fix: builtins subscript bypass, /bin/rm normalize, filter args-as-list crash

  - _python_scanner: Subscript(__builtins__/globals/vars/locals[...]) now
    detected as dynamic exec sink (was complete bypass)
  - _python_scanner: remove 3-arg getattr exemption entirely
  - _bash_scanner: normalize cmd with basename so /bin/rm matches rm check
  - _safety_filter: safe extraction when req['args'] is list not dict

Author: lll-peanut

trpc_agent_sdk/tools/safety/_bash_scanner.py

@@ -314,7 +314,8 @@ def _analyse_one_command(self, line_no: int, raw_line: str, cmd_tokens: List[str
             return  # pure assignment/prefix, no real command
         cmd = cmd_tokens[idx]
         args = cmd_tokens[idx + 1:]
-        cmd_lower = cmd.lower()
+        # Normalise: /bin/rm, /usr/bin/rm → rm
+        cmd_lower = cmd.lower().rsplit("/", 1)[-1]
         args_str = " ".join(args)
         evidence = " ".join(cmd_tokens)[:300]
 

trpc_agent_sdk/tools/safety/_python_scanner.py

@@ -483,10 +483,6 @@ def _handle_call(self, node: ast.Call) -> None:
                 receiver = self._resolve_canonical(node.func.value) if isinstance(node.func, ast.Attribute) else ""
                 if canonical == "compile" and receiver in ("re", "regex"):
                     pass  # re.compile(pattern) — safe, pattern compilation only
-                # getattr(x, y, default) as plain expression (NOT immediately
-                # called) is safe property access.
-                elif (canonical == "getattr" and len(node.args) >= 3 and not isinstance(node.func, ast.Call)):
-                    pass
                 else:
                     self._findings.append(
                         PythonScanFinding(kind="eval_exec",
@@ -559,6 +555,15 @@ def _check_dynamic_call(self, node: ast.Call, line_no: int, evidence: str) -> No
                         line_number=line_no,
                         evidence=evidence,
                     ))
+        elif isinstance(func, ast.Subscript):
+            # __builtins__["exec"](code) / globals()["__builtins__"]["eval"](x)
+            container = self._resolve_canonical(func.value)
+            if container in ("__builtins__", "globals", "vars", "locals"):
+                self._findings.append(
+                    PythonScanFinding(kind="eval_exec",
+                                      canonical_name=f"{container}[...]",
+                                      line_number=line_no,
+                                      evidence=evidence))
         elif isinstance(func, ast.Attribute):
             # __import__("os").system("id") — the receiver is a dynamic
             # import call whose result was then attribute-accessed

trpc_agent_sdk/tools/safety/_safety_filter.py

@@ -252,9 +252,14 @@ def _extract_list_field(req: Any, *keys: str) -> Optional[list[str]]:
     """Extract a list-typed field from the request by trying multiple key names."""
     if isinstance(req, dict):
         for k in keys:
-            val = req.get(k) or req.get("args", {}).get(k)
+            val = req.get(k)
             if isinstance(val, list):
                 return val
+            args = req.get("args")
+            if isinstance(args, dict):
+                val = args.get(k)
+                if isinstance(val, list):
+                    return val
     if hasattr(req, "args"):
         args = getattr(req, "args")
         if isinstance(args, dict):
@@ -266,20 +271,30 @@ def _extract_list_field(req: Any, *keys: str) -> Optional[list[str]]:
 
 
 def _extract_str_field(req: Any, *keys: str) -> Optional[str]:
-    """Extract a string-typed field from the request by trying multiple key names."""
+    """Extract a string-typed field, safe against args-as-list."""
     if isinstance(req, dict):
         for k in keys:
-            val = req.get(k) or req.get("args", {}).get(k)
+            val = req.get(k)
             if isinstance(val, str):
                 return val
+            args = req.get("args")
+            if isinstance(args, dict):
+                val = args.get(k)
+                if isinstance(val, str):
+                    return val
     return None
 
 
 def _extract_dict_field(req: Any, *keys: str) -> Optional[dict[str, str]]:
-    """Extract a dict-typed field from the request by trying multiple key names."""
+    """Extract a dict-typed field, safe against args-as-list."""
     if isinstance(req, dict):
         for k in keys:
-            val = req.get(k) or req.get("args", {}).get(k)
+            val = req.get(k)
             if isinstance(val, dict):
                 return val
+            args = req.get("args")
+            if isinstance(args, dict):
+                val = args.get(k)
+                if isinstance(val, dict):
+                    return val
     return None