fix(security): harden worker approval, hook traversal, MCP exec, install scripts, git hooks

- orchestrate-codex-worker: drop yolo, default never approval, worktree containment
- run-with-flags-shell: add path traversal containment mirroring JS guard
- mcp-health-check: gate workspace probe, denylist dangerous env, shell-free reconnect with opt-in
- install.sh/ps1: add --ignore-scripts to block postinstall RCE
- git hooks: refuse global hooksPath clobber, remove file disable bypass, gate pre-push repo script execution
- claw.js: remove Windows shell:true, validate model token
- tests: opt into new secure defaults, quote-aware reconnect parsing

scripts/orchestrate-codex-worker.sh

@@ -48,6 +48,35 @@ fi
 
 write_status "running" "- Task file: \`$task_file\`"
 
+# SECURITY: never auto-approve agent tool execution. The worker prompt is built
+# from a task file that may contain LLM-generated or third-party content
+# (indirect prompt injection). `codex exec -p yolo` would execute
+# rm -rf / exfiltration commands without confirmation.
+# Default to the most restrictive approval mode; allow an explicit operator
+# override only via env (e.g. ECC_CODEX_APPROVAL_MODE=on-request for trusted runs).
+APPROVAL_MODE="${ECC_CODEX_APPROVAL_MODE:-never}"
+case "$APPROVAL_MODE" in
+  never|on-request|on-failure) ;;
+  *)
+    echo "[ECC worker] Refusing to run: unsupported ECC_CODEX_APPROVAL_MODE='$APPROVAL_MODE' (expected never|on-request|on-failure)" >&2
+    write_status "failed" "- Error: unsupported approval mode"
+    exit 1
+    ;;
+esac
+
+# Contain the task file to the current worktree so a malicious launcher cannot
+# point the worker at /etc/passwd or a sibling checkout.
+task_real="$(realpath -m "$task_file" 2>/dev/null || readlink -f "$task_file" 2>/dev/null || printf '%s' "$task_file")"
+work_real="$(pwd -P 2>/dev/null || pwd)"
+case "$task_real" in
+  "$work_real"/*) ;;
+  *)
+    echo "[ECC worker] Refusing to run: task file outside worktree: $task_file" >&2
+    write_status "failed" "- Error: task file outside worktree"
+    exit 1
+    ;;
+esac
+
 prompt_file="$(mktemp)"
 output_file="$(mktemp)"
 cleanup() {
@@ -77,7 +106,7 @@ Task file: $task_file
 $(cat "$task_file")
 EOF
 
-if codex exec -p yolo -m gpt-5.4 --color never -C "$(pwd)" -o "$output_file" - < "$prompt_file"; then
+if codex exec -p "$APPROVAL_MODE" -m gpt-5.4 --color never -C "$(pwd)" -o "$output_file" - < "$prompt_file"; then
   {
     echo "# Handoff"
     echo