Harden nested bash auto-shell peels

Author: TheGreatAxios

src/permission/classify-security.test.ts

@@ -802,9 +802,24 @@ describe("CL-6988 — nested / escaped interpreter peels do not auto-allow", ()
   });
 
   test("a double-nested alternating-quote bash -c redirect still denies", () => {
+    expect(autoShellRuleForCall(shellCall(`bash -c "bash -c 'echo hi > out.txt'"`))?.name).toBe(
+      "file-mutation",
+    );
+  });
+
+  test("bash -O/-o option values before -c do not hide dependency installs", () => {
+    expect(autoShellRuleForCall(shellCall(`bash -O extglob -c 'npm install left-pad'`))?.name).toBe(
+      "dependency-install",
+    );
     expect(
-      autoShellRuleForCall(shellCall(`bash -c "bash -c 'echo hi > out.txt'"`))?.name,
-    ).toBe("file-mutation");
+      autoShellRuleForCall(shellCall(`bash -o pipefail -c 'npm install left-pad'`))?.name,
+    ).toBe("dependency-install");
+  });
+
+  test("bash -c positional argv execution does not auto-allow dependency installs", () => {
+    const cmd = `bash -c '$0 $1 $2' npm install left-pad`;
+    expect(isAutoAllowedShellCall(shellCall(cmd))).toBe(false);
+    expect(autoShellRuleForCall(shellCall(cmd))?.name).toBe("opaque-wrapper");
   });
 
   test("an escaped triple-nested bash -c redirect does not auto-allow", () => {
@@ -820,10 +835,10 @@ describe("CL-6988 — nested / escaped interpreter peels do not auto-allow", ()
 
   test("quote-broken deep nesting that degrades to a bare interpreter asks", () => {
     // Alternating quotes collide by depth 4 and peel used to land on bare `bash`.
-    const deep = `bash -c "bash -c 'bash -c \"bash -c 'echo hi > out.txt'\"'"`;
+    const deep = String.raw`bash -c "bash -c 'bash -c \"bash -c 'echo hi > out.txt'\"'"`;
     expect(isAutoAllowedShellCall(shellCall(deep))).toBe(false);
     const rule = autoShellRuleForCall(shellCall(deep));
     expect(rule).toBeDefined();
-    expect(rule!.effect === "ask" || rule!.effect === "deny").toBe(true);
+    expect(rule?.effect === "ask" || rule?.effect === "deny").toBe(true);
   });
 });

src/shell/run-shell-authz.ts

@@ -391,17 +391,26 @@ function isBackslashInterpreterToken(token: string): boolean {
   return base.startsWith("\\") && SHELL_INTERPRETERS.has(base.slice(1));
 }
 
+function shellPayloadReferencesPositional(payload: string): boolean {
+  return /\$(?:[0-9@*#]|\{(?:[0-9]+|[@*#])\})/.test(payload);
+}
+
 function nestedInterpreterPayloadOpaque(payload: string, rest: readonly string[]): boolean {
   if (isBackslashInterpreterToken(payload)) return true;
   const first = tokenize(payload)[0];
   if (first !== undefined && isBackslashInterpreterToken(first)) return true;
+  // The payload can execute trailing argv through $0/$1/... substitution, so
+  // the payload alone is not a faithful subject for dependency-install policy.
+  if (rest.length > 0 && shellPayloadReferencesPositional(payload)) return true;
   // Trailing tokens after the -c payload: allow only plain positionals.
   // `-c`, redirects, backslashes, or flags mean the quoted body was split and
   // the truncated payload must not be trusted on its own under auto.
   if (rest.length > 0 && !rest.every(isSafeShellPositional)) return true;
   return false;
 }
 
+const SHELL_SEPARATE_VALUE_FLAGS = new Set(["-O", "-o"]);
+
 function peelShellDashC(tokens: string[], start: number): PeelOutcome {
   let i = start;
   while (i < tokens.length) {
@@ -424,6 +433,10 @@ function peelShellDashC(tokens: string[], start: number): PeelOutcome {
       if (nestedInterpreterPayloadOpaque(payload, [])) return { kind: "opaque" };
       return { kind: "inner", command: payload };
     }
+    if (SHELL_SEPARATE_VALUE_FLAGS.has(t)) {
+      i += 2;
+      continue;
+    }
     // Clustered short flags that include `c` (`-lc`, `-ic`, …): `c` takes the
     // next token as the command string, matching bash/sh/zsh.
     if (/^-[A-Za-z]*c[A-Za-z]*$/.test(t)) {