sec: close remaining Critical/High avarice findings (admission, openshell, splunk bridge, SSRF rebind) + local-obs UX

[vineethsai7]

Stacked on top of #258 (fix/high-critical-remediation). Review/merge that PR first; this PR's base is the stack parent, not main. It carries the trusted-paths work from #348/#354 plus the changes below.

Problem

The avarice/deepsec pre-launch audit surfaced 99 Critical/High findings against the DefenseClaw CLI. Most were already remediated on #258, but a tranche remained unfixed and unverified, and the fixes had never been confirmed against the actual shipped artifacts. Specifically:

• Admission bypass — the first-party allow-list matched provenance by substring, so an attacker dir like .defenseclaw-evil or a plugin dropped under .codex-plugin could spoof first-party status and skip scanning (F-0541/F-0543). The same broad markers lived in the Rego bundle, the Python defaults, and all three YAML posture presets.
• OpenShell egress — a hostless allowed_ips endpoint matched on port alone (any host) (F-0544), and messaging egress (Slack/Discord/Telegram) was granted to every sandbox binary via /** (F-0546) — a built-in exfiltration path.
• Splunk bridge — shipped a hardcoded exporter password, followed redirects with the HEC token, defaulted TLS verification off, spliced unescaped $connector$/$run_id$ into SPL (injection), and silently reset its export window on a corrupt checkpoint (F-0585/0602/0603/0604/0608/0805).
• DNS rebinding — registry/MCP SSRF guards validated the hostname once, but the client re-resolved at connect time, reopening a TOCTOU window (F-0344/F-0345).
• Local observability — required a Grafana password and disabled dev APIs on a loopback-only developer dashboard (pure friction; operator asked to remove).

Current Situation

• policies/rego/{admission.rego,data.json} and policies/{default,strict,permissive}.yaml all carry the first-party allow-list; a Go parity test (TestDefaultYAMLDataJSONParity) enforces that default.yaml and data.json agree.
• cli/defenseclaw/_data/ is a gitignored build-staging copy seeded from canonical policies/, bundles/, scripts/ via make _bundle-data — edits must land on the canonical sources.
• A remediation regression spec already exists (cli/tests/test_remediation_*.py); each unfixed finding shows as a failing test.
• The fixes had not been exercised against a running gateway, the real OPA bundle, or the actual scanners.

Solution

Close the remaining findings on the canonical sources, re-seed _data/, and verify every change three ways: the remediation test spec, the full Go + Python suites, and live manual exercise against a running gateway.

Admission provenance (F-0541 / F-0543)

Match first-party provenance by whole path components (a contiguous component run), not substring — mirrored across admission.rego (new _provenance_prefix_matches using array.slice), the Python _matches_provenance default, data.json, and all three YAML presets. Each marker now pins the asset's own leaf dir (extensions/defenseclaw), never a broad parent (.defenseclaw, .openclaw/extensions, .codex-plugin).

OpenShell policy (F-0544 / F-0546)

endpoint_allowed/endpoint_matches_request hostless branches now require the connection host or resolved IP to be a member of allowed_ips (new _host_in_allowed_ips). allow_channels binaries are scoped to the four agent runtimes (/**/node|openclaw|claude|codex) instead of /**.

Splunk bridge & infra

No hardcoded password (fail closed when SPLUNK_PASSWORD unset); _NoRedirectHandler opener for token-bearing POSTs; TLS verified by default with explicit --insecure opt-out; |s SPL escaping across dashboards + macros; CorruptCheckpointError (fail closed) instead of silent window reset; HEC TLS + env-sourced token; loopback binds + required private env file; pinned-sha256 installer integrity gate.

DNS-rebind pinning (F-0344 / F-0345)

New pinned_getaddrinfo context manager pins socket.getaddrinfo to the vetted IP for the duration of a fetch (covers urllib3 and async httpx). The MCP remote scan resolve-and-pins; git clones pin libcurl via http.curloptResolve (preserving Host/SNI).

Local observability (operator decision)

Grafana opens with no login (anonymous Admin, login form disabled) and Prometheus dev APIs are re-enabled — the 127.0.0.1 port bind is the security boundary for a developer-laptop stack, not a password. Splunk HEC token/TLS hardening is kept.

Why this approach over alternatives:

• Component-match vs. a denylist of bad markers — a denylist is unbounded; pinning to the asset's own leaf dir is a positive allowlist that can't be widened by a new attacker dir name.
• getaddrinfo pin vs. extending the urllib3-only _PinnedConnect — the MCP SDK uses async httpx, which never touches urllib3; both stacks bottom out at getaddrinfo, so pinning there is the one seam that covers every client. Rejected: per-client pins (N code paths to keep in sync).
• Loopback-bind vs. password for local Grafana — a password on a localhost-only dashboard is friction with no threat model; the bind is the real control. Re-enable auth when HOST_BIND=0.0.0.0.

Architecture Diagram

Provenance match (F-0541/F-0543)            DNS-rebind pin (F-0344/F-0345)
  Before: substring                           Before:
   "/tmp/.defenseclaw-evil/..."                 guard_url() ── resolves once ──▶ OK
        contains ".defenseclaw" ─▶ ALLOW        client ───── resolves again ──▶ INTERNAL IP  ✗
        (scan skipped)  ✗                                    (rebind window)
  After: path components                      After:
   ["tmp",".defenseclaw-evil",...]              resolve_and_pin() ─▶ vetted IP ─┐
        run-match ".defenseclaw"? NO            pinned_getaddrinfo(host,ip): ◀──┘
        ─▶ SCAN  ✓                                 getaddrinfo(host) ─▶ vetted IP only ✓
                                                   getaddrinfo(other) ─▶ SSRFError ✓

