fix: address credential and evidence review

avifenesh · avifenesh · commit c7806d917e93 · 2026-08-08T22:06:12.000+03:00
diff --git a/crates/agnix-cli/locales/en.yml b/crates/agnix-cli/locales/en.yml
@@ -1298,6 +1298,8 @@ rules:
     sigv4_object: sandbox.credentials.sigv4 must be an object (got %{actual})
     sigv4_entry: 'sandbox.credentials.sigv4.%{field} must be deny or passthrough, and the field must be streaming, presigned, or sigv4a (got %{actual})'
     sigv4_suggestion: Set streaming, presigned, and sigv4a policies to deny or passthrough, or remove unsupported fields.
+    tls_terminate_required: AWS credential re-signing via sandbox.credentials.%{feature} requires sandbox.network.tlsTerminate to be an object
+    tls_terminate_suggestion: 'Set sandbox.network.tlsTerminate to an object such as {}, or remove the AWS credential re-signing settings.'
   cc_set_013:
     message: autoMode.classifyAllShell must be a boolean when present (got %{actual}); Claude Code 2.1.193+ documents this
       auto-mode setting as a strict true/false toggle
diff --git a/crates/agnix-cli/locales/es.yml b/crates/agnix-cli/locales/es.yml
@@ -808,6 +808,8 @@ rules:
     sigv4_object: sandbox.credentials.sigv4 debe ser un objeto (se obtuvo %{actual})
     sigv4_entry: 'sandbox.credentials.sigv4.%{field} debe ser deny o passthrough, y el campo debe ser streaming, presigned o sigv4a (se obtuvo %{actual})'
     sigv4_suggestion: Establece las politicas streaming, presigned y sigv4a en deny o passthrough, o elimina campos no admitidos.
+    tls_terminate_required: La firma de credenciales de AWS mediante sandbox.credentials.%{feature} requiere que sandbox.network.tlsTerminate sea un objeto
+    tls_terminate_suggestion: 'Establece sandbox.network.tlsTerminate en un objeto como {}, o elimina la configuracion de firma de credenciales de AWS.'
   cc_set_013:
     message: autoMode.classifyAllShell debe ser un booleano cuando esta presente (se obtuvo %{actual}); Claude Code 2.1.193+
       documenta esta configuracion de auto-mode como un interruptor true/false estricto
diff --git a/crates/agnix-cli/locales/zh-CN.yml b/crates/agnix-cli/locales/zh-CN.yml
@@ -772,6 +772,8 @@ rules:
     sigv4_object: sandbox.credentials.sigv4 必须是对象（实际为 %{actual}）
     sigv4_entry: 'sandbox.credentials.sigv4.%{field} 必须是 deny 或 passthrough，且字段必须是 streaming、presigned 或 sigv4a（实际为 %{actual}）'
     sigv4_suggestion: 将 streaming、presigned 和 sigv4a 策略设置为 deny 或 passthrough，或移除不支持的字段。
+    tls_terminate_required: 通过 sandbox.credentials.%{feature} 重新签署 AWS 凭证时，sandbox.network.tlsTerminate 必须是对象
+    tls_terminate_suggestion: '将 sandbox.network.tlsTerminate 设置为对象（例如 {}），或移除 AWS 凭证重新签署设置。'
   cc_set_013:
     message: autoMode.classifyAllShell 存在时必须是布尔值 (实际为 %{actual}); Claude Code 2.1.193+ 将该 auto-mode 设置记录为严格的 true/false 开关
     suggestion: 将 autoMode.classifyAllShell 设置为不带引号的 true 或 false，或移除此字段以保留默认的 auto-mode 分类器范围。
diff --git a/crates/agnix-core/locales/en.yml b/crates/agnix-core/locales/en.yml
@@ -1298,6 +1298,8 @@ rules:
     sigv4_object: sandbox.credentials.sigv4 must be an object (got %{actual})
     sigv4_entry: 'sandbox.credentials.sigv4.%{field} must be deny or passthrough, and the field must be streaming, presigned, or sigv4a (got %{actual})'
     sigv4_suggestion: Set streaming, presigned, and sigv4a policies to deny or passthrough, or remove unsupported fields.
