feat: execution sandbox hardening (Codex #1, Level 1) + remove internal docs (#10)

Sandbox (the last open critical from the Codex review):
- createCommandRunner({ env }) — when set, replaces the child env so
  spawned commands don't inherit the parent environment.
- scrubbedEnv() strips secret-shaped vars (ANTHROPIC_API_KEY,
  OPENAI_API_KEY, GH/GITHUB tokens, *_KEY/_TOKEN/_SECRET/_PASSWORD, AWS_*
  etc.) while keeping PATH/HOME/npm_config_* so pnpm/tsc/vitest still run.
- run-a builds the loop's runner with scrubbedEnv(); GitOps keeps its own
  full-env runner so `git push` / `gh pr create` still authenticate.
  That's credential separation: secrets are in scope ONLY for the git/gh
  steps that need them, never for untrusted target-repo install/build/test.
- pnpm install runs with --ignore-scripts by default; opt back in via
  ASIL_ALLOW_INSTALL_SCRIPTS=1. Kills lifecycle-script RCE on install.
- README gains a "Running against untrusted repos" section stating plainly
  what Level 1 does and does not protect (no fs/network isolation yet;
  containerized exec is the planned opt-in for adversarial input).

Internal docs removed from the public repo and moved to the private KB
(ASIL/private-kb/, outside the repo): CODEX_REVIEW.md and the design doc.
.gitignore now excludes CODEX_REVIEW.md and docs/design/ so they can't be
re-committed by accident.

Tests: 384 → 387. New: scrubbedEnv strips secrets / keeps build vars;
CommandRunner { env } isolates a secret from the spawned process while the
inherited runner still sees it; loop installs with --ignore-scripts by
default. No skips.

Refs Codex review #1 (private KB).

Author: telivity-otaip

.gitignore

@@ -15,3 +15,7 @@ dist/
 .asil/
 *.log
 coverage/
+
+# Internal/private review + design notes — kept in private KB, never in the public repo
+CODEX_REVIEW.md
+docs/design/

CODEX_REVIEW.md

@@ -86,6 +86,15 @@ Optional layer. Pass `--transcripts <dir>` to `pnpm --filter asil-runners run:a`
 
 ASIL can run against any HTTP server speaking the OpenAI-compatible `/v1/chat/completions` API: **Ollama, LM Studio, vLLM, llama.cpp server, OpenRouter, Azure OpenAI**. Set `ASIL_LLM_BASE_URL` and `ASIL_LLM_MODEL` and the runner uses the local adapter instead of cloud Anthropic. `ANTHROPIC_API_KEY` is no longer required in local mode. Cost-controller token caps still bite (chars/4 fallback when the server omits `usage`); the dollar number reports as $0 since local inference has no wire cost. Full walkthrough — including the mixed cloud-execution + local-adversarial-gate recipe — in [`examples/local-llm.md`](examples/local-llm.md).
 
+### Running against untrusted repos — sandbox
+
+ASIL executes target-repo code (`pnpm install`, build, tests) inside disposable worktrees. To keep that safe:
+
+- **Secrets are stripped from the execution environment.** The runner that executes target-repo commands gets a scrubbed env — `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, and git/GitHub tokens are never in scope, so a malicious `postinstall`/build/test script can't exfiltrate them. The git/`gh` operations that genuinely need a token use a separate, full-env runner (credential separation).
+- **Install lifecycle scripts are disabled by default** (`pnpm install --ignore-scripts`). Opt back in with `ASIL_ALLOW_INSTALL_SCRIPTS=1` only for repos you trust.
+
+This is process-level hardening (Level 1). It removes the credential-exfiltration vector but does **not** sandbox the filesystem or network — a hostile repo's build/test can still read local files or make network calls. For genuinely adversarial input, run ASIL inside a container with `--network=none` (containerized exec is a planned opt-in). See the design notes in the private KB.
+
 ### Languages — Python profile
 
 The scanner is profile-driven (`LanguageProfile` interface). TypeScript is the reference; Python ships out of the box. Select via `--profile <ts|python>`. Python requires `pytest` with the `pytest-json-report` plugin, `mypy`, and `coverage.py`. Adding Go or Rust is a "write a profile" task, not a fork.

README.md

@@ -149,6 +149,42 @@ describe('runLoop — integration', () => {
     expect(result.outcomes[0]?.totalTokenUsage.outputTokens).toBeGreaterThan(100);
   });
 
+  it('installs target-repo deps with --ignore-scripts by default (Codex #1 — no lifecycle-script RCE)', async () => {
+    const queue = new TaskQueue(queuePath);
+    queue.enqueue(mkTask({ id: 't-ignore-scripts' }));
+
+    const installArgsSeen: string[][] = [];
+    const runner = mockRunner([
+      {
+        match: (cmd, args) => {
+          if (cmd === 'pnpm' && args.includes('install')) installArgsSeen.push(args);
+          return cmd === 'pnpm' && args.includes('install');
+        },
+        exitCode: 0,
+      },
+      { match: (cmd) => cmd === 'diff', exitCode: 1, stdout: CANNED_UNIFIED_DIFF },
+      { match: (cmd) => cmd === 'pnpm', exitCode: 0 },
+      { match: (cmd) => cmd === 'grep', exitCode: 0 },
+    ]);
+
+    await runLoop(cfg(), {
+      llm: goodLLM(),
+      codex: mockCodex(JSON.stringify({ approved: true, severity: 'pass' })),
+      git: mockGit('https://example.com/pr/3'),
+      tracker,
+      budgetManager,
+      runner,
+      fileReader: mockFileReader(),
+      fileFetcher: mockFileFetcher(),
+      diff: mockDiffApplier(),
+      readCurrent: fakeReadCurrent,
+      queue,
+    });
+
+    expect(installArgsSeen.length).toBeGreaterThan(0);
+    expect(installArgsSeen[0]).toContain('--ignore-scripts');
+  });
+
   it('pnpm install failure in the worktree → task aborts as infra-failed, LLM never called, worktree cleaned (Codex #6)', async () => {
     const queue = new TaskQueue(queuePath);
     queue.enqueue(mkTask({ id: 't-install-fail' }));

docs/design/2026-06-17-criticals-sandbox-and-budget.md

@@ -221,11 +221,18 @@ export async function runLoop(
       // 3b. Install dependencies in the worktree so typecheck + tests work.
       //     Without this the clone has no node_modules and every tsc/vitest
       //     call fails with "Cannot find module" errors.
-      const installResult = await deps.runner.run(
-        'pnpm',
-        ['install', '--frozen-lockfile'],
-        { cwd: workDir },
-      );
+      // --ignore-scripts by default: a target repo's install lifecycle
+      // scripts (postinstall/prepare) are arbitrary code we should not
+      // run with ASIL's privileges. Opt back in with
+      // ASIL_ALLOW_INSTALL_SCRIPTS=1 for repos that genuinely need them
+      // (the operator then explicitly accepts the risk). (Codex #1.)
+      const allowInstallScripts = process.env.ASIL_ALLOW_INSTALL_SCRIPTS === '1';
+      const installArgs = allowInstallScripts
+        ? ['install', '--frozen-lockfile']
+        : ['install', '--frozen-lockfile', '--ignore-scripts'];
+      const installResult = await deps.runner.run('pnpm', installArgs, {
+        cwd: workDir,
+      });
       if (installResult.exitCode !== 0) {
         // Install failure is fatal: with no node_modules, every
         // downstream typecheck/test runs in a known-bad environment and