agentwire-dev 1.53.0__tar.gz → 1.55.0__tar.gz

{agentwire_dev-1.53.0 → agentwire_dev-1.55.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentwire-dev
-Version: 1.53.0
+Version: 1.55.0
 Summary: Multi-session voice web interface for AI coding agents
 Project-URL: Homepage, https://agentwire.dev
 Project-URL: Repository, https://github.com/dotdevdotdev/agentwire-dev

{agentwire_dev-1.53.0 → agentwire_dev-1.55.0}/agentwire/__init__.py

@@ -1,3 +1,3 @@
 """AgentWire - Multi-session voice web interface for AI coding agents."""
 
-__version__ = "1.53.0"
+__version__ = "1.55.0"

{agentwire_dev-1.53.0 → agentwire_dev-1.55.0}/agentwire/__main__.py

@@ -191,7 +191,7 @@ Command Categories:
     from . import scheduler_cli, ensure_cli
     from . import doctor_cli, history_cli, machine_cli, safety_cli
     from . import handoff_cli, hooks_cli, mcp_cli, roles_cli, tunnels_cli
-    from . import notify_cli, push_cli, repo_cli, system_cli, wiki_cli
+    from . import notify_cli, palette_cli, push_cli, repo_cli, system_cli, wiki_cli
     from .council import cli as council_cli
 
     _REGISTRARS = [  # noqa: N806  # registry constant; Phase 1 of #495 appends here
@@ -223,6 +223,7 @@ Command Categories:
         push_cli.register_push_parser,
         repo_cli.register_repo_parser,
         config_cli.register_config_parser,
+        palette_cli.register_palette_parser,
     ]
     for _reg in _REGISTRARS:
         _reg(subparsers)

{agentwire_dev-1.53.0 → agentwire_dev-1.55.0}/agentwire/config.py

@@ -431,6 +431,10 @@ class SchedulerConfig:
     session_create_timeout: int = 30
     max_loop_sleep: int = 60
     dispatch_cooldown: int = 60
+    # Watchdog ceiling for a single dispatch (seconds). A hung `ensure`
+    # (e.g. an unrecognized usage-limit dialog) otherwise holds the single
+    # dispatch slot forever and starves the whole board (#677). 0 disables.
+    dispatch_max_runtime: int = 14400
     # Crash-loop guard: a board that won't parse / has no tasks backs off
     # exponentially from `error_backoff_base` up to `error_backoff_max`
     # instead of tight-looping (#449).

{agentwire_dev-1.53.0 → agentwire_dev-1.55.0}/agentwire/config_cli.py

@@ -28,6 +28,7 @@ EXECUTION_PLANE_PREFIXES = (
     "pi.",
     "hooks.",
     "dev.",
+    "palette.",  # user palette `run` templates feed the shell (#676)
 )
 
 # Value shapes that are command-shaped regardless of section.

{agentwire_dev-1.53.0 → agentwire_dev-1.55.0}/agentwire/core.py

@@ -78,12 +78,36 @@ class AgentCommand:
 _UNATTENDED_ENV_KEYS = ("AGENTWIRE_UNATTENDED", "AGENTWIRE_UNATTENDED_ALLOW")
 
 
+def _capture_unattended_env() -> dict[str, str]:
+    """Pop the unattended marker OUT of this process's environment.
+
+    The marker must reach new sessions only via the deliberate
+    ``tmux new-session -e K=V`` path (``_with_unattended_env`` below). If it
+    stays in ``os.environ``, a ``tmux`` client we spawn while no server is
+    running boots the shared tmux server WITH the marker in its process env,
+    and from then on every session that server creates — interactive human
+    sessions included — inherits it and gets falsely treated as unattended
+    (#674). Capturing at import time preserves intended propagation while
+    guaranteeing no child process of the CLI can inherit the raw var.
+    """
+    captured: dict[str, str] = {}
+    for key in _UNATTENDED_ENV_KEYS:
+        val = os.environ.pop(key, None)
+        if val:
+            captured[key] = val
+    return captured
+
+
+_UNATTENDED_ENV = _capture_unattended_env()
+
+
 def _with_unattended_env(env: dict[str, str]) -> dict[str, str]:
     """Propagate the unattended marker into a session being created.
 
