From 70c4ead6f173f65f76e8975b527c71d748b8dd26 Mon Sep 17 00:00:00 2001
From: wsp <mr.wanger2018@outlook.com>
Date: Sat, 25 Jul 2026 10:19:39 +0800
Subject: [PATCH] fix(permission): honor full access for Bash commands

- Recognize the full-access wildcard allow in Bash permission matching
- Preserve exact matching for custom Bash allow rules
- Add coverage for the full-access Bash baseline
---
 .../agentic/tools/pipeline/tool_pipeline.rs   | 29 +++++++++++++++----
 1 file changed, 24 insertions(+), 5 deletions(-)

diff --git a/src/crates/assembly/core/src/agentic/tools/pipeline/tool_pipeline.rs b/src/crates/assembly/core/src/agentic/tools/pipeline/tool_pipeline.rs
index 36eb18dda..b5d65fe69 100644
--- a/src/crates/assembly/core/src/agentic/tools/pipeline/tool_pipeline.rs
+++ b/src/crates/assembly/core/src/agentic/tools/pipeline/tool_pipeline.rs
@@ -566,7 +566,10 @@ fn permission_intent_effect(
                         &rule.action,
                         PermissionResourceCaseSensitivity::Sensitive,
                     ) && match rule.effect {
-                        PermissionEffect::Allow => rule.resource == *resource,
+                        PermissionEffect::Allow => {
+                            rule.resource == *resource
+                                || (rule.action == "*" && rule.resource == "*")
+                        }
                         PermissionEffect::Ask | PermissionEffect::Deny => {
                             wildcard_matches(resource, &rule.resource, case_sensitivity)
                         }
@@ -2189,10 +2192,10 @@ mod tests {
     };
     use bitfun_runtime_ports::{
         ClockPort, PermissionAuditEvent, PermissionAuditRecord, PermissionAuditStorePort,
-        PermissionGrant, PermissionGrantKey, PermissionGrantStorePort, PermissionReplyStorePort,
-        PortResult, RoundInjection, RoundInjectionExecutionPolicy, RoundInjectionKind,
-        RoundInjectionTarget, RoundInjectionToolPreemption, RuntimeServiceCapability,
-        RuntimeServicePort,
+        PermissionGrant, PermissionGrantKey, PermissionGrantStorePort, PermissionPolicyPreset,
+        PermissionReplyStorePort, PortResult, RoundInjection, RoundInjectionExecutionPolicy,
+        RoundInjectionKind, RoundInjectionTarget, RoundInjectionToolPreemption,
+        RuntimeServiceCapability, RuntimeServicePort,
     };
     use serde_json::json;
     use std::collections::HashMap;
@@ -2296,6 +2299,22 @@ mod tests {
         );
     }
 
+    #[test]
+    fn full_access_baseline_allows_bash_commands() {
+        let intent = PermissionIntent::new("bash", vec!["git status && rm -rf build".to_string()]);
+        let full_access_rules = PermissionPolicyPreset::FullAccess.baseline_rules();
+
+        assert_eq!(
+            permission_intent_effect(
+                &intent,
+                &full_access_rules,
+                &[],
+                PermissionResourceCaseSensitivity::Sensitive,
+            ),
+            PermissionEffect::Allow
+        );
+    }
+
     #[test]
     fn account_scoped_fresh_approval_works_without_a_workspace_and_ignores_allow_rules() {
         let mut intent = PermissionIntent::new(