+    tls_terminate_required: AWS credential re-signing via sandbox.credentials.%{feature} requires sandbox.network.tlsTerminate to be an object
+    tls_terminate_suggestion: 'Set sandbox.network.tlsTerminate to an object such as {}, or remove the AWS credential re-signing settings.'
   cc_set_013:
     message: autoMode.classifyAllShell must be a boolean when present (got %{actual}); Claude Code 2.1.193+ documents this
       auto-mode setting as a strict true/false toggle
diff --git a/crates/agnix-core/locales/es.yml b/crates/agnix-core/locales/es.yml
@@ -808,6 +808,8 @@ rules:
     sigv4_object: sandbox.credentials.sigv4 debe ser un objeto (se obtuvo %{actual})
     sigv4_entry: 'sandbox.credentials.sigv4.%{field} debe ser deny o passthrough, y el campo debe ser streaming, presigned o sigv4a (se obtuvo %{actual})'
     sigv4_suggestion: Establece las politicas streaming, presigned y sigv4a en deny o passthrough, o elimina campos no admitidos.
+    tls_terminate_required: La firma de credenciales de AWS mediante sandbox.credentials.%{feature} requiere que sandbox.network.tlsTerminate sea un objeto
+    tls_terminate_suggestion: 'Establece sandbox.network.tlsTerminate en un objeto como {}, o elimina la configuracion de firma de credenciales de AWS.'
   cc_set_013:
     message: autoMode.classifyAllShell debe ser un booleano cuando esta presente (se obtuvo %{actual}); Claude Code 2.1.193+
       documenta esta configuracion de auto-mode como un interruptor true/false estricto
diff --git a/crates/agnix-core/locales/zh-CN.yml b/crates/agnix-core/locales/zh-CN.yml
@@ -772,6 +772,8 @@ rules:
     sigv4_object: sandbox.credentials.sigv4 必须是对象（实际为 %{actual}）
     sigv4_entry: 'sandbox.credentials.sigv4.%{field} 必须是 deny 或 passthrough，且字段必须是 streaming、presigned 或 sigv4a（实际为 %{actual}）'
     sigv4_suggestion: 将 streaming、presigned 和 sigv4a 策略设置为 deny 或 passthrough，或移除不支持的字段。
+    tls_terminate_required: 通过 sandbox.credentials.%{feature} 重新签署 AWS 凭证时，sandbox.network.tlsTerminate 必须是对象
+    tls_terminate_suggestion: '将 sandbox.network.tlsTerminate 设置为对象（例如 {}），或移除 AWS 凭证重新签署设置。'
   cc_set_013:
     message: autoMode.classifyAllShell 存在时必须是布尔值 (实际为 %{actual}); Claude Code 2.1.193+ 将该 auto-mode 设置记录为严格的 true/false 开关
     suggestion: 将 autoMode.classifyAllShell 设置为不带引号的 true 或 false，或移除此字段以保留默认的 auto-mode 分类器范围。
diff --git a/crates/agnix-core/src/rules/claude_settings.rs b/crates/agnix-core/src/rules/claude_settings.rs
@@ -865,7 +865,9 @@ fn validate_respond_to_bash_commands(
 /// Both arrays are optional, but when present they must be arrays of objects.
 /// Each entry must name the credential target and carry a supported `mode`.
 /// Claude Code v2.1.199 added environment-variable masking, and v2.1.221 added
-/// file masking plus controls for narrowing injection and extraction.
+/// file masking plus controls for narrowing injection and extraction. Claude
+/// Code v2.1.224 added AWS credential re-signing, which requires
+/// `sandbox.network.tlsTerminate`.
 fn validate_sandbox_credentials(
     path: &Path,
     content: &str,
@@ -939,6 +941,13 @@ fn validate_sandbox_credentials(
         diagnostics,
     );
     validate_sandbox_credential_sigv4(path, content, credentials_obj.get("sigv4"), diagnostics);
+    validate_sandbox_credential_aws_tls_termination(
+        path,
+        content,
+        value,
+        credentials_obj,
+        diagnostics,
+    );
 }
 
 #[derive(Clone, Copy)]
@@ -1711,6 +1720,46 @@ fn validate_sandbox_credential_sigv4(
     }
 }
 
+fn validate_sandbox_credential_aws_tls_termination(
+    path: &Path,
+    content: &str,
+    value: &serde_json::Value,
+    credentials: &serde_json::Map<String, serde_json::Value>,
+    diagnostics: &mut Vec<Diagnostic>,
+) {
+    let feature = match (
+        credentials.contains_key("awsPairs"),
+        credentials.contains_key("sigv4"),
+    ) {
+        (true, true) => "awsPairs and sigv4",
+        (true, false) => "awsPairs",
+        (false, true) => "sigv4",
+        (false, false) => return,
+    };
+
+    if value
+        .pointer("/sandbox/network/tlsTerminate")
+        .is_some_and(serde_json::Value::is_object)
