Function WriteHostCAFile

internal/isolation/cacopy.go:32–54

WriteHostCAFile writes the MITM CA cert to ~/.agent-vault/isolation/ca- .pem with mode 0o644 (the container's unprivileged claude user must read it via the bind mount). The enclosing directory stays 0o700 so only the host user and root can read the file on the host side. Returns the full

(pem []byte, sessionID string)

//
// Returns the full host path for use as a docker -v source.
func WriteHostCAFile(pem []byte, sessionID string) (string, error) {
	if !sessionIDRE.MatchString(sessionID) {
		return "", fmt.Errorf("WriteHostCAFile: sessionID must be hex, got %q", sessionID)
	}
	dir, err := hostIsolationDir()
	if err != nil {
		return "", err
	}
	if err := os.MkdirAll(dir, 0o700); err != nil {
		return "", fmt.Errorf("create isolation dir: %w", err)
	}
	path := filepath.Join(dir, caPrefix+sessionID+caSuffix)
	if err := os.WriteFile(path, pem, 0o600); err != nil {
		return "", fmt.Errorf("write CA file: %w", err)
	}
	// WriteFile with 0o600 is default-safe; Chmod to 0o644 is the
	// explicit step that lets the container read its own bind mount.
	// Parent dir is 0o700 so the host attack surface is unchanged.
	if err := os.Chmod(path, 0o644); err != nil { // #nosec G302 -- container user (UID != host) must read bind-mounted CA; parent dir is 0o700
		return "", fmt.Errorf("chmod CA file: %w", err)
	}
	return path, nil
}

// PruneHostCAFiles removes ca-*.pem files in ~/.agent-vault/isolation/
// older than caStaleTTL. Best-effort — errors are ignored because this