feat: Sandbox jobs

[ilblackdragon]

I want to create lots of jobs that run inside Sandbox with sub-agent logic

[serrrfirat]

this needs a 'not root' check. anybody can pass /root/.ssh and they can get arbitrary r/w access to the host

[serrrfirat]

same problem? llm can get prompt injected to root dir

[serrrfirat]

do we have auth on these end points?

[serrrfirat]

LLM feedback
list_sandbox_jobs() returns ALL sandbox jobs for ALL users. Called from the web
server, this means any authenticated user sees every other user's jobs. Same issue
in sandbox_job_summary() and cleanup_stale_sandbox_jobs().

Fix: Add WHERE user_id = $1 parameter to all sandbox job queries.

[serrrfirat]

Security & Correctness Review (by Claude)

PR #4: feat: Sandbox jobs — 14,091 additions across 75 files.

This review was performed by Claude across 6 parallel analysis passes covering: orchestrator auth, sandbox/worker runtime, web gateway, database layer, agent loop/routines, and config/LLM changes.

---

CRITICAL (5 issues — must fix before merge)

1. Arbitrary host directory bind mount via project_dir

src/tools/builtin/job.rs:328-352, 453-456

The create_job tool allows the LLM to specify any host path as project_dir, which gets bind-mounted read-write into the Docker container with zero validation. A prompt-injected LLM could pass project_dir: "/root/.ssh" or project_dir: "/etc", granting the container read-write access to arbitrary host filesystem locations.

Fix: Validate that project_dir falls within ~/.ironclaw/projects/ using path canonicalization + prefix check, or remove the parameter entirely.

2. Orchestrator API binds to 0.0.0.0:50051 with no middleware auth

src/orchestrator/api.rs

The internal orchestrator API listens on all interfaces. While individual handlers call validate_token(), the worker_auth_middleware defined in auth.rs is never applied as a route layer. This is fragile — any new endpoint that forgets the manual auth check becomes publicly accessible. The /health endpoint is already unauthenticated.

Fix: Bind to 127.0.0.1. Apply worker_auth_middleware as a .route_layer() on all /worker/ routes.

3. XSS via marked.parse() + innerHTML without sanitization

src/channels/web/static/app.js:160-176, 181-193

LLM/tool responses are passed through marked.parse() (which allows raw HTML passthrough) and injected via innerHTML without any sanitizer. Any <img onerror="..."> or <script> in a response executes in the user's browser with full access to the auth token.

Fix: Add DOMPurify before innerHTML assignment. Add SRI hash to the CDN-loaded marked library. Add a Content-Security-Policy header.

4. list_sandbox_jobs() IDOR — no user_id filtering

src/history/store.rs:535-547

list_sandbox_jobs() returns ALL sandbox jobs for ALL users. Called from the web server, any authenticated user sees every other user's jobs. Same issue in sandbox_job_summary() and cleanup_stale_sandbox_jobs().

Fix: Add WHERE user_id = $1 parameter to all sandbox job queries.

5. NEAR AI session token stored unencrypted in database

src/llm/session.rs:526-537

The session token is stored as plaintext JSON in the generic settings table, bypassing the existing SecretsStore with AES-256-GCM encryption entirely. Anyone with SELECT on the settings table can read it.

Fix: Encrypt via the existing SecretsCrypto infrastructure, or store through SecretsStore instead of the settings table.

---

HIGH (12 issues — should fix before merge)

#	Issue	File
6	Auth token in URL query parameters for SSE endpoints (visible in logs, referrer, browser history)	app.js:58,492 / web/auth.rs:37-46
7	--dangerously-skip-permissions hardcoded in Claude bridge — disables all tool approval in containers	worker/claude_bridge.rs
8	Non-constant-time token comparison in both orchestrator and gateway auth (timing attack)	orchestrator/auth.rs:43-48 / web/auth.rs:30,41
9	/projects/ file serving routes are unauthenticated — merged outside the auth-protected router	web/server.rs:182-192
10	No token expiry/TTL on job bearer tokens — leaked tokens valid forever until process restart	orchestrator/auth.rs
11	Auth tokens leaked to event triggers — check_event_triggers runs on ALL messages including auth token submissions, storing them in routine_runs.trigger_detail	agent/agent_loop.rs:436-442
12	Credential exposure via settings table/API — database_url with password serialized to DB and exposed via /api/settings	settings.rs:20 / store.rs:1368-1386
13	XSS in breadcrumb onclick via single-quote breakout — escapeHtml() doesn't escape '	app.js:450-459
14	XSS in jobs table via unescaped class/onclick attributes	app.js:781-794
15	No CSP header; marked loaded from CDN without SRI hash	index.html:8 / server.rs:159-175
16	Session file written with default 0644 permissions (world-readable NEAR AI bearer token)	llm/session.rs:487-521
17	Debug logging of full API request/response bodies (user messages, system prompts) at debug level	nearai.rs:222,238,241 / nearai_chat.rs:76,88,99

