feat(interp): add AllowedCommandPatterns argv-prefix allowlist

[matt-dz]

Summary

Introduces a second command permit axis alongside AllowedCommands. Each AllowedCommandPatterns entry is a token list; an invocation whose argv begins with the same tokens is allowed. Patterns are matched after shell expansion, so command substitution cannot bypass enforcement — the matcher inspects the resolved argv at execve time.

The two axes are joined by union: a command runs if its name is in AllowedCommands OR its argv prefix-matches any pattern. This lets operators express "allow kubectl get but not kubectl delete" without having to allow kubectl wholesale.

Why

Built as a POC for an rshell permission-model RFC. The motivating example is the canonical substitution attack:

$ ./rshell --allowed-command-patterns "echo hello" -c '$(printf echo) goodbye'
rshell: echo: command not allowed   # exit 127

The literal command text is opaque to any static caller. Only enforcement that runs after expansion (i.e. on the node, not the backend) can defend against this; this PR adds that primitive in the OSS interpreter.

What changed

Library API

• New interp.AllowedCommandPatterns([][]string) RunnerOption with validation (non-empty patterns, non-empty tokens).
• New (*Runner).argvMatchesAllowedPattern([]string) bool — six-line linear-scan, exact-token equality, no regex.
• Existing builtins.CallContext.CommandAllowed callback signature extended from func(name string) bool to func(name string, args []string) bool. All consumers (find, help) updated; pattern matching now flows through find -exec/-execdir at both parse-time (unsubstituted argv with {} placeholders preserved) and eval-time (fully substituted argv).
• help passes single-element argv []string{name}; documented cosmetic limitation: pattern-only multi-token commands don't appear in the help listing.

Enforcement points (all four)

• runner_exec.go:call (top-level dispatch).
• runner_exec.go:runCmd (recursive builtin dispatch; reconstructs full argv from cmdName + cmdArgs before consulting matcher).
• Both CommandAllowed callback definitions in runner_exec.go (handed to builtins).

CLI

• New --allowed-command-patterns flag: comma-separates patterns, whitespace-separates tokens within a pattern. e.g. --allowed-command-patterns "kubectl get,ls,echo hello".
• Existing --allowed-commands and --allow-all-commands unchanged.

Tests

• 13 unit tests in interp/allowed_command_patterns_test.go: option validation, basic matching, length edge cases, union semantics with AllowedCommands, and the architectural test TestPatternsBlockSubstitutionEscape that proves substitution can't bypass.
• 6 YAML scenarios under tests/scenarios/shell/allowed_command_patterns/ covering the same cases through the existing TestShellScenarios harness.
• 9 find test stubs updated to the new CommandAllowed signature.

Docs + examples

• README.md Security Model table updated with the new option.
• SHELL_FEATURES.md lists AllowedCommandPatterns.
• examples/command_patterns.sh — 8 curated invocations stepping through allow/block/substitution-defeat/find -exec/union semantics.

Semantics summary

Configuration	Behaviour
AllowedCommands: ["rshell:cat"]	cat allowed for any args (existing).
AllowedCommandPatterns: [["kubectl","get"]]	kubectl get * allowed; kubectl delete * blocked.
Both above set	Either alone is sufficient — union of permits.
Neither set, no allow-all-commands	Default-deny (existing).

Test plan

• go test ./... — 45/45 packages pass, no failures.
• bash examples/command_patterns.sh — all 8 cases produce documented outcomes.
• Substitution-defeat test passes both as a Go unit test and a YAML scenario.
• find -exec flows pattern matching through both parse-time and eval-time gates.
• Reviewer should sanity-check the CommandAllowed signature change doesn't affect any consumer outside find and help (grepped, but worth a fresh pass).

Out of scope / follow-ups

• Operator-side pattern allowlist intersection in the agent (POC treats backend as authoritative for patterns).
• Surfacing partially-allowed commands in help listings when only patterns are configured.
• CLI escape syntax for pattern tokens containing literal commas or whitespace (use the library API directly until then).

🤖 Generated with Claude Code