feat(permissions): scope shell trust to the command prefix

Trusting one `git commit -m "wip"` used to trust ALL of shell for
the session — so a later `rm -rf` ran without a prompt. Now
trust-tool on a shell command extracts the command prefix
("git commit", "npm run", "ls") via a new commandPrefix() helper
and trusts only that family; other commands still prompt. Mirrors
Claude Code's getSimpleCommandPrefix.

The prefix logic: first command of a compound, binary + subcommand
for known subcommand tools (git/npm/cargo/docker/…), else just the
binary, after stripping env-assignments and sudo/nice/env wrappers.
Falls back to whole-tool trust when no prefix can be extracted.
14 prefix tests + a store test proving 'trust git commit doesn't
trust rm'.

Author: halfaipg

src/permissions/command-prefix.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, it } from "vitest";
+import { commandPrefix } from "./command-prefix.js";
+
+describe("commandPrefix", () => {
+	it("keeps binary + subcommand for subcommand-style tools", () => {
+		expect(commandPrefix('git commit -m "wip"')).toBe("git commit");
+		expect(commandPrefix("npm run build")).toBe("npm run");
+		expect(commandPrefix("cargo test --all")).toBe("cargo test");
+		expect(commandPrefix("docker compose up -d")).toBe("docker compose");
+	});
+
+	it("keeps just the binary for plain commands", () => {
+		expect(commandPrefix("ls -la")).toBe("ls");
+		expect(commandPrefix("python script.py")).toBe("python");
+		expect(commandPrefix("cat /etc/hosts")).toBe("cat");
+	});
+
+	it("takes only the first command of a compound", () => {
+		expect(commandPrefix("git add . && git commit -m x")).toBe("git add");
+		expect(commandPrefix("make build; make test")).toBe("make build");
+		expect(commandPrefix("cat foo | grep bar")).toBe("cat");
+	});
+
+	it("strips leading env assignments and bare wrappers", () => {
+		expect(commandPrefix("FOO=bar npm run dev")).toBe("npm run");
+		expect(commandPrefix("sudo systemctl restart nginx")).toBe("systemctl restart");
+		expect(commandPrefix("env cargo build")).toBe("cargo build");
+	});
+
+	it("strips a directory path from the binary", () => {
+		expect(commandPrefix("/usr/bin/git status")).toBe("git status");
+		expect(commandPrefix("./scripts/deploy.sh")).toBe("deploy.sh");
+	});
+
+	it("does not attach a flag as a subcommand", () => {
+		expect(commandPrefix("git --version")).toBe("git");
+		expect(commandPrefix("npm -v")).toBe("npm");
+	});
+
+	it("returns null for empty / whitespace", () => {
+		expect(commandPrefix("")).toBeNull();
+		expect(commandPrefix("   ")).toBeNull();
+	});
+});

src/permissions/command-prefix.ts

@@ -0,0 +1,77 @@
+/**
+ * Extract a stable "command prefix" from a shell command line so that
+ * trusting one `git commit -m "wip"` persists as trust for `git commit`
+ * generally — not the exact string, and not all of `shell`. Mirrors
+ * Claude Code's getSimpleCommandPrefix.
+ *
+ * Rules, kept deliberately simple (this is a UX convenience, not a
+ * security boundary — the shell validator is the hard guard):
+ *   - Take the first command of a compound (`a && b` → `a`).
+ *   - Keep the binary + one subcommand if the binary is a known
+ *     subcommand-style tool (git, npm, cargo, docker, kubectl, …):
+ *     `git commit -m x` → `git commit`, `npm run build` → `npm run`.
+ *   - Otherwise keep just the binary: `ls -la` → `ls`, `python x.py` → `python`.
+ *   - Stop at the first token that looks like a flag, path, or value.
+ *
+ * Returns null when no meaningful prefix can be extracted (empty,
+ * shell-builtin noise) — caller should fall back to whole-tool trust.
+ */
+const SUBCOMMAND_TOOLS: ReadonlySet<string> = new Set([
+	"git",
+	"npm",
+	"pnpm",
+	"yarn",
+	"bun",
+	"cargo",
+	"go",
+	"docker",
+	"kubectl",
+	"gh",
+	"pip",
+	"pip3",
+	"poetry",
+	"brew",
+	"apt",
+	"apt-get",
+	"systemctl",
+	"terraform",
+	"make",
+]);
+
+export function commandPrefix(command: string): string | null {
+	const trimmed = command.trim();
+	if (!trimmed) return null;
+
+	// First command of a compound / pipeline. Split on the common
+	// separators; we only care about the leading segment for the prefix.
+	const firstSegment = trimmed.split(/&&|\|\||;|\||\n/)[0]?.trim() ?? "";
+	if (!firstSegment) return null;
+
+	// Strip a leading env-assignment prefix (`FOO=bar cmd …`) and common
+	// wrappers that don't change what's really being run.
+	const tokens = firstSegment.split(/\s+/).filter(Boolean);
+	let i = 0;
+	while (i < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=.*/.test(tokens[i])) i++;
+	while (i < tokens.length && (tokens[i] === "sudo" || tokens[i] === "nice" || tokens[i] === "env")) i++;
+	if (i >= tokens.length) return null;
+
+	const binary = baseName(tokens[i]);
+	if (!binary) return null;
+
+	if (SUBCOMMAND_TOOLS.has(binary)) {
+		const sub = tokens[i + 1];
+		// Only attach the subcommand if it's a bare word (not a flag/path).
+		if (sub && /^[a-z][a-z0-9-]*$/i.test(sub)) {
+			return `${binary} ${sub}`;
+		}
+	}
+	return binary;
+}
+
+/** Strip a directory path from a binary token: `/usr/bin/git` → `git`. */
+function baseName(token: string): string {
+	const slash = token.lastIndexOf("/");
+	const name = slash >= 0 ? token.slice(slash + 1) : token;
+	// Drop a trailing path-ish or quote noise; keep word chars + - .
+	return name.replace(/['"]/g, "");
+}

src/permissions/store.test.ts

@@ -57,6 +57,24 @@ describe("PermissionStore trust state", () => {
 		await expect(second).resolves.toBe("block");
 	});
 
