pastilhasandClaude Opus 5
661b3d761f
The privilege drop and the allowlist both held in production. Captured from /proc during the first real member chat turn: uid 1001, parent sudo, HOME and CLAUDE_CONFIG_DIR both inside the member's home, and exactly nine environment variables — the allowlist plus what setpriv supplies. Zero ANTHROPIC_*, POSTGRES_URL or JWT_SECRET. The defect is the cwd. websocket.ts:134 defaults a chat turn to the email-derived general_chat_sessions, and confineUserTree makes every sibling of home the platform's at 0700. So the member's turn starts in a directory it cannot enter — verified, cd fails — and every Bash call in that turn dies instantly, which is what the owner saw as "the shell is unusable". 29 reasoned that those paths stay email-derived because they live under DATA_PATH rather than a home. That is true and it does not follow that they are usable: platform-owned by design means a member's turn can never run there. Fix is a member-owned default, and I would put general_chat_sessions inside their home rather than repointing at the home itself, since it keeps the existing shape for both parties and does not change the owner's path at all. The sibling's 0700 should not be loosened — it holds attachments and email_accounts. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>