- Block running an explicit LOCAL executable path at command position (./evil, subdir/tool) in
both the argv scanner and the shell command scanner: a sandboxed snippet can create + chmod a
local script with an interpreter shebang and run it, starting an unguarded child the basename
scan never sees. Absolute system-bin paths (/bin, /usr/bin, ...) stay allowed and are still
interpreter-checked by basename.
- Fail closed on a child file-reader (cat / head / ...) with a relative argv path under a
NON-literal subprocess cwd= (cwd=P that could evaluate to /etc), which cannot be proven
sandbox-local; a literal benign cwd and a non-reader program stay allowed.
- Treat a shell startup variable (BASH_ENV / ENV) in an explicit subprocess env= dict as a shell
escape: bash / sh sources it before the -c payload runs.
- Runtime backstop: treat the exact /root path (not only /root/*) as sensitive so a directory
reader over the root home is denied, and wrap Path.glob / Path.rglob like Path.iterdir so a
dynamically built receiver pointing at a sensitive directory is screened.
- Make the newline -> ; command-separator rewrite quote-aware, and neutralize quoted separators
before the command-boundary regex, so a quoted multiline string (echo "ok\nrm") is not
mis-blocked; unquoted separators and command substitution ($(...) / backticks, including
inside double quotes) still block.
Adds TestRound27Bypasses plus runtime tests for exact /root and pathlib glob / rglob.
e6d24369a9