邝谧 46adb04e54 fix(egress): close three P0 security gaps in iron-proxy integration ... P0-1: iron_proxy_version() leaked full host env to subprocess - The version probe ('--version') is a one-shot subprocess call but inherited os.environ including OPENAI_API_KEY, ANTHROPIC_API_KEY, BWS_ACCESS_TOKEN, etc. - Build a minimal env from _PROXY_SUBPROCESS_ENV_ALLOWLIST (PATH, HOME, locale) and pass it explicitly. The S603 comment is updated to acknowledge the PATH-fallback risk is real but mitigated by the scrubbed env. P0-2: Bitwarden ImportError branch never checked allow_env_fallback - The sibling branches (missing-secret, empty-token) honor the flag; the ImportError branch silently fell through to host env regardless. - Mirror the sibling behavior: raise unless allow_env_fallback is set. A wizard-time check cannot catch a dependency that goes missing between setup and a later restart. P0-3: Container reuse could cross egress on -> off boundary - When egress_label is 'off', _find_reusable_container skipped the egress label filter entirely, matching containers by (task, profile) alone. An operator running 'hermes egress disable' could end up reusing a container created under egress=on with baked-in proxy env vars and CA mounts. - Add a post-filter: when egress=off, parse the hermes-egress label from the docker ps output (3-field format) and reject containers whose label is present and not 'off'. Tests: 3 new tests - test_bitwarden_importerror_raise_without_fallback - test_bitwarden_importerror_honor_allow_env_fallback - test_reuse_off_rejects_non_off_egress_container - Updated _mock_subprocess_run_with_reuse and inline mocks to 3-field - All 191 iron_proxy + docker tests pass (0 regressions) Review: @maxpetrusenko		2026-06-25 11:00:06 -07:00
..
__init__.py	feat(egress): iron-proxy credential-injection firewall for sandboxes	2026-05-23 20:38:27 -07:00
iron_proxy.py	fix(egress): close three P0 security gaps in iron-proxy integration	2026-06-25 11:00:06 -07:00