fix: double-escape regex bypass and multi-field scan

  - Fix \d+ → \d+ in _SENSITIVE_PATHS_RE and _CRED_PATH_RE so
    /proc/<pid>/environ is correctly detected.
  - Fix \s → \s in _path_boundary_pattern for whitespace matching.
  - _extract_script_content now collects ALL script-bearing fields
    (code + command + ...) instead of returning the first hit.

Author: lll-peanut

trpc_agent_sdk/tools/safety/_bash_scanner.py

@@ -745,7 +745,7 @@ def _strip_inline_comment(line: str) -> str:
     r"(?:/etc/(?:shadow|passwd|sudoers|hosts)|"
     r"~?/\.ssh|~?/\.gnupg|~?/\.aws|~?/\.gcloud|~?/\.azure|"
     r"\.env|\.pem|id_rsa|id_ed25519|id_ecdsa|"
-    r"/proc/(?:self|\\d+)/(?:mem|cmdline|environ)|"
+    r"/proc/(?:self|\d+)/(?:mem|cmdline|environ)|"
     r"/var/run/docker\.sock)",
     re.IGNORECASE,
 )

trpc_agent_sdk/tools/safety/_python_scanner.py

@@ -913,7 +913,7 @@ def get_python_concurrency(findings: List[PythonScanFinding]) -> List[PythonScan
     r"(?:\.ssh|\.gnupg|\.aws|\.gcloud|\.azure|\.pem|\.key|id_rsa|id_ed25519|id_ecdsa|"
     r"credentials|secrets|\.env|config\.json|"
     r"/etc/(?:shadow|passwd|sudoers|hosts)|"
-    r"/proc/(?:self|\\d+)/(?:mem|cmdline|environ)|"
+    r"/proc/(?:self|\d+)/(?:mem|cmdline|environ)|"
     r"/var/run/docker\.sock)",
     re.IGNORECASE,
 )

trpc_agent_sdk/tools/safety/_rules.py

@@ -145,9 +145,7 @@ def _strip_python_comment_line(line: str) -> str:
             continue
 
         # Triple-quote detection (simplified — checks for ''' or \"\"\")
-        if (not in_single and not in_double
-                and i + 2 < n and ch in ("'", '"')
-                and line[i:i + 3] == ch * 3):
+        if (not in_single and not in_double and i + 2 < n and ch in ("'", '"') and line[i:i + 3] == ch * 3):
             marker = ch * 3
             result.append(marker)
             i += 3
@@ -537,7 +535,8 @@ def __call__(
 
                     # FIXED: Check whitelist_commands — was dead code before
                     # Whitelisted commands get downgraded to INFO or skipped
-                    if policy.is_command_whitelisted(cmd_key) and cmd_key not in ("|", "$(", "`", "&>", "nohup", "disown"):
+                    if policy.is_command_whitelisted(cmd_key) and cmd_key not in ("|", "$(", "`", "&>", "nohup",
+                                                                                  "disown"):
                         # Explicitly whitelisted → informational only
                         findings.append(
                             _build_finding(
@@ -860,9 +859,9 @@ def _is_in_echo_string(line: str, pattern: str) -> bool:
     """
     stripped = line.strip()
     # Only applies to echo / printf commands
-    if not (stripped.startswith("echo ") or stripped.startswith("echo\t")
-            or stripped.startswith("printf ") or stripped.startswith("printf\t")
-            or stripped.startswith("/bin/echo ") or stripped.startswith("/usr/bin/echo ")):
+    if not (stripped.startswith("echo ") or stripped.startswith("echo\t") or stripped.startswith("printf ")
+            or stripped.startswith("printf\t") or stripped.startswith("/bin/echo ")
+            or stripped.startswith("/usr/bin/echo ")):
         return False
     # Check if the pattern *matches* inside single or double quotes
     try:
@@ -900,7 +899,7 @@ def _path_boundary_pattern(path: str) -> str:
     escaped = re.escape(path)
     # If the path starts with a dot (like .env), require a path boundary before it
     if path.startswith("."):
-        return r"(?:^|[\\s/'\"`;|&(])" + escaped + r"(?:$|[\\s/'\"`;|&)])"
+        return r"(?:^|[\s/'\"`;|&(])" + escaped + r"(?:$|[\s/'\"`;|&)])"
     else:
         return escaped.replace(r"\*", ".*")
 

trpc_agent_sdk/tools/safety/_safety_filter.py

@@ -160,33 +160,44 @@ def __init__(self, report):
 
 
 def _extract_script_content(req: Any) -> Optional[str]:
-    """Heuristically extract script-like content from a tool request."""
+    """Heuristically extract script-like content from a tool request.
+
+    All recognised script-bearing fields are collected and joined so that
+    a request carrying both ``code`` (benign) and ``command`` (dangerous)
+    does not bypass detection by hiding behind the first hit.
+    """
     if isinstance(req, str):
         return req
+    parts: list[str] = []
+    seen: set[str] = set()
+
+    def _collect(val: Any) -> None:
+        if isinstance(val, str) and val.strip():
+            stripped = val.strip()
+            if stripped not in seen:
+                parts.append(stripped)
+                seen.add(stripped)
+
     if isinstance(req, dict):
-        # Common field names used to pass code / commands
         for key in ("code", "script", "command", "cmd", "shell", "source", "content", "text", "input"):
-            val = req.get(key)
-            if isinstance(val, str) and val.strip():
-                return val
-        # Check for MCP tool arguments
+            _collect(req.get(key))
         args = req.get("args", {})
         if isinstance(args, dict):
             for key in ("code", "script", "command", "cmd", "shell"):
-                val = args.get(key)
-                if isinstance(val, str) and val.strip():
-                    return val
-        # Check for keyword arguments
+                _collect(args.get(key))
         kwargs = req.get("kwargs")
         if isinstance(kwargs, dict) and kwargs:
-            return _extract_script_content(kwargs)
-    # Try to get 'args' attribute from an object
+            sub = _extract_script_content(kwargs)
+            if sub:
+                _collect(sub)
     if hasattr(req, "args") and isinstance(getattr(req, "args"), dict):
-        return _extract_script_content(getattr(req, "args"))
+        sub = _extract_script_content(getattr(req, "args"))
+        if sub:
+            _collect(sub)
     if hasattr(req, "script_content"):
-        val = getattr(req, "script_content")
-        if isinstance(val, str):
-            return val
+        _collect(getattr(req, "script_content"))
+
+    return "\n".join(parts) if parts else None
     return None