LuckVd 1dae5eb363
fix(sandbox): exempt expression division after closers from the host-bash guard (#7448)
* fix(sandbox): exempt expression division after closers from the host-bash guard

A single-segment absolute-path match directly after ')', ']' or '}' is
division in an inline expression (python3 -c, perl, node -e, $((...)) ),
not a host path; #7023 exempted this shape only inside single-quoted awk
programs. Per-closer rules keep unknown-value path builds rejected:
digits only after ')' and '}' ($1/1024 rationale), an identifier after
')' only when the paren closes a name(...) call, any segment after ']'.
Literal tokens ('ls /2') are unchanged.

Fixes #7444

* fix(sandbox): scope division exemptions to parsed expressions

* docs(sandbox): fit inherited guidance within the hard limit

---------

Co-authored-by: Willem Jiang <willem.jiang@gmail.com>
2026-11-08 09:49:07 +08:00
..