[potiuk]

Summary

Follow-up to #1789. The container-gateway session hook runs outside the sandbox; two more inputs to it came from the session environment, which project settings can set:

• Bash read the environment before the hook's first line. BASH_ENV (a file bash executes), exported functions (BASH_FUNC_git%% would replace git) and SHELLOPTS all applied. The shebang is now #!/bin/bash -p: privileged mode ignores all three. That only holds when the hook is executed directly — as bash <path> nothing inside the script can undo what the shell already imported (an exported function can shadow even exec) — so the setup, verify and docs now wire it by its absolute path, executed directly: a ~ in the hook command is also expanded from $HOME by the launching shell. isolated-setup-verify flags a ~/$HOME or bash/sh hook command.
• The account-home lookup failed open. When the account database's home cannot be determined, the hook now does not start, rather than falling back to $HOME alone.

Type of change

• Cross-cutting (sandbox / agent isolation)
• Skill change (isolated-setup-install / isolated-setup-verify: absolute, direct hook command)
• Documentation (secure-agent-setup.md)

Test plan

• prek run on the changed files passes
• pytest tools/agent-isolation/tests/test_container_gateway_hook.py (outside /tmp/claude*, where the suite does not skip): 71 passed
• New regression tests with the hook executed through its shebang — BASH_ENV, exported git, SHELLOPTS each fail on the hook before this change; exported exec guards the re-exec trap rejected during review
• roborev review clean

RFC-AI-0004 compliance

• Sandbox — closes a way for a project's settings to get code run outside the sandbox

---

Gen-AI disclosure: drafted with Claude Code (Opus 5); reviewed by the submitter.

🤖 Generated with Claude Code