feat: port one-shot-token from C to Rust and improve container security#720

Closed

lpcox wants to merge 16 commits intomainfrom

lpcox/port-one-shot-token-rust

Commits on Feb 12, 2026

fix: narrow home directory mounts to prevent access to sensitive paths
lpcox
committed
fix: delete docker-compose.yml after container startup
lpcox
committed
refactor: port one-shot-token library from C to Rust
lpcox
committed
fix: cache token values in rust implementation to match c behavior
lpcox
committed
fix: create .copilot/logs mountpoint before docker mount (#722)

Claude
and
lpcox
authored
Potential fix for code scanning alert no. 611: Incomplete string escaping or encoding

lpcox
and
github-advanced-security[bot]
authored
fix: prevent docker output from contaminating command stdout (#743)

Claude
and
lpcox
authored
fix(ci): clean npm cache and verify Rust binary locations in chroot tests (#744)
Claude
authored
fix(ci): detect and set CARGO_HOME explicitly for rust tests (#745)

Claude
and
lpcox
authored
Verify token removal from /proc/self/environ and /proc/self/task/*/environ after unsetenv (#746)

Copilot
and
lpcox
authored
fix: add CARGO_HOME/bin to GitHub Actions PATH for rust tests (#749)

Claude
and
lpcox
authored
fix(chroot): detect cargo binaries when CARGO_HOME unset (#750)

Copilot
and
lpcox
authored
fix: remove legacy C impl, add -v to fallback docker rm, fix tests (#754)

Mossaka
and
claude
authored
fix: resolve merge conflicts with main

Mossaka
and
claude
committed
fix: mount ~/.cargo read-only in chroot, hide only credentials file

Mossaka
and
claude
committed
fix: skip cargo credentials tmpfs in chroot (parent is read-only)

Mossaka
and
claude
committed