security): detect a created-in-session core.hooksPath dir (sandbox-escape Issue F) - #86
Merged
Merged
Conversation
…ooksPath dir (Issue F) Sandbox-escape eval Issue F (LOW). The core.hooksPath :ro mount (#82) is existence-gated — it only covers a hooks dir present at launch. The create-fresh case (hooksPath set, dir absent at launch, agent writes .githooks/pre-commit in-session) escapes both the mount and the static protected-dirs walk, so it went undetected. It's the last uncovered slice of Pillar #4 (Issue D's residual). - sandy: _sandy_configured_hooks_rel resolves the configured hooksPath existence-independently (unlike _sandy_extra_hooks_dir, which needs the dir to exist for the mount), with the same containment rules (inside workspace, not root, no .. escape, not an already-protected dir). Snapshot records it only if it existed at launch; the exit sweep flags a newly-appeared hooks dir with content alongside the other auto-execution configs. - run-tests.sh §38d: 8 resolver cases incl. the absent-dir case (the F gap), root/escape/outside/already-protected rejections. - CLAUDE.md + SPEC: document the create-fresh coverage (was marked 'deferred'). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sandbox-escape eval Issue F (LOW) — closes the last detection slice of Issue D's residual.
The
core.hooksPath:romount (#82) is existence-gated: it only covers a hooks dir present at launch. The create-fresh case —core.hooksPathset but the dir absent at launch, so the agent writes.githooks/pre-commitduring the session — escapes both the mount and the static protected-dirs walk, and fires on the user's next hostgit commit. The code + SPEC previously marked this 'deferred to a generalized auto-exec sweep (Issue F)'; this is that sweep._sandy_configured_hooks_relresolves the configured hooks path existence-independently (same containment rules as_sandy_extra_hooks_dir: inside workspace, not root, no..escape, not an already-protected dir). The launch snapshot records it only if it existed; the exit sweep flags a newly-appeared hooks dir with content.Detection + warn only (no auto-delete), consistent with the existing philosophy.