fix(core): preserve environment prefixes in Bash permission rules

packages/core/src/permissions/dangerousRules.ts

@@ -13,6 +13,7 @@
  */
 
 import { ToolNames } from '../tools/tool-names.js';
+import { stripLeadingVariableAssignments } from './rule-parser.js';
 import type { PermissionRule } from './types.js';
 
 /**
@@ -171,7 +172,9 @@ export function isDangerousBashRule(rule: PermissionRule): boolean {
 
   if (!rule.specifier || rule.specifier === '*') return true;
 
-  const content = rule.specifier.trim().toLowerCase();
+  const content = stripLeadingVariableAssignments(rule.specifier)
+    .trim()
+    .toLowerCase();
   if (content === '' || content === '*') return true;
 
   // Treat whitespace as the first-token delimiter; matcher-colon form is

packages/core/src/permissions/permission-manager.test.ts

@@ -341,13 +341,13 @@ describe('matchesCommandPattern', () => {
       expect(matchesCommandPattern('npm run *', 'npm run build')).toBe(true);
     });
 
-    it('matches commands with leading env var assignments', async () => {
+    it('does not let env assignments inherit a glob Bash rule', async () => {
       expect(
         matchesCommandPattern(
           'python3 *',
           'PYTHONPATH=/tmp/lib python3 -c "print(1)"',
         ),
-      ).toBe(true);
+      ).toBe(false);
     });
 
     it('matches commands containing embedded newlines (dotAll)', async () => {

packages/core/src/permissions/permission-manager.ts

@@ -10,6 +10,7 @@ import {
   matchesRule,
   resolveToolName,
   splitCompoundCommand,
+  stripLeadingVariableAssignments,
   SHELL_TOOL_NAMES,
   toolMatchesRuleToolName,
 } from './rule-parser.js';
@@ -68,6 +69,78 @@ const DECISION_PRIORITY: Readonly<Record<PermissionDecision, number>> = {
   allow: 0,
 };
 
+/**
+ * Restrictive shell rules retain the legacy no-env identity as an additional
+ * match shape. Both the command and an env-prefixed rule specifier are stripped
+ * together so tightening allow-rule identity can never make deny/ask fail open.
+ * Assignment-only restrictive rules deliberately have no stripped fallback:
+ * stripping them to an empty specifier would broaden them to the whole tool.
+ */
+function matchesRestrictiveRule(
+  rule: PermissionRule,
+  ctx: PermissionCheckContext,
+  pathCtx: PathMatchContext | undefined,
+): boolean {
+  const {
+    toolName,
+    toolAliases,
+    command,
+    filePath,
+    domain,
+    specifier,
+    toolParams,
+  } = ctx;
+
+  const match = (
+    candidateRule: PermissionRule,
+    candidateCommand: string | undefined,
+  ): boolean =>
+    matchesRule(
+      candidateRule,
+      toolName,
+      candidateCommand,
+      filePath,
+      domain,
+      pathCtx,
+      specifier,
+      toolParams,
+      toolAliases,
+      'canonical',
+    );
+
+  if (match(rule, command)) {
+    return true;
+  }
+
+  if (
+    command === undefined ||
+    !SHELL_TOOL_NAMES.has(resolveToolName(toolName))
+  ) {
+    return false;
+  }
+
+  const strippedCommand = stripLeadingVariableAssignments(command);
+  if (!strippedCommand || strippedCommand === command) {
+    return false;
+  }
+
+  let fallbackRule = rule;
+  if (
+    rule.specifier !== undefined &&
+    (rule.specifierKind === 'command' || SHELL_TOOL_NAMES.has(rule.toolName))
+  ) {
+    const strippedSpecifier = stripLeadingVariableAssignments(rule.specifier);
+    if (!strippedSpecifier) {
+      return false;
+    }
+    if (strippedSpecifier !== rule.specifier) {
+      fallbackRule = { ...rule, specifier: strippedSpecifier };
+    }
+  }
+
+  return match(fallbackRule, strippedCommand);
+}
+
 /**
  * Minimal interface for the parts of Config used by PermissionManager.
  * Keeps the dependency explicit and avoids a circular import on the
@@ -415,14 +488,14 @@ export class PermissionManager {
         ...this.sessionRules.deny,
         ...this.persistentRules.deny,
       ]) {
-        if (matchesRule(rule, ...matchArgs, 'canonical')) return 'deny';
+        if (matchesRestrictiveRule(rule, ctx, pathCtx)) return 'deny';
       }
       // Priority 2: ask rules
       for (const rule of [
         ...this.sessionRules.ask,
         ...this.persistentRules.ask,
       ]) {
-        if (matchesRule(rule, ...matchArgs, 'canonical')) return 'ask';
+        if (matchesRestrictiveRule(rule, ctx, pathCtx)) return 'ask';
       }
       // Priority 3: allow rules
       for (const rule of [
@@ -894,16 +967,7 @@ export class PermissionManager {
    */
   findMatchingDenyRule(ctx: PermissionCheckContext): string | undefined {
     ctx = this.normalizePermissionContext(ctx);
-    const {
-      toolName,
-      toolAliases,
-      command,
-      cwd,
-      filePath,
-      domain,
-      specifier,
-      toolParams,
-    } = ctx;
+    const { cwd } = ctx;
 
     const pathCtx: PathMatchContext | undefined =
       this.config.getProjectRoot && this.config.getCwd
@@ -913,22 +977,11 @@ export class PermissionManager {
           }
         : undefined;
 
-    const matchArgs = [
-      toolName,
-      command,
-      filePath,
-      domain,
-      pathCtx,
-      specifier,
-      toolParams,
-      toolAliases,
-    ] as const;
-
     for (const rule of [
       ...this.sessionRules.deny,
       ...this.persistentRules.deny,
     ]) {
-      if (matchesRule(rule, ...matchArgs, 'canonical')) {
+      if (matchesRestrictiveRule(rule, ctx, pathCtx)) {
         return rule.raw;
       }
     }
@@ -1081,7 +1134,7 @@ export class PermissionManager {
 
     return (
       restrictiveRules.some((rule) =>
-        matchesRule(rule, ...matchArgs, 'canonical'),
+        matchesRestrictiveRule(rule, ctx, pathCtx),
       ) || allowRules.some((rule) => matchesRule(rule, ...matchArgs))
     );
   }
@@ -1097,16 +1150,7 @@ export class PermissionManager {
    */
   hasMatchingAskRule(ctx: PermissionCheckContext): boolean {
     ctx = this.normalizePermissionContext(ctx);
-    const {
-      toolName,
-      toolAliases,
-      command,
-      cwd,
-      filePath,
-      domain,
-      specifier,
-      toolParams,
-    } = ctx;
+    const { toolName, command, cwd } = ctx;
 
     const pathCtx: PathMatchContext | undefined =
       this.config.getProjectRoot && this.config.getCwd
@@ -1166,20 +1210,7 @@ export class PermissionManager {
       }
     }
 
-    const matchArgs = [
-      toolName,
-      command,
-      filePath,
-      domain,
-      pathCtx,
-      specifier,
-      toolParams,
-      toolAliases,
-    ] as const;
-
-    return askRules.some((rule) =>
-      matchesRule(rule, ...matchArgs, 'canonical'),
-    );
+    return askRules.some((rule) => matchesRestrictiveRule(rule, ctx, pathCtx));
   }
 
   private hasAskRuleForTool(toolName: string): boolean {