fix(cosh-ng): route Han prompts - #2746
Conversation
![qoderai[bot]](https://avatars.githubusercontent.com/in/1396158?s=60&v=4){kind=small}
There was a problem hiding this comment.
- Han 首词 metachar 豁免范围略超出“quoted command context”，未引用的
&&/;/</>/$/反引号也直接路由 natural_language，建议收紧为“仅引号内命令片段豁免”并补充矩阵用例。 - missing_path context 中 Han + pipeline 提示语从 command 改为 natural_language，相当于在 debug trap 路径进一步放宽 metachar 检测，建议明确边界并增加 ASCII 对照负例防止误用。
- 新增 PTY E2E 仅覆盖管道/变量/反引号，未包含重定向和分号组合的 Han prompt，建议补充这些 case，确保 classify 与 host wiring 在真实 shell 中行为一致。
🤖 Generated by Qoder • View workflow run
| if (( top_han_status == 0 )); then | ||
| case "$scan" in |
There was a problem hiding this comment.
[P1] Han metachar routing may be too permissive
input_intent.sh:204-248 中 Han 分支仅剩 [[:cntrl:]] veto，ASCII 分支仍对 | & ; < > $ ` 等做全局 veto。当前改动让所有 Han 首词 + 这些元字符的输入直接落到 natural_language，包括未引用的 解释 true && touch x、解释 foo; bar 等，这与描述中“quoted command context”略有偏差，也可能在后续路由链路中降低防御强度。建议明确“仅在元字符处于合法引号上下文时豁免”的语义，例如保留未引号的 pipeline/控制符 veto，只对 "$HOME" 等被完整包裹的片段放通，并在 Han Tier A 矩阵中同时覆盖 quoted / unquoted 对照用例。
🤖 Generated by Qoder • Fix in Qoder
There was a problem hiding this comment.
Fixed in 1410bd6. Confirmed: returning success from command-not-found can enable a sibling command. The classifier now keeps unquoted control operators, redirects, and command substitution shell-owned; quoted literals and safe parameter references retain Han Tier-A routing. Added a bash/zsh PTY counterproof for the AND-list case.
| // A Han-leading prompt can quote pipeline syntax for the Agent. | ||
| ( | ||
| "打开./config.toml | cat", | ||
| "打开./config.toml", |
There was a problem hiding this comment.
[P2] Missing-path Han pipeline case change might warrant explicit guard
missing_path_context_keeps_conservative_vetoes 中将 "打开./config.toml | cat" 在 missing_path context 下从 command 变更为 natural_language，与 issue #1919 中“仅豁免 slash 形状、其他 veto 规则保持”的描述略有不同。虽然该输入首词为 Han 提示语，实测也不会直接执行管道，但这里相当于在 debug trap 路径上进一步放宽 metachar 检测。建议在描述或测试矩阵中明确这类“Han 首词 + pipeline + missing path”的放宽边界，并补一个负例（如纯 ASCII open ./config.toml | cat 仍走 command），避免后续误读这条用例为“所有含管道的 missing-path 都可视为 NL”。
🤖 Generated by Qoder • Fix in Qoder
There was a problem hiding this comment.
Fixed in 1410bd6. The missing-path pipe case is again shell-owned, and the matrix now includes an ASCII missing-path control case that remains a command result.
| } | ||
|
|
||
| #[test] | ||
| fn shell_host_han_metachar_prompts_route_to_agent() { |
There was a problem hiding this comment.
[P2] PTY E2E test does not cover redirects/semicolon variants
shell_host_han_metachar_prompts_route_to_agent E2E 测试覆盖了管道、变量和反引号，但没有包含新路由矩阵中的 解释 foo; bar、解释 'a>b'/解释 input < file/解释 output > file 等 Han + 控制符/重定向组合。当前仅依赖 classify 层单元测试验证这些 case，未校验真实 bash/zsh PTY 环境下是否也统一路由到 natural_language。建议在同一测试中补充这些输入，或新增一个专门覆盖 redirects/semicolon 的接受测试，防止 classify 与 host wiring 行为出现偏差。
🤖 Generated by Qoder • Fix in Qoder
There was a problem hiding this comment.
Not applicable after the P1 correction. Semicolon and redirection forms remain shell-owned because command-not-found cannot safely intercept parsed compound syntax. The classifier matrix anchors those outcomes; the PTY acceptance test now covers the executable-control-operator counterproof.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6a2d691188
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| if (( top_han_status == 0 )); then | ||
| case "$scan" in | ||
| *'|'*|*'&'*|*';'*|*'<'*|*'>'*|*'$'*|*'`'*|*[[:cntrl:]]*) | ||
| *[[:cntrl:]]*) |
There was a problem hiding this comment.
When a Han-leading prompt contains && and no user-defined command-not-found handler is installed, this now classifies the missing first command as natural language; both shell handlers emit the intercept and return status 0 (marker/bash.rs:557-558, marker/zsh.rs:498-499). Consequently, an input such as 解释 true && touch /tmp/x is sent to the agent and then executes touch, whereas the previous veto delegated the missing command with status 127 and prevented the right-hand side from running. Keep control operators vetoed, or otherwise ensure the remaining compound command cannot execute after interception.
AGENTS.md reference: src/cosh-ng/AGENTS.md:L106-L108
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in 1410bd6. The Han branch now vetoes unquoted control operators, and the bash/zsh PTY counterproof verifies that the right side of an AND-list does not execute.
1410bd6 to
e1fe105
Compare
Route Han-leading prompts that safely quote parameter expansions to the Agent. Keep executable shell operators and command substitution shell-owned so an intercept cannot change compound-command execution. Fixes: f1f5882 ("fix(cosh-ng): [shell] classify Han tier-a input") Signed-off-by: Zhilinlinlin <aiyiqi@linux.alibaba.com>
e1fe105 to
84dd7fd
Compare
1 participant
Why
Han-leading natural-language prompts that reference parameter expansions can bypass NL interception and fall through to the shell. Compound shell syntax cannot safely be intercepted from command-not-found: a successful handler status can change sibling-command execution.
What changed
Allow Han Tier-A prompts containing safe parameter-expansion references such as
$HOME. Keep unquoted control operators, redirects, command substitution, malformed quoting, unquoted parentheses/process substitution, and control bytes shell-owned.Related issue
closes #1990
User / Agent impact
Prompts such as
帮我解释 $HOME 变量route to the Agent in bash and zsh. Executable shell structures remain native so an intercept cannot run or suppress adjacent commands.Risk and compatibility
The command-not-found handler no longer changes the execution status of compound shell lines.
Validation
cargo test -p cosh-shell --test shell_host input_intent::(19 passed)cargo test -p cosh-shell --test shell_host marker::shell_host_han_(bash/zsh PTY positive and control-operator counterproof)cargo clippy -p cosh-shell --all-targets -- -D warningscargo fmt --all -- --checkDocumentation and rollback
No documentation change is required. Revert
1410bd645to restore the prior classifier behavior.