axconfig 3.5.1 → 3.6.0

package/dist/agents/claude-reader.js

@@ -45,11 +45,11 @@ function parseClaudeRule(rule) {
     if (parenIndex > 0 && rule.endsWith(")")) {
         const toolName = rule.slice(0, parenIndex);
         const pattern = rule.slice(parenIndex + 1, -1);
-        // Bash pattern: "Bash(git:*)" → pattern is "git:*", we want "git"
+        // Bash pattern: "Bash(git:*)" → pattern is "git:*", we want "git*"
+        // Append * to indicate prefix matching (required by axconfig's canonical format)
         if (toolName === "Bash") {
-            const bashPattern = pattern.endsWith(":*")
-                ? pattern.slice(0, -2)
-                : pattern;
+            const prefix = pattern.endsWith(":*") ? pattern.slice(0, -2) : pattern;
+            const bashPattern = prefix === "" ? "*" : `${prefix}*`;
             return { type: "bash", pattern: bashPattern };
         }
         // Path pattern: "Read(src/**)" → tool is "read", pattern is "src/**"

package/dist/agents/claude.js

@@ -40,8 +40,15 @@ function translateRule(rule) {
             return TOOL_MAP[rule.name];
         }
         case "bash": {
-            // Claude Code uses "Bash(pattern:*)" for command patterns
-            return `Bash(${rule.pattern}:*)`;
+            // User provides pattern with explicit trailing *
+            // Strip it to get the prefix for Claude format
+            const prefix = rule.pattern.slice(0, -1);
+            // bash:* (all commands) → Bash (without parentheses)
+            // bash:git* → Bash(git:*)
+            if (prefix === "" || prefix.trim() === "") {
+                return "Bash";
+            }
+            return `Bash(${prefix}:*)`;
         }
         case "path": {
             // Claude Code uses "Tool(path/**)" for path patterns

package/dist/agents/codex-reader.js

@@ -90,12 +90,14 @@ function readPermissions(configDirectory) {
         // Read is always allowed in Codex sandbox
         allowRules.push({ type: "tool", name: "read" });
         // Parse bash patterns from rules files
+        // Append * to indicate prefix matching (required by axconfig's canonical format)
         for (const rule of rules) {
+            const pattern = rule.pattern === "" ? "*" : `${rule.pattern}*`;
             if (rule.decision === "allow") {
-                allowRules.push({ type: "bash", pattern: rule.pattern });
+                allowRules.push({ type: "bash", pattern });
             }
             else {
-                denyRules.push({ type: "bash", pattern: rule.pattern });
+                denyRules.push({ type: "bash", pattern });
             }
         }
         const permConfig = {

package/dist/agents/codex.js

@@ -146,13 +146,17 @@ function build(config, output) {
     // Generate execpolicy rules
     const rules = ["# Generated by axconfig"];
     if (permissions) {
-        // Collect bash patterns
+        // Collect bash patterns, stripping trailing * since Codex does prefix matching natively
+        // Filter out empty patterns (from bash:*) - Codex doesn't support empty prefix
+        // bash:* means "all commands" which is the default when no rules exist
         const allowBash = permissions.allow
             .filter((r) => r.type === "bash")
-            .map((r) => r.pattern);
+            .map((r) => r.pattern.slice(0, -1).trim())
+            .filter((p) => p !== "");
         const denyBash = permissions.deny
             .filter((r) => r.type === "bash")
-            .map((r) => r.pattern);
+            .map((r) => r.pattern.slice(0, -1).trim())
+            .filter((p) => p !== "");
         // Generate allow rules
         for (const pattern of allowBash) {
             rules.push(generatePrefixRule(pattern, "allow"));

package/dist/agents/gemini-reader.js

@@ -73,12 +73,14 @@ function readPermissions(configDirectory) {
                 ? rule.toolName
                 : [rule.toolName];
             // Check for bash command patterns
+            // Append * to indicate prefix matching (required by axconfig's canonical format)
             if (rule.commandPrefix) {
                 const prefixes = Array.isArray(rule.commandPrefix)
                     ? rule.commandPrefix
                     : [rule.commandPrefix];
                 for (const prefix of prefixes) {
-                    targetList.push({ type: "bash", pattern: prefix });
+                    const pattern = prefix === "" ? "*" : `${prefix}*`;
+                    targetList.push({ type: "bash", pattern });
                 }
                 continue;
             }

