Close backslash-escaped-quote bypass; narrow changelog claim

dequoteForMatching tracked quote state without escape awareness, so a
backslash-escaped quote (\") still toggled quote state the same as a real
one. In real bash \" is a literal quote character that never opens or
closes a quoted span, so an operator or flag that follows is genuinely
unquoted. Skip the escaped character without touching quote state.

Also narrow the CHANGELOG's nested bash -c claim to what the tests
actually cover (one level of quoting inside -c), not true multi-level
nested-shell parsing, which remains a known gap tracked separately.

Author: TheGreatAxios

src/permission/auto-shell-policy.ts

@@ -45,12 +45,24 @@ const inCmd = (body: string): RegExp => new RegExp(`${CMD}${body}`);
 // span; every other character (letters, digits, `-`) passes through
 // dequoted. Heredoc bodies are left alone: the file-mutation heredoc pattern
 // keys on the bare `<<` operator, which is always outside any quoting.
+//
+// A backslash before a quote character escapes it: `\"` is a literal `"`
+// that never opens or closes a quoted span (real bash semantics outside
+// single quotes), so `echo hi \"> file"` is a bare, unquoted redirect, not
+// text inside a quote. Skip the escaped character without touching quote
+// state so its following operator is still seen as live.
 const QUOTE_NEUTRALIZED_OPERATORS = new Set(["<", ">", "|", "&", ";", "`"]);
 
 const dequoteForMatching = (command: string): string => {
   let out = "";
   let quote: '"' | "'" | null = null;
-  for (const ch of command) {
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i] as string;
+    if (ch === "\\" && quote !== "'" && i + 1 < command.length) {
+      out += command[i + 1];
+      i++;
+      continue;
+    }
     if (quote !== null) {
       if (ch === quote) {
         quote = null;

src/permission/classify-security.test.ts

@@ -736,6 +736,23 @@ describe("CL-6703 — quoted redirect targets still deny file-mutation", () => {
   test("a quoted '>' inside non-redirect text does not false-positive", () => {
     expect(autoShellRuleForCall(shellCall(`git commit -m 'fix > bug'`))).toBeUndefined();
   });
+
+  test("a backslash-escaped quote before a redirect still denies", () => {
+    // `\"` is a literal quote character in real bash, not a quote-open — the
+    // shell is never inside a quoted string here, so the `>` that follows is
+    // a genuine, unquoted redirect.
+    expect(autoShellRuleForCall(shellCall('echo hi \\"> file"'))?.name).toBe("file-mutation");
+  });
+
+  test("a backslash-escaped quote ahead of a dangerous flag still denies", () => {
+    // The escaped quote sits before an extra leading space, so it never
+    // touches the `\s-c` junction later in the string; a naive quote-pairing
+    // scanner (ignoring the backslash) would consume that junction as part
+    // of a fake quoted span and hide the -c flag entirely.
+    expect(autoShellRuleForCall(shellCall('python3 \\" -c print(1)"'))?.name).toBe(
+      "file-mutation",
+    );
+  });
 });
 
 describe("CL-6702 — bash clobber redirects match file-mutation", () => {