fix(security)!: flag elided audit records, block host-availability commands, ship arm64 (0.8.1)

[blackaxgit]

Six issues, all surfaced by end-to-end testing against a live disposable SSH host rather than by the unit suite. 833 tests, 90% coverage, all gates exit 0. Every new guard is proven fail-on-mutation.

Version 0.8.1: nothing here turns a configuration that started on 0.8.0 into one that refuses to start, which is the test 0.8.0 itself recorded for taking the minor.

1. The audit log could silently omit an executed command — HIGH

Redaction replaces from the credential marker to the end of the whitespace-delimited token — which is what stops a partially quoted secret leaking — but shell separators are not whitespace:

sent:   echo --password=X;touch /tmp/CHAINED
logged: echo --password={REDACTED} /tmp/CHAINED     ← "touch" gone
sent:   echo --password=X;reboot
logged: echo --password={REDACTED}                   ← "reboot" gone entirely

Proven, not inferred: the elided touch created its file on the host. The tripwire still saw the real string, so rm -rf / stayed blocked — but anything the tripwire did not cover executed and vanished from the record.

Narrowing the replacement to the separator was rejected: a secret containing ; would then have its tail printed. The value stays fully hidden and the record stops being silent instead — text that could chain a command now yields {REDACTED+ELIDED}.

The marker errs toward flagging: a secret that merely contains ; is flagged too, because distinguishing those needs shell parsing this module refuses to do. A noisy marker is recoverable; a truncated audit record is not. Hypothesis found that false positive immediately, so the property test now derives its expected placeholder from the generated secret — exact equality preserved, not loosened.

Newline and CR were removed from the separator set after asserting them failed: whitespace has already split the token, so they were unreachable branches in a security-relevant predicate.

2. The tripwire covered data destruction, not availability destruction — MEDIUM

BLOCKED       rm -rf /tmp/build-cache    ← routine
reached host  reboot / poweroff / init 0 / systemctl poweroff
reached host  iptables -F                ← severs access to the host
reached host  userdel -r / passwd -l

Inverted priorities for a tool whose execute_on_group fans one command across a fleet. Now covered, anchored on command position rather than the bare word — a plain \breboot\b blocks last reboot and grep reboot /var/log/messages, and blocking read-only diagnostics is how a tripwire teaches operators to route around it. Accepted and documented cost: sudo -n reboot slips past.

_is_dangerous_command now searches two renderings, because collapsing a newline to a space is right for one pattern class and wrong for the other: rm -rf\n/ needs the whitespace reading, a second line reboot needs the command-position one. With the space rendering alone, echo hi\nreboot was measurably not caught.

rm -rf was deliberately NOT narrowed. It blocks any absolute path today, a false positive on rm -rf /tmp/cache — but loosening a security denylist is the owner's decision, not a drive-by, and rm -rf /etc would pass under the narrower form.

3. upload_file on a fifo hung, killing all SFTP — MEDIUM

O_NONBLOCK was missing, so the existing S_ISREG refusal was unreachable for exactly the file type it rejects. Sixteen concurrent fifo uploads exhausted the default executor and every later to_thread call stalled until restart, while execute kept working.

The test asserts the flag rather than uploading a real fifo, and that shape was measured: the end-to-end version goes red and then hangs the run for 120 s, because the blocked executor thread is non-daemon. A mutation that hangs CI is strictly worse than one that fails it.

4. The image is now linux/amd64 and linux/arm64 — MEDIUM

0.8.0 was amd64-only, so docker run failed outright on Apple Silicon and Graviton — verified against the published manifest. Two consequences would otherwise have shipped a green-but-blind gate:

• Trivy resolves an index to the runner's platform, so one scan step would publish arm64 uninspected. There is now one step per platform via TRIVY_PLATFORM.
• steps.build.outputs.digest is now an index digest whose children are what imagetools create copies into the tag, so verification derives its expected set from the scanned reference. Hardcoding the digest would have failed every publish run — the same shape as the 2026-07-26 incident, one level down.

5. Typing — LOW

_lifespan was -> Any, producing two real Pyright errors; now -> AsyncGenerator[None]. The three deprecated Iterator forms under @contextmanager became Generator. Fixing the last surfaced a genuine narrowing hole: _transfer_root yielded an int | None attribute instead of a checked local. ssh.py reports zero Pyright errors; server.py is down from seven to two venv-resolution artefacts that mypy resolves.

6. Honest output and one prose correction — LOW

• An unknown group no longer renders as Executing on group 'x' (1 servers)..., which asserted both that the group existed and that it had a member.
• A symlink at a download destination now says so, instead of reading as "a regular file is in the way".
• The 0.7.0 claim that all four security floors protect pip install consumers is corrected: only mcp and asyncssh reach the wheel's METADATA; cryptography and click are uv-only constraints.

Verification

Live-smoked on the real binary: availability blocks fire, last reboot / grep reboot / systemctl status / iptables -L still run, and the audit lines read {REDACTED+ELIDED} exactly where a command was swallowed while an ordinary secret still reads {REDACTED}. Fixture (two containerised sshd instances, throwaway key, sandboxed HOME) torn down; no real host or ~/.ssh was touched.

New mutation-proven guards: the redaction marker (7 cases + the deliberate false positive), 19 availability blocks and 13 must-still-run diagnostics, the newline double-rendering, the multi-arch platform/scan equality, the upload O_NONBLOCK flag, and the group-header shape (including two tests that keep the fix from over-reaching).