+    {
+        return;
+    }
+
+    let line = find_key_line(content, "awsPairs")
+        .or_else(|| find_key_line(content, "sigv4"))
+        .or_else(|| find_key_line(content, "credentials"))
+        .unwrap_or(1);
+    diagnostics.push(
+        Diagnostic::warning(
+            path.to_path_buf(),
+            line,
+            0,
+            "CC-SET-012",
+            t!("rules.cc_set_012.tls_terminate_required", feature = feature),
+        )
+        .with_suggestion(t!("rules.cc_set_012.tls_terminate_suggestion")),
+    );
+}
+
 fn has_javascript_capturing_group(pattern: &str) -> bool {
     let bytes = pattern.as_bytes();
     let mut escaped = false;
@@ -3716,6 +3765,9 @@ mod tests {
     fn test_sandbox_credentials_v2_1_224_options_are_valid() {
         let content = r#"{
           "sandbox": {
+            "network": {
+              "tlsTerminate": {}
+            },
             "credentials": {
               "files": [{
                 "path": "~/.config/service/token.json",
@@ -3760,6 +3812,9 @@ mod tests {
     fn test_sandbox_credentials_v2_1_224_invalid_options_flag() {
         let content = r#"{
           "sandbox": {
+            "network": {
+              "tlsTerminate": {}
+            },
             "credentials": {
               "files": [{
                 "path": "~/.config/service/token.json",
@@ -3805,7 +3860,9 @@ mod tests {
 
     #[test]
     fn test_sandbox_credentials_aws_pairs_and_sigv4_containers_are_checked() {
-        let diagnostics = validate(r#"{"sandbox":{"credentials":{"awsPairs":true,"sigv4":[]}}}"#);
+        let diagnostics = validate(
+            r#"{"sandbox":{"network":{"tlsTerminate":{}},"credentials":{"awsPairs":true,"sigv4":[]}}}"#,
+        );
         let hits: Vec<_> = diagnostics
             .iter()
             .filter(|diagnostic| diagnostic.rule == "CC-SET-012")
@@ -3815,6 +3872,21 @@ mod tests {
         assert!(hits.iter().any(|hit| hit.message.contains("sigv4")));
     }
 
+    #[test]
+    fn test_sandbox_credentials_aws_resigning_requires_tls_termination() {
+        for content in [
+            r#"{"sandbox":{"credentials":{"awsPairs":[],"sigv4":{}}}}"#,
+            r#"{"sandbox":{"network":{"tlsTerminate":true},"credentials":{"awsPairs":[]}}}"#,
+        ] {
+            let hits: Vec<_> = validate(content)
+                .into_iter()
+                .filter(|diagnostic| diagnostic.rule == "CC-SET-012")
+                .collect();
+            assert_eq!(hits.len(), 1);
+            assert!(hits[0].message.contains("tlsTerminate"));
+        }
+    }
+
     #[test]
     fn test_sandbox_credentials_optional_field_types_are_checked() {
         let diagnostics = validate(
diff --git a/crates/agnix-lsp/locales/en.yml b/crates/agnix-lsp/locales/en.yml
@@ -1298,6 +1298,8 @@ rules:
     sigv4_object: sandbox.credentials.sigv4 must be an object (got %{actual})
     sigv4_entry: 'sandbox.credentials.sigv4.%{field} must be deny or passthrough, and the field must be streaming, presigned, or sigv4a (got %{actual})'
     sigv4_suggestion: Set streaming, presigned, and sigv4a policies to deny or passthrough, or remove unsupported fields.
+    tls_terminate_required: AWS credential re-signing via sandbox.credentials.%{feature} requires sandbox.network.tlsTerminate to be an object
+    tls_terminate_suggestion: 'Set sandbox.network.tlsTerminate to an object such as {}, or remove the AWS credential re-signing settings.'
   cc_set_013:
     message: autoMode.classifyAllShell must be a boolean when present (got %{actual}); Claude Code 2.1.193+ documents this
       auto-mode setting as a strict true/false toggle
diff --git a/crates/agnix-lsp/locales/es.yml b/crates/agnix-lsp/locales/es.yml
@@ -808,6 +808,8 @@ rules:
     sigv4_object: sandbox.credentials.sigv4 debe ser un objeto (se obtuvo %{actual})
     sigv4_entry: 'sandbox.credentials.sigv4.%{field} debe ser deny o passthrough, y el campo debe ser streaming, presigned o sigv4a (se obtuvo %{actual})'
     sigv4_suggestion: Establece las politicas streaming, presigned y sigv4a en deny o passthrough, o elimina campos no admitidos.