     The scheduler is the single place that decides a dispatch is unattended —
     it seeds ``AGENTWIRE_UNATTENDED[=1]`` (and any per-task
-    ``AGENTWIRE_UNATTENDED_ALLOW``) into the dispatch subprocess environment.
+    ``AGENTWIRE_UNATTENDED_ALLOW``) into the dispatch subprocess environment,
+    captured here at import (see ``_capture_unattended_env``).
     Every session-creation path funnels its env through here on the way to
     ``tmux new-session -e K=V``, so the marker lands in the new session BEFORE
     the agent launches and the damage-control hook can read it. A child session
@@ -94,7 +118,7 @@ def _with_unattended_env(env: dict[str, str]) -> dict[str, str]:
     """
     merged = dict(env)
     for key in _UNATTENDED_ENV_KEYS:
-        val = os.environ.get(key)
+        val = _UNATTENDED_ENV.get(key)
         if val and key not in merged:
             merged[key] = val
     return merged

{agentwire_dev-1.53.0 → agentwire_dev-1.55.0}/agentwire/hooks/damage-control/bash-tool-damage-control.py

@@ -121,6 +121,25 @@ READ_ONLY_BLOCKED = (
 
 NO_DELETE_BLOCKED = DELETE_PATTERNS
 
+# Interpreter programs can write a file without any shell-level write token:
+# ``python3 -c 'open(p, "w")...'``, a heredoc piped into ``python -``, or
+# ``echo 'open(p,"w")' | python3``. The program text is opaque to static
+# matching, so for PROTECTED control-plane paths we fail closed: an interpreter
+# invocation that takes inline code (-c/-e, combined forms like ``perl -pie``),
+# a heredoc/stdin program, or has data piped into it, AND mentions a protected
+# path anywhere in the command, is blocked (#678). Applied ONLY by
+# ``check_protected_command`` — never to user readOnlyPaths rules — so a
+# legitimate read via ``cat``/``grep`` stays allowed.
+_INTERPRETERS = r'(?:python[\d.]*|perl|ruby|node|deno|bun|php)'
+INTERPRETER_WRITE_PATTERNS = [
+    # interpreter ... -c/-e/... or stdin/heredoc marker, path anywhere after
+    (r'\b' + _INTERPRETERS +
+     r'\b[^\n|;&]*(?:\s-\S*[ceE]\b|\s+-\s|\s+-$|<<)(?s:.*){path}',
+     "interpreter program"),
+    # path anywhere before a pipe into an interpreter
+    (r'{path}(?s:.*)\|\s*' + _INTERPRETERS + r'\b', "pipe into interpreter"),
+]
+
 
 # ============================================================================
 # GLOB / PATH HELPERS
@@ -416,7 +435,11 @@ def check_path_patterns(
     Returns ``(matched, reason)`` where reason names the operation that triggered.
     """
     if is_glob_pattern(path):
-        path_regex = glob_to_regex(path)
+        # Allow an optional (possibly quoted) directory prefix: ``*`` in the
+        # glob can't span ``/``, so without this a basename glob like
+        # ``*.agentwire.yml`` never matched an absolute target
+        # (``> /repo/.agentwire.yml`` sailed past every write pattern) (#678).
+        path_regex = r'["\']?(?:[^\s"\';|&<>]*/)?' + glob_to_regex(path)
     else:
         expanded = os.path.expanduser(path)
         if expanded == path:
@@ -484,6 +507,9 @@ def load_write_patterns_from_tooldefs(tooldefs_dir: Optional[Path]) -> List[Dict
                     "pattern": regex,
                     "reason": f"{tool_name}: {cmd_def.get('description', cmd_str)}",
                     "ask": True,
+                    # Command-prefix rule: match command position only, never
+                    # quoted argument/message content (#675).
+                    "anchored": True,
                 }
                 # An explicit ``id:`` on the tooldef command yields a stable
                 # rule ID (e.g. ``git.push``) that survives description edits —
@@ -806,7 +832,10 @@ def check_protected_command(
     for path in _protected_path_patterns():
         for hay in haystacks:
             matched, reason = check_path_patterns(
-                hay, path, READ_ONLY_BLOCKED, "protected control-plane path"
+                hay,
+                path,
+                READ_ONLY_BLOCKED + INTERPRETER_WRITE_PATTERNS,
+                "protected control-plane path",
             )
             if matched:
                 op = _infer_operation_from_reason(reason)
@@ -918,6 +947,165 @@ def normalize_subcommands(command: str) -> Tuple[List[str], Optional[str]]:
     return subs, None
 
