fix(sandbox): keep agent workspace off gateway state files

[cursor]

Summary

Default workspace_path was ~/.shellclaw, the same directory as gateway pairing tokens, memory.db, and config.toml. With default workspace_only=1, inbound Discord / WebChat / cron file tools treated those files as in-bounds.

Bug

• File/function: src/core/config.c (config_load default), src/tools/file.c (path_within_workspace), src/sandbox/allowlist.c
• Trigger: Run ShellClaw with a default or example config (no custom workspace_path). Send a Discord/WebChat/cron prompt that causes the agent to read_file / write_file auth_tokens.json, or cat ~/.shellclaw/auth_tokens.json via shell.
• Impact: Steal or wipe dashboard pairing bearer tokens; overwrite memory.db or config.toml. After PR fix(asap): wire provider and tools into POST /asap #53 lands, the same path applies to inbound POST /asap.
• Distinct from fix(sandbox): block .. escapes when shell destinations do not exist #66/fix(gateway): bind listen socket to configured host #68/fix(sandbox): Landlock + relative-token block for workspace FS escapes #74/fix(sandbox): fail closed when namespace isolation cannot be applied #76 (sandbox escapes) and fix(file): persist workspace writes with atomic replace #78 (ENOSPC truncate): those address leaving the workspace. This is the workspace root sitting on the state directory, so the default-on workspace_only boundary includes secrets.

Root cause

workspace_only is a prefix check against workspace_path. The default path was the process state dir, so the security control that is on by default authorized tool access to pairing tokens.

Fix

• Default workspace_path to ~/.shellclaw/workspace and create that directory at tool init.
• Deny auth_tokens.json, shellclaw.pid, shellclaw.log, and .shellclaw/config.toml / .shellclaw/memory.db even if they sit inside a custom workspace.
• Block those token names in the shell allowlist and unsandboxed fallback list.

Validation

• CI=true GATEWAY=1 make test (full suite, including new file/allowlist/config/shell cases)

  

[cursor]

Summary

This PR moves the default tool workspace from ~/.shellclaw to ~/.shellclaw/workspace, and it refuses pairing tokens, the pid file, the log, and .shellclaw/config.toml / .shellclaw/memory.db when a custom workspace still contains them. The default split is the right fix, and the file-tool test checks that token bytes are not returned.

The compatibility denylist is incomplete. I compiled allowlist.c against a throwaway driver: absolute config.toml is blocked, and the three cases below are allowed (allowlist_check_shell_command returns 0).

Must Fix

1. memory.db-wal and memory.db-shm are not reserved. src/core/memory.c sets PRAGMA journal_mode=WAL, so live memory and session pages sit in those sidecars. allowlist_path_is_runtime_state_file matches only the exact basename memory.db. With the workspace pointed at a .shellclaw directory, read_file / write_file and cat <abs>/.shellclaw/memory.db-wal are allowed. Match memory.db and memory.db-* when the parent directory is .shellclaw.
2. Sandboxed shell chdirs into workspace_path (setup_child_process in src/sandbox/sandbox.c) but the new check only inspects the raw token. has_path_chars ignores a token that does not start with /, ~, or ., and a bare config.toml has no slash, so the parent-directory test returns "not reserved". cat config.toml and cat memory.db are allowed, then the child reads the state files. Resolve the token against the workspace root before deciding. tests/test_allowlist.c only asserts absolute cat %s paths, so CI stays green.

Should Fix

• ensure_workspace_directory treats any EEXIST as success. If ~/.shellclaw/workspace is a symlink (including one planted before this upgrade), later realpath uses the link target as the workspace root and the default split is gone. lstat the final component and refuse a symlink or a non-directory.
• The runtime-state loop sits under the workspace_only early return in allowlist_check_shell_command, and the unsandboxed fallback in src/tools/shell.c never calls it. sandbox_enabled stays 0 unless TOML sets it. Unsandboxed cat ~/.shellclaw/config.toml still runs. A global substring on config.toml is too broad. Run the same path predicate on that fallback for real path tokens.
• test_runtime_state_files_rejected_inside_workspace returns without failing when mkdir fails, so a setup error looks like a pass. test_shell_blocked_auth_tokens passes a NULL config, so it only hits the fallback substring.

Nice to Have

• test_defaults only checks that the path ends in /workspace, not that the parent is .shellclaw.
• ensure_workspace_directory creates only the immediate parent. The default ~/.shellclaw/workspace is fine. A deeper custom path logs a mkdir failure and tools_init still returns 0. File access then fail-closes because the workspace does not resolve.
• Every basename auth_tokens.json is reserved, not only under .shellclaw. That also blocks an unrelated project file and any command that merely mentions the name. The header comment says this is intentional.

Positive Highlights

• Separating the tool root from the state directory fixes the default case without a new sandbox mechanism.
• config.toml and memory.db are reserved only when the parent is .shellclaw, and test_allow_project_config_toml locks the other case.
• The file-tool regression checks that secret-pair is absent from the tool result, not only that the call returned -1.
• Example config, CHANGELOG, and the gateway oversize-file helper were updated for the new directory.

  

_{Sent by Cursor Automation: Adrianno’s personal code review}

[adriannoes]

Should Fix items that were not inline threads are also in e63a7ec:

• Unsandboxed shell runs allowlist_check_shell_command with a null config, so path tokens hit the runtime-state predicate without a global config.toml substring.
• test_runtime_state_files_rejected_inside_workspace fails the test if mkdir fails.
• test_defaults now requires the path to end in /.shellclaw/workspace.

Left as-is: a custom workspace whose parents do not exist still fail-closes when realpath misses (no recursive mkdir). Every basename auth_tokens.json stays reserved, as the header already documents.

[cursor]

🔒 Agentic Security Review
Severity: HIGH

The new runtime-state denylist inspects raw strtok tokens and exact basenames. A quoted or globbed path such as cat "~/.shellclaw/auth_tok*" never matches auth_tokens.json / config.toml, has_path_chars skips the token because it does not start with /, ~, or ., and the unsandboxed fallback still calls this check with cfg == NULL.

Impact: An inbound Discord/WebChat/cron prompt that causes shell can still dump pairing tokens or config.toml after this PR’s default workspace split.

 

^{Reviewed by Cursor Security Reviewer for commit e63a7ec. Configure here.}