+    tls_terminate_required: La firma de credenciales de AWS mediante sandbox.credentials.%{feature} requiere que sandbox.network.tlsTerminate sea un objeto
+    tls_terminate_suggestion: 'Establece sandbox.network.tlsTerminate en un objeto como {}, o elimina la configuracion de firma de credenciales de AWS.'
   cc_set_013:
     message: autoMode.classifyAllShell debe ser un booleano cuando esta presente (se obtuvo %{actual}); Claude Code 2.1.193+
       documenta esta configuracion de auto-mode como un interruptor true/false estricto
diff --git a/crates/agnix-lsp/locales/zh-CN.yml b/crates/agnix-lsp/locales/zh-CN.yml
@@ -772,6 +772,8 @@ rules:
     sigv4_object: sandbox.credentials.sigv4 必须是对象（实际为 %{actual}）
     sigv4_entry: 'sandbox.credentials.sigv4.%{field} 必须是 deny 或 passthrough，且字段必须是 streaming、presigned 或 sigv4a（实际为 %{actual}）'
     sigv4_suggestion: 将 streaming、presigned 和 sigv4a 策略设置为 deny 或 passthrough，或移除不支持的字段。
+    tls_terminate_required: 通过 sandbox.credentials.%{feature} 重新签署 AWS 凭证时，sandbox.network.tlsTerminate 必须是对象
+    tls_terminate_suggestion: '将 sandbox.network.tlsTerminate 设置为对象（例如 {}），或移除 AWS 凭证重新签署设置。'
   cc_set_013:
     message: autoMode.classifyAllShell 存在时必须是布尔值 (实际为 %{actual}); Claude Code 2.1.193+ 将该 auto-mode 设置记录为严格的 true/false 开关
     suggestion: 将 autoMode.classifyAllShell 设置为不带引号的 true 或 false，或移除此字段以保留默认的 auto-mode 分类器范围。
diff --git a/crates/agnix-rules/rules.json b/crates/agnix-rules/rules.json
@@ -5518,12 +5518,12 @@
       "evidence": {
         "source_type": "vendor_code",
         "source_urls": [
-          "https://github.com/openai/codex/blob/rust-v0.147.0/codex-rs/plugin/src/plugin_id.rs"
+          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core-plugins/src/manifest.rs"
         ],
-        "verified_on": "2026-08-08",
+        "verified_on": "2026-06-04",
         "applies_to": {
           "tool": "codex",
-          "version_range": ">=0.147.0"
+          "version_range": ">=0.117.0"
         },
         "normative_level": "MUST",
         "tests": {
@@ -5547,12 +5547,13 @@
       "evidence": {
         "source_type": "vendor_code",
         "source_urls": [
-          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core-plugins/src/manifest.rs"
+          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core-plugins/src/manifest.rs",
+          "https://github.com/openai/codex/blob/rust-v0.147.0/codex-rs/plugin/src/plugin_id.rs"
         ],
-        "verified_on": "2026-06-04",
+        "verified_on": "2026-08-08",
         "applies_to": {
           "tool": "codex",
-          "version_range": ">=0.117.0"
+          "version_range": ">=0.147.0"
         },
         "normative_level": "MUST",
         "tests": {
diff --git a/knowledge-base/VALIDATION-RULES.md b/knowledge-base/VALIDATION-RULES.md
@@ -435,8 +435,8 @@ Rules are active by default. Deprecated rules should include `status`, `deprecat
 
 <a id="cc-set-012"></a>
 ### CC-SET-012 [MEDIUM] Invalid sandbox.credentials Setting
-**Requirement**: `sandbox.credentials` in `.claude/settings.json` / `.local.json` / `managed-settings.json` MUST be an object with optional `files` and `envVars` arrays when present (Claude Code 2.1.187+). Each entry MUST use `mode: "deny"` or `mode: "mask"`; environment-variable masking was added in 2.1.199 and file masking in 2.1.221. Claude Code 2.1.224 added structured environment extraction, JWT-aware `decode: "jwt"` with non-empty `maskClaims`, `awsPairs`, and `sigv4` policies. File entries require a non-empty string `path`; environment entries require a shell-compatible variable `name`. Masked `extract` patterns require a valid ECMAScript regex with a credential capture group. Environment entries cannot combine `extract` and `decode`, and decoded environment variables only accept `onExtractNoMatch: "warn"`. `awsPairs` entries require non-empty `accessKeyIdVar` and `secretAccessKeyVar` strings with an optional non-empty `sessionTokenVar`. `sigv4` accepts only `streaming`, `presigned`, and `sigv4a` keys with `deny` or `passthrough` values. Claude Code accepts but ignores mask-only fields on `deny` entries. Top-level `allowPlaintextInject`, when present, MUST be boolean.
