mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-08-03 14:15:28 +08:00
GNU tools accept unique long-option prefix abbreviations at runtime, so `chown --recurs root` and `git push --forc` evaded the approval gate's exact-match `--recursive`/`--force` patterns. Switch those two entries to prefix matches (--recur[a-z]*, --forc[a-z]*). The rm/chmod/sed long-flag patterns were left unchanged: every abbreviation of those is already caught by the sibling short-flag and target patterns (rm -[^s]*r, base chmod 777, sed -[^s]*i), so prefix-matching them is a no-op. Only chown (beyond the coincidental case-insensitive r->R catch) and git push had genuine gaps. Co-authored-by: Subway2023 <subw3@mail2.sysu.edu.cn>