jhheider / scriptbox / 29617774444

79%

push

github

subscripts: add wrap mode (freeze shell children recursively)

`--subscripts=wrap` / `subscripts = "wrap"` rewrites resolvable shell child
invocations in the served copy to route through scriptbox itself
(`bash child.sh` -> `<scriptbox> --subscripts=wrap bash child.sh`), so each
child is frozen too, recursively. source/. (in-process), dynamic paths, and
already-immune interpreters (python/ruby/node) are reported but left alone.
Proven by a differential e2e test: a self-mutating shell child is vulnerable
under `report` and frozen under `wrap`.

Also documents a pre-existing quirk found here: SCRIPTBOX_SOURCE is an env var,
so an un-wrapped child inherits the parent's value; wrap fixes it for the tree.
In-process `source` freezing (fd substitution) is the remaining piece.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014psyX18vgHn4UkMwCtZqff

70 of 118 new or added lines in 3 files covered. (59.32%)

837 of 953 relevant lines covered (87.83%)

7.31 hits per line