two real CI failures on main, both shipping bugs in the action:
1. `token-exfil-claude` was a real sandbox escape: GHA `ubuntu-latest`
puts `runner` in the `docker` group, so a sandboxed shell could run
`docker run --pid=host --privileged busybox cat /proc/<parent>/environ`
and read the action process's env (which holds user secrets) — fully
bypassing the unshare PID-namespace. fix: inside the sandbox's mount
namespace (already private via `--mount-proc` which implies `--mount`),
bind-mount /dev/null over /var/run/docker.sock (+ podman/containerd/crio
variants) so any container-runtime socket connect from the sandbox fails.
only affects sandboxed shells — host runner mount table is untouched, so
user workflow steps outside pullfrog keep working.
2. `restricted-opencode` regressed in #719 (`experimental.batch_tool`).
opencode's batch tool rejects MCP tools with `"Tool '<name>' not in
registry. External tools (MCP, environment) cannot be batched."` when a
model emits parallel `pullfrog_shell` (or any MCP) tool_use blocks,
opencode internally routes them through batch, they all fail, the model
misreads the error as "the tool doesn't exist", and gives up. caught by
a `lens:` subagent in the restricted test concluding shell was
unavailable and setting `DIAGNOSTIC_ID=empty`. drop `batch_tool: true`
and the matching opencode-specific guidance in `instructions.ts` — native
parallel tool_use (multiple tool_use blocks per assistant message) still
works for both built-in and MCP tools without batch, so we lose only the
1-25 wrapper, not parallelism.
Colin McDonnell
c0988e35b0