iampantherr
diff --git a/‎docker/Dockerfile‎
Lines changed: 10 additions & 0 deletions b/‎docker/Dockerfile‎
Lines changed: 10 additions & 0 deletions
diff --git a/‎docker/docker-compose.yml‎
Lines changed: 11 additions & 0 deletions b/‎docker/docker-compose.yml‎
Lines changed: 11 additions & 0 deletions
diff --git a/‎package-lock.json‎
Lines changed: 16 additions & 3 deletions b/‎package-lock.json‎
Lines changed: 16 additions & 3 deletions
diff --git a/‎package.json‎
Lines changed: 3 additions & 1 deletion b/‎package.json‎
Lines changed: 3 additions & 1 deletion
diff --git a/‎scripts/py_ast_walker.py‎
Lines changed: 142 additions & 0 deletions b/‎scripts/py_ast_walker.py‎
Lines changed: 142 additions & 0 deletions
@@ -27,6 +27,12 @@ FROM node:22-alpine AS runtime
 RUN addgroup -g 1001 -S securecontext && \
     adduser  -u 1001 -S securecontext -G securecontext
 
+# v0.26.0 Step 3 — install python3 for AST-based scanning of bundled scripts
+# in Anthropic-style filesystem skills. The script_scanner runs `python3 -c`
+# with a small ast.parse() walker that detects shell=True, eval, exec,
+# os.system, pickle.loads, etc. — patterns regex can't reliably catch.
+RUN apk add --no-cache python3
+
 WORKDIR /app
 
 # Copy built artifacts + production deps only
@@ -39,6 +45,10 @@ COPY --from=builder --chown=securecontext:securecontext /app/package.json ./pack
 # host skills/ over this in docker-compose for live editing.
 COPY --chown=securecontext:securecontext skills/ ./skills/
 
+# v0.26.0 Step 3 — bake the Python AST walker for skill bundled-script scanning.
+# Called by src/skills/script_scanner.ts via spawnSync("python3", ...).
+COPY --chown=securecontext:securecontext scripts/py_ast_walker.py ./scripts/py_ast_walker.py
+
 USER securecontext
 
 # Health check — uses the /health endpoint
 
@@ -87,6 +87,17 @@ services:
       # Without this, HMAC-protected data in PG (skills.body_hmac, hash chains)
       # becomes unverifiable after every `docker compose build`.
       - api_state:/home/securecontext/.claude/zc-ctx
+      # v0.26.0 Step 2 — mount the operator's ~/.claude/skills/ directory so the
+      # filesystem-skill watcher can see Anthropic-style skill directories.
+      # Writable because Step 3's quarantine atomic-moves dirs to
+      # ~/.claude/skills.quarantine/ when admission scan fails.
+      - ${USERPROFILE:-${HOME}}/.claude/skills:/home/securecontext/.claude/skills
+      - ${USERPROFILE:-${HOME}}/.claude/skills.quarantine:/home/securecontext/.claude/skills.quarantine
+      # v0.27.0 — optional mount(s) for project-scoped skill admission. The boot
+      # importer + /api/v1/skills/import-project endpoint walk these paths to
+      # admit any <project>/.claude/skills/<name>/. Add more lines + extend
+      # ZC_PROJECT_SKILL_PATHS env to register additional projects.
+      - ${USERPROFILE:-${HOME}}/AI_projects/Test_Agent_Coordination:/projects/Test_Agent_Coordination
     ports:
       - "${SC_API_PORT:-3099}:3099"  # Direct access (dev) — use sc-nginx in production
     depends_on:
 
@@ -1,6 +1,6 @@
 {
   "name": "zc-ctx",
-  "version": "0.25.3",
+  "version": "0.27.0",
   "description": "Secure memory & context optimization MCP plugin for Claude Code — drop-in replacement for context-mode with credential isolation, SSRF protection, MemGPT-style persistent memory, and A2A multi-agent broadcast channel",
   "keywords": [
     "claude-code",
@@ -80,6 +80,8 @@
     "@fastify/cors": "^11.2.0",
     "@modelcontextprotocol/sdk": "^1.0.0",
     "@types/pg": "^8.20.0",
+    "acorn": "^8.16.0",
+    "acorn-walk": "^8.3.5",
     "fastify": "^5.8.4",
     "graphology": "^0.26.0",
     "graphology-communities-louvain": "^2.0.2",
 
