NurCLI v0.43.4

NurCLI v0.43.4 - "always" means what it names

In manual mode, answering a (always) to a bash approval used to approve every shell command for the rest of the session. A grant now names the programs the command runs:

• git status -> always approves git (any arguments, /usr/bin/git, GIT_PAGER=cat git ...), never rm.
• git push && npm test -> approves git and npm; a later chain is covered only when every program in it is.
• A command that hides what it runs - $(...), backticks, a redirect into a file, or a wrapper such as sudo, bash -c, env, xargs, powershell - is approved as that exact command only.

The approval modal's footer and the headless nur run prompt say what a will cover (a always: git, npm, or this exact command). Other tools are still granted by name, and Enclave by the Enclave tool.