Repository navigation
Allow-always is a command prefix, not the whole tool #479
Description
What the CLIs do
Claude Code "don't ask again" writes a session rule like `Bash(npm test:*)`, not "all Bash". Grok 0.2.119: always-allow for bash lets you edit a free-form glob instead of only a word prefix. Kimi/Codex are the same idea: the next `ls` is not a blank check for `curl | sh`.
Solenta today
"Accept all" sends `allowAlways`. `electron/runner.js` adds a session rule with `{ toolName }` only — every future invocation of that tool in this CLI session is allowed. For `Bash` that is YOLO for the rest of the turn stack.
`#322` is the non-bypassable destructive gate. This ticket is the everyday allow-always, which currently punches a hole in supervision the CLIs refused to punch.
Why it matters
People click Accept all because the agent is about to run `npm test` fifteen times. They just allowed `rm -rf`. The CLI never made that the default always-allow.
Scope
- Derive a default prefix/glob from the pending input (`npm test`, `git`, `cargo test`). Show it on the button: "Always allow `npm test*`".
- Let the user edit the glob before confirming (Grok).
- Whole-tool always-allow stays behind an explicit overflow ("this tool, anything").
- Persist the same shape the provider already understands (Claude `addRules` with a command prefix if the SDK supports it; otherwise Solenta-side filter before we auto-allow).
- Tests: accept-all on `npm test -- foo` does not auto-allow `rm`.
Related: #473 (the `a` key should apply this rule, not whole-tool), #322, #256.
Round 23.
Activity
currentbits commentedon Aug 18, 2026
Round 22 attack intel: Claude Code fixed a permission-matching bypass where "a Bash command could hide part of itself from permission checks, and tab or invisible-Unicode padding no longer hides part of a command from the approval dialog." Prefix-based allow-always (this issue) is exactly the kind of matcher this defeats:
rm<zero-width-space>-rfdoes not start withrm, and padding pushes the dangerous tail out of the visible dialog. Rules for Solenta's matcher: normalize whitespace (collapse tabs/odd spaces), strip zero-width and bidi-control Unicode before both the prefix match and the card render, and match on the normalized form while displaying it too, so what you approve is byte-identical to what runs. Also applies to #509's edit-before-approve: the edit field shows the normalized command.currentbits commentedon Oct 18, 2026
PR #1666: Always allow now sends a Claude session rule for the command prefix (
npm test:*), and the user can edit that rule. Allowing the whole tool is a separate "Allow any this session" option. Governed threads keep the exact-action grant from #262. Issue stays open until the PR merges.Scope Always allow to a command prefix instead of the whole tool (#479)…
Merge origin/main: adopt #1666's prefix-scoped Always allow, keep y /…
Scope Always allow to a command prefix instead of the whole tool (#479)
Merge origin/main: adopt #1666's prefix-scoped Always allow, keep y /…