axconfig 3.5.2 → 3.6.0

package/dist/agents/claude-reader.js

@@ -45,11 +45,11 @@ function parseClaudeRule(rule) {
     if (parenIndex > 0 && rule.endsWith(")")) {
         const toolName = rule.slice(0, parenIndex);
         const pattern = rule.slice(parenIndex + 1, -1);
-        // Bash pattern: "Bash(git:*)" → pattern is "git:*", we want "git"
+        // Bash pattern: "Bash(git:*)" → pattern is "git:*", we want "git*"
+        // Append * to indicate prefix matching (required by axconfig's canonical format)
         if (toolName === "Bash") {
-            const bashPattern = pattern.endsWith(":*")
-                ? pattern.slice(0, -2)
-                : pattern;
+            const prefix = pattern.endsWith(":*") ? pattern.slice(0, -2) : pattern;
+            const bashPattern = prefix === "" ? "*" : `${prefix}*`;
             return { type: "bash", pattern: bashPattern };
         }
         // Path pattern: "Read(src/**)" → tool is "read", pattern is "src/**"

package/dist/agents/claude.js

@@ -40,8 +40,15 @@ function translateRule(rule) {
             return TOOL_MAP[rule.name];
         }
         case "bash": {
-            // Claude Code uses "Bash(pattern:*)" for command patterns
-            return `Bash(${rule.pattern}:*)`;
+            // User provides pattern with explicit trailing *
+            // Strip it to get the prefix for Claude format
+            const prefix = rule.pattern.slice(0, -1);
+            // bash:* (all commands) → Bash (without parentheses)
+            // bash:git* → Bash(git:*)
+            if (prefix === "" || prefix.trim() === "") {
+                return "Bash";
+            }
+            return `Bash(${prefix}:*)`;
         }
         case "path": {
             // Claude Code uses "Tool(path/**)" for path patterns

package/dist/agents/codex-reader.js

@@ -90,12 +90,14 @@ function readPermissions(configDirectory) {
         // Read is always allowed in Codex sandbox
         allowRules.push({ type: "tool", name: "read" });
         // Parse bash patterns from rules files
+        // Append * to indicate prefix matching (required by axconfig's canonical format)
         for (const rule of rules) {
+            const pattern = rule.pattern === "" ? "*" : `${rule.pattern}*`;
             if (rule.decision === "allow") {
-                allowRules.push({ type: "bash", pattern: rule.pattern });
+                allowRules.push({ type: "bash", pattern });
             }
             else {
-                denyRules.push({ type: "bash", pattern: rule.pattern });
+                denyRules.push({ type: "bash", pattern });
             }
         }
         const permConfig = {

package/dist/agents/codex.js

@@ -146,13 +146,17 @@ function build(config, output) {
     // Generate execpolicy rules
     const rules = ["# Generated by axconfig"];
     if (permissions) {
-        // Collect bash patterns
+        // Collect bash patterns, stripping trailing * since Codex does prefix matching natively
+        // Filter out empty patterns (from bash:*) - Codex doesn't support empty prefix
+        // bash:* means "all commands" which is the default when no rules exist
         const allowBash = permissions.allow
             .filter((r) => r.type === "bash")
-            .map((r) => r.pattern);
+            .map((r) => r.pattern.slice(0, -1).trim())
+            .filter((p) => p !== "");
         const denyBash = permissions.deny
             .filter((r) => r.type === "bash")
-            .map((r) => r.pattern);
+            .map((r) => r.pattern.slice(0, -1).trim())
+            .filter((p) => p !== "");
         // Generate allow rules
         for (const pattern of allowBash) {
             rules.push(generatePrefixRule(pattern, "allow"));

package/dist/agents/gemini-reader.js

@@ -73,12 +73,14 @@ function readPermissions(configDirectory) {
                 ? rule.toolName
                 : [rule.toolName];
             // Check for bash command patterns
+            // Append * to indicate prefix matching (required by axconfig's canonical format)
             if (rule.commandPrefix) {
                 const prefixes = Array.isArray(rule.commandPrefix)
                     ? rule.commandPrefix
                     : [rule.commandPrefix];
                 for (const prefix of prefixes) {
-                    targetList.push({ type: "bash", pattern: prefix });
+                    const pattern = prefix === "" ? "*" : `${prefix}*`;
+                    targetList.push({ type: "bash", pattern });
                 }
                 continue;
             }

