Improve granularity of approve `eca_shell_command` tool

[afucher]

Using the new "approve and remember" with the eca_shell_command tool does not work as I expect, since it just allows every call to this tool independent which command it is executing.
So, I allow it to run a git checkout -b <new_branch> and now it can do anything in my shell 😅

Cursor for example, the allow list is per command not tool in this case:

Claude also has this feature:

To upvote this issue, give it a thumbs up. See this list for the most upvoted issues.

[ericdallo]

The approve is by tool-call-name here, let me check if it's working as expected

[afucher]

Yeah, but in this case the tool is always eca_shell_command, no matter which command it is running

[ericdallo]

Ah you are right, we are saving by tool name, not sure there is much to do here unless we make ifs specifically for that tool

[ericdallo]

@zikajk any thoughts?

[zikajk]

Yes, I agree. I wanted to open this ticket myself :-).
I am just not sure what is the best granularity.

[ericdallo]

each tool call may have different args, so we will need to have an optional extensibility for them, but I agree it makes sense
We will need to think how to adapt this to the protocol too, if we intend to change UX

[afucher]

updated the description with Claude example of the same feature

[ericdallo]

@afucher does claude saves per shell command + args so? if the command is echo > foo | awk | ... it will save only for that specific command or any echo commands?

[Ramblurr]

FWIW claude code makes heavy use of calling lightweight models like haiku to perform basic security checks. You can read about this here: https://jannesklaas.github.io/ai/2025/07/20/claude-code-agent-design.html

[bombaywalla]

There is a similar, but less problematic, issue with other tool calls as well.
For example, eca_*_file. If I allow, say, eca_write_file README.md, I have now allowed eca_write_file for all files.
I'm bringing this up so that we can come up with a general solution that could apply to all tools.