Harden execpolicy deny matching against & chains and shell wrappers

[Copilot]

Execpolicy deny rules could be bypassed when a denied command appeared after a single &, or when the command was wrapped in shell syntax the segmenter/token matcher did not normalize. In AskForApproval::Never / UnlessTrusted modes, that weakened the last enforcement gate for destructive commands.

• Deny matching now sees single-& chains

  • command_segments() now splits on single & in addition to &&, ||, |, and ;.
  • This prevents a benign leading command from shielding a denied suffix in background/foreground chains.

• Deny matching now normalizes simple shell wrappers

  • denied_prefix_matches() now sanitizes tokens before comparison so the anchored positional match still lands on the underlying command.
  • Covered wrappers:
    • (cmd ...)
    • { cmd ...; }
    • $(cmd ...)

• Regression coverage for the reported bypasses

  • Added a focused test that exercises the deny path for:
    • ls & rm -rf /
    • (rm -rf /)
    • { rm -rf /; }
    • $(rm -rf /)

Example:

let engine = ExecPolicyEngine::new(vec![], vec!["rm -rf /".to_string()]);

for command in [
    "ls & rm -rf /",
    "(rm -rf /)",
    "{ rm -rf /; }",
    "$(rm -rf /)",
] {
    let decision = engine.check(ctx(command, AskForApproval::Never)).unwrap();
    assert!(!decision.allow);
}

• Fixes v0.9.4: execpolicy deny rules evadable via single-& chains and subshell wrapping #5161

[Copilot]

Pull request overview

Hardens ExecPolicyEngine deny-prefix enforcement to prevent bypasses via shell chaining and simple wrapper syntax, closing a gap that could allow destructive commands through in AskForApproval::Never / UnlessTrusted modes.

Changes:

• Split deny matching across additional chain separators by treating single & as a segment boundary.
• Normalize simple shell wrapper tokens in denied_prefix_matches() so anchored positional matching still lands on the underlying command.
• Add regression tests covering the reported bypass cases (& chains and wrapper forms).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.