From 9355e281a08fd7d173e317a2a39778df7e7fc23d Mon Sep 17 00:00:00 2001 From: Michelle Tilley Date: Tue, 21 Apr 2026 23:00:25 -0700 Subject: fix: require all subcommands covered for shell allow rules (#3440) --- crates/atuin-ai/src/permissions/check.rs | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) (limited to 'crates/atuin-ai/src/permissions/check.rs') diff --git a/crates/atuin-ai/src/permissions/check.rs b/crates/atuin-ai/src/permissions/check.rs index 6b908b93..96abc3ab 100644 --- a/crates/atuin-ai/src/permissions/check.rs +++ b/crates/atuin-ai/src/permissions/check.rs @@ -57,15 +57,12 @@ impl PermissionChecker { } } - for rule in &file.content.permissions.allow { - if request.call.matches_rule(rule) { - tracing::debug!( - "Permission 'ALLOW' by rule: {} in file: {}", - rule, - file.path.display() - ); - return Ok(PermissionResponse::Allowed); - } + if request.call.all_covered_by(&file.content.permissions.allow) { + tracing::debug!( + "Permission 'ALLOW' by rules in file: {}", + file.path.display() + ); + return Ok(PermissionResponse::Allowed); } } -- cgit v1.3.1