wave-ctx-security

Security Context

Three-layer defense system — permission enforcement (deny-first tool access control), input sanitization (prompt injection detection, risk scoring), path validation (traversal prevention, symlink rejection, Unicode homograph detection), sandbox isolation (Docker with full hardening, bubblewrap via Nix), credential scrubbing in audit logs, and curated subprocess environments.

Invariants

• Deny patterns ALWAYS take precedence over allow patterns — deny rules checked first, match blocks regardless of allow rules
• Path traversal sequences always rejected — checks .., ./, ../, ..\, URL-encoded variants (%2e%2e, %252e%252e, ..%2f, ..%5c)
• Paths must be within approved directories — resolved to absolute, checked via filepath.Rel, relative path must not start with '..'
• Symlinks rejected by default — every path component checked via os.Lstat for os.ModeSymlink when AllowSymlinks is false
• Unicode homograph attacks detected and blocked — UTF-7 sequences rejected, mixed confusable scripts (Latin+Cyrillic, Latin+Greek, Latin+Arabic, Latin+Hebrew) rejected; CJK intentionally allowed
• Path length must not exceed MaxPathLength (default 255)
• Prompt injection detection enabled by default in strict (MustPass) mode — seven regex patterns detect injection attempts
• Input length capped at MaxInputLength (default 10000 characters) — excess truncated
• Schema content size must not exceed ContentSizeLimit (default 1MB) — hard error, not truncation
• Script tags, event handlers, and javascript: URLs always stripped from schema content
• TodoWrite always injected into the deny list for every adapter invocation
• Docker containers always run with --read-only, --cap-drop=ALL, --security-opt=no-new-privileges, --network=none
• Docker containers get tmpfs mounts with nosuid,nodev for /tmp, /var/run, /home/wave
• Artifact directories mounted read-only in Docker; output and workspace directories read-write
• Docker UID/GID mapping defaults to host user — prevents root execution inside container
• All logged output scrubbed for credential patterns before writing to disk — 8 patterns: API_KEY, TOKEN, SECRET, PASSWORD, CREDENTIAL, AUTH, PRIVATE_KEY, ACCESS_KEY
• Credential scrubbing applies to ALL log methods — tool calls, file ops, step start/end, error messages
• DebugTracer writes are thread-safe — sync.Mutex protects file handle, verified with 50-goroutine concurrency test
• Adapter subprocesses receive curated environment, not full host environment — only HOME, PATH, TERM, TMPDIR=/tmp plus whitelisted vars
• Claude Code telemetry suppressed — DISABLE_TELEMETRY, DISABLE_ERROR_REPORTING, CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY, DISABLE_BUG_COMMAND
• Claude Code always runs with --dangerously-skip-permissions — Wave enforces permissions via agent frontmatter instead
• All embedded personas, pipelines, and prompts scanned for unsafe CLI interpolation patterns — prevents shell injection via double-quoted variable expansion
• MaxPathLength, MaxInputLength, and ContentSizeLimit must all be positive — non-positive values produce non-retryable SecurityValidationError
• AllowSymlinks defaults to false, AllowUnknownPersonas defaults to false, ValidatePersonaReferences defaults to true
• Risk score capped at 100 — scores >=50 considered high risk
• Security errors are structured with retryability metadata — path traversal and config errors non-retryable; injection and input errors retryable