[spark-compete] fix(security): require approval for docker exec, nsenter, and chroot

[mrxlolcat]

Spark Compete Packet

{
  "schema": "spark-compete-hotfix-v1",
  "event": "spark-compete-first-event",
  "submission_mode": "public_repo_pr",
  "submission_target_url": "https://github.com/vibeforge1111/spark-cli/pull/1440",
  "team": {
    "name": "lolcat",
    "members": [
      "mrxlolcat",
      "ouwibo",
      "rahmanhsim"
    ],
    "llm_device_holder": "mrxlolcat",
    "device_holder_github": "https://github.com/mrxlolcat",
    "github_accounts": [
      "mrxlolcat",
      "ouwibo",
      "rahmanhsim"
    ]
  },
  "target_repo": {
    "id": "vibeforge1111/spark-cli",
    "source": "https://github.com/vibeforge1111/spark-cli",
    "owner_surface": "spark-cli"
  },
  "issue": {
    "type": "security_concern",
    "severity": "high",
    "title": "docker exec, nsenter, and chroot bypass the approval classifier",
    "actual_behavior": "approval_required_for_command(['docker', 'exec', 'container', 'bash']) returns requires_approval=False. Same for nsenter and chroot. An agent can execute code with elevated privileges inside containers or escape namespace isolation without operator approval.",
    "expected_behavior": "docker exec should be classified as container_privilege_escalation/high; nsenter as container_privilege_escalation/critical; chroot as container_privilege_escalation/high.",
    "repro_steps": [
      "from spark_cli.security.approval import approval_required_for_command, CommandContext",
      "d = approval_required_for_command(['docker', 'exec', 'my-container', 'bash'], CommandContext())",
      "assert d.requires_approval == False  # BUG: should be True",
      "n = approval_required_for_command(['nsenter', '--target', '1', '--all', 'bash'], CommandContext())",
      "assert n.requires_approval == False  # BUG: should be True"
    ],
    "affected_workflow": "Any agent shell workflow \u2014 docker exec shells into a running container, nsenter escapes container namespaces to the host, chroot pivots the filesystem root"
  },
  "evidence": {
    "safe_links_only": true,
    "before_after_proof": "Before: docker exec, nsenter, chroot fall through to the catch-all and return requires_approval=False. After: docker exec -> container_privilege_escalation/high; nsenter -> container_privilege_escalation/critical; chroot -> container_privilege_escalation/high.",
    "links": [
      "https://github.com/vibeforge1111/spark-cli/pull/1440"
    ],
    "forbidden": [
      "pdf",
      "zip",
      "exe",
      "unknown downloads",
      "shortened links",
      "archives",
      "binaries",
      "tokens",
      "browser cookies",
      "wallet material",
      "raw logs",
      "raw conversations",
      "raw memory",
      "raw patches",
      "private repo maps",
      "private scoring details"
    ]
  },
  "proposed_fix": {
    "approach": "Add three classifier branches after the existing docker --privileged check: docker exec / docker container exec -> container_privilege_escalation/high; nsenter -> container_privilege_escalation/critical; chroot -> container_privilege_escalation/high.",
    "files_expected": [
      "src/spark_cli/security/approval.py",
      "tests/test_cli.py"
    ],
    "tests_or_smoke": "3 new test methods covering 7 command variants. python -m pytest tests/test_cli.py -k 'docker_exec or nsenter or chroot' -> 3 passed, 7 subtests passed."
  },
  "pr": {
    "branch": "fix/container-exec-approval",
    "title_prefix": "[spark-compete]",
    "author_github": "mrxlolcat",
    "body_must_include": [
      "packet",
      "team",
      "pr_author",
      "repo",
      "actual_behavior",
      "expected_behavior",
      "repro_steps",
      "before_after_proof",
      "tests_or_smoke",
      "duplicate_notes",
      "risk_notes",
      "review_claim"
    ],
    "url": "https://github.com/vibeforge1111/spark-cli/pull/1440"
  },
  "review_claim": {
    "impact_claim": "high",
    "evidence_types": [
      "passing_test"
    ],
    "duplicate_notes": "Checked all open spark-compete PRs. jumperz11 PR #1265 covers docker-compose exec/run (different command). No open PR covers plain docker exec, nsenter, or chroot in the approval classifier.",
    "risk_notes": "Only src/spark_cli/security/approval.py and tests/test_cli.py modified. No CI, dependency, installer, or auth changes. Adds classification branches only \u2014 no existing approved flows broken.",
    "review_state_requested": "pr_review"
  }
}

PR Author: mrxlolcat