fix(agent): let pushd and popd move the walk the way they move the shell

`pushd ..; cat outside.txt` read the file. The walk asked whether a segment's
first word was `cd`, so the builtin that moves the shell exactly as far, and
is on every interactive user's fingers, stepped over the fence untouched.
Its destination is now checked the same way `cd`'s is.

The stack is what the walk cannot follow. `popd` and a bare `pushd` take
their destination from entries an earlier push put there, and each of those
was cleared on the way in, so the shallowest place either can land is where
the command began. The walk adds that place rather than guessing which one,
which is the same answer a separator that proves nothing already gets.

Co-authored-by: Claude (claude-opus-5[1m]) <noreply@anthropic.com>

Author: LivXue

raven/agent/tools/shell.py

@@ -468,6 +468,12 @@ def _steps_outside(
         nothing -- and after any of them, every relative path in the rest of
         the command resolves somewhere the operator did not allow.
 
+        ``pushd`` moves the shell exactly as far and is read the same way. Its
+        stack is what this cannot follow: ``popd`` and a bare ``pushd`` take
+        their destination from entries earlier pushes already cleared, so the
+        walk falls back to the shallowest of those, which is where the command
+        began.
+
         Each `cd` starts from where the last one landed, so
         `cd subdir && cd ..` ends where it began rather than being read as
         leaving. Which is knowable only where the separator says so: `&&` runs
@@ -490,7 +496,13 @@ def _steps_outside(
             # segment with the bracket already gone, and the bracket is now
             # one more separator that proves nothing.
             tokens = _unwrap_command_wrappers(raw_tokens)
-            if not tokens or tokens[0] != "cd":
+            if not tokens or tokens[0] not in ("cd", "pushd", "popd"):
+                continue
+            if tokens[0] == "popd":
+                # A stack return lands on a directory some earlier push put
+                # there, and each of those was cleared on the way in. The
+                # shallowest of them is where the command began.
+                here = cls._either(here, [cwd])
                 continue
             arguments = list(tokens[1:])
             while arguments and arguments[0] in ("-L", "-P"):
@@ -503,6 +515,12 @@ def _steps_outside(
             elif arguments and arguments[0] == "-":
                 # ``$OLDPWD`` is a directory some earlier ``cd`` already passed.
                 continue
+            if not arguments and tokens[0] == "pushd":
+                # A bare `pushd` swaps the top two entries rather than naming a
+                # destination. Both were cleared on the way in, so the worst
+                # case is the one `popd` gets.
+                here = cls._either(here, [cwd])
+                continue
             target = arguments[0] if arguments else env.get("HOME", "")
             if not target:
                 continue

tests/test_shell_workspace_fence.py

@@ -734,6 +734,30 @@ def test_a_proven_walk_survives_a_separator_later_in_the_command(fenced: ExecToo
     assert refusal(fenced, command) is None
 
 
+@pytest.mark.parametrize(
+    "command",
+    ["pushd ..; ls", "pushd /; cat etc/passwd", "pushd -- ..; ls"],
+    ids=["up", "root", "after-terminator"],
+)
+def test_pushd_leaves_by_the_same_door_as_cd(fenced: ExecTool, command: str) -> None:
+    """`pushd` is a `cd` that also remembers where it was.
+
+    The walk read `cd` alone, so the builtin that moves the shell exactly as
+    far, and is on every interactive user's fingers, stepped over the fence
+    untouched. Its destination is checked the same way; what the stack does
+    afterwards is why the walk stops carrying (see the test below).
+    """
+    assert refusal(fenced, command) is not None
+
+
+def test_a_stack_return_stops_the_walk_from_carrying(fenced: ExecTool) -> None:
+    """`popd` and a bare `pushd` take their destination off a stack this
+    cannot see, so a walk carried past one would be guessing. The stricter
+    reading holds instead, the same answer a bracket already gets.
+    """
+    assert refusal(fenced, "pushd subdir && popd && cd .. && ls") is not None
+
+
 def test_a_subshell_makes_the_walk_strict_again(fenced: ExecTool) -> None:
     """A `cd` inside a subshell does not outlive it, and the splitter has
     already dropped the bracket that said so. Carrying the directory forward