Default safe for untrusted code: crew run tokens scoped to their repo, and outside repos quarantined until a security review passes #3963

Owner, 2026-10-21 02:05Z, after migrating an outside repository (osint/gods-eye-view): "security is important. this is a random repo. i dont wanna get hacked … is this safe? do we need a safe mode? ideally no and we are just default safe".

Probes (steward):

• A crew run's forge token is not scoped to its repository. src/crew/runner.ts:827 — createToken(app.db, agent.user.id, "run:<id>", "rw", { expiresAt }): the crew member's full read-write power for the run's life. A crew member works across repos (Quill builds trevato/arm, private), so text inside an untrusted repo (README, comments, AGENTS.md — prompt injection) could steer a run into reading private repos and posting their content publicly on the forge (an issue/comment is an exfiltration channel even with the network locked to the forge), or pushing branches/opening pulls elsewhere.
• Cells' egress was report (undeclared web hosts let through); the steward switched it to enforce (gitops, 02:00Z; 0 apps had egress reports).
• Nothing from osint/gods-eye-view ran: its two crew runs failed ("no model account") and its deploy failed ("not an app"). Its autonomy and quill/gods-eye-view's are now off pending review.

Done — default safe, no "safe mode" switch:

1. Run tokens are repo-scoped: a run's token can read and write only its own repository (and read its fork parent); every other repo answers 404 to it — including the crew member's other repos, the owner's private repos, admin APIs, secrets. Issues/comments it writes are limited to its own repo. Test: a run token on repo A gets 404 on private repo B and cannot comment on B.
2. Untrusted code is quarantined by default: a repo migrated from outside, a fork from a non-member, or an outside pull: the first crew pass is a read-only security review (Sentinel) of install hooks, CI, network calls, obfuscation, binaries, prompt-injection text; until it passes, no app deploy, no install scripts, no checks run its code, and no builder runs on it. Passing is recorded on the repo; the owner can override. (This is default behaviour, not a mode to remember.)
3. Prompt-injection hygiene: the crew brief marks repository content as untrusted data, never instructions; tool calls that touch other repositories from a run are refused by the token anyway (1).
4. Install scripts off by default for untrusted repos (bun install --ignore-scripts) until reviewed.
5. Tests for each, plus a red-team fixture repo whose README tells the agent to post a private file — the run cannot.

Parked by the crew: the check failed in the place it ran, not in the change, and failed the same way when it was run again (pull #3971 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Live triage (automatic, not written by a person): no pillar named, so it waits behind the Later gate; name a pillar to move it.

Steward (trevato): pull #3971 was parked by an infrastructure fault, not this work - the egress cap from #3719 stopped every check's package install (02:20-03:12Z). The forge is rolled back and the cap is fixed (c7ea1935). Reopened and re-checked; this strike does not count.