 
+#
+# CONTENT MASKING (#675)
+#
+# Tooldef rules are COMMAND-PREFIX rules (``\bgh\s+pr\s+comment\b``), but the
+# haystacks above include quoted argument text — so a commit message that
+# merely *mentions* "gh pr comment" false-matches the rule. Anchored rules are
+# therefore matched against MASKED subcommands instead: quoted spans that can
+# only be content (a quoted token containing whitespace — a message, an echo
+# string, a heredoc body) are replaced with a placeholder, while quoted
+# single words are kept (``"gh" pr comment`` is still a real command) and
+# ``sh -c "…"`` payloads are recursively re-scanned as commands.
+
+_MASK = "\x00"
+_HEREDOC_RE = re.compile(r"<<-?\s*(['\"]?)([A-Za-z_]\w+)\1")
+_SHELL_NAMES = {"sh", "bash", "zsh", "dash", "ksh"}
+_ASSIGN_TOKEN_RE = re.compile(r"^[A-Za-z_]\w*=")
+
+
+def _strip_heredoc_bodies(command: str) -> str:
+    """Remove heredoc body lines (``<<EOF … EOF``) — they are content."""
+    m = _HEREDOC_RE.search(command)
+    if not m:
+        return command
+    delim = m.group(2)
+    nl = command.find("\n", m.end())
+    if nl == -1:
+        return command
+    lines = command[nl + 1:].split("\n")
+    for i, line in enumerate(lines):
+        if line.strip() == delim:
+            rest = "\n".join(lines[i + 1:])
+            return command[:nl + 1] + _strip_heredoc_bodies(rest)
+    # Unterminated heredoc: everything after the marker is body.
+    return command[:nl + 1]
+
+
+def _scan_masked_tokens(command: str) -> List[List[Tuple[str, bool]]]:
+    """Split ``command`` into subcommands of ``(token_text, fully_quoted)``.
+
+    Quotes/escapes are resolved into the token text (so ``g''h`` -> ``gh``);
+    ``fully_quoted`` is True when no character of the token was unquoted.
+    """
+    subs: List[List[Tuple[str, bool]]] = []
+    cur: List[Tuple[str, bool]] = []
+    buf: List[str] = []
+    has_unquoted = False
+    has_any = False
+
+    def end_token() -> None:
+        nonlocal buf, has_unquoted, has_any
+        if has_any:
+            cur.append(("".join(buf), not has_unquoted))
+        buf, has_unquoted, has_any = [], False, False
+
+    def end_sub() -> None:
+        nonlocal cur
+        end_token()
+        if cur:
+            subs.append(cur)
+            cur = []
+
+    i, n = 0, len(command)
+    while i < n:
+        c = command[i]
+        if c == "'":
+            j = command.find("'", i + 1)
+            if j == -1:
+                j = n
+            buf.append(command[i + 1:j])
+            has_any = True
+            i = j + 1
+        elif c == '"':
+            j = i + 1
+            out: List[str] = []
+            while j < n and command[j] != '"':
+                if command[j] == "\\" and j + 1 < n and command[j + 1] in '"\\$`':
+                    out.append(command[j + 1])
+                    j += 2
+                else:
+                    out.append(command[j])
+                    j += 1
+            buf.append("".join(out))
+            has_any = True
+            i = j + 1
+        elif c == "\\" and i + 1 < n:
+            buf.append(command[i + 1])
+            has_unquoted = True
+            has_any = True
+            i += 2
+        elif c in " \t":
+            end_token()
+            i += 1
+        elif c in ";\n":
+            end_sub()
+            i += 1
+        elif c in "&|":
+            end_sub()
+            while i < n and command[i] in "&|":
+                i += 1
+        else:
+            buf.append(c)
+            has_unquoted = True
+            has_any = True
+            i += 1
+    end_sub()
+    return subs
+
+
+def masked_subcommands(command: str) -> List[str]:
+    """Return per-subcommand strings with content-only quoted spans masked.
+
+    Used for command-prefix (``anchored``) rules so quoted argument text —
+    commit messages, echo strings, heredoc bodies — cannot false-match a
+    command rule, while quoting obfuscation of the command itself still
+    normalizes to the literal form.
+    """
+    command = _strip_heredoc_bodies(command)
+
+    assigns: Dict[str, str] = {}
+    for m in _ASSIGN_RE.finditer(command):
+        assigns[m.group(1)] = m.group(2).strip("'\"")
+
+    def _resolve(tok: str) -> str:
+        for name, val in assigns.items():
+            tok = tok.replace("${%s}" % name, val).replace("$" + name, val)
+        return tok
+
+    results: List[str] = []
+    for toks in _scan_masked_tokens(command):
+        words: List[str] = []
+        prev = ""
+        for text, fully_quoted in toks:
+            resolved = _resolve(text)
+            is_content = fully_quoted and (not resolved or any(ch in " \t\n" for ch in resolved))
+            if not words and _ASSIGN_TOKEN_RE.match(resolved):
+                # Leading VAR=value assignment — its value is data here (the
+                # assigns table already handles later ``$VAR`` expansion).
+                words.append(_MASK)
+                prev = _MASK
+                continue
+            if is_content:
+                # A ``sh -c "…"`` payload is a command, not content — rescan.
+                if (
+                    words
+                    and prev.startswith("-")
+                    and "c" in prev
+                    and words[0].rsplit("/", 1)[-1] in _SHELL_NAMES
+                ):
+                    results.extend(masked_subcommands(resolved))
+                words.append(_MASK)
+                prev = _MASK
+            else:
+                words.append(resolved)
+                prev = resolved
+        if words and any(w != _MASK for w in words):
+            results.append(" ".join(words))
+    return results
+
+
 # ============================================================================
 # DECISION LADDERS
 # ============================================================================
@@ -1003,9 +1191,12 @@ def check_command(command: str, config: Dict[str, Any]) -> Dict[str, Any]:
     # ``ask`` at the end (the unattended resolver turns that into a block).
     subcommands, ambiguous = normalize_subcommands(command)
     haystacks = [command] + [s for s in subcommands if s and s != command]
+    # Anchored (command-prefix) rules match only masked subcommands, so quoted
+    # argument text — commit messages, echo strings — can't false-match (#675).
+    masked_haystacks = masked_subcommands(command)
 
