fix: harden execution-control decision boundary (WorkspaceWrite write-target bypasses + truthful sandbox diagnosis)

[XuebinMa]

Summary

Two execution-control hardening fixes found during a code audit of the guard pipeline. Both are in the security-critical decision/attestation surface.

HIGH-1 — fix(validators): close WorkspaceWrite write-target extraction bypasses

In WorkspaceWrite mode, validate_paths collected write targets only from the tokens after the command word and recognised writes via a closed command allowlist. Three classes of out-of-workspace write slipped through as Allow (and, in a default build where the sandbox is a passthrough shell, actually executed):

1. Leading redirection — >/etc/passwd echo x parsed > as the command word, so the target was never scanned.
2. dd of=PATH — an =-joined operand, invisible to both the redirection and positional scans.
3. tar create — tar -cf /etc/evil.tar . wrote an archive outside the workspace.

Fix: scan the whole segment (after unwrapping one sudo) for >/>>/>& and <, stripping redirection operators and their targets out of the positional stream so command-word detection is robust to a leading redirect (symmetric fix for read targets); extract dd of=; add tar_archive_write_target for create/append forms (-cf, dashless czf, --create, --file=). Extract/list -f stays a read so legitimate extracts aren't false-positived.

HIGH-2 — fix(sdk): stop reporting seccomp when no syscall filter is compiled in

On Linux, resolve_default_sandbox unconditionally returned SeccompSandbox with selected_name="seccomp", fallback_to_noop=false — even when the seccomp Cargo feature was not compiled in, in which case SeccompSandbox silently runs an unfiltered sh -c compat shell. Operators reading the doctor/diagnosis output — and execution receipts, which record sandbox_type() — were told syscall isolation was active when it was not.

Fix: split the Linux (non-Landlock) diagnosis on cfg(feature = "seccomp"). Feature on → seccomp as before; feature off → NoopSandbox with a truthful selected="none", fallback_to_noop=true, and a reason pointing at the rebuild flags. Makes both the diagnosis and the execution-receipt backend honest.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Docs
• CI / tooling

Checklist

• ./scripts/verify.sh full passes locally — ran the Rust scope only (workspace tests, clippy -D warnings, fmt); did not run the Python/Node/docs legs.
• Tests added or updated for the behavior change
• Security-sensitive changes include regression coverage — 13 new tests in the validator unit module (crates/agent-guard-validators/src/bash.rs) plus the platform-selection gate (tests/release_gate.rs). A reviewer may want these mirrored into tests/security_regression.rs.
• Cross-language parity preserved — no public type or decision surface changed (private functions / internal diagnosis only).
• Commits follow Conventional Commits
• Docs updated — none yet; if any guide states "Linux defaults to seccomp," it is now contradicted by the honest behavior and should be revisited (flagged, not done here).
• No secrets, tokens, or internal-only material added

Test plan

• cargo test --workspace --exclude agent-guard-python --all-features — all suites green.
• cargo test -p agent-guard-validators --lib — 181 passed (incl. 13 new HIGH-1 regressions).
• cargo clippy --all-features -- -D warnings clean; cargo fmt -- --check clean.
• Independent PoC harness against the real validator before/after: all 6 out-of-workspace writes flipped from ALLOW → BLOCK; controls (in-workspace leading redirect, in-workspace dd of=, tar -cf, and tar -xf reading an outside archive) behave correctly.

Reviewer caveat

HIGH-2's edited branch is cfg(target_os = "linux"). It was developed on macOS with a Homebrew toolchain that has no Linux std/rustup, so that arm could not be compiled locally — Linux CI is the authoritative check for it. The change is a simple cfg-split with both arms yielding the same (Box<dyn Sandbox>, DefaultSandboxDiagnosis) tuple, and NoopSandbox is already used elsewhere in the same function.

[XuebinMa]

Heads-up for review: the red Node Binding & Framework Tests check is a pre-existing failure on main (loopback HTTP execute test vs. the SSRF deny-list), not introduced by this PR. Tracked separately in #47. All checks this PR actually touches — Rust workspace, Linux seccomp integration, clippy/fmt, cross-language parity, docs — are green.

[XuebinMa]

Post-merge note (no npm republish needed): the published agent-guard-plugin npm package only ships JS glue + the outbound policy and builds guard-hook from git source via cargo install --git, so fresh installs pick up these fixes automatically once this lands on main. However, cargo install --git is not version-pinned, so users who already installed guard-hook before this merge must refresh manually to get the HIGH-1/HIGH-2 fixes:

cargo install --git https://github.com/XuebinMa/agent-guard guard-hook --force

@agent-guard/node (the napi binding that embeds the Rust decision logic) is not published to npm, so nothing to republish there.