[Bug]: Bash permission deny rules can be skipped via transparent wrappers while allow rules match the stripped form

[KevinBarrus]

Description

In the bash permission evaluator, user deny rules are matched only against the raw command text, while user allow rules are additionally matched against a transparent-wrapper-stripped form. When both rule kinds exist for the same prefix family, a wrapped command can skip the deny and match the allow, so the deny policy is not enforced.

Source evidence

Audited against the 0.4.12 source preview (release/extraction.json sourceRevision 9b9885e42a3cf1a3df1cfa52a46e4fdb034cfcee); line numbers refer to that revision.

• Step 1 (user deny), packages/agent-modules/permission/src/tools/bash-permission.ts:1136-1145: matches matchShellRule(command, parsedRule) on the raw subcommand only. Step 2 (user ask, lines 1147-1156) is the same.
• Step 5 (user allow), packages/agent-modules/permission/src/tools/bash-permission.ts:1304-1320: additionally computes stripTransparentWrappersForRuleMatch(command) and matches the stripped form as well. The comment documents the intent: "if a transparent wrapper prefixes the line (nohup/setsid/timeout/xargs/...), also match the stripped form so pnpm:* covers nohup pnpm install".
• matchShellRule prefix semantics (packages/agent-modules/permission/src/tools/bash-rule-match.ts:159-171): a prefix rule matches only when the command equals the prefix or starts with prefix + " ".

Worked example with rules allow npm:* and deny npm publish:*:

• npm publish → deny rule matches → denied (correct).
• nohup npm publish → raw text does not start with npm publish, so the deny rule does not match; the allow rule matches the stripped form npm publish → allowed, bypassing the deny.

Any of the transparent wrappers covered by stripTransparentWrappersForRuleMatch (e.g. nohup, timeout, nice, setsid, xargs) reproduces this.

Expected behavior

Deny rules should see at least every command form that allow rules see. A command that is denied unwrapped should stay denied when wrapped in a transparent wrapper.

Suggested fix

In Step 1 (and Step 2 for ask rules), match matchShellRule(command, parsedRule) || (wrapperStrippedCommand && matchShellRule(wrapperStrippedCommand, parsedRule)) — the same disjunction Step 5 already uses, so deny/ask are evaluated against a superset of the allow forms.

Environment

Found by source audit; not runtime-reproduced yet. No credentials or live systems involved — the example above uses synthetic rules.

[hetaoBackend]

Thanks for the report. Fixed and merged in #167 (commit e3724a13d72d61c9bdc68a1a72b5c020f065ba26).

Deny, ask, and allow rules now use the same raw and transparent-wrapper-stripped command forms. A wrapped npm publish can no longer skip deny npm publish:* and fall through to allow npm:*.

Regression tests cover default/auto/bypass static evaluation, wrapper chains, environment prefixes, compound commands, and exact/prefix/wildcard/whole-tool rules. The sample npm commands are evaluated as strings, not executed.

Validation: all 106 new regression cases pass; the full local verification profile passed on macOS arm64, and Linux/macOS/Windows CI plus the source audit passed on the PR head. Built-CLI smoke/startup and offline BYOK runtime tests also passed. This is a source fix on main; it does not imply a new package release.