package/dist/agents/gemini.js

@@ -112,23 +112,38 @@ function build(config, output) {
         const denyTools = permissions.deny
             .filter((r) => r.type === "tool")
             .map((r) => TOOL_MAP[r.name]);
-        // Collect bash patterns
-        const allowBash = permissions.allow
-            .filter((r) => r.type === "bash")
-            .map((r) => r.pattern);
-        const denyBash = permissions.deny
-            .filter((r) => r.type === "bash")
-            .map((r) => r.pattern);
+        // Collect bash patterns, stripping trailing * since Gemini does prefix matching natively
+        // bash:* (empty prefix after strip) → allow run_shell_command tool entirely
+        // bash:git* → commandPrefix = "git"
+        const allowBashPatterns = permissions.allow.filter((r) => r.type === "bash");
+        const denyBashPatterns = permissions.deny.filter((r) => r.type === "bash");
+        // Separate bash:* (all commands) from specific patterns
+        const allowAllBash = allowBashPatterns.some((r) => r.pattern.slice(0, -1).trim() === "");
+        const denyAllBash = denyBashPatterns.some((r) => r.pattern.slice(0, -1).trim() === "");
+        const allowBash = allowBashPatterns
+            .map((r) => r.pattern.slice(0, -1).trim())
+            .filter((p) => p !== "");
+        const denyBash = denyBashPatterns
+            .map((r) => r.pattern.slice(0, -1).trim())
+            .filter((p) => p !== "");
         // Generate allow rules (high priority)
-        if (allowTools.length > 0) {
-            rules.push(generateToolRule(allowTools, "allow", 999));
+        // Include run_shell_command if bash:* is in allow list
+        const effectiveAllowTools = allowAllBash
+            ? [...allowTools, TOOL_MAP.bash]
+            : allowTools;
+        if (effectiveAllowTools.length > 0) {
+            rules.push(generateToolRule(effectiveAllowTools, "allow", 999));
         }
         if (allowBash.length > 0) {
             rules.push(generateBashRule(allowBash, "allow", 998));
         }
         // Generate deny rules (medium priority)
-        if (denyTools.length > 0) {
-            rules.push(generateToolRule(denyTools, "deny", 500));
+        // Include run_shell_command if bash:* is in deny list
+        const effectiveDenyTools = denyAllBash
+            ? [...denyTools, TOOL_MAP.bash]
+            : denyTools;
+        if (effectiveDenyTools.length > 0) {
+            rules.push(generateToolRule(effectiveDenyTools, "deny", 500));
         }
         if (denyBash.length > 0) {
             rules.push(generateBashRule(denyBash, "deny", 499));

package/dist/agents/opencode-permission-builder.js

@@ -76,29 +76,6 @@ export function collectBashPatterns(rules) {
         .filter((r) => r.type === "bash")
         .map((r) => r.pattern);
 }
-/**
- * Normalize a bash pattern for OpenCode by adding a trailing wildcard if needed.
- *
- * OpenCode uses an "arity" system to extract command prefixes for permission
- * checking. For example, `gh` has arity 3, so `gh api repos/foo/bar` extracts
- * the prefix `gh api repos/foo/bar` (first 3 tokens). A pattern `gh api` won't
- * match because it's missing the third token.
- *
- * By appending `*` to patterns that don't already have wildcards, we ensure
- * patterns like `gh api` become `gh api*` which matches `gh api repos/...`.
- *
- * @example
- * normalizeBashPattern("gh api") // "gh api*"
- * normalizeBashPattern("git *")  // "git *" (already has wildcard)
- * normalizeBashPattern("cat")    // "cat*"
- */
-function normalizeBashPattern(pattern) {
-    // Don't add another * if pattern already ends with one
-    if (pattern.endsWith("*")) {
-        return pattern;
-    }
-    return `${pattern}*`;
-}
 /**
  * Build bash permission config from patterns and tool permissions.
  *
@@ -124,10 +101,10 @@ export function buildBashPermission(allowPatterns, denyPatterns, bashAllowed, ba
             "*": bashAllowed ? "allow" : "deny",
         };
         for (const pattern of allowPatterns) {
-            bashConfig[normalizeBashPattern(pattern)] = "allow";
+            bashConfig[pattern] = "allow";
         }
         for (const pattern of denyPatterns) {
-            bashConfig[normalizeBashPattern(pattern)] = "deny";
+            bashConfig[pattern] = "deny";
         }
         return bashConfig;
     }

package/dist/parse-permissions.d.ts

@@ -3,10 +3,13 @@
  *
  * Parses --allow and --deny CLI arguments into PermissionConfig.
  *
+ * Bash patterns require an explicit trailing wildcard (*) to indicate
+ * prefix matching. Patterns without wildcards will throw an error.
+ *
  * @example
  * parsePermissions(
  *   ["read,glob,bash:git *"],
- *   ["bash:rm *"]
+ *   ["bash:rm*"]
  * )
  * // Returns:
  * // {
@@ -16,7 +19,7 @@
  * //     { type: "bash", pattern: "git *" }
  * //   ],
  * //   deny: [
- * //     { type: "bash", pattern: "rm *" }
+ * //     { type: "bash", pattern: "rm*" }
  * //   ]
  * // }
  */

package/dist/parse-permissions.js

@@ -3,10 +3,13 @@
  *
  * Parses --allow and --deny CLI arguments into PermissionConfig.
  *
+ * Bash patterns require an explicit trailing wildcard (*) to indicate
+ * prefix matching. Patterns without wildcards will throw an error.
+ *
  * @example
  * parsePermissions(
  *   ["read,glob,bash:git *"],
- *   ["bash:rm *"]
+ *   ["bash:rm*"]
  * )
  * // Returns:
  * // {
@@ -16,7 +19,7 @@
  * //     { type: "bash", pattern: "git *" }
  * //   ],
  * //   deny: [
- * //     { type: "bash", pattern: "rm *" }
+ * //     { type: "bash", pattern: "rm*" }
  * //   ]
  * // }
  */
@@ -51,6 +54,11 @@ function parseRule(rule) {
         if (pattern === "") {
             throw new Error('Invalid bash pattern: "bash:" requires a command pattern');
         }
+        if (!pattern.endsWith("*")) {
+            throw new Error(`Bash pattern "${pattern}" requires a trailing wildcard.\n` +
+                `Use "bash:${pattern}*" to match commands starting with "${pattern}".\n` +
+                `All bash patterns are prefix matches.`);
+        }
         return { type: "bash", pattern };
     }
     // Check for path restriction: "read:src/**"

package/package.json

@@ -2,7 +2,7 @@
   "name": "axconfig",
   "author": "Łukasz Jerciński",
   "license": "MIT",
-  "version": "3.5.2",
+  "version": "3.6.0",
   "description": "Unified configuration management for AI coding agents - common API for permissions, settings, and config across Claude Code, Codex, Gemini CLI, and OpenCode",
   "repository": {
     "type": "git",