[delete-cloud]

Summary

• Fix bash_run absolute-path escape scanning so relative paths like src/pkg and tests/test_file.py are not misread as absolute paths.
• Add regression coverage for the DeepSeek dogfood failure mode.

Verification

• uv run pytest tests/tools/test_shell.py::TestShellTool::test_none_sandbox_allows_relative_paths_with_slashes tests/tools/test_shell.py::TestShellTool::test_none_sandbox_blocks_absolute_path_escape -q
• uv run pytest tests/tools/test_shell.py -q
• uv run pytest tests/coding_agent/plugins/test_core_tools.py::TestCoreToolsPlugin::test_bash_run_uses_and_updates_shell_session tests/coding_agent/plugins/test_core_tools.py::TestCoreToolsPlugin::test_bash_run_uses_injected_environment_workspace -q
• uv run ruff check src/coding_agent/tools/shell.py tests/tools/test_shell.py
• git diff --check -- .

Summary by CodeRabbit

• Bug Fixes

  • Improved path validation for more accurate detection of absolute paths in shell operations

• Tests

  • Added test coverage for relative path handling in sandbox mode

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

Path escape detection regex tightened to only match absolute-like paths when slash is preceded by a non-identifier character, reducing false positives. Test validates relative paths with slashes work correctly under sandbox_mode="none".

Changes

Path Escape Validation Refinement

Layer / File(s)

Summary

Path escape detection regex and validation coding-agent/src/coding_agent/tools/shell.py, coding-agent/tests/tools/test_shell.py

The regex in _validate_no_path_escape is updated to use a negative lookbehind (?<![A-Za-z0-9_]) so absolute-like paths are only matched when the leading / is preceded by a non-identifier character, preventing relative paths with slashes from being incorrectly flagged. A new test verifies this behavior by running mkdir -p with relative paths and confirming no "outside sandbox workspace" errors occur.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~15 minutes

Poem

🐰 A slash dodged by the lookbehind's eye,
Relative paths now freely fly,
No false alarms when slashes appear,
The regex keeps absolute paths clear! 🐇

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically summarizes the main change: fixing shell path validation to allow relative paths with slashes, which aligns with the actual bug fix in the regex validation.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/bash-path-validation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}