Gate-hook permission globs bake absolute home path → protections silently no-op after a home/box move

[vikasprogrammer]

Severity: 🔴 security

Discovered during the instawp box-to-box migration (2026-07-21).

Problem

Each agent's .claude/aos-settings.json gate-hook deny/allow rules are written as absolute paths at materialization, e.g.:

/home/vikas/tools/agent-os/data/agent-os.db*
/home/vikas/.ssh/**
/home/vikas/tools/agent-os/data/connectors/**

When the data home moves (box migration, service-user rename, path change), these globs no longer match the real runtime paths (now /home/ubuntu/...). The rules that protect the DB, secrets, connector state, and SSH keys silently stop matching — with no error. The agent then runs with those guardrails effectively removed.

Impact

A migrated tenant loses its DB/secret/SSH protection rules without any signal. This is a silent security downgrade.

Fix direction

• Derive these protective globs from the live data home at gate-hook evaluation (or at materialization each launch), not freeze the absolute path at agent-create time; or
• Resolve realpath / make the deny match home-relative in terminal/gate-hook.sh.

Workaround

docs/tenant-box-migration.md §4 rewrites /home/OLD/→/home/NEW/ across .claude configs post-move.