Confined shell engine: argv + safe-subset executor (pipes/globs/&&/redirects; refuse dynamic constructs)

[hartsock]

Tracks ADR 0005 D3 — the default confined-shell engine for this pass (L3 is the boundary, L2 is convenience). No brush fork, no upstream dependency.

Why

The brush CommandInterceptor (L2) requires a fork crates.io won't let us publish and that waits on reubeno/brush#1184 (#20) — so today the shell is a fail-closed stub (ADR 0003). ADR 0005 decouples: ship a usable, honestly-advisory confined shell now where bridle is the exec funnel, and let L3 (#31) become the boundary.

Scope — implement directly (no shell interpreter)

• Pipelines a | b — spawn N processes, wire stdout→stdin via OS pipes; check each argv0 against exec scope at the funnel.
• Globs *.rs — expand with the glob crate against fs_read scope; refuse expansions that escape scope.
• Sequencing/branching &&, ||, ; — exit-code logic over argv commands.
• Redirections >, >>, <, 2>&1 — bridle opens the target (canonical fs_read/fs_write check, I6) and wires the fd.
• Safe scalar expansion ($HOME-style env), quoting/word-splitting for argv parsing.
• Reuse the shared leash plumbing: ToolContext, the Denial sink, the result envelope (sandbox_kind, I9).

Structurally refuse (least authority by construction — ADR 0001 "opaque ⇒ never cleared")

• Command substitution $(...) / backticks; eval; process substitution <(...)/>(...); dynamic $VAR-as-command; functions; control flow with computed command names. Refused with a legible message (these are the undecidable interiors; they belong on the --yolo path, ADR 0003 / D5).

Notes

• Even as L2 "convenience," this is a stronger advisory posture than an in-process hook over full bash: it never runs the dynamic attack surface and is the funnel for every spawn.
• Composes cleanly under L3 (ADR 0004 D2: un-stub gate — no confinement regression below the fail-closed stub #31) when it lands; a future brush-bridle-core engine (brush-bridle-core: optional full-bash shell engine (deferred, reversible — not the path to a usable shell) #20) is a feature-gated addition on the same seam, not a replacement.

[hartsock]

Increment 1 landed in #38 (squash cabd72f), merged on green.

Done:

• The safe-subset parser (parse.rs): quote-aware tokenizer → a single command's argv; refuses $(...)/backticks/subshells by design (Dynamic), refuses operators/globs/$VAR as Unsupported, Malformed for bad input.
• Single-command execution: program+args or cmd; exec/cwd leash checks; direct spawn + capture + timeout; structured denied envelopes; honest sandbox_kind: none (L2 advisory until L3 / L3 boundary: Landlock as a Linux-only publishable variant (execute+read+write allow-list + netns) #35).
• De-stubbed the crate; mcp consumer tests restored to real assertions.

Remaining increments (each its own PR, merge-on-green):

• Pipelines a | b (spawn N, OS-pipe wiring; per-stage exec check).
• Redirections >, >>, <, 2>&1 (bridle opens the target → fs_write/fs_read check).
• Sequencing/branching &&, ||, ; (exit-code logic).
• Globbing *, ?, [ (safe expansion against fs_read scope) + $VAR scalar expansion.

Each lights up a construct currently refused as Unsupported by the parser.