fix: require word boundary for Bash(cmd *) permission wildcard

[failsafesecurity]

Problem

matches_permission_pattern() matches the Bash(cmd *) wildcard with actual_cmd.startswith(prefix) and no word boundary, so a permission scoped to one command family also authorizes unrelated commands sharing the prefix:

Bash(git *) -> matches 'gitleaks --dump-secrets'   (should not)
Bash(ls *)  -> matches 'lsof -i'                     (should not)
Bash(cat *) -> matches 'catnip /etc/passwd'          (should not)

This widens the auto-approved command set beyond operator intent (CWE-863). Severity is constrained by needing such a wildcard in config plus a useful prefix-sharing binary, so this is a hardening fix.

Fix

Require an exact match or a trailing space after the prefix:

if actual_cmd == prefix or actual_cmd.startswith(prefix + ' '):
    return True

Test Plan

• Existing test suite passes (pytest tests/unit/test_tool_approval.py, Python >=3.10)
• Bash(git *) matches git and git status, but NOT gitleaks --dump
• Bash(ls *) does NOT match lsof -i

Security Note

Low/hardening, CWE-863 (Incorrect Authorization). Reported by FailSafe Researcher (authorized security review).

[failsafesecurity]

Hi maintainers 👋 — friendly follow-up on this security hardening PR. It has been open for a while with no reviewer feedback yet. Happy to address any concerns or adjust the approach. Thanks!

[failsafesecurity]

Thanks for reviewing this security fix. Just a friendly ping — this PR has been open for a while. Happy to adjust the approach if you have any concerns. No rush, just want to make sure it stays on your radar.

[sanmaxdev]

The behavior change is right, but this should add a regression test next to test_bash_command_prefix_wildcard. That would lock the allow case for git status and the reject case for gitleaks detect.