OpenShell hostless allowed_ips (F-0544)      Local Grafana (operator)
  Before: port-only                            Before: ${GF_ADMIN_PASSWORD:?} + anon off
   host="" ports=[443] ─▶ ANY host:443 ✓(bad)   After:  anon Admin + login form disabled
  After: + _host_in_allowed_ips(allowed,host)           ports: 127.0.0.1:3000  ◀─ boundary
   evil IP ─▶ deny ; allowed IP ─▶ allow ✓

What Changed (Where & How)

File	Summary
policies/rego/admission.rego	_provenance_prefix_matches component matcher (F-0543)
policies/rego/data.json, policies/{default,strict,permissive}.yaml	leaf-pinned first-party markers (F-0541)
policies/openshell/default.rego, default-data.yaml	_host_in_allowed_ips + runtime-scoped egress (F-0544/0546)
cli/defenseclaw/enforce/admission.py	Python component matcher + tightened defaults
cli/defenseclaw/registries/ssrf.py, scanner/mcp.py, registries/adapters/git.py	pinned_getaddrinfo + MCP/git connect pinning (F-0344/0345)
bundles/splunk_local_bridge/**	password/redirect/TLS/SPL-escape/checkpoint fixes
bundles/local_observability_stack/docker-compose.yml	Grafana loginless + Prometheus dev APIs (loopback-bound)
bundles/splunk_o11y_dashboards/**, scripts/install-openshell-sandbox.sh	freshness detector, env-token README, integrity gate
cli/defenseclaw/tui/{app.py,panels/setup.py}	recover files truncated by a concurrent-editor event + re-apply TUI fixes (backspace, overview audit-feed leak, logs refresh churn, audit/activity 0600)
cli/tests/test_remediation_*.py, test_registry_ssrf.py, test_scanners.py, splunk exporter tests	regression spec + updated for the new posture

Breaking Changes

Local-stack defaults now require operator-supplied secrets (fail closed): SPLUNK_PASSWORD, SPLUNK_ENV_FILE, SPLUNK_HEC_TOKEN; the Splunk export_search flag flipped --verify-tls (opt-in) → --insecure (opt-out); the OpenShell installer requires OPENSHELL_SANDBOX_SHA256 (or explicit DEFENSECLAW_OPENSHELL_ALLOW_UNPINNED=1). The upgrade path already fails closed without signed checksums. See per-item notes in the remediation tests.

Open Issues / Follow-ups

• Pre-existing: connector hook-script fail-mode tests fail locally (FAIL_MODE=closed not honored) #358 — pre-existing connector hook-script fail-mode test failures (reproduce on the base branch; environment vs. real regression TBD).
• F-0344: MCP-scanner SDK DNS-rebind residual — verify pinned_getaddrinfo covers all SDK transports #359 — re-verify the F-0344 pinned_getaddrinfo pin against the real mcp-scanner SDK transports (sse_client/streamablehttp_client) end-to-end.
• Flaky: test_cmd_init.py::test_init_no_token_shows_local fails under full-suite parallelism #360 — flaky test_init_no_token_shows_local under full-suite parallelism (test-isolation, not a behavior regression).

Test Plan

• pytest cli/tests → 3652 passed, 2 skipped, 1 deselected (slow Go-build test), 243 subtests; the lone full-run failure (Flaky: test_cmd_init.py::test_init_no_token_shows_local fails under full-suite parallelism #360) passes in isolation.
• go test ./... → 30 packages ok; internal/policy parity fixed (added the F-0541 YAML tightening); the 3 connector hook-script failures (Pre-existing: connector hook-script fail-mode tests fail locally (FAIL_MODE=closed not honored) #358) reproduce on the base branch unchanged.
• make _bundle-data → re-seeds _data/; defenseclaw-gateway policy validate → Rego compiles, data.json schema OK.
• Manual, against a running gateway (127.0.0.1:18970):
  • OPA: spoof provenance paths → scan; legit extensions/defenseclaw → allowed; policy evaluate plugin/HIGH → rejected/block; mcp/MEDIUM override → block.
  • OpenShell: evil IP → allow_network=false, allowlisted IP → true; allow_channels has no bare /**.
  • Scanning: MCP remote scan refuses loopback/metadata/RFC1918; stdio allowlist permits only npx/uvx; pinned_getaddrinfo resolves pinned host to the vetted IP and blocks side-channel hosts; a malicious plugin sample yields SRC-EVAL + STRUCT-BINARY + META-DROP-AND-EXEC.
  • Guardrail (live hook): /etc/shadow and reverse-shell payloads → severity=CRITICAL would_block=true in gateway.jsonl; benign → allow.
  • Skills admission: quarantined → rejected; path-pinned allow fails closed on empty/mismatched path, allows only the exact pinned path.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 47ffac0153

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject npx --call in stdio scan allowlist

When a registry MCP entry uses command: "npx", args: ["--call", "sh -c ..."] passes this check because --call and --call=... are not forbidden. I confirmed npx --help documents [-c|--call <call>], and running npx --call 'printf ...' executes that shell command, so a publisher-controlled manifest can still get arbitrary code spawned during registry/local MCP scanning before admission. Please block --call (including --call=...) or avoid allowing npx forms that accept an arbitrary command string.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Preserve keyword getaddrinfo arguments when pinning

For clients that call socket.getaddrinfo(host, port, family=..., type=...) (the style used by async networking stacks), this wrapper calls original(ip, service, fam, *args[1:], **kwargs) while leaving the original family keyword in kwargs, which raises TypeError: getaddrinfo() got multiple values for argument 'family'. In that scenario remote MCP scans fail inside the DNS pin instead of connecting to the vetted IP; strip or override any family keyword before passing the pinned family through.

Useful? React with 👍 / 👎.