security: harden scheduler/auth/mcp against shell injection (port upstream #32)

[JeanBaptisteRenard]

Port of doctly/switchboard#32 (author: @joeytwiddle), manually adapted — the fork's main.js is ~1900 LOC vs upstream's ~350, so this is a full hand-port, not a cherry-pick.

Vectors fixed

1. Scheduler shell injection (high severity)

buildScheduleCommand previously built a shell string by interpolating YAML frontmatter fields (model, permission-mode, max-budget-usd, allowed-tools, append-system-prompt, add-dirs) directly into a bash -c command. A malicious schedule-*.md in any indexed project could achieve RCE within 60 s of the next cron tick.

Fix: buildScheduleCommand now returns { claudeArgs: string[] } — a plain argv array. runScheduleCommand in main.js re-serialises it via quoteArgvForShell() (new helper in shell-profiles.js) before passing to the user's login shell. Each token is POSIX/PowerShell/cmd-quoted so shell metacharacters inside frontmatter values are never interpreted. Input validation (isSafeScalar/assertSafe) additionally rejects control characters, and max-budget-usd is validated as a number.

2. claude-auth.js keychain read

execSync with a shell-interpolated string → execFileSync with an argv array. Prevents $USER or a crafted CLAUDE_CONFIG_DIR from being interpolated into a shell command.

3. mcp-bridge.js lockfile permissions

The lockfile at ~/.claude/ide/<port>.lock contained the MCP auth token and was previously created with default umask (world-readable on many systems). Now written with mode: 0o600. A chmodSync call also tightens permissions on pre-existing files from older builds.

Deliberately deferred

The open-terminal argv refactor (ipcMain.handle('open-terminal', ...)) is a heavier change and is being ported in a separate PR to avoid collision with a parallel in-progress port.

Tests

test/schedule-injection.test.js — 16 new tests covering:

• argv-array return type
• hostile payloads (curl, whoami, backticks, $()) survive as literal tokens
• max-budget-usd numeric validation
• control-character rejection
• quoteArgForShell correctness for bash/zsh/PowerShell
• Full end-to-end: malicious frontmatter → shell command, verify no metacharacters leak outside quoted tokens

All 16 pass. Existing pure-logic tests (32 tests) continue to pass.