Harden sandbox: sanitize SQLite names, restrict exec/imports, remove hard-coded secret

[harvatechs]

Why

This PR fixes critical security issues discovered during an audit: SQL identifier injection risk in the memory store, sandbox escape surface via exec()/imports in the transpiler, and a hard-coded secret in a benchmark file. Tests and basic validation were performed locally.

What changed (approach)

• Sanitize and strictly validate memory namespace → SQLite table names. Enforce a safe regex and raise on invalid names. Also validate savepoint token format before use. (inthon/memory/sqlite_store.py)
• Reduce exec() attack surface by running transpiled code with a minimal builtins and a safe import wrapper that only allows inthon.* and time. This keeps necessary imports while blocking arbitrary module imports. (inthon/compiler/transpiler.py)
• Replace an in-repo hard-coded secret used in a benchmark with an environment lookup (os.environ) to avoid secrets in source. (benchmarks/suite/agent_memory_squeeze.py)

Tests & validation

• Full test suite: 224 passed locally.
• Ran pip-audit: found 54 dependency advisories (reported separately). This PR does not upgrade deps; it focuses on code-level hardening and secret removal.

Notes and review requests

• The safe import allows only the inthon.* modules and time. If additional stdlib modules are required by transpiled code, please advise which ones to permit; prefer explicit, minimal additions.
• Savepoint/table validation prevents SQL injection via namespace or crafted tokens. If callers need names with other characters, please provide a mapping/whitelist to canonical identifiers instead of relaxing validation.
• Pip-audit shows several vulnerable packages (aiohttp, cryptography, etc.). Recommend a follow-up PR to pin/upgrade high-severity deps and re-run tests.

Files changed

• inthon/memory/sqlite_store.py — sanitization and savepoint validation
• inthon/compiler/transpiler.py — restricted builtins and safe import wrapper
• benchmarks/suite/agent_memory_squeeze.py — removed hard-coded secret

Follow-ups (recommended)

1. Upgrade vulnerable dependencies identified by pip-audit and test.
2. Review all call sites that build SQL identifiers or rely on SAVEPOINT names; prefer parameterized queries and mapping to controlled identifiers.
3. Audit subprocess/spawn sites (subprocess.Popen, os.system) and ensure they avoid shell=True and validate arguments.
4. Consider moving transpiled execution into a separate OS-level sandbox (process/container) for defense-in-depth.

N/A sections from repository PR templates (if any)

N/A