fix(shell): workspace lockdown bypass via non-obvious shell redirection

[ilhamyunusbaihaqi-png]

AgentOS version or commit

v2026.8.2 (commit before d3ef548)

Area

CLI

Reproduction steps

1. Enable workspace lockdown

agentos run --workspace /tmp/workspace --workspace-lockdown

2. Execute command with redirection WITHOUT space before operator

These bypass the lockdown (before fix):

echo malicious>/etc/passwd
cmd 2>/tmp/leak.txt

&/tmp/both.txt
true | cat >/tmp/out.txt
true; echo x >/tmp/out.txt
(echo x) >/tmp/out.txt

Expected behavior

All redirection operators (>, >>, 2>, 2>>, &>, &>>, 1>, 1>>) should be detected regardless of whitespace, and writes outside allowed workspace roots should be blocked with workspace_lockdown reason.

Actual behavior

test_shell_fuzz.py
shell_fix.py
test_shell_approval_policy.py

Redirections without leading whitespace (e.g., echo ok>file vs echo ok > file) were not parsed by _shell_write_targets(), allowing sandbox escape via shell redirection.

Environment

AgentOS: v2026.8.2 - Python: 3.12+ - OS: Linux

[bukeeastrey]

i want to work on this

[andreapn]

@bukeeastrey You have some issues that are not yet fully completed and require numerous changes, so please focus on resolving the issues you are currently handling before accepting new ones. Thank you.