Phase 8: Security & Polish

[laynepenney]

Summary

Production hardening with security features and polish.

Reference Implementation

Based on Codex-RS patterns:

• execpolicy/ - Command safety analysis
• linux-sandbox/, windows-sandbox/ - Process isolation
• keyring-store/ - Credential management

Components to Implement

Command Safety

• Dangerous command detection patterns
• Command allowlist/blocklist
• Safety scoring system

Process Sandboxing (Optional)

• Linux sandbox (landlock/seccomp)
• macOS sandbox (sandbox-exec)
• Windows sandbox (Job objects)
• Feature-gated for optional use

Credential Storage

• Keyring integration (keyring crate)
• Secure API key storage
• Provider authentication tokens

OAuth Flows

• Provider-specific OAuth
• Token refresh handling
• Secure token storage

Error Recovery

• Graceful degradation
• Provider fallback chains
• Network error handling
• Session recovery

Dependencies

• keyring 3 for credential storage
• OS-specific sandbox libraries (feature-gated)

Related

• Depends on: All previous phases

Estimated Effort

~4 weeks, ~6 person-weeks