[Kewton]

Closes #568

What changed

• src/tools/bash_write_guard/working_directory.rs (new) tracks the working directory a command can reach after cd, pushd and popd. It keeps a set of candidates.
  • The set starts at the workspace root. Each cd or pushd with a resolvable target adds that target to every candidate; nothing is ever replaced. Subshells, pipelines and || may or may not restore the directory, and keeping the root covers both cases without emulating them.
  • A target is resolvable when it is literal: no $, backticks, ~, glob, - or ...
  • popd, pushd ±N and a bare pushd add no candidates. pushd -n DIR adds DIR.
  • The candidate set is unresolvable in these cases:
    • the command contains CDPATH or DIRSTACK
    • cd, pushd or popd is combined with a loop or a function definition
    • the set grows past 64 candidates. Each chained cd doubles the set, so this cap prevents exponential work before sh starts.
• src/tools/bash_write_guard.rs:
  • Relative write targets and each cd/pushd target are checked against every candidate.
  • When the candidate set is unresolvable, any relative write target is rejected (honest failure).
  • pushd is recorded as a working directory target.
  • protected_path_mutation also matches relative targets against each candidate. cd tests && cp a.txt spec.rs is now detected.
• src/tools/bash.rs:
  • The stage-2 path check uses the same candidates for relative read candidates. When the candidate set is unresolvable, it rejects every relative read word. This closes cd sub && cat link/secret and CDPATH=sub cd link && cat secret.
  • CDPATH is removed from the environment of the sh -c process, so the runtime cannot resolve cd differently from the static check.
• src/tools/bash_write_guard/command_prefix.rs: pushd and popd are added to the write programs that the unresolvable-prefix scan looks for.
• tests/issue568_bash_cwd_write_targets.rs (new): integration tests that call path_confinement_rejection.

What did not change

• shell_tokens, ShellToken and the command_prefix resolution.
• The ANSI-C quoting scan at the start of write_targets.
• The candidates are not added as WriteTargets. So write detection and the bash:verify auto-allow do not change: cd frontend && npm test and cd crates/x && cargo test are still auto-allowed.
• Event names and schemas. Rejections reuse existing operation values.

Verification

• Runner verify: 15/15 pass on 175b61da.
• Before/after: on 3581d777, 4 of 5 new integration tests fail. After the review fix, the DIRSTACK/CDPATH test fails on b5bea876, and the candidate-cap test does not return within 15 minutes there. All 7 pass on 175b61da.
• cargo mutants (-- working_directory, no --lib filter, --jobs 2):
  • First run: 94 mutants, 76 caught.
  • The 9 survivors were stricter-side or unused-value mutants. Tests were added, and all of them are caught now.
  • Fix diff: 27 mutants, 21 caught. The remaining 4 shift the cap comparison by one step (64 vs 128 candidates). That is stricter and still bounded.
• Merge-gate review (Claude_Sub):
  • The first review found 2 blockers. Rewriting DIRSTACK sent popd outside the workspace. A relative read was allowed after CDPATH. It also found the exponential candidate growth.
  • All three are fixed. The recheck reports 0 blockers.
  • 1760 earlier table rows were re-run: 0 changed from reject to allow. Write detection, protected-path detection and auto-allow did not change, except the intended protected-path detection after cd.
• Unchanged and still passing: issue575_*, issue566_*, issue567_*, issue428_*, bash_workspace_confinement.

Notes

• Out of scope ([security][tools] Bash の字句検査では、プログラム経由の間接書き込みや検証コマンドの副作用を閉じ込められない #502): eval cd …, trap 'cd …' DEBUG, source/alias, and variable names built at runtime (n=CD; export "${n}PATH=sub").
• Known conservative false rejections, tracked separately:
  • Once the candidate set is unresolvable, stage 2 counts command names as relative read words. So CDPATH= cd sub && cargo test is rejected.
  • Any word that contains DIRSTACK makes the set unresolvable.
• The exec-prefix vs shell-prefix distinction carried over from [security][tools] Bash の書き込み検査が env・sudo・timeout などの前置きや { … } の中の書き込みを認識せず、ワークスペース外へ書き込める（#509 の調査で発見） #566 is not needed. Keeping the root candidate already covers env cd sub.
• Related: [security][tools] Bash の書き込み検査が env・sudo・timeout などの前置きや { … } の中の書き込みを認識せず、ワークスペース外へ書き込める（#509 の調査で発見） #566, [security][tools] Bash の書き込み検査の字句解析が ANSI-C 引用 $'…' を扱わず、program や option を見逃してワークスペース外へ書き込める（#566 の再確認で発見） #575, [security][tools] Bash の書き込み検査が、字句解析で読めないコマンド（heredoc・コメントの中の '）を丸ごと許可し、ワークスペース外へ書き込める（#575 の調査で発見） #576, [security][tools] Bash の 2 段目の読み取りの判定が、引用符のない glob・動的な値・glob を含む絶対パスで抜け、ワークスペース外を読める（#567 の調査で発見） #571, [security][tools] Bash の字句検査では、プログラム経由の間接書き込みや検証コマンドの副作用を閉じ込められない #502.

Developed with the CommandMate parallel-dev harness (PM: Claude Code, leader: Claude_Dev, workers: Command Code).

🤖 Generated with Claude Code