Repository navigation
fix(agent-guard): unwrap env/command prefixes and refuse a quoted ~ - #1690
Closed
liwenjie200543 wants to merge 1 commit into
Closed
liwenjie200543 wants to merge 1 commit into
liwenjie200543 wants to merge 1 commit into
Conversation
The engine looked only at a segment's first word, so `env git commit` and `command git push` slipped past every guard, and vetted-ops-spelling compared the base after shlex removed the quotes, so a quoted `~` - which the shell never expands - matched the allowed spelling. Unwrap `env` (options -i, -u NAME in both spellings, --unset=NAME, --, and NAME=value assignments, which still feed Segment.env so overrides keep working) and `command` (-p, --) in the engine, before any guard runs; nesting unwraps too, and `command -v` - which locates rather than runs - ends the wrapper instead of fabricating a bare argv. split_segments now pairs every token with its own source text (Segment.raw_argv), so vetted-ops-spelling can read the spelling: a quoted or escaped `~` that parses to the stable path is refused with the same corrected-command message. Tests cover every wrapper form per guard family, the override behind `env` assignments, and each spelling the shell will not expand.
github-actions
Bot
added
family:tools
Member
|
Thank you for working on this, and for the careful write-up. #1679 was fixed by #1691, which merged yesterday and covers the same ground: unwrapping Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1679.
The engine now unwraps
env/commandprefixes before any guard runs:envwith its options (-i,-u NAMEin both spellings,--unset=NAME,--) and itsNAME=valueassignments — which still feedSegment.env,so
env MAGPIE_ALLOW_VETTED_PATH=1 …keeps working — andcommandwith-p/--. Nesting unwraps too (env command git …), andcommand -v,which locates rather than runs, ends the wrapper instead of fabricating a
bare argv; the "prefix wrappers remain a separate gap" note in
Segment.__init__is gone with the gap.For the quoted
~,split_segmentsnow pairs every token with its ownsource text (
Segment.raw_argv) and_vetted_launchreports the argvslot the base arrived in, so vetted-ops-spelling reads the spelling, not
just the value: a quoted or backslash-escaped
~that parses to thestable path is refused with the same corrected-command message — the
shell never expands it, so
uvreceives a directory literally named~and the sandbox exclusion does not match.
Verification: pytest 332 passed in
tools/agent-guard(the 73 baselinefailures are an artifact of this working copy carrying only
tools/agent-guard, so the skill-owned guards fail discovery — CI's fullcheckout does not see them); ruff check + format clean; mypy clean apart
from the two pre-existing Windows
pwd/getuidnotes.