-    def _search(pat: str) -> bool:
-        for hay in haystacks:
+    def _search(pat: str, hays: List[str]) -> bool:
+        for hay in hays:
             try:
                 if re.search(pat, hay, re.IGNORECASE):
                     return True
@@ -1025,8 +1216,9 @@ def check_command(command: str, config: Dict[str, Any]) -> Dict[str, Any]:
         reason = pattern_obj.get("reason", "Matched pattern")
         should_ask = pattern_obj.get("ask", False)
         bypassable = pattern_obj.get("bypassable", False)
+        anchored = pattern_obj.get("anchored", False)
         try:
-            if _search(pattern):
+            if _search(pattern, masked_haystacks if anchored else haystacks):
                 if should_ask:
                     return {
                         "decision": "ask",

{agentwire_dev-1.53.0 → agentwire_dev-1.55.0}/agentwire/hooks/damage-control/edit-tool-damage-control.py

@@ -117,6 +117,25 @@ READ_ONLY_BLOCKED = (
 
 NO_DELETE_BLOCKED = DELETE_PATTERNS
 
+# Interpreter programs can write a file without any shell-level write token:
+# ``python3 -c 'open(p, "w")...'``, a heredoc piped into ``python -``, or
+# ``echo 'open(p,"w")' | python3``. The program text is opaque to static
+# matching, so for PROTECTED control-plane paths we fail closed: an interpreter
+# invocation that takes inline code (-c/-e, combined forms like ``perl -pie``),
+# a heredoc/stdin program, or has data piped into it, AND mentions a protected
+# path anywhere in the command, is blocked (#678). Applied ONLY by
+# ``check_protected_command`` — never to user readOnlyPaths rules — so a
+# legitimate read via ``cat``/``grep`` stays allowed.
+_INTERPRETERS = r'(?:python[\d.]*|perl|ruby|node|deno|bun|php)'
+INTERPRETER_WRITE_PATTERNS = [
+    # interpreter ... -c/-e/... or stdin/heredoc marker, path anywhere after
+    (r'\b' + _INTERPRETERS +
+     r'\b[^\n|;&]*(?:\s-\S*[ceE]\b|\s+-\s|\s+-$|<<)(?s:.*){path}',
+     "interpreter program"),
+    # path anywhere before a pipe into an interpreter
+    (r'{path}(?s:.*)\|\s*' + _INTERPRETERS + r'\b', "pipe into interpreter"),
+]
+
 
