fix(core): canonicalize wrapper approvals and support heredoc prefix …

[viyatb-oai]

Summary

• Reduced repeated approvals for equivalent wrapper commands and fixed execpolicy matching for heredoc-style shell invocations, with minimal behavior change and fail-closed defaults.

Fixes

1. Canonicalized approval matching for wrappers so equivalent commands map to the same approval intent.
2. Added heredoc-aware prefix extraction for execpolicy so commands like python3 <<'PY' ... PY match rules such as prefix_rule(["python3"], ...).
3. Kept fallback behavior conservative: if parsing is ambiguous, existing prompt behavior is preserved.

Edge Cases Covered

• Wrapper path/name differences: /bin/bash vs bash, /bin/zsh vs zsh.
• Shell modes: -c and -lc.
• Heredoc forms: quoted delimiter (<<'PY') and unquoted delimiter (<< PY).
• Multi-command heredoc scripts are rejected by the fallback
• Non-heredoc redirections (>, etc.) are not treated as heredoc prefix matches.
• Complex scripts still fall back to prior behavior rather than expanding permissions.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3964f175be

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Ensure non-heredoc << scripts don’t bypass approvals

This parser accepts any word nodes verbatim, and parse_shell_lc_single_command_prefix is gated only by script.contains("<<"). That combination means scripts that merely contain << (e.g., arithmetic shift echo $((1<<2)) or a here‑string with command substitution like python3 <<< "$(rm -rf /)") can be reduced to a simple argv prefix and matched by prefix_rule, skipping approvals that previously triggered when word‑only parsing failed. This is a regression in safety: << in non‑heredoc contexts can now be used to bypass the intended “complex script” fallback. Consider verifying that the AST actually contains a heredoc redirect, and/or rejecting words that include expansions before returning a prefix.

Useful? React with 👍 / 👎.