+	it("trust-tool on a shell command scopes to the command prefix", async () => {
+		const store = new PermissionStore();
+		// `git commit` needs permission (write-ish). Trust it.
+		const first = store.evaluate("shell", { command: 'git commit -m "wip"' });
+		store.respond(store.current()!.id, "trust-tool");
+		await expect(first).resolves.toBe("allow");
+
+		// Another `git commit` is auto-allowed by prefix.
+		await expect(store.evaluate("shell", { command: 'git commit -m "more"' })).resolves.toBe("allow");
+		expect(store.current()).toBeUndefined();
+
+		// But a DIFFERENT command family still prompts — trust didn't leak.
+		const danger = store.evaluate("shell", { command: "rm -rf build" });
+		expect(store.current()).toMatchObject({ tool: "shell" });
+		store.respond(store.current()!.id, "deny");
+		await expect(danger).resolves.toBe("block");
+	});
+
 	it("trust-all auto-allows everything for the rest of the session", async () => {
 		const store = new PermissionStore();
 		const first = store.evaluate("shell", { command: "rm file" });

src/permissions/store.ts

@@ -1,4 +1,5 @@
 import { shellNeedsPermission } from "../tools/permission.js";
+import { commandPrefix } from "./command-prefix.js";
 
 export type Decision = "allow" | "block";
 
@@ -167,7 +168,16 @@ export interface PermissionStoreOptions {
 export class PermissionStore {
 	private trustAll = false;
 	private readonly trustedTools = new Set<string>();
-	private readonly queue: Array<{ request: PermissionRequest; resolve: (d: Decision) => void }> = [];
+	/** Trusted shell command prefixes (e.g. "git commit") from a trust-tool
+	 * response to a shell prompt. Scopes trust to the command family rather
+	 * than all of shell — trusting one `git commit` doesn't trust `rm`. */
+	private readonly trustedShellPrefixes = new Set<string>();
+	private readonly queue: Array<{
+		request: PermissionRequest;
+		resolve: (d: Decision) => void;
+		/** Command prefix for a shell prompt, used to scope trust-tool. */
+		shellPrefix?: string;
+	}> = [];
 	private readonly listeners = new Set<(req: PermissionRequest | undefined) => void>();
 	private counter = 0;
 	private readonly matchAllow: (toolName: string, args: unknown) => boolean;
@@ -194,7 +204,15 @@ export class PermissionStore {
 				detail: detailFor(toolName, args),
 				risk: riskFor(toolName, args),
 			};
-			this.queue.push({ request, resolve });
+			// For shell, capture the command prefix so a trust-tool response
+			// trusts the command family (e.g. "git commit") rather than all
+			// of shell.
+			let shellPrefix: string | undefined;
+			if (toolName === "shell") {
+				const cmd = (args as { command?: string } | undefined)?.command;
+				if (typeof cmd === "string") shellPrefix = commandPrefix(cmd) ?? undefined;
+			}
+			this.queue.push({ request, resolve, shellPrefix });
 			this.notify();
 		});
 	}
@@ -215,8 +233,19 @@ export class PermissionStore {
 		const head = this.queue[0];
 		if (!head || head.request.id !== id) return;
 
-		if (choice === "trust-tool") this.trustedTools.add(head.request.tool);
-		else if (choice === "trust-all") this.trustAll = true;
+		if (choice === "trust-tool") {
+			// Shell trust is scoped to the command prefix when we have one,
+			// so "trust" on a `git commit` prompt auto-allows future
+			// `git commit …` calls but NOT every shell command. Falls back to
+			// whole-tool trust when no prefix could be extracted.
+			if (head.request.tool === "shell" && head.shellPrefix) {
+				this.trustedShellPrefixes.add(head.shellPrefix);
+			} else {
+				this.trustedTools.add(head.request.tool);
+			}
+		} else if (choice === "trust-all") {
+			this.trustAll = true;
+		}
 
 		head.resolve(choice === "deny" ? "block" : "allow");
 		this.queue.shift();
@@ -227,6 +256,7 @@ export class PermissionStore {
 	clear(): void {
 		this.trustAll = false;
 		this.trustedTools.clear();
+		this.trustedShellPrefixes.clear();
 	}
 
 	private shouldAutoAllow(toolName: string, args: unknown): boolean {
@@ -235,7 +265,12 @@ export class PermissionStore {
 		if (this.trustedTools.has(toolName)) return true;
 		if (toolName === "shell") {
 			const cmd = (args as { command?: string } | undefined)?.command;
-			if (typeof cmd === "string" && !shellNeedsPermission(cmd)) return true;
+			if (typeof cmd === "string") {
+				if (!shellNeedsPermission(cmd)) return true;
+				// Auto-allow if the command's prefix was trusted earlier.
+				const prefix = commandPrefix(cmd);
+				if (prefix && this.trustedShellPrefixes.has(prefix)) return true;
+			}
 		}
 		// git_branch with no name (or just listing) is read-only.
 		if (toolName === "git_branch") {