fix(security): harden worker approval, hook traversal, MCP exec, install scripts, git hooks

- orchestrate-codex-worker: drop yolo, default never approval, worktree containment
- run-with-flags-shell: add path traversal containment mirroring JS guard
- mcp-health-check: gate workspace probe, denylist dangerous env, shell-free reconnect with opt-in
- install.sh/ps1: add --ignore-scripts to block postinstall RCE
- git hooks: refuse global hooksPath clobber, remove file disable bypass, gate pre-push repo script execution
- claw.js: remove Windows shell:true, validate model token
- tests: opt into new secure defaults, quote-aware reconnect parsing

scripts/codex-git-hooks/pre-push

@@ -5,12 +5,12 @@ set -euo pipefail
 # Runs a lightweight verification flow before pushes.
 
 if [[ "${ECC_SKIP_GIT_HOOKS:-0}" == "1" || "${ECC_SKIP_PREPUSH:-0}" == "1" ]]; then
+  printf '[ECC pre-push] WARNING: hook bypassed via env (ECC_SKIP_*=1)\n' >&2
   exit 0
 fi
 
-if [[ -f ".ecc-hooks-disable" || -f ".git/ecc-hooks-disable" ]]; then
-  exit 0
-fi
+# NOTE: file-based disables (.ecc-hooks-disable) were removed — a malicious
+# repo could ship that file and silently disable verification.
 
 if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
   exit 0
@@ -85,8 +85,14 @@ run_node_script() {
 }
 
 if [[ -f "package.json" ]]; then
-  pm="$(detect_pm)"
-  log "Node project detected (package manager: $pm)"
+  # SECURITY: executing a cloned repo's lint/test/build scripts on push is
+  # arbitrary code execution (package.json scripts run as you). Opt-in only:
+  # set ECC_PREPUSH_RUN_CHECKS=1 for repos you trust.
+  if [[ "${ECC_PREPUSH_RUN_CHECKS:-0}" != "1" ]]; then
+    log "Node project detected but ECC_PREPUSH_RUN_CHECKS!=1; skipping repo script execution (set =1 to opt in)."
+  else
+    pm="$(detect_pm)"
+    log "Node project detected (package manager: $pm)"
 
   for script_name in lint typecheck test build; do
     if has_node_script "$script_name"; then
@@ -109,8 +115,12 @@ if [[ -f "package.json" ]]; then
       *) npm audit --omit=dev || fail "npm audit failed" ;;
     esac
   fi
+  fi
 fi
 
+# SECURITY: go test / pytest execute repo-controlled code (TestMain,
+# conftest.py). Same opt-in gate as Node scripts above.
+if [[ "${ECC_PREPUSH_RUN_CHECKS:-0}" == "1" ]]; then
 if [[ -f "go.mod" ]] && command -v go >/dev/null 2>&1; then
   ran_any_check=1
   log "Go project detected. Running: go test ./..."
@@ -126,6 +136,11 @@ if [[ -f "pyproject.toml" || -f "requirements.txt" ]]; then
     log "Python project detected but pytest is not installed. Skipping."
   fi
 fi
+else
+  if [[ -f "go.mod" || -f "pyproject.toml" || -f "requirements.txt" ]]; then
+    log "Go/Python project detected but ECC_PREPUSH_RUN_CHECKS!=1; skipping test execution."
+  fi
+fi
 
 if [[ "$ran_any_check" -eq 0 ]]; then
   log "No supported checks found in this repository. Skipping."