fix: /dev/null redirect false positive, AST domain extractor @ bypass

  - _bash_scanner: exclude /dev/null/zero/random/urandom/std*/tty from
    redirect CRITICAL detection (2>/dev/null is harmless).
  - _python_scanner: _extract_domain_from_url now strips userinfo:port
    same as _extract_url (fixes localhost:8080@evil.com AST bypass).

Author: lll-peanut

trpc_agent_sdk/tools/safety/_bash_scanner.py

@@ -438,13 +438,29 @@ def _check_rm(self, line_no: int, raw_line: str, tokens: List[str], args: List[s
                     ))
 
     def _check_redirects(self, line_no: int, raw_line: str, tokens: List[str]) -> None:
-        """Detect write redirects to sensitive paths."""
-        # Look for > or >> patterns
+        """Detect write redirects to sensitive paths.
+
+        Excludes harmless device files like ``/dev/null`` and ``/dev/zero``
+        so that ``grep foo /etc/hosts 2>/dev/null`` is not falsely blocked.
+        """
+        _SAFE_DEVS = frozenset({
+            "/dev/null",
+            "/dev/zero",
+            "/dev/random",
+            "/dev/urandom",
+            "/dev/stdin",
+            "/dev/stdout",
+            "/dev/stderr",
+            "/dev/fd",
+            "/dev/tty",
+            "/dev/pts",
+            "/dev/console",
+        })
         for i, t in enumerate(tokens):
             if t in (">", ">>", ">" + ">") and i + 1 < len(tokens):
-                # Strip surrounding quotes so that "/etc/passwd" in
-                # test expressions ([[ … ]]) is treated consistently.
                 target = tokens[i + 1].strip("'\"")
+                if target in _SAFE_DEVS:
+                    continue
                 if _is_sensitive_path(target) or target.startswith("/dev/"):
                     self._findings.append(
                         BashScanFinding(
@@ -459,6 +475,8 @@ def _check_redirects(self, line_no: int, raw_line: str, tokens: List[str]) -> No
             if ">" in t and len(t) > 1:
                 parts = t.split(">", 1)
                 target = parts[1].strip().strip("'\"")
+                if target in _SAFE_DEVS:
+                    continue
                 if target and (_is_sensitive_path(target) or target.startswith("/dev/sd")):
                     self._findings.append(
                         BashScanFinding(

trpc_agent_sdk/tools/safety/_python_scanner.py

@@ -973,10 +973,15 @@ def _is_sensitive_env_key(key: str) -> bool:
 
 
 def _extract_domain_from_url(url: Optional[str]) -> Optional[str]:
-    """Extract domain from a URL string."""
+    """Extract bare hostname from a URL, stripping userinfo and port."""
     if not url:
         return None
-    m = re.search(r"https?://([^\s/\"':]+)", url)
+    m = re.search(r"https?://([^\s/\"']+)", url)
     if m:
-        return m.group(1)
+        host = m.group(1)
+        if "@" in host:
+            host = host.rsplit("@", 1)[-1]
+        if ":" in host:
+            host = host.rsplit(":", 1)[0]
+        return host
     return None