---

MEDIUM (17 issues)

#	Issue	File
18	Token passed as container env var (visible via docker inspect, /proc/1/environ)	job_manager.rs
19	Entire ~/.claude directory mounted into container (all credentials exposed)	job_manager.rs
20	Container bridge networking allows unrestricted outbound traffic (no proxy like existing SandboxManager)	job_manager.rs
21	Follow-up prompts injected without safety sanitization	worker/runtime.rs
22	truncate / truncate_for_preview panic on multi-byte UTF-8 (byte indexing on char boundaries)	routine_engine.rs:567 / agent_loop.rs:40
23	Cross-user event triggering — list_event_routines() loads ALL users' routines, User B's messages fire User A's routines	routine_engine.rs:96-140
24	Path traversal via routine names used in workspace paths (routines/{name}/state.md)	routine.rs tool / routine_engine.rs:418
25	Webhook trigger secret stored in plaintext JSON in DB trigger_config column	routine.rs:67-72
26	No rate limiting on auth attempts, LLM proxy, or chat endpoints	orchestrator/api.rs / web/server.rs
27	No input validation on message content length (DoS / LLM cost amplification)	web/types.rs:8-12
28	update_routine / update_sandbox_job_mode / delete_routine have no ownership checks	store.rs:709-717, 861-906, 942-948
29	Race condition in save_sandbox_job ON CONFLICT — can overwrite "completed" with "running"	store.rs:477-482
30	No LIMIT on list_sandbox_jobs() query — unbounded result set	store.rs:539-544
31	Integer truncation: Duration::as_secs() as i32 overflows at ~24.8 days	store.rs (lines 137, 282, 296, 743)
32	Recovered tool calls from XML tags in LLM content bypass normal structured tool-call path	reasoning.rs:327-341
33	MCP server config loaded from DB without calling .validate()	mcp/config.rs:333-370
34	routine_update silently converts event/webhook triggers to cron when schedule param is provided	routine.rs tool lines 439-448

---

LOW (12 issues)

#	Issue	File
35	Auth token logged at INFO level on startup	web/mod.rs:207
36	Worker token remains in env/memory after read (should remove_var)	worker/api.rs
37	Error messages leak internal details to clients	web/server.rs (multiple handlers)
38	No audit logging for auth failures	orchestrator/auth.rs
39	escapeHtml() doesn't escape single quotes	app.js:807-811
40	No max WebSocket/SSE connection limit	sse.rs / ws.rs
41	parse_job_state silently defaults to Pending on unknown values	store.rs:1219-1231
42	Bootstrap load_from silently swallows JSON parse errors	bootstrap.rs:84-88
43	Settings/bootstrap files written with default permissions	settings.rs:562 / bootstrap.rs:113
44	Missing ON DELETE CASCADE on job_events FK (inconsistent with rest of schema)	V5__claude_code.sql:8
45	No CHECK constraints on trigger_type/action_type enum columns	V6__routines.sql:15-19
46	dirs::home_dir() fallback to . in multiple places — secrets written to CWD in containers	config.rs:324-329 / settings.rs:491-496

---

Positive Observations

• No SQL injection — All queries use parameterized statements. Zero string interpolation.
• Per-job bearer tokens — Good isolation design for container auth.
• SecretString usage — API keys, DB URLs, and master keys properly wrapped to prevent accidental Debug logging.
• Token parameter removed from tool_auth — Prevents LLM from seeing API tokens in conversation history.
• HTTPS enforcement for tunnel URLs and remote MCP servers.
• OAuth PKCE default — Aligns with OAuth 2.1 requirements.
• Path traversal protection on /projects/ file serving uses canonicalize().starts_with().

---

Recommended Priority

Before merge (blocking):

1. Critical #1 — arbitrary host bind mount
2. Critical #2 — bind orchestrator to 127.0.0.1 + apply auth middleware
3. Critical #3 — XSS via marked (add DOMPurify)
4. Critical #4 — IDOR in sandbox job queries
5. Critical #5 — encrypt session token in DB

Shortly after merge:

• High #6-17 (auth token in URLs, constant-time comparison, CSP headers, unauthenticated project serving, session file permissions)

---

Review performed by Claude (Opus 4.6) across 6 parallel analysis agents.