feat: layered prompt injection security scanning

[waynesun09]

Summary

• Adds defense-in-depth security scanning pipeline with two execution paths for the fullsend CLI runner
• Path A (GHA pre-step): fullsend scan input|output|context|url commands scan EVENT_PAYLOAD before sandbox creation, with optional LLM Guard ML detection
• Path B (sandbox-internal): pre-agent context file scanning, runtime Claude Code hooks (Tirith, SSRF, secret redaction), post-agent output scanning
• Extends harness YAML schema with SecurityConfig — secure by default (omitting the block enables all scanners with fail_mode: closed)
• Embeds Python hook scripts via go:embed with JSONL audit logging and trace ID correlation

New packages/files

• internal/security/ — Scanner interface, Pipeline, UnicodeNormalizer, ContextInjectionScanner, SSRFValidator, SecretRedactor, LLMGuardScanner, trace ID generation, hook embedding
• internal/security/hooks/ — 3 Python hook scripts (ssrf_pretool, secret_redact_posttool, tirith_check)
• internal/cli/scan.go — fullsend scan CLI subcommands

Modified files

• internal/harness/harness.go — SecurityConfig schema types, validation, helper methods
• internal/cli/run.go — pre-agent scan (step 7d), post-agent output scan (step 8e), hook bootstrap, trace ID injection
• internal/cli/root.go — wire scan command

Dependencies

Draft: Depends on PR #231 (sandbox runner) merging first. This branch is based on PR 231's commit 1383726.

Implements story 6 (issue #129).

Test plan

• go test ./... — all 10 packages pass
• go vet ./internal/... — clean
• go build ./cmd/fullsend/ — binary builds
• E2E test with known-bad payload → verify host scan blocks
• E2E test with security enabled → verify hooks fire and findings logged
• E2E test with fail_mode: open → verify warnings but no blocking

[github-actions]

Site preview

Preview: https://39c2c0d4-site.fullsend-ai.workers.dev

Commit: 3e49da87615320dd5f6636c77c9fecc9c1b7ecfe

[waynesun09]

Heads up @maruiz93 — this PR adds a new base sandbox Containerfile at images/sandbox/Containerfile that extracts the common runtime layer (Claude Code, rsync, tirith) out of the experiment-specific image.

The experiment Containerfile at experiments/runner-hello-world/experiment/Containerfile now extends this base via ARG BASE_IMAGE, and run-experiment.sh builds the base first then the experiment image on top.

Key changes to the image setup:

• Claude Code installed via the official curl -fsSL https://claude.ai/install.sh | bash (replaces npm approach, no Node.js dependency needed)
• tirith v0.2.12 baked in with sha256 checksum verification for supply chain safety
• TIRITH_REQUIRED=1 env var set by the harness so the hook fails closed if the binary is unexpectedly missing

This builds on the sandbox infrastructure from #231 — would appreciate your review on the image layering approach.

[ralphbean]

Security review — 3 high-severity findings related to fail-open behavior under degraded conditions.

[waynesun09]

Addressed all three findings from @ralphbean's security review in two commits:

Commit bc7790d — direct fixes for the 3 high-severity findings

• ssrf.go: Default resolveDNS to true in Scan() and ValidateRedirectChain() to prevent DNS rebinding bypasses
• ssrf_pretool.py: Add socket.getaddrinfo() DNS resolution check to the Python hook for parity with the Go scanner
• tirith_check.py: Apply TIRITH_REQUIRED guard to TimeoutExpired and generic Exception branches (not just FileNotFoundError)
• llmguard.go: Add Required field that fails closed when Python is unavailable in sandbox context

Commit a96f208 — hardening from follow-up review (3 agents: Gemini, security-focused, code quality)

• llmguard.go: NewLLMGuardScanner constructor now accepts required bool param (was dead code before — field was never set); LLM_GUARD_REQUIRED=1 env var propagated to inline Python so ImportError also fails closed; warning writes to stderr instead of stdout
• scan.go: CLI scan url --resolve-dns defaults to true for consistency with Scan()/ValidateRedirectChain()
• ssrf_pretool.py: 2s timeout on socket.getaddrinfo() to prevent hook blocking on slow/malicious DNS
• tirith_check.py: Exception message sanitized to type(e).__name__ only (prevents leaking env details to agent); module docstring updated to reflect conditional fail-open/fail-closed behavior
• scanner_test.go: 8 new tests covering DNS resolution paths (localhost, NXDOMAIN, Scan default, redirect chain) and LLMGuardScanner.Required (fail-closed, fail-open, constructor propagation)

TOCTOU DNS rebinding (filed separately)

The DNS rebinding TOCTOU race (hook resolves DNS at check time, but Claude Code's tool performs its own lookup at request time) is filed as a separate issue. In the OpenShell sandbox, network policies block connections to private IPs at the supervisor level regardless of DNS, so the hook provides defense-in-depth + audit trail while OpenShell is the authoritative enforcement. See the linked issue for details.