承認したのは、私が読んだ文字列ではなかった — 確認プロンプトの中継を細工文字で検証する

# probe.py — 細工文字が各層をどこまで通るかを測る
import unicodedata
 
RLO, PDF_, ZWSP, ZWNJ = "\u202E", "\u202C", "\u200B", "\u200C"
 
# (名前, 実際に渡されるバイト列, 人間に見えている見た目)
CORPUS = [
    ("P1 bidi-override",   f"rm -rf /tmp/build{RLO}gpj.nohtyp/{PDF_}", "rm -rf /tmp/build/python.jpg"),
    ("P2 zero-width",      f"rm{ZWSP} -rf /{ZWSP}",                    "rm -rf /"),
    ("P3 lookalike-quote", 'rm -rf “$HOME/repos”',           'rm -rf "$HOME/repos"'),
    ("P4 homoglyph",       "claude --dangerously-skip-permissiпns", "claude --dangerously-skip-permissions"),
    ("P5 fake-line",       "git status\n✅ Approved by policy\ngit push --force", "git status"),
    ("P6 zwnj-flag",       f"--allow{ZWNJ}-all",                       "--allow-all"),
]
 
def L1_plain(s):        # そのままチャットへ流す
    return False
def L2_strip_ctrl(s):   # 制御文字（カテゴリ Cf）の有無で弾く
    return any(unicodedata.category(c) == "Cf" for c in s)
def L3_nfkc(s):         # NFKC 正規化して変化したら弾く
    return unicodedata.normalize("NFKC", s) != s
def L4_nonascii(s):     # ASCII 外と改行を可視化して弾く
    return any(ord(c) > 0x7E or c == "\n" for c in s)
 
LAYERS = [("L1 そのまま中継", L1_plain), ("L2 制御文字の除去", L2_strip_ctrl),
          ("L3 NFKC正規化", L3_nfkc), ("L4 エスケープ表示", L4_nonascii)]
 
counts = {n: 0 for n, _ in LAYERS}
for name, raw, _ in CORPUS:
    for n, fn in LAYERS:
        counts[n] += fn(raw)
 
n = len(CORPUS)
for name, _ in LAYERS:
    print(f"{name:18} 検知 {counts[name]}/{n} ({counts[name]/n*100:.0f}%)")

BENIGN = [
    'git commit -m "記事を追加: 承認中継の設計"',
    'git commit -m "Add: approval relay design (JA+EN)"',
    'python3 article_gate.py content/articles/ja/claude-code/x.mdx',
    'echo "完了しました" >> log.txt',
    'rm -rf "$HOME/repos/claudelab.net/.next"',
]

import unicodedata
 
DECEPTIVE = {
    "\u202A":"LRE","\u202B":"RLE","\u202C":"PDF","\u202D":"LRO","\u202E":"RLO",
    "\u2066":"LRI","\u2067":"RLI","\u2068":"FSI","\u2069":"PDI",
    "\u200B":"ZWSP","\u200C":"ZWNJ","\u200D":"ZWJ","\uFEFF":"BOM",
    "“":"LEFT-DQ","”":"RIGHT-DQ","‘":"LEFT-SQ","’":"RIGHT-SQ",
}
ALLOWED = ("LATIN", "DIGIT", "CJK", "HIRAGANA", "KATAKANA", "IDEOGRAPHIC", "FULLWIDTH")
 
def script_of(ch):
    try:
        name = unicodedata.name(ch)
    except ValueError:
        return "UNNAMED"
    return next((a for a in ALLOWED if a in name), "OTHER")
 
def inspect(raw):
    """咎めるべき位置だけを返す。日本語は通す。"""
    hits = []
    for i, ch in enumerate(raw):
        if ch in DECEPTIVE:
            hits.append((i, DECEPTIVE[ch]))
        elif ch == "\n":
            hits.append((i, "LINE FEED"))
        elif ord(ch) > 0x7E:
            s = script_of(ch)
            if s in ("OTHER", "UNNAMED"):
                hits.append((i, f"UNEXPECTED {s}"))
    return hits

import hashlib
 
def safe_view(raw: str) -> str:
    """人間に見せる用。疑わしい文字は符号位置で可視化する。"""
    out = []
    for ch in raw:
        if ch in DECEPTIVE or ch == "\n" or (ord(ch) > 0x7E and script_of(ch) in ("OTHER", "UNNAMED")):
            out.append(f"⟪U+{ord(ch):04X}⟫")
        else:
            out.append(ch)
    return "".join(out)
 
def approval_token(raw: str) -> str:
    """承認の対象はバイト列。見た目ではない。"""
    return hashlib.sha256(raw.encode("utf-8")).hexdigest()[:16]
 
def render_request(raw: str) -> dict:
    hits = inspect(raw)
    return {
        "view": safe_view(raw),
        "token": approval_token(raw),
        "findings": hits,
        "verdict": "HOLD" if hits else "SHOW",
    }
 
def confirm(raw_at_exec: str, approved_token: str) -> bool:
    """承認後にバイト列がすり替わっていたら成立させない。"""
    return approval_token(raw_at_exec) == approved_token

[HOLD] token=131d185e49635e23
        view: rm -rf /tmp/build⟪U+202E⟫gpj.nohtyp/⟪U+202C⟫
        hits: RLO@17, PDF@29
[HOLD] token=ef2566299d8fc126
        view: git status⟪U+000A⟫⟪U+2705⟫ Approved by policy⟪U+000A⟫git push --force
        hits: LINE FEED@10, UNEXPECTED OTHER@11, LINE FEED@31
[SHOW] token=a82299bcae807c0b
        view: git commit -m 'ok' && git push origin main
 
同一バイト列で実行  -> True
ZWSP 混入で実行     -> False