package/dist/agents/gemini.js

@@ -112,23 +112,38 @@ function build(config, output) {
         const denyTools = permissions.deny
             .filter((r) => r.type === "tool")
             .map((r) => TOOL_MAP[r.name]);
-        // Collect bash patterns
-        const allowBash = permissions.allow
-            .filter((r) => r.type === "bash")
-            .map((r) => r.pattern);
-        const denyBash = permissions.deny
-            .filter((r) => r.type === "bash")
-            .map((r) => r.pattern);
+        // Collect bash patterns, stripping trailing * since Gemini does prefix matching natively
+        // bash:* (empty prefix after strip) → allow run_shell_command tool entirely
+        // bash:git* → commandPrefix = "git"
+        const allowBashPatterns = permissions.allow.filter((r) => r.type === "bash");
+        const denyBashPatterns = permissions.deny.filter((r) => r.type === "bash");
+        // Separate bash:* (all commands) from specific patterns
+        const allowAllBash = allowBashPatterns.some((r) => r.pattern.slice(0, -1).trim() === "");
+        const denyAllBash = denyBashPatterns.some((r) => r.pattern.slice(0, -1).trim() === "");
+        const allowBash = allowBashPatterns
+            .map((r) => r.pattern.slice(0, -1).trim())
+            .filter((p) => p !== "");
+        const denyBash = denyBashPatterns
+            .map((r) => r.pattern.slice(0, -1).trim())
+            .filter((p) => p !== "");
         // Generate allow rules (high priority)
-        if (allowTools.length > 0) {
-            rules.push(generateToolRule(allowTools, "allow", 999));
+        // Include run_shell_command if bash:* is in allow list
+        const effectiveAllowTools = allowAllBash
+            ? [...allowTools, TOOL_MAP.bash]
+            : allowTools;
+        if (effectiveAllowTools.length > 0) {
+            rules.push(generateToolRule(effectiveAllowTools, "allow", 999));
         }
         if (allowBash.length > 0) {
             rules.push(generateBashRule(allowBash, "allow", 998));
         }
         // Generate deny rules (medium priority)
-        if (denyTools.length > 0) {
-            rules.push(generateToolRule(denyTools, "deny", 500));
+        // Include run_shell_command if bash:* is in deny list
+        const effectiveDenyTools = denyAllBash
+            ? [...denyTools, TOOL_MAP.bash]
+            : denyTools;
+        if (effectiveDenyTools.length > 0) {
+            rules.push(generateToolRule(effectiveDenyTools, "deny", 500));
         }
         if (denyBash.length > 0) {
             rules.push(generateBashRule(denyBash, "deny", 499));

package/dist/parse-permissions.d.ts

@@ -3,10 +3,13 @@
  *
  * Parses --allow and --deny CLI arguments into PermissionConfig.
  *
+ * Bash patterns require an explicit trailing wildcard (*) to indicate
+ * prefix matching. Patterns without wildcards will throw an error.
+ *
  * @example
  * parsePermissions(
  *   ["read,glob,bash:git *"],
- *   ["bash:rm *"]
+ *   ["bash:rm*"]
  * )
  * // Returns:
  * // {
@@ -16,7 +19,7 @@
  * //     { type: "bash", pattern: "git *" }
  * //   ],
  * //   deny: [
- * //     { type: "bash", pattern: "rm *" }
+ * //     { type: "bash", pattern: "rm*" }
  * //   ]
  * // }
  */

package/dist/parse-permissions.js

@@ -3,10 +3,13 @@
  *
  * Parses --allow and --deny CLI arguments into PermissionConfig.
  *
+ * Bash patterns require an explicit trailing wildcard (*) to indicate
+ * prefix matching. Patterns without wildcards will throw an error.
+ *
  * @example
  * parsePermissions(
  *   ["read,glob,bash:git *"],
- *   ["bash:rm *"]
+ *   ["bash:rm*"]
  * )
  * // Returns:
  * // {
@@ -16,7 +19,7 @@
  * //     { type: "bash", pattern: "git *" }
  * //   ],
  * //   deny: [
- * //     { type: "bash", pattern: "rm *" }
+ * //     { type: "bash", pattern: "rm*" }
  * //   ]
  * // }
  */
@@ -51,6 +54,11 @@ function parseRule(rule) {
         if (pattern === "") {
             throw new Error('Invalid bash pattern: "bash:" requires a command pattern');
         }
+        if (!pattern.endsWith("*")) {
+            throw new Error(`Bash pattern "${pattern}" requires a trailing wildcard.\n` +
+                `Use "bash:${pattern}*" to match commands starting with "${pattern}".\n` +
+                `All bash patterns are prefix matches.`);
+        }
         return { type: "bash", pattern };
     }
     // Check for path restriction: "read:src/**"

package/package.json

@@ -2,7 +2,7 @@
   "name": "axconfig",
   "author": "Łukasz Jerciński",
   "license": "MIT",
-  "version": "3.5.1",
+  "version": "3.6.0",
   "description": "Unified configuration management for AI coding agents - common API for permissions, settings, and config across Claude Code, Codex, Gemini CLI, and OpenCode",
   "repository": {
     "type": "git",