提出 #862681: poco-ai poco-agent 0.5.4 Incomplete Cleanup (CWE-459)

# Technical Details
A Destructive Local File Deletion vulnerability exists in the `_setup_session_persistence()` method in `executor/app/core/workspace.py` of poco-agent.

The application fails to check whether `~/.claude` contains user data before deleting it. During task startup, `WorkspaceManager.prepare()` calls `_setup_session_persistence()`, which unconditionally executes `shutil.rmtree(Path.home() / ".claude")` if the directory exists and is not a symlink, then replaces it with a symlink to workspace-local storage. This happens before any repository preparation or agent logic execution, so any valid task payload sent to `POST /v1/tasks/execute` can trigger destructive deletion of host Claude Code data including chat history under `~/.claude/projects`.

# Vulnerable Code
File: executor/app/core/workspace.py
Method: _setup_session_persistence()
Why: The method unconditionally calls shutil.rmtree(self.system_claude_home) where self.system_claude_home = Path.home() / ".claude", deleting all user Claude Code data before replacing it with a symlink. No check is performed to preserve existing user data or warn the user.

# Reproduction
1. Create an isolated test home with sentinel data: `mkdir -p /tmp/test_home/.claude/projects && echo important > /tmp/test_home/.claude/projects/sentinel.txt`
2. Start the affected executor (v0.5.4) with the isolated HOME: `HOME=/tmp/test_home WORKSPACE_PATH=/tmp/test_home/workspace uv run python -m app.main`
3. Submit any valid task payload: `curl -X POST http://127.0.0.1:8080/v1/tasks/execute -H 'Content-Type: application/json' -d '{"session_id":"poc","run_id":"poc-run","prompt":"hello","callback_url":"http://127.0.0.1:9999/callback","callback_token":"dummy","config":{}}'`
4. Verify the sentinel file is deleted and ~/.claude has been replaced with a symlink to workspace storage.

# Impact
- Remote triggering of destructive local data loss via the executor API without any malicious prompt content needed
- Permanent deletion of Claude Code user data including project conversation history under ~/.claude/projects
- In deployments where HOME is bind-mounted from host into executor container, impact extends to host data loss outside the intended workspace boundary

• ソース: ⚠️ https://github.com/poco-ai/poco-claw/issues/131
• ユーザー: JondaChen (UID 99096)
• 送信: 2026年06月18日 11:10 (2 月 ago)
• モデレーション: 2026年08月05日 23:29 (2 months later)
• ステータス: 承諾済み
• VulDBエントリ: 386419 [poco-ai poco-agent 迄 0.5.4 Claude File workspace.py WorkspaceManager._setup_session_persistence]
• ポイント: 20