 # ============================================================================
 # GLOB / PATH HELPERS
@@ -412,7 +431,11 @@ def check_path_patterns(
     Returns ``(matched, reason)`` where reason names the operation that triggered.
     """
     if is_glob_pattern(path):
-        path_regex = glob_to_regex(path)
+        # Allow an optional (possibly quoted) directory prefix: ``*`` in the
+        # glob can't span ``/``, so without this a basename glob like
+        # ``*.agentwire.yml`` never matched an absolute target
+        # (``> /repo/.agentwire.yml`` sailed past every write pattern) (#678).
+        path_regex = r'["\']?(?:[^\s"\';|&<>]*/)?' + glob_to_regex(path)
     else:
         expanded = os.path.expanduser(path)
         if expanded == path:
@@ -480,6 +503,9 @@ def load_write_patterns_from_tooldefs(tooldefs_dir: Optional[Path]) -> List[Dict
                     "pattern": regex,
                     "reason": f"{tool_name}: {cmd_def.get('description', cmd_str)}",
                     "ask": True,
+                    # Command-prefix rule: match command position only, never
+                    # quoted argument/message content (#675).
+                    "anchored": True,
                 }
                 # An explicit ``id:`` on the tooldef command yields a stable
                 # rule ID (e.g. ``git.push``) that survives description edits —
@@ -802,7 +828,10 @@ def check_protected_command(
     for path in _protected_path_patterns():
         for hay in haystacks:
             matched, reason = check_path_patterns(
-                hay, path, READ_ONLY_BLOCKED, "protected control-plane path"
+                hay,
+                path,
+                READ_ONLY_BLOCKED + INTERPRETER_WRITE_PATTERNS,
+                "protected control-plane path",
             )
             if matched:
                 op = _infer_operation_from_reason(reason)
@@ -914,6 +943,165 @@ def normalize_subcommands(command: str) -> Tuple[List[str], Optional[str]]:
     return subs, None
 
