fix: allow_patterns audit log, risk_level recalc, redirect/background mapping, W605

  - _scanner: allow_patterns upgrade logs warning + [auto_allowed] in summary
  - _scanner: risk_level recalculated after blocklist findings appended
  - _scanner: bash redirect/background findings mapped to SafetyFinding
  - _bash_scanner: remove raw docstring $(...) causing W605

Author: lll-peanut

trpc_agent_sdk/tools/safety/_bash_scanner.py

@@ -259,7 +259,7 @@ def _dispatch_commands(self, line_no: int, raw_line: str, tokens: List[str]) ->
             self._analyse_one_command_with_dynamic_scan(line_no, raw_line, tokens[seg_start:])
 
     def _analyse_one_command_with_dynamic_scan(self, line_no: int, raw_line: str, cmd_tokens: List[str]) -> None:
-        r"""Analyse a command segment AND scan all tokens for eval/exec inside \$(...)."""
+        """Analyse a command segment AND scan all tokens for eval/exec inside $(...)."""
         self._analyse_one_command(line_no, raw_line, cmd_tokens)
         # Scan for dynamic commands that appear anywhere in the token stream
         # (not just as the head command), so that $(eval "rm -rf /") and

trpc_agent_sdk/tools/safety/_scanner.py

@@ -249,8 +249,17 @@ def scan(self, scan_input: SafetyScanInput) -> SafetyScanReport:
         # Also refuses to upgrade when any CRITICAL finding exists, regardless
         # of how the policy maps CRITICAL → decision.
         has_critical = any(f.risk_level == RiskLevel.CRITICAL for f in all_findings)
+        allow_upgraded = False
         if (decision == Decision.NEEDS_HUMAN_REVIEW and not has_critical and self._check_allow_patterns(script)):
+            logger.info("allow_patterns upgraded NEEDS_HUMAN_REVIEW → ALLOW for '%s'", scan_input.tool_name)
             decision = Decision.ALLOW
+            allow_upgraded = True
+
+        # ══════════════════════════════════════════════════════════════
+        # Recompute max_risk after blocklist findings may have been appended
+        # ══════════════════════════════════════════════════════════════
+        if all_findings:
+            max_risk = max(f.risk_level for f in all_findings)
 
         # ══════════════════════════════════════════════════════════════
         # Multi-layer evidence redaction (improved from single-layer)
@@ -273,7 +282,8 @@ def scan(self, scan_input: SafetyScanInput) -> SafetyScanReport:
             denied = sum(1 for f in all_findings if f.risk_level in (RiskLevel.CRITICAL, RiskLevel.HIGH))
             total = len(all_findings)
             summary = (f"Scan of '{scan_input.tool_name or 'unnamed tool'}' found {total} issue(s) "
-                       f"({denied} high/critical). Decision: {decision.value}.")
+                       f"({denied} high/critical). Decision: {decision.value}." +
+                       (" [auto_allowed by allow_patterns]" if allow_upgraded else ""))
 
         return SafetyScanReport(
             tool_name=scan_input.tool_name,
@@ -676,6 +686,37 @@ def _scan_bash_tokens(self, script: str, scan_input: SafetyScanInput) -> List[Sa
                             path,
                         ))
 
+            # Redirect to sensitive paths (e.g. > /etc/passwd, 2>/dev/sda)
+            for f in bash_findings:
+                if f.kind == "redirect":
+                    target = f.extra.get("target", "?")
+                    findings.append(
+                        self._make_finding(
+                            "BASH-FILE-003",
+                            RiskCategory.DANGEROUS_FILE_OPS,
+                            RiskLevel.CRITICAL,
+                            f.evidence,
+                            f"Bash: redirect to sensitive path '{target}'",
+                            "Do not redirect output to sensitive system files.",
+                            f.line_number,
+                            target,
+                        ))
+
+            # Background execution
+            for f in bash_findings:
+                if f.kind == "background":
+                    findings.append(
+                        self._make_finding(
+                            "BASH-PROC-004",
+                            RiskCategory.PROCESS_AND_SYSTEM,
+                            RiskLevel.MEDIUM,
+                            f.evidence,
+                            "Bash: background execution operator &",
+                            "Background execution in tool scripts may indicate persistence or resource abuse.",
+                            f.line_number,
+                            "&",
+                        ))
+
         except ImportError:
             logger.debug("Bash shlex scanner not available; skipping.")
         except Exception: