[currentbits]

Accepting npm test with "Accept all" used to add a whole-tool session rule, so every later Bash call in that session ran unasked, rm -rf included. Always allow now grants Bash(npm test:*), which is what the CLIs themselves offer. Allowing the whole tool is an explicit choice you have to pick. Closes #479.

Changes

• Button: on a Claude command the card shows Always allow npm test:*. The rule is derived from the command that will actually run, so it updates when you edit the command.
• Overflow: a collapsed "Always-allow options" section lets you type your own rule, e.g. npm run *, and holds a red Allow any Bash this session button. That button is the only way to get a whole-tool rule.
• Narrow default everywhere: the main process also derives the prefix itself when no rule is sent, so orchestration, the web bridge and older clients stop granting whole-tool too.
• Event log: the conversation event records the rule that was granted, e.g. Allowed for session: Bash: npm test (rule: npm test:*).
• Unchanged: tools without a command (Edit, Write) still allow the whole tool. Codex keeps "Accept all", because acceptForSession already covers only that exact command.

Verification

• npm run typecheck passes and npx vite build succeeds.
• Electron: every test file that exercises respondPermission, including the governance, guardrails, codex-approvals and orch-merge tests, passes 177/0 after rebasing onto main.
• New tests check that accepting npm test -- foo sends ruleContent: "npm test:*" and not a whole-tool rule. They also cover a typed rule, * meaning the whole tool, and an empty typed rule falling back to the prefix.
• Renderer: threadView, permissionPrompt and the new permissionRuleParity tests pass. Card tests cover the rule following command edits, a typed rule surviving later edits, an empty rule disabling the button, the overflow sending *, and profile.ask hiding every always-allow option.
• Before the rebase, the full test:electron run ended at 4738 passing and 19 failing. The failures were in grok MCP registration, codex usage and worktree tests, none of which load these files. Rerun on their own, those files pass 146/0 both on this branch and on an unmodified HEAD.
• Not tested: clicking through a live Claude CLI session in the app.

Notes for reviewers

• Two copies of the prefix logic: src/permissionRule.ts is a renderer copy of commandPrefix in electron/permissionCommand.js, so the button can show the rule as you type. test/permissionRuleParity.test.ts fails if they drift.
• Governed threads (Governance layer: per-agent permission matrix, OS sandbox profiles, audit trail #262): these send no CLI rule and keep the exact-action session grant from Governance layer v1: per-profile permission matrix, HMAC audit, Claude gate (#262) #1655, so a typed rule is ignored there. The button still reads "Always allow <prefix>", which describes more than is actually granted; the real grant is narrower, never wider.
• Compound commands: whether npm test && rm -rf matches npm test:* is decided by the Claude CLI, which splits chained commands. Solenta doesn't check it again.

---

claude-opus-5-5 via Claude Code

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T20:01:54.825040Z	266ff9f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

solenta/electron/permissionCommand.js

Lines 130 to 131 in 266ff9f

	if (TWO_TOKEN_BINS.has(bin) && tokens[1] && !tokens[1].startsWith("-")) {
	prefix = `${tokens[0]} ${tokens[1]}`;

Put the wildcard after the actual operation

For commands whose operation appears after a dispatcher or global option, this two-token heuristic creates a much broader grant than the approved command: npm run test becomes npm run:*, while git -C repo status becomes git:*. Claude documents that npm run * matches every npm script and that git * permits every git subcommand, so later deploy, publish, push, or other mutating commands can run without another prompt. Parse through dispatcher verbs and global options, or fall back to a narrower exact rule, before appending the wildcard. Claude Code wildcard-rule documentation

---

solenta/electron/permissionCommand.js

Lines 122 to 124 in 266ff9f

	const withoutEnv = trimmed.replace(
	/^(?:[A-Za-z_][A-Za-z0-9_]*=\S*\s+)+/,
	"",

Preserve environment assignments Claude does not strip

For a command such as FOO=bar npm test, this removes the assignment and stores npm test:*, but Claude only strips a fixed set of known-safe environment variables when matching allow rules; an arbitrary variable prevents that rule from matching. Consequently, clicking “Always allow” for such a command still produces another prompt on the identical next invocation. Only remove variables from Claude's safe allowlist, or retain unknown assignments in the derived rule. Claude Code wrapper and environment matching documentation

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".