Refuse ANSI-C and locale quoting in the Bash write guard (#575)

[Kewton]

Closes #575

What changed

• src/tools/bash_write_guard/ansi_c_quoting.rs (new): scans the whole command for ANSI-C quoting $'…' and locale quoting $"…" outside quotes, in any word position.
  • Quote state follows shell_tokens: inside '…', \ is literal; inside "…" and outside quotes, \ escapes the next character.
  • "$'x'", '$' and \$'x' stay allowed, because bash does not expand them.
• src/tools/bash_write_guard.rs: runs the scan at the start of write_targets.
  • The scan runs before shell_tokens, so the $'\'' misreading cannot hide the commands after it. That misreading makes shell_tokens return None, which leaves no write targets.
  • confinement_rejection rejects the result with the new operation ANSI-C / locale quoting.
  • The reason suggests alternatives such as printf 'a\tb\n' and grep -P '\t'.
• tests/issue575_bash_ansi_c_quoting.rs (new): integration tests through path_confinement_rejection.

Why reject instead of decoding

• Escape tables differ between shell versions.
• The value of $"…" depends on the locale's translations.
• Rejecting is honest failure and needs no decoder in each of the three lexers.
• Recorded agent Bash commands use $' or $" 0 times.

Verification

• Runner verify: 15/15 pass on 1c01ed71 (verify run 1176).
• Before/after: on the earlier code, the new rejection table and the operation-name test fail, and the allow table passes. With this change, all pass.
• cargo mutants (-- ansi_c_quoting, no --lib filter, --jobs 2), 19 mutants: 15 caught, 2 missed, 2 unviable.
  • One missed mutant is caught when measured again with --jobs 1.
  • The other is a pre-existing line in write_targets. Integration tests catch it.
  • No survivor remains in the new code.
• Merge-gate review (Claude_Sub): 0 blockers.
  • The tables from the investigation were run again: no form changed from reject to allow.
  • These forms are all rejected: $'\'' misreading, cat $'.env', cat $'sub/link/secret', "a"$'tee', \\$'tee', $(…), backticks, <(…), heredoc bodies.
• Unchanged and still passing: issue566_*, issue567_*, issue428_*, bash_workspace_confinement.

Notes

• Every behavior change is stricter.
  • Commands that contain $' or $" now count as writes, so bash:verify no longer auto-allows them.
  • Auto-allow of verification commands is unchanged: cargo test, timeout 600 cargo test, cargo clippy …, npm test, python3 -m pytest.
  • Event names and schemas are unchanged; only a new operation value is added.
• Accepted false rejections: printf $'a\tb\n' > out.txt, grep $'\t' a.txt, IFS=$'\n' read -r x, read -d $'\0', echo $"hello".
• Out of scope: shell_tokens does not read comments or heredoc bodies. A ' there can hide later commands ([security][tools] Bash の書き込み検査が、字句解析で読めないコマンド（heredoc・コメントの中の '）を丸ごと許可し、ワークスペース外へ書き込める（#575 の調査で発見） #576, pre-existing). When [security][tools] Bash の書き込み検査が、字句解析で読めないコマンド（heredoc・コメントの中の '）を丸ごと許可し、ワークスペース外へ書き込める（#575 の調査で発見） #576 teaches the lexer to skip them, ansi_c_quoting needs the same handling.
• shell_tokens, path_tokens, sensitive_path and the verify classifier are unchanged.
• Related: [security][tools] Bash の書き込み検査が env・sudo・timeout などの前置きや { … } の中の書き込みを認識せず、ワークスペース外へ書き込める（#509 の調査で発見） #566, [security][tools] Bash の書き込み検査が同じコマンドの cd・pushd の後の cwd を追わず、symlink を通ってワークスペース外へ書き込める（#509 の調査で発見） #568, [security][tools] Bash の書き込み検査が、字句解析で読めないコマンド（heredoc・コメントの中の '）を丸ごと許可し、ワークスペース外へ書き込める（#575 の調査で発見） #576, [security][tools] Bash の字句検査では、プログラム経由の間接書き込みや検証コマンドの副作用を閉じ込められない #502.

Developed with the CommandMate parallel-dev harness (PM: Claude Code, leader: Claude_Dev, workers: Command Code).

🤖 Generated with Claude Code