-**Detection**: Parse settings.json; walk `sandbox.credentials`; validate the container and arrays, required target fields, supported modes, environment-variable names, mask-only constraints, optional field types and enums, ECMAScript regex syntax and capture-group presence, JWT decode and claim-mask combinations, AWS credential-pair fields, SigV4 policies, injection host arrays, and `allowPlaintextInject`. Skip mask-only optional-field validation for `deny` entries to match Claude Code preprocessing.
+**Requirement**: `sandbox.credentials` in `.claude/settings.json` / `.local.json` / `managed-settings.json` MUST be an object with optional `files` and `envVars` arrays when present (Claude Code 2.1.187+). Each entry MUST use `mode: "deny"` or `mode: "mask"`; environment-variable masking was added in 2.1.199 and file masking in 2.1.221. Claude Code 2.1.224 added structured environment extraction, JWT-aware `decode: "jwt"` with non-empty `maskClaims`, `awsPairs`, and `sigv4` policies. File entries require a non-empty string `path`; environment entries require a shell-compatible variable `name`. Masked `extract` patterns require a valid ECMAScript regex with a credential capture group. Environment entries cannot combine `extract` and `decode`, and decoded environment variables only accept `onExtractNoMatch: "warn"`. `awsPairs` entries require non-empty `accessKeyIdVar` and `secretAccessKeyVar` strings with an optional non-empty `sessionTokenVar`. `sigv4` accepts only `streaming`, `presigned`, and `sigv4a` keys with `deny` or `passthrough` values. When `awsPairs` or `sigv4` is configured, `sandbox.network.tlsTerminate` MUST be an object so Claude Code can inspect and re-sign AWS requests. Claude Code accepts but ignores mask-only fields on `deny` entries. Top-level `allowPlaintextInject`, when present, MUST be boolean.
+**Detection**: Parse settings.json; walk `sandbox.credentials`; validate the container and arrays, required target fields, supported modes, environment-variable names, mask-only constraints, optional field types and enums, ECMAScript regex syntax and capture-group presence, JWT decode and claim-mask combinations, AWS credential-pair fields, SigV4 policies, the AWS re-signing TLS-termination prerequisite, injection host arrays, and `allowPlaintextInject`. Skip mask-only optional-field validation for `deny` entries to match Claude Code preprocessing.
 **Fix**: Manual - use a valid `deny` or `mask` entry shape for the credential target, or remove the invalid entry or option.
 **Source**: github.com/anthropics/claude-code/releases/tag/v2.1.187 (added `sandbox.credentials`), github.com/anthropics/claude-code/releases/tag/v2.1.199 (added environment-variable masking), github.com/anthropics/claude-code/releases/tag/v2.1.221 (added file masking), github.com/anthropics/claude-code/releases/tag/v2.1.224 (added structured environment, JWT, and AWS masking), code.claude.com/docs/en/settings, code.claude.com/docs/en/sandboxing
 
diff --git a/knowledge-base/rules.json b/knowledge-base/rules.json
@@ -5518,12 +5518,12 @@
       "evidence": {
         "source_type": "vendor_code",
         "source_urls": [
-          "https://github.com/openai/codex/blob/rust-v0.147.0/codex-rs/plugin/src/plugin_id.rs"
+          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core-plugins/src/manifest.rs"
         ],
-        "verified_on": "2026-08-08",
+        "verified_on": "2026-06-04",
         "applies_to": {
           "tool": "codex",
-          "version_range": ">=0.147.0"
+          "version_range": ">=0.117.0"
         },
         "normative_level": "MUST",
         "tests": {
@@ -5547,12 +5547,13 @@
       "evidence": {
         "source_type": "vendor_code",
         "source_urls": [
-          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core-plugins/src/manifest.rs"
+          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core-plugins/src/manifest.rs",
+          "https://github.com/openai/codex/blob/rust-v0.147.0/codex-rs/plugin/src/plugin_id.rs"
         ],
-        "verified_on": "2026-06-04",
+        "verified_on": "2026-08-08",
         "applies_to": {
           "tool": "codex",
-          "version_range": ">=0.117.0"
+          "version_range": ">=0.147.0"
         },
         "normative_level": "MUST",
         "tests": {
diff --git a/locales/en.yml b/locales/en.yml
diff --git a/locales/es.yml b/locales/es.yml
diff --git a/locales/zh-CN.yml b/locales/zh-CN.yml
diff --git a/website/docs/rules/generated/cdx-pl-003.md b/website/docs/rules/generated/cdx-pl-003.md
diff --git a/website/docs/rules/generated/cdx-pl-004.md b/website/docs/rules/generated/cdx-pl-004.md
