fix(core): enable granular shell command allowlisting in policy engine (#15601)

2026-04-28 14:04:41 -07:00 · 2025-12-26 18:48:44 -05:00
parent 5566292cc8
commit 37be162435
6 changed files with 241 additions and 22 deletions
@@ -89,7 +89,15 @@ export class ShellToolInvocation extends BaseToolInvocation<
  protected override getPolicyUpdateOptions(
    outcome: ToolConfirmationOutcome,
  ): PolicyUpdateOptions | undefined {
-    if (outcome === ToolConfirmationOutcome.ProceedAlwaysAndSave) {
+    if (
+      outcome === ToolConfirmationOutcome.ProceedAlwaysAndSave ||
+      outcome === ToolConfirmationOutcome.ProceedAlways
+    ) {
+      const command = stripShellWrapper(this.params.command);
+      const rootCommands = [...new Set(getCommandRoots(command))];
+      if (rootCommands.length > 0) {
+        return { commandPrefix: rootCommands };
+      }
      return { commandPrefix: this.params.command };
    }
    return undefined;