 
+#
+# CONTENT MASKING (#675)
+#
+# Tooldef rules are COMMAND-PREFIX rules (``\bgh\s+pr\s+comment\b``), but the
+# haystacks above include quoted argument text — so a commit message that
+# merely *mentions* "gh pr comment" false-matches the rule. Anchored rules are
+# therefore matched against MASKED subcommands instead: quoted spans that can
+# only be content (a quoted token containing whitespace — a message, an echo
+# string, a heredoc body) are replaced with a placeholder, while quoted
+# single words are kept (``"gh" pr comment`` is still a real command) and
+# ``sh -c "…"`` payloads are recursively re-scanned as commands.
+
+_MASK = "\x00"
+_HEREDOC_RE = re.compile(r"<<-?\s*(['\"]?)([A-Za-z_]\w+)\1")
+_SHELL_NAMES = {"sh", "bash", "zsh", "dash", "ksh"}
+_ASSIGN_TOKEN_RE = re.compile(r"^[A-Za-z_]\w*=")
+
+
+def _strip_heredoc_bodies(command: str) -> str:
+    """Remove heredoc body lines (``<<EOF … EOF``) — they are content."""
+    m = _HEREDOC_RE.search(command)
+    if not m:
+        return command
+    delim = m.group(2)
+    nl = command.find("\n", m.end())
+    if nl == -1:
+        return command
+    lines = command[nl + 1:].split("\n")
+    for i, line in enumerate(lines):
+        if line.strip() == delim:
+            rest = "\n".join(lines[i + 1:])
+            return command[:nl + 1] + _strip_heredoc_bodies(rest)
+    # Unterminated heredoc: everything after the marker is body.
+    return command[:nl + 1]
+
+
+def _scan_masked_tokens(command: str) -> List[List[Tuple[str, bool]]]:
+    """Split ``command`` into subcommands of ``(token_text, fully_quoted)``.
+
+    Quotes/escapes are resolved into the token text (so ``g''h`` -> ``gh``);
+    ``fully_quoted`` is True when no character of the token was unquoted.
+    """
+    subs: List[List[Tuple[str, bool]]] = []
+    cur: List[Tuple[str, bool]] = []
+    buf: List[str] = []
+    has_unquoted = False
+    has_any = False
+
+    def end_token() -> None:
+        nonlocal buf, has_unquoted, has_any
+        if has_any:
+            cur.append(("".join(buf), not has_unquoted))
+        buf, has_unquoted, has_any = [], False, False
+
+    def end_sub() -> None:
+        nonlocal cur
+        end_token()
+        if cur:
+            subs.append(cur)
+            cur = []
+
+    i, n = 0, len(command)
+    while i < n:
+        c = command[i]
+        if c == "'":
+            j = command.find("'", i + 1)
+            if j == -1:
+                j = n
+            buf.append(command[i + 1:j])
+            has_any = True
+            i = j + 1
+        elif c == '"':
+            j = i + 1
+            out: List[str] = []
+            while j < n and command[j] != '"':
+                if command[j] == "\\" and j + 1 < n and command[j + 1] in '"\\$`':
+                    out.append(command[j + 1])
+                    j += 2
+                else:
+                    out.append(command[j])
+                    j += 1
+            buf.append("".join(out))
+            has_any = True
+            i = j + 1
+        elif c == "\\" and i + 1 < n:
+            buf.append(command[i + 1])
+            has_unquoted = True
+            has_any = True
+            i += 2
+        elif c in " \t":
+            end_token()
+            i += 1
+        elif c in ";\n":
+            end_sub()
+            i += 1
+        elif c in "&|":
+            end_sub()
+            while i < n and command[i] in "&|":
+                i += 1
+        else:
+            buf.append(c)
+            has_unquoted = True
+            has_any = True
+            i += 1
+    end_sub()
+    return subs
+
+
+def masked_subcommands(command: str) -> List[str]:
+    """Return per-subcommand strings with content-only quoted spans masked.
+
+    Used for command-prefix (``anchored``) rules so quoted argument text —
+    commit messages, echo strings, heredoc bodies — cannot false-match a
+    command rule, while quoting obfuscation of the command itself still
+    normalizes to the literal form.
+    """
+    command = _strip_heredoc_bodies(command)
+
+    assigns: Dict[str, str] = {}
+    for m in _ASSIGN_RE.finditer(command):
+        assigns[m.group(1)] = m.group(2).strip("'\"")
+
+    def _resolve(tok: str) -> str:
+        for name, val in assigns.items():
+            tok = tok.replace("${%s}" % name, val).replace("$" + name, val)
+        return tok
+
+    results: List[str] = []
+    for toks in _scan_masked_tokens(command):
+        words: List[str] = []
+        prev = ""
+        for text, fully_quoted in toks:
+            resolved = _resolve(text)
+            is_content = fully_quoted and (not resolved or any(ch in " \t\n" for ch in resolved))
+            if not words and _ASSIGN_TOKEN_RE.match(resolved):
+                # Leading VAR=value assignment — its value is data here (the
+                # assigns table already handles later ``$VAR`` expansion).
+                words.append(_MASK)
+                prev = _MASK
+                continue
+            if is_content:
+                # A ``sh -c "…"`` payload is a command, not content — rescan.
+                if (
+                    words
+                    and prev.startswith("-")
+                    and "c" in prev
+                    and words[0].rsplit("/", 1)[-1] in _SHELL_NAMES
+                ):
+                    results.extend(masked_subcommands(resolved))
+                words.append(_MASK)
+                prev = _MASK
+            else:
+                words.append(resolved)
+                prev = resolved
+        if words and any(w != _MASK for w in words):
+            results.append(" ".join(words))
+    return results
+
+
 # ============================================================================
 # DECISION LADDERS
 # ============================================================================
@@ -999,9 +1187,12 @@ def check_command(command: str, config: Dict[str, Any]) -> Dict[str, Any]:
     # ``ask`` at the end (the unattended resolver turns that into a block).
     subcommands, ambiguous = normalize_subcommands(command)
     haystacks = [command] + [s for s in subcommands if s and s != command]
+    # Anchored (command-prefix) rules match only masked subcommands, so quoted
+    # argument text — commit messages, echo strings — can't false-match (#675).
+    masked_haystacks = masked_subcommands(command)
 
-    def _search(pat: str) -> bool:
-        for hay in haystacks:
+    def _search(pat: str, hays: List[str]) -> bool:
+        for hay in hays:
             try:
                 if re.search(pat, hay, re.IGNORECASE):
                     return True
@@ -1021,8 +1212,9 @@ def check_command(command: str, config: Dict[str, Any]) -> Dict[str, Any]:
         reason = pattern_obj.get("reason", "Matched pattern")
         should_ask = pattern_obj.get("ask", False)
         bypassable = pattern_obj.get("bypassable", False)
+        anchored = pattern_obj.get("anchored", False)
         try:
-            if _search(pattern):
+            if _search(pattern, masked_haystacks if anchored else haystacks):
                 if should_ask:
                     return {
                         "decision": "ask",