Round-6 sonnet-panel review surfaced seven more concrete bypass
classes. All seven are now closed (629 tests passing, 60 new R6
regression tests):
1. Path traversal under home prefix. `~/../etc/shadow`,
`~root/../etc/shadow`, `~ubuntu/../../etc/shadow`, and
`/home/u/../u/.aws/credentials` all slipped because
`_normalize_path_separators` re-attached the home prefix even
when `..` had escaped it. Now when the tail of a home-prefixed
path begins with `..`, the projection is treated as absolute
(mirroring the runtime resolve when HOME is a single-segment path
like `/root`). POSIX `~<user>/` tilde-user expansion is
handled the same way.
2. Pandas / numpy reader keyword arguments. `pd.read_csv(filepath_or_buffer='/etc/shadow')`,
`pd.read_excel(io=...)`, `np.fromfile(fname=...)` used the actual
API parameter names that the previous gate's `{"file", "path"}`
kwarg list missed. The kwarg set is expanded to cover
`filepath_or_buffer`, `path_or_buf`, `fname`, `filename`, `io`,
`buf`, `source`, `src` and a few common variants.
3. Bash directory exfil verbs. `cp -r ~/.ssh /tmp/out`, `mv ~/.aws /tmp`,
`tar czf out.tar.gz ~/.ssh`, `rsync -av ~/.aws/ /tmp/`,
`zip -r out.zip ~/.ssh` previously slipped because
`_find_sensitive_paths` only flagged named files, leaving the
bash side asymmetric to the Python shutil dir-exfil gate. A new
`_BASH_DIR_EXFIL_RE` matches dir-copy verbs (`cp`, `mv`, `rsync`,
`tar`, `zip`, `7z`, `scp`, `sftp`, `xz`) followed by a sensitive
directory. `ls ~/.ssh` and `find ~/.aws -type f` stay allowed.
4. Inner-tree alias walk for eval / exec. `exec("import shutil as sh\nsh.copytree('~/.ssh', dst)")`
slipped because the inner AST visit did not re-run the
alias-tracking pre-pass that built `shutil_module_aliases`.
Extracted both pre-pass loops into helpers (`_run_alias_prepass`,
already had `_run_string_binding_prepass`) and call both on each
literal eval / exec payload before the visitor recurses.
5. Chained assignment. `a = b = '/etc/shadow'; open(a).read()`
slipped because the binding pre-pass only handled
`len(targets) == 1`. Multi-target Assign nodes now bind every
Name target to the resolved value.
6. Annotated assignment. `path: str = '/etc/shadow'; open(path)`
slipped because the binding pre-pass walked `ast.Assign` but
not `ast.AnnAssign`. Same-shape handler for single Name target.
7. Brace-bomb empty-alt bypass. `cat ~/{,x0,...,x341}/{.ssh/id_rsa,other}`
exhausts the expansion cap before the empty alt's second-brace
projection reaches `~/.ssh/id_rsa`. A defensive
`_SENSITIVE_IN_BRACE_RE` catches sensitive-name fragments inside
an unexpanded brace group attached to a sensitive root,
regardless of whether the brace expansion completed. Anchored
with `(?<=[,{/])` lookbehind and `(?=,|\}|/)` lookahead so
project-local lookalikes (`./workspace/home/u/{a,b}/...`) stay
allowed via the `_PATH_TOKEN_START` boundary.
NetworkAndIoVisitor inner-tree pre-pass. The visitor eval / exec
recursion now mirrors SignalEscapeVisitor's call to both
`_run_alias_prepass` and `_run_string_binding_prepass` so it is
independently correct regardless of visitor execution order.
Cumulative bypass closures across rounds 1 through 6: 24 distinct
classes, 629 regression tests, three-OS green.
eae716675b