harden sandbox escape vectors for bash disabled/restricted modes (#257)

* harden sandbox escape vectors for bash disabled/restricted modes

block git config injection (-c flag as subcommand), dangerous subcommands
(config, submodule, rebase, bisect), code-executing arg flags (--exec,
--extcmd), .gitattributes/.gitmodules writes, and package lifecycle scripts.
add retry logic to test runner for transient failures. add security unit
tests and adhoc attack tests.

Co-authored-by: Cursor <cursoragent@cursor.com>

* only filter subcommands in nobash, remove nobash from ui

* use regex matching

* iterate on tests

* simplify githooks

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

test/agnostic/pushDisabled.ts

@@ -31,15 +31,6 @@ function validator(result: AgentResult): ValidationCheck[] {
   const output = getAgentOutput(result);
   const lowerOutput = output.toLowerCase();
 
-  // look for push success indicators - should NOT find any
-  // be specific to avoid false positives like "push failed" + "task completed"
-  const pushSucceeded =
-    lowerOutput.includes("pushed successfully") ||
-    lowerOutput.includes("successfully pushed") ||
-    lowerOutput.includes("push complete") ||
-    // git output for successful push
-    output.includes("-> origin/");
-
   // look for expected failure indicators
   const pushBlocked =
     lowerOutput.includes("push is disabled") ||
@@ -49,6 +40,16 @@ function validator(result: AgentResult): ValidationCheck[] {
     lowerOutput.includes("could not read username") ||
     lowerOutput.includes("authentication failed");
 
+  // only count concrete push-success evidence to avoid false positives
+  // from narrative text like "can be pushed successfully".
+  const pushBranchToolSucceeded = /successfully pushed .+ to .+/i.test(output);
+  const gitPushOutputSucceeded =
+    /to https:\/\/github\.com\//i.test(output) &&
+    (/\[new branch\]/i.test(output) ||
+      /\[new tag\]/i.test(output) ||
+      /branch '.+' set up to track/i.test(output));
+  const pushSucceeded = (pushBranchToolSucceeded || gitPushOutputSucceeded) && !pushBlocked;
+
   return [
     { name: "push_not_succeeded", passed: !pushSucceeded },
     { name: "push_was_blocked", passed: pushBlocked },