claude-code: adversarially harden the privacy boundary

[SignalLayerLabs]

Goal

Treat Claude Code integration input as hostile and prove that sensitive local context cannot accidentally cross MARGINAL privacy boundaries.

Contribution wanted

Build adversarial privacy tests using synthetic canaries and harden any boundary that fails.

Synthetic canaries

Include synthetic examples resembling:

• email addresses;
• usernames;
• macOS home paths;
• Windows user paths;
• private repository URLs;
• bearer tokens;
• API keys;
• AWS-style credentials;
• UUID installation IDs;
• session identifiers;
• repository/state hashes;
• raw shell commands;
• prompts;
• source snippets;
• tool output;
• arbitrary URLs;
• custom/private model aliases.

Required guarantee

Privacy-safe or exportable evidence must not contain raw:

• prompts;
• source code;
• command text;
• tool output;
• filenames or paths;
• repository identity;
• user identity;
• session identity;
• device/install identity;
• credentials;
• arbitrary metadata;
• arbitrary free text.

Pseudonymization must not be presented as anonymity.

Acceptance criteria

• Direct unknown-field tests.
• Nested unknown-field tests.
• Serialization-level canary tests.
• Malformed input tests.
• Oversized input tests where applicable.
• Tests prove synthetic secrets/canaries never reach privacy-safe serialized output.
• No stable user, device or installation identifier is introduced.
• Unknown/private/custom model identity is not exported as a public model identity.
• Existing Local Only behavior remains intact.
• Existing Codex, OpenCode and PrivacyCode behavior remains unchanged.
• Use synthetic fixtures only.

Security posture

If a field cannot be proven safe for a strict privacy boundary, reject or keep it local rather than attempting heuristic sanitization.