fix(sandbox): recognize --attr-source and widen the unparseable git fallback

gitSubcommand (and its mirror in internal/agent/command_prefix.go) was
missing --attr-source from git's value-taking global options, so
`git --attr-source HEAD push origin main` resolved to the wrong subcommand
and never got classified as network access.

The unparseable-command regex fallback used when the shell parser fails now
also matches an optional .exe suffix, so a Windows form like
`git.exe push origin main & rem '` — valid under cmd.exe but rejected by the
POSIX parser AnalyzeCommand uses — still classifies as network. The
generic-token scan before the subcommand no longer caps at 8 tokens; Go's
regexp package is RE2-backed (linear time, no backtracking blowup), so the
cap only served to silently drop coverage once a git invocation had more
than a handful of value-taking global options.

Addresses review feedback from jatmn on PR #726.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: PierrunoYT

internal/agent/command_prefix.go

@@ -414,15 +414,16 @@ func gitSubcommand(command []string) (int, string, bool) {
 
 func gitOptionConsumesValue(arg string) bool {
 	switch arg {
-	case "-C", "-c", "--config-env", "--exec-path", "--git-dir", "--namespace", "--super-prefix", "--work-tree":
+	case "-C", "-c", "--attr-source", "--config-env", "--exec-path", "--git-dir", "--namespace", "--super-prefix", "--work-tree":
 		return true
 	default:
 		return false
 	}
 }
 
 func gitOptionHasInlineValue(arg string) bool {
-	return strings.HasPrefix(arg, "--config-env=") ||
+	return strings.HasPrefix(arg, "--attr-source=") ||
+		strings.HasPrefix(arg, "--config-env=") ||
 		strings.HasPrefix(arg, "--exec-path=") ||
 		strings.HasPrefix(arg, "--git-dir=") ||
 		strings.HasPrefix(arg, "--namespace=") ||

internal/sandbox/analyzer.go

@@ -305,7 +305,7 @@ func gitSubcommand(words []string) string {
 // SEPARATE token (mirrors gitOptionConsumesValue in internal/agent).
 func gitGlobalOptionConsumesValue(option string) bool {
 	switch option {
-	case "-C", "-c", "--config-env", "--exec-path", "--git-dir", "--namespace", "--super-prefix", "--work-tree":
+	case "-C", "-c", "--attr-source", "--config-env", "--exec-path", "--git-dir", "--namespace", "--super-prefix", "--work-tree":
 		return true
 	default:
 		return false

internal/sandbox/analyzer_test.go

@@ -74,6 +74,7 @@ func TestAnalyzeCommand(t *testing.T) {
 		{name: "git -c config push", script: "git -c http.sslVerify=false push origin main", network: true},
 		{name: "git --git-dir fetch", script: "git --git-dir /repo/.git fetch origin", network: true},
 		{name: "git --work-tree pull", script: "git --work-tree /repo pull origin main", network: true},
+		{name: "git --attr-source push", script: "git --attr-source HEAD push origin main", network: true},
 		{name: "git -C local commit", script: `git -C repo commit -m "local change"`, network: false},
 		{name: "git.exe push", script: "git.exe push origin main", network: true},
 		{name: "git.exe local commit", script: `git.exe commit -m "local change"`, network: false},

internal/sandbox/risk.go

@@ -33,7 +33,15 @@ var (
 	// unparseableNetworkPattern is used only after the shell parser fails. At
 	// that point the command is already marked too complex, so this intentionally
 	// favors catching obvious network programs over proving exact shell syntax.
-	unparseableNetworkPattern = regexp.MustCompile(`(?i)\b(curl|wget|fetch|aria2c|ssh|scp|sftp|rsync|nc|ncat|netcat|telnet|ftp|npx|http-server|vite|next|nuxt|astro)\b|\b(npm|pnpm|yarn|bun|pip|pip2|pip3)\s+(install|add|publish|login|start|serve|dev|preview|run\s+(start|serve|dev|preview)|exec|x|dlx)\b|\bgo\s+get\b|\bgit(?:\s+[^\s;&|]+){0,8}\s+(clone|fetch|pull|push)\b|\bpython(2|3)?\s+-m\s+(http\.server|pip\s+install)\b|\bgh\s+(api|repo\s+clone|release\s+download)\b`)
+	// The git branch matches an optional .exe suffix (a parser-failing Windows
+	// command like `git.exe push origin main & rem '` runs under cmd.exe and
+	// must still classify as network) and scans an unbounded run of
+	// non-separator tokens before the subcommand rather than capping at a
+	// fixed count — Go's regexp is RE2-backed (linear time, no backtracking
+	// blowup), so nothing is gained by capping, and a git invocation with more
+	// than a handful of value-taking global options would otherwise silently
+	// fall through uncapped.
+	unparseableNetworkPattern = regexp.MustCompile(`(?i)\b(curl|wget|fetch|aria2c|ssh|scp|sftp|rsync|nc|ncat|netcat|telnet|ftp|npx|http-server|vite|next|nuxt|astro)\b|\b(npm|pnpm|yarn|bun|pip|pip2|pip3)\s+(install|add|publish|login|start|serve|dev|preview|run\s+(start|serve|dev|preview)|exec|x|dlx)\b|\bgo\s+get\b|\bgit(?:\.exe)?(?:\s+[^\s;&|]+)*\s+(clone|fetch|pull|push)\b|\bpython(2|3)?\s+-m\s+(http\.server|pip\s+install)\b|\bgh\s+(api|repo\s+clone|release\s+download)\b`)
 	// destructiveExtraPatterns hold high-severity patterns that the legacy
 	// destructiveCommandPattern does not already cover. Folded in from the
 	// blueprint safe_bash.go without duplicating existing matches.

internal/sandbox/risk_hardening_test.go

@@ -340,6 +340,14 @@ func TestClassifyUnparseableNetworkCommandFailsClosed(t *testing.T) {
 		`git pull origin main && "unterminated`,
 		`git push gitlawb://example.com/repo.git main && "unterminated`,
 		`git -C repo push gitlawb://example.com/repo.git main && "unterminated`,
+		// git.exe runs under cmd.exe, which has no notion of a trailing single
+		// quote — this parses fine there but fails the POSIX shell parser used
+		// by AnalyzeCommand, so it must still be caught by the regex fallback.
+		`git.exe push origin main & rem '`,
+		// More value-taking global options than the fallback regex used to cap
+		// its generic-token scan at (formerly {0,8}) — every option here still
+		// precedes the actual subcommand.
+		`git -c a=1 -c b=2 -c c=3 -c d=4 -c e=5 push gitlawb://example.com/repo.git main && "unterminated`,
 	} {
 		t.Run(command, func(t *testing.T) {
 			risk := classifyCommand(command)