fix: require all subcommands covered for shell allow rules (#3440)

1 files changed, 6 insertions, 9 deletions

diff --git a/crates/atuin-ai/src/permissions/check.rs b/crates/atuin-ai/src/permissions/check.rs
index 6b908b93..96abc3ab 100644
--- a/crates/atuin-ai/src/permissions/check.rs
+++ b/crates/atuin-ai/src/permissions/check.rs
@@ -57,15 +57,12 @@ impl PermissionChecker {
                 }
             }
 
-            for rule in &file.content.permissions.allow {
-                if request.call.matches_rule(rule) {
-                    tracing::debug!(
-                        "Permission 'ALLOW' by rule: {} in file: {}",
-                        rule,
-                        file.path.display()
-                    );
-                    return Ok(PermissionResponse::Allowed);
-                }
+            if request.call.all_covered_by(&file.content.permissions.allow) {
+                tracing::debug!(
+                    "Permission 'ALLOW' by rules in file: {}",
+                    file.path.display()
+                );
+                return Ok(PermissionResponse::Allowed);
             }
         }