harden: container isolation, MCP argument handling, bridge token compare

[korivi-CraftOS]

Four items from the V1.4.3 hardening list (#5, #6, #12, #13). Opening for review rather than merging directly: unlike the six PRs just merged, nothing here has had a second pair of eyes.

#5 docker.sock mount + root container

docker-compose.yml mounted /var/run/docker.sock into the agent container and the image had no USER. The socket is the host's Docker control plane — anything holding it can start a privileged container and take the host — and this container runs shell commands the model chooses.

Checked why it was there before removing it: nothing in the repo ever used it (no docker exec, no docker SDK, no DOCKER_HOST). So the Docker CLI install goes too, along with gnupg/lsb-release, which existed only to add its apt repo. Adds a fixed-uid non-root user and no-new-privileges.

Needs a build test. No Docker daemon was available here, so the image was never built. The USER change is the part that needs one. Bind-mounted host directories keep host ownership, so ./workspace needs chown -R 10001:10001 once — noted in both files.

#6 .dockerignore leaking secrets into published images

Excluded .env but not .credentials/, app/config/settings.json, config.json, agent_file_system/ or logs. COPY . . runs against a developer's working tree and the release workflow pushes to a public registry, so integration tokens and API keys were baked into published layers — permanently, since deleting a file in a later layer doesn't remove it.

#12 MCP stdio argument injection on Windows

The spawn built a shell string and passed it to create_subprocess_shell; one embedded quote closed the quoting and everything after it ran. MCP server config is editable in the UI, importable from a profile bundle and writable by the agent, so those arguments are not trusted input.

Now one create_subprocess_exec path on both platforms. A list alone isn't sufficient — Windows runs .cmd/.bat through cmd.exe however it's spawned, and cmd.exe re-parses the line, so a & echo x still escapes. I verified that by running it. No quoting closes it (the BatBadBut class), so those arguments are refused with a message saying what to do instead.

% and ^ are deliberately allowed: neither can start a command, and rejecting % would break percent-encoded URLs. A URL containing & is refused on a batch target — that looks like a false positive but isn't, since cmd.exe would split it anyway; test_a_url_with_a_query_string_is_refused_on_a_batch_wrapper documents that.

#13 Non-constant-time bridge token compare

validate_bridge_token used == on a caller-supplied header. That token guards every connected integration: present it to /api/integrations/proxy and CraftBot injects the user's real OAuth credentials into the outbound call. Now hmac.compare_digest, on bytes so a non-ASCII or surrogate-bearing header can't turn a failed auth into a 500.

(The a2app half of #13 was already fixed in #452.)

Verification

• 1311 passed, 0 failed on the full suite
• ruff check clean on every file touched
• 53 new tests across the two new files
• Formatting churn from ruff format on unrelated lines was reverted, so the diff is only these four items