fix(sandbox): parse quoted patch paths

Amp-Thread-ID: https://ampcode.com/threads/T-019fbdfb-b1e9-765e-ac9c-240512dfcd2f
Co-authored-by: Pierre Bruno <pierrebruno@hotmail.ch>

Author: ampagent

internal/sandbox/risk.go

@@ -325,15 +325,31 @@ func patchHeaderPaths(patch string) []string {
 			oldRemaining, newRemaining = parsePatchHunkCounts(line)
 			inHunk = oldRemaining > 0 || newRemaining > 0
 		case strings.HasPrefix(line, "--- "), strings.HasPrefix(line, "+++ "):
-			fields := strings.Fields(line)
-			if len(fields) >= 2 {
-				paths = append(paths, stripPatchPrefix(fields[1]))
+			if path := patchFileHeaderPath(line); path != "" {
+				paths = append(paths, stripPatchPrefix(path))
 			}
 		}
 	}
 	return paths
 }
 
+// patchFileHeaderPath mirrors the apply_patch parser's handling of unified-diff
+// file headers: paths may be C-quoted and may contain spaces, while an optional
+// timestamp is separated by a tab.
+func patchFileHeaderPath(line string) string {
+	rest := line[len("--- "):] // "--- " and "+++ " are both 4 bytes
+	if tab := strings.IndexByte(rest, '\t'); tab >= 0 {
+		rest = rest[:tab]
+	}
+	rest = strings.TrimSpace(rest)
+	if len(rest) >= 2 && rest[0] == '"' && rest[len(rest)-1] == '"' {
+		if unquoted, err := strconv.Unquote(rest); err == nil {
+			return unquoted
+		}
+	}
+	return rest
+}
+
 func parsePatchHunkCounts(line string) (int, int) {
 	_, rest, ok := strings.Cut(line, "@@")
 	if !ok {

internal/tools/daemon_token_exclusion_test.go

@@ -171,6 +171,39 @@ func TestEngineDeniesDaemonTokenFileTools(t *testing.T) {
 	}
 }
 
+func TestApplyPatchDeniesQuotedDaemonTokenPathWithSpaces(t *testing.T) {
+	ws, err := filepath.EvalSymlinks(t.TempDir())
+	if err != nil {
+		t.Fatalf("EvalSymlinks: %v", err)
+	}
+	token := filepath.Join(ws, "bridge token")
+	if err := os.WriteFile(token, []byte("bridge-secret\n"), 0o600); err != nil {
+		t.Fatalf("write token: %v", err)
+	}
+	t.Setenv(remote.EnvToken, "")
+	t.Setenv(remote.EnvTokenFile, token)
+	engine := sandbox.NewEngine(sandbox.EngineOptions{WorkspaceRoot: ws, Policy: sandbox.DefaultPolicy()})
+
+	registry := NewRegistry()
+	registry.Register(NewScopedApplyPatchTool(ws, nil))
+	patch := "diff --git \"a/bridge token\" \"b/bridge token\"\n" +
+		"--- \"a/bridge token\"\n" +
+		"+++ \"b/bridge token\"\n" +
+		"@@ -1 +1 @@\n" +
+		"-bridge-secret\n" +
+		"+attacker-controlled\n"
+	result := registry.RunWithOptions(context.Background(), "apply_patch", map[string]any{
+		"patch": patch,
+	}, RunOptions{Sandbox: engine, PermissionGranted: true})
+	if result.Status == StatusOK || !strings.Contains(result.Output, "remote bridge token") {
+		t.Fatalf("apply_patch on quoted protected path: status=%s output=%q, want bridge-token denial", result.Status, result.Output)
+	}
+	contents, err := os.ReadFile(token)
+	if err != nil || string(contents) != "bridge-secret\n" {
+		t.Fatalf("token changed after denied patch: contents=%q err=%v", contents, err)
+	}
+}
+
 // TestDaemonTokenAliasesDeniedEndToEnd covers the in-process tools, which are
 // the layer that can close inode aliases: they see every requested path before
 // opening it, so a symlink or hard link to the token resolves back to the