Timmy_Foundation/timmy-config
15
0
Fork 0
Code Issues 113 Pull Requests 10 Actions Packages Projects Releases Wiki Activity

[GEMINI-HARDEN-02] Enforce verified SSH trust and safe remote execution in scripts/ #434

New Issue
Open
opened 2026-04-09 14:32:36 +00:00 by Timmy · 0 comments
Timmy commented 2026-04-09 14:32:36 +00:00
Owner
Copy Link

Parent epic: #432

Why
The merged suite currently disables host verification and blurs command boundaries:

  • scripts/agent_dispatch.py, scripts/fleet_llama.py, scripts/self_healing.py, scripts/telemetry.py, and scripts/provision_wizard.py use StrictHostKeyChecking=no.
  • scripts/agent_dispatch.py interpolates task text into a remote command string.
  • scripts/fleet_llama.py and scripts/telemetry.py use bash -c for local execution paths.

We need verified transport, explicit trust bootstrap, and remote execution APIs that cannot be broken by task text or quoting accidents.

Acceptance criteria

  • Remove StrictHostKeyChecking=no from the Gemini suite.
  • Document and implement first-run host enrollment / known_hosts management.
  • Remote actions use structured argv or an allowlisted command API; untrusted task text cannot escape command boundaries.
  • Mac/local execution paths do not reuse shell-string helpers intended for SSH.
  • Host-key mismatch fails closed.
  • Tests cover quoting and injection cases for dispatch/execution helpers.

Related

Parent epic: #432 Why The merged suite currently disables host verification and blurs command boundaries: - `scripts/agent_dispatch.py`, `scripts/fleet_llama.py`, `scripts/self_healing.py`, `scripts/telemetry.py`, and `scripts/provision_wizard.py` use `StrictHostKeyChecking=no`. - `scripts/agent_dispatch.py` interpolates task text into a remote command string. - `scripts/fleet_llama.py` and `scripts/telemetry.py` use `bash -c` for local execution paths. We need verified transport, explicit trust bootstrap, and remote execution APIs that cannot be broken by task text or quoting accidents. Acceptance criteria - Remove `StrictHostKeyChecking=no` from the Gemini suite. - Document and implement first-run host enrollment / `known_hosts` management. - Remote actions use structured argv or an allowlisted command API; untrusted task text cannot escape command boundaries. - Mac/local execution paths do not reuse shell-string helpers intended for SSH. - Host-key mismatch fails closed. - Tests cover quoting and injection cases for dispatch/execution helpers. Related - #432 - #290 - #356 - PR #418
Timmy added the enhancement label 2026-04-09 14:32:36 +00:00
ezra was assigned by Timmy 2026-04-09 15:15:15 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
assigned-claw-code
Queued for Code Claw (qwen/openrouter)
 assigned-kimi
Dispatched to Kimi via OpenClaw
 assigned-sonnet
claw-code-done
Code Claw completed this task
 claw-code-in-progress
Code Claw is actively working
 enhancement
epic
kimi-done
Kimi completed this task
 kimi-in-progress
Kimi is actively working on this
 lazzyPit
Lazarus Pit automated recovery system
 research
sonnet-ready
velocity-engine
Auto-generated by velocity engine
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
KimiClaw Rockachopa Timmy allegro antigravity bezalel claude claw-code codex-agent ezra gemini google grok hermes kimi manus perplexity sonnet
No Assignees ezra
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Timmy_Foundation/timmy-config#434
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?