From d201e491c0b0a201b41814b9e00880824fdbddbb Mon Sep 17 00:00:00 2001
From: kina0630 <kiakiana0630@gmail.com>
Date: Tue, 8 Sep 2026 09:58:35 +0800
Subject: [PATCH] fix(shell): skip git URLs in path-escape check

bash_run sandbox_mode=none treated https Git URLs as absolute paths and blocked clone.
---
 coding-agent/src/coding_agent/tools/shell.py | 20 +++++
 coding-agent/tests/tools/test_shell.py       | 85 ++++++++++++++++++++
 2 files changed, 105 insertions(+)

diff --git a/coding-agent/src/coding_agent/tools/shell.py b/coding-agent/src/coding_agent/tools/shell.py
index 97fbd7417..4f6e33de4 100644
--- a/coding-agent/src/coding_agent/tools/shell.py
+++ b/coding-agent/src/coding_agent/tools/shell.py
@@ -17,6 +17,16 @@
 from agentkit.tools import tool
 
 _DISALLOWED_TOKENS = {"&&", "||", "|", ";", ">", ">>", "<", "2>", "&"}
+_REMOTE_URL_SCHEMES = (
+    "https://",
+    "http://",
+    "git+https://",
+    "git+http://",
+    "git+ssh://",
+    "ssh://",
+    "git://",
+)
+
 _STRUCTURED_RESULTS: ContextVar[bool] = ContextVar(
     "coding_agent_shell_structured_results", default=False
 )
@@ -295,12 +305,22 @@ def _validated_execution_cwd(
     return str(resolved_cwd)
 
 
+def _looks_like_remote_url(arg: str) -> bool:
+    stripped = arg.strip().strip("'\"")
+    lowered = stripped.lower()
+    if lowered.startswith(_REMOTE_URL_SCHEMES):
+        return True
+    return lowered.startswith("git@") and ":" in stripped[4:]
+
+
 def _validate_no_path_escape(
     args: list[str],
     workspace_root: Path,
     additional_roots: tuple[Path, ...] = (),
 ) -> None:
     for arg in args[1:]:
+        if _looks_like_remote_url(arg):
+            continue
         for match in re.findall(r"(?<![A-Za-z0-9_.-])/[A-Za-z0-9_./-]+", arg):
             candidate = Path(match).expanduser().resolve()
             if not _path_under_any_root(candidate, workspace_root, additional_roots):
diff --git a/coding-agent/tests/tools/test_shell.py b/coding-agent/tests/tools/test_shell.py
index caee8e6b0..5fbab7ac2 100644
--- a/coding-agent/tests/tools/test_shell.py
+++ b/coding-agent/tests/tools/test_shell.py
@@ -175,6 +175,91 @@ def test_none_sandbox_blocks_absolute_path_escape(self, tmp_path: Path):
         assert str(workspace).lower() in blocked_text
         assert "secret" not in blocked_text
 
+
+    def test_none_sandbox_allows_https_git_url_argument(self, tmp_path: Path):
+        workspace = tmp_path / "workspace"
+        workspace.mkdir()
+        pipeline_ctx = SimpleNamespace(
+            config={"workspace_root": str(workspace), "shell": {"sandbox_mode": "none"}}
+        )
+        url = "https://github.com/delete-cloud/Coding-Agent-Loop.git"
+        result = bash_run(
+            command=f"echo {url}",
+            cwd=str(workspace),
+            __pipeline_ctx__=pipeline_ctx,
+        )
+        result_text = _as_text(result)
+        assert "outside sandbox workspace" not in result_text.lower()
+        assert url in result_text
+
+    def test_none_sandbox_allows_ssh_git_url_argument(self, tmp_path: Path):
+        workspace = tmp_path / "workspace"
+        workspace.mkdir()
+        pipeline_ctx = SimpleNamespace(
+            config={"workspace_root": str(workspace), "shell": {"sandbox_mode": "none"}}
+        )
+        url = "git@github.com:delete-cloud/Coding-Agent-Loop.git"
+        result = bash_run(
+            command=f"echo {url}",
+            cwd=str(workspace),
+            __pipeline_ctx__=pipeline_ctx,
+        )
+        result_text = _as_text(result)
+        assert "outside sandbox workspace" not in result_text.lower()
+        assert "github.com:delete-cloud/Coding-Agent-Loop.git" in result_text
+
+    def test_none_sandbox_allows_ssh_scheme_git_url_argument(self, tmp_path: Path):
+        workspace = tmp_path / "workspace"
+        workspace.mkdir()
+        pipeline_ctx = SimpleNamespace(
+            config={"workspace_root": str(workspace), "shell": {"sandbox_mode": "none"}}
+        )
+        url = "ssh://git@github.com/delete-cloud/Coding-Agent-Loop.git"
+        result = bash_run(
+            command=f"echo {url}",
+            cwd=str(workspace),
+            __pipeline_ctx__=pipeline_ctx,
+        )
+        result_text = _as_text(result)
+        assert "outside sandbox workspace" not in result_text.lower()
+        assert url in result_text
+
+    def test_none_sandbox_allows_git_plus_ssh_url_argument(self, tmp_path: Path):
+        workspace = tmp_path / "workspace"
+        workspace.mkdir()
+        pipeline_ctx = SimpleNamespace(
+            config={"workspace_root": str(workspace), "shell": {"sandbox_mode": "none"}}
+        )
+        url = "git+ssh://git@github.com/delete-cloud/Coding-Agent-Loop.git"
+        result = bash_run(
+            command=f"echo {url}",
+            cwd=str(workspace),
+            __pipeline_ctx__=pipeline_ctx,
+        )
+        result_text = _as_text(result)
+        assert "outside sandbox workspace" not in result_text.lower()
+        assert url in result_text
+
+    def test_none_sandbox_blocks_escape_path_next_to_git_url(self, tmp_path: Path):
+        workspace = tmp_path / "workspace"
+        workspace.mkdir()
+        outside = tmp_path / "outside"
+        outside.mkdir()
+        pipeline_ctx = SimpleNamespace(
+            config={"workspace_root": str(workspace), "shell": {"sandbox_mode": "none"}}
+        )
+        result = bash_run(
+            command=(
+                "git clone https://github.com/delete-cloud/Coding-Agent-Loop.git "
+                f"{outside}"
+            ),
+            cwd=str(workspace),
+            __pipeline_ctx__=pipeline_ctx,
+        )
+        result_text = _as_text(result).lower()
+        assert "outside sandbox workspace" in result_text
+        assert str(workspace).lower() in result_text
+
     def test_none_sandbox_allows_absolute_path_under_additional_root(
         self, tmp_path: Path
     ):