# Phase 2 深审 — Wave P2-2（sync_v2 全文 + 路径/Shell 依赖）

**日期**: 2026-06-04  
**范围**: `sync_v2.py` 1656 行全文 + 路径校验与 SSH 包装  
**标准**: `standards/line-walk-audit-standard-v2.md` 8 步

## 登记

| # | 文件 | 语言 | 行数 N | Read 范围 |
|---|------|------|--------|-----------|
| 1 | `server/api/sync_v2.py` | Python | 1656 | 1–1656 全文（分段 Read 至 EOF） |
| 2 | `server/utils/posix_paths.py` | Python | 149 | 1–149 全文 |
| 3 | `server/infrastructure/ssh/remote_shell.py` | Python | 63 | 1–63 全文 |
| 4 | `server/api/remote_path_validation.py` | Python | 33 | 1–33 全文 |
| 5 | `server/utils/unix_ls.py` | Python | 115 | 1–115 全文 |

## 入口表（sync_v2 全 22 路由）

| 路由 | 鉴权 |
|------|------|
| POST `/files`, `/preview`, `/file-ops`, `/file-clipboard`, `/browse` | JWT |
| POST `/browse-local`, `/local-file-ops`, `/local-file-preview` | JWT + upload 沙箱 |
| POST `/cancel`, `/reconcile-stale-logs`, `/validate-source-path`, `/diagnose` | JWT |
| POST `/file-diff`, `/upload`, `/upload-zip`, `/verify` | JWT |
| POST `/download`, `/read-file`, `/write-file`, `/chmod`, `/compress`, `/decompress` | JWT |

## Closure 表

| H | 文件:行号 | 判定 | 理由 |
|---|-----------|------|------|
| H-Auth | sync_v2.py:74–1614 | SAFE | 22 路由均 `Depends(get_current_admin)` |
| H-Shell | sync_v2.py:156-168 | RISK | `rm -rf` 删目录；JWT+审计+前端 confirm |
| H-Shell | sync_v2.py:156,165,168,223-227 | SAFE | path shlex.quote |
| H-Path | sync_v2.py:149-165 | SAFE | normalize_remote_abs_path |
| H-Clipboard | sync_v2.py:207-208 | SAFE | assert_clipboard_transfer_safe |
| H-Sandbox | sync_v2.py:302,341,413,721 | SAFE | ensure_under_nexus_upload |
| H-Source | sync_v2.py:548,1096 | SAFE | FORBIDDEN prefixes + resolve |
| H-Audit | sync_v2.py:461-475 | SAFE | 失败 log warning+exc_info，非静默 pass |
| H-Upload | sync_v2.py:876-877,977-978 | SAFE | 100MB / 500MB 上限 |
| H-ZipSlip | sync_v2.py:1000-1005 | SAFE | assert_zip + is_path_under_prefix |
| H-Download | sync_v2.py:1244-1272 | SAFE | 100MB + filename sanitize |
| H-Read | sync_v2.py:1322-1326 | SAFE | max_size 来自 payload |
| H-Write | sync_v2.py:1394-1414 | SAFE | 5MB + etag 409 冲突 |
| H-Chmod | sync_v2.py:1507-1514 | SAFE | recursive policy + test -d |
| H-Verify | sync_v2.py:1145-1146 | SAFE | sha256sum 路径 shlex.quote |
| H-Path | posix_paths.py:46-59 | SAFE | 禁 `..` 与反斜杠 |
| H-Path | posix_paths.py:117-136 | SAFE | upload 前缀 + zip-slip |
| H-Sudo | remote_shell.py:35-53 | SAFE | bash -c + shlex.quote(command) |
| H-Clipboard | remote_path_validation.py:24-33 | SAFE | dest 非源子树 |
| H-Parse | unix_ls.py:70-71 | SAFE | 跳过 `.` `..` |

**len(H)=20, Closure=20**

## FINDING

无 P0/P1 新 FINDING。

## DoD

- [x] sync_v2 全文 Read（D1 仅 grep+分段，本波补全）
- [x] len(H) == Closure
- [x] local_verify 通过

## 验证

`bash scripts/local_verify.sh` — 全绿
