[RSI, security] Refuse sudo/doas privilege escalation in kernel bash

packages/coding-agent/.changes/kernel-sudo-guard.md

@@ -0,0 +1 @@
+- Added a privilege-escalation guard to the kernel bash tool: sudo/doas command words are refused before any process starts, because silent privilege escalation outranks every other guard on passwordless-sudo setups. Covered: any path spelling, quote- and escape-folded spellings (`su"do"`, `"sudo"`, ANSI-C `$'su\x64o'` with out-of-range escapes kept literal instead of raising), brace/glob/letter obfuscation of the command word (`su{d,}o`, `{sudo,} id`, `sud[o]`, `su?do`, sequences such as `s{u..u}do` or `{1..9}`), and a brace group whose element count times the group chain exceeds the enumeration cap fails closed before it is built, wrapper chains (env/nice/timeout/nohup/setsid/exec/busybox/stdbuf/ionice/strace/ltrace/watch/faketime/systemd-run/chroot, including their value-taking options such as `env -S`, `env -C`, `timeout -s`, `stdbuf -o`, `nice -n`, `exec -a`, `watch -n` (its `-d`/`-t` and `faketime`'s `-m`/`-f` are boolean), each launcher's required-argument long options (strace's `--user`/`--argv0`/`--color` and the rest of its longopts, ltrace's `--indent`/`--library`, systemd-run's `-H`/`--uid`/`--gid` and its timer and property options, parallel's `-C`/`-d`/`-J`/`-P`/`-s`/`-E` and their long forms, `env -a`/`--argv0` and BSD `env -P`, `watch -q`/`-s`), bundled short flags such as `env -vu NAME`, and the operands of xargs options such as `-n`, `-I`, `-P`, plus the leading operands of `chroot`/`faketime` and `timeout`'s integer, floating-point, and suffixed durations), assignment prefixes, redirections, group/subshell/brace, `coproc`, and compound-command positions (`if`/`then`/`elif`/`else`/`while`/`until`/`for`/`do`/`case` bodies, with `for`/`select` loop variables and `case` subjects and labels read as syntax rather than commands, and `time`'s own flags skipped so `time -p sudo id` still reaches the command word), pipelines (`echo x | sudo tee /etc/hosts`), xargs and `parallel` operands and option operands (judged fail-closed because BSD and GNU disagree on which operands are optional), `find -exec`/`-execdir`/`-ok`/`-okdir` and `fd -x`/`-X` commands, alias bodies and `hash -p` command-hash entries in every spelling (a registered name scans as the command it runs, shell builtins such as `eval`/`command`/`exec` keep their own meaning because the hash table cannot shadow them, the word's own spelling is judged as well so `hash -r` cannot hide it, and an entry built from expansion is refused because the command it hides cannot be resolved), interpreter payloads (`sh -c`, bundled `-ce`, and glued payloads only from short bundles, so `bash --rcfile FILE -c 'sudo id'` is refused, `eval`), quoted `$(...)` spans (matched quote-aware, so `echo "$(printf ')'; sudo id)"` is refused), backticks, process substitutions (`<(cmd)`, `>(cmd)`) including a runner's script source, here-strings (`bash <<< 'sudo id'`, `bash<<<'sudo id'`, and glued multi-token payloads such as `bash<<<'sh -c "sudo id"'`, whose quoted target the tokenizer keeps as one word), and heredoc bodies owned by a shell or piped to one in the same text (the gate reuses the guard's own command-word walk, so `command`, `command -p`, `command --`, wrapper chains, xargs operands, and `find -exec`/`-execdir` operands are all treated as shell runners, while a `command -v`/`-V` lookup or a plain operand mention is not; an alias whose body reaches a runner (wrapper chains such as `env sh`, `command sh`, or `xargs -I{} sh -c {}` included) counts as a runner for the same gate and for the script-source scan). Lookup forms (`command -v sudo`, `command -V sudo`, `which sudo`) stay allowed, and `command` itself stays gated to those lookup flags instead of short-circuiting the walk, so `command sudo id` is refused; operand mentions (`man sudo`, `grep sudo file`), data heredocs, and comments stay allowed; unresolvable command-position words carrying a sudo/doas mention (`$CMD id`, `$SUDO id`) fail closed, while a name assembled so that no such spelling appears (a `printf` with hex escapes, a base64 payload piped to a shell) stays out of a name-based scan's reach, as do payloads nested deeper than the scan follows. Out of scope: `su`, trap actions, other interpreters' string payloads (`python -c`), Windows runas, script-file contents, launchers outside the modeled set that pick their own program or domain (`ssh`, `script` with its diverging util-linux and BSD option shapes, package runners such as `dx`/`npx`), and make recipes. Explicit bypasses: `bash(command, allow_sudo=True)` or `PI_BASH_ALLOW_SUDO=1`, where the environment bypass is frozen at kernel start so mid-session `os.environ` writes cannot neuter the guard; they are ignored and warned about loudly. It is a foot-gun guard, not a sandbox: an unmodeled launcher or value option, an abbreviated long option (`strace --verb 5 sudo id`), a renamed or copied tool at another path (a symlink to the tool and a plain copy both run the real binary, and `realpath` cannot see a copy), or an extglob spelling such as `s@(u|x)do` with `shopt -s extglob` on (the tokenizer splits the group, and shell-option state is not statically knowable), can still hide a command word, and `su`, other interpreters' string payloads, script files, and those bypasses all still reach root. A name that merely contains `sudo` is judged by its case-folded basename, so `sudoku`, `sudo-report`, and `s-u-d-o` stay runnable while `SUDO` still is the tool on a case-insensitive filesystem; a glob in the basename is judged as a pattern (`/usr/bin/su*` refuses), and a word that carries quoting or expansion still falls back to its letters. The launcher tables name only options their tool really has, because an entry for a phantom option swallows the command word. A glob pattern that can match `sudo`/`doas` is read as a pattern, POSIX classes included, so `[[:lower:]]udo` and `[[:alpha:]]udo` refuse exactly like `sud[o]` and `su?do`, while a spelling that cannot match either name (`s[[:upper:]]do`, `[[:digit:]]udo`, `[![:lower:]]udo`) stays allowed. Known measured cost, accepted for this pass and named as the follow-up: a command carrying many heredocs is resolved quadratically, because each heredoc scans the remaining text for its delimiter and then sweeps the words to mark the body as data. Measured on this module: 0.066s at 1000 heredocs and 1.34s at 5000 (about 100 KB of command text), reproduced by timing `_apply_heredocs` alone, and extrapolating to a command near the argv limit gives minutes. The fix is a single sweep over the collected body ranges; it is not taken here because it changes the scan machinery rather than closing a bypass.