@@ -0,0 +1,142 @@
+#!/usr/bin/env python3
+"""
+v0.26.0 Step 3 — Python AST walker for skill bundled-script scanning.
+
+Reads a Python file from argv[1], parses with stdlib ast module, walks the
+tree looking for dangerous patterns, prints findings as JSON to stdout.
+
+Detected patterns (block-severity):
+  - subprocess.run/Popen/call with shell=True (allows arg injection)
+  - os.system / os.popen
+  - eval() / exec() / compile()
+  - __import__() called dynamically (not at module-level import statement)
+  - pickle.loads / pickle.load / dill.loads (untrusted deserialization)
+  - yaml.load without SafeLoader
+
+Detected patterns (warn-severity):
+  - Hardcoded secret patterns inline (sk-ant-, sk-..., ghp_, etc.)
+  - urllib/requests calls to non-allowlisted domains (deferred — needs allowlist arg)
+  - File operations outside skill's expected scope (deferred)
+
+Output: JSON {"passed": bool, "violations": [{"pattern", "line", "col", "severity", "snippet"}], "errors": []}
+Exit codes: 0 = scan completed (regardless of violations); 1 = parser couldn't read the file.
+"""
+import ast
+import json
+import sys
+from pathlib import Path
+
+VIOLATIONS = []
+ERRORS = []
+SOURCE_LINES = []
+
+
+def add_violation(severity, pattern, node, snippet=None):
+    VIOLATIONS.append({
+        "pattern": pattern,
+        "severity": severity,
+        "line": getattr(node, "lineno", 0),
+        "col": getattr(node, "col_offset", 0),
+        "snippet": snippet or (SOURCE_LINES[node.lineno - 1].strip() if 0 < getattr(node, "lineno", 0) <= len(SOURCE_LINES) else ""),
+    })
+
+
+class Walker(ast.NodeVisitor):
+    def visit_Call(self, node):
+        # Resolve the callable name
+        func_name = self._resolve_call_name(node.func)
+
+        if func_name in ("eval", "exec"):
+            add_violation("block", f"dynamic_{func_name}", node)
+
+        if func_name == "compile":
+            add_violation("block", "compile_call", node)
+
+        if func_name == "__import__":
+            # Inline __import__ is suspicious. Module-level `import` doesn't hit this node.
+            add_violation("block", "dynamic_import", node)
+
+        if func_name in ("os.system", "os.popen"):
+            add_violation("block", "os_shell_exec", node)
+
+        if func_name in ("subprocess.run", "subprocess.Popen", "subprocess.call",
+                         "subprocess.check_call", "subprocess.check_output", "subprocess.getoutput"):
+            for kw in node.keywords:
+                if kw.arg == "shell" and isinstance(kw.value, ast.Constant) and kw.value.value is True:
+                    add_violation("block", "subprocess_shell_true", node)
+                    break
+
+        if func_name in ("pickle.loads", "pickle.load", "dill.loads", "dill.load",
+                         "marshal.loads", "marshal.load"):
+            add_violation("block", "untrusted_deserialization", node)
+
+        if func_name == "yaml.load":
+            # yaml.load without Loader=SafeLoader is unsafe.
+            # If a second positional arg or `Loader=` kwarg is present, check it.
+            loader_arg = None
+            if len(node.args) >= 2:
+                loader_arg = node.args[1]
+            for kw in node.keywords:
+                if kw.arg == "Loader":
+                    loader_arg = kw.value
+                    break
+            if loader_arg is None:
+                add_violation("block", "yaml_load_unsafe", node)
+            elif isinstance(loader_arg, ast.Attribute) and loader_arg.attr not in ("SafeLoader", "CSafeLoader"):
+                add_violation("block", "yaml_load_unsafe", node)
+
+        self.generic_visit(node)
+
+    def _resolve_call_name(self, func_node):
+        """Resolve a Call.func into a dotted name like 'subprocess.run' or 'os.system'."""
+        parts = []
+        cur = func_node
+        while True:
+            if isinstance(cur, ast.Name):
+                parts.append(cur.id); break
+            if isinstance(cur, ast.Attribute):
+                parts.append(cur.attr); cur = cur.value
+            else:
+                return ""
+        return ".".join(reversed(parts))
+
+
+def main():
+    if len(sys.argv) != 2:
+        print(json.dumps({"passed": False, "violations": [], "errors": ["usage: py_ast_walker.py <script.py>"]}))
+        sys.exit(1)
+    path = Path(sys.argv[1])
+    try:
+        source = path.read_text(encoding="utf-8", errors="replace")
+    except Exception as e:
+        print(json.dumps({"passed": False, "violations": [], "errors": [f"read failed: {e}"]}))
+        sys.exit(1)
+
+    global SOURCE_LINES
+    SOURCE_LINES = source.splitlines()
+
+    try:
+        tree = ast.parse(source, filename=str(path))
+    except SyntaxError as e:
+        # Parse error = can't analyze. Mark as block since we can't verify safety.
+        VIOLATIONS.append({
+            "pattern": "syntax_error",
+            "severity": "block",
+            "line": e.lineno or 0,
+            "col": e.offset or 0,
+            "snippet": str(e),
+        })
+        print(json.dumps({"passed": False, "violations": VIOLATIONS, "errors": ERRORS}))
+        sys.exit(0)
+
+    Walker().visit(tree)
+    blocking = [v for v in VIOLATIONS if v["severity"] == "block"]
+    print(json.dumps({
+        "passed": len(blocking) == 0,
+        "violations": VIOLATIONS,
+        "errors": ERRORS,
+    }))
+
+
+if __name__ == "__main__":
+    main()