[dotdevdotdev]

Batch 5 (path resolution / cwd lane) of the damage-control residual inventory. Every statically decidable shape in this lane is closed; the rest fails closed (ask, unverifiable, not demoted by bypass).

Behavior

• Mission: Hierarchical Dashboard Refactor #15 false blocks removed: rsync writes only its destination (last operand, options may trail); <<$"EOF" is a quoted heredoc; a [a-z] character class no longer counts as a literal run in a glob (echo [a-z]*; echo hi | sh allows).
• Mission: AgentWire MCP Server #16 cwd the scanner couldn't see: d=<dir>; cd $d && … (same-command literal, last assignment wins, $(…) makes it unknown), env -C/--chdir, patch -d, whitespace inside a prefix assignment (A=${x:-\n} cd …). An unresolvable cd (cd -, popd, cd $x) followed by a distinctive protected name the rest would write is an ask (core.control-plane-target); settings.json/config.yaml are deliberately not distinctive.
• Connection-aware TTS routing for MCP speak() #17 patch / git apply / git am run in a protected dir ask (--dry-run/--check/--stat… stay allowed).
• Voice Orchestrator + Worker Sessions (Complete Mission) #20 brace expansion past the cap in a command that names the control plane asks (kill-switch exempt). The inventory's repro was invalid: it tripped the .env zero-access rule, which hides the gap.
• Add /desktop route with OS-like window manager UI #26 ln/link naming a protected file or dir on either side is refused (the old "source is a read" ruling reverses: a link is how a later write reaches the file). Every path word is realpath'd at hook time (symlink, symlinked dir, hardlink to a protected file) and judged as where it really goes.
• Wrapper differential: sh -c '…' / ssh host '…' payloads are re-scanned as commands, so cwd resolution applies inside a wrapper (before: bash -c 'cd <dir> && touch <protected name>' allowed while the bare form blocked — a pre-existing gap, found by the differential).
• Extract CLI and Portal docs from CLAUDE.md #21 perf (separate commit, no decision change): _GLOB_TOKEN retried from every offset of a long run. All three inventory shapes were that one regex, not _PATH_ODDITY/the brace walker: ../×7000 4.9s→0.6s, \×20000 2.1s→0.3s, {a,×7000 1.8s→0.5s; quoted and unquoted runs now double with the input.

Verification

• New tests/unit/test_path_resolution_lane.py (13 tests, loops collect every offender); 17 mutations of the code under pin, all killed.
• Differential vs origin/main over 5874 distinct real commands from the audit log: 5 decision changes, all block→ask/allow, all heredoc/prose bodies containing [a-z]*-style classes (the Mission: Hierarchical Dashboard Refactor #15 false block). No new blocks or asks on real traffic.
• Glob scan fuzz-compared against the old regex (4000 strings, identical words).
• Fast unit set green after merging origin/main; hooks regenerated (regen_damage_control_hooks.py).
• Two existing pins moved on purpose: ln -s <protected> /tmp/link (allow→block) and <<-$"EOF" (now a real heredoc).

Docs: wiki updated with the exact new behavior; closed residuals deleted from the declared-residual text (<<$"EOF", glob+pipe, rsync source/dest, patch/apply, symlink/hardlink alias, brace cap, cd $dir/cd -/env -C, whitespace prefix, and the stale rm foo -rf / crontab-comment claims in the same paragraphs).

Not closed, said so: a cwd known only from the session; a project's protected-file directory (not enumerable) for patch/apply; an alias created and written through by the same command from a computed name; TOCTOU.

Closes #1132

Built by dotdev.dev