Repository navigation
[FEATURE]: Extract inner commands from xargs/parallel/find -exec for permission matching #9516
Description
Problem
When a command is wrapped in xargs, find -exec, parallel, watch, or similar command wrappers, the permission system only sees the wrapper command, not the inner command being executed.
For example, with this permission config:
"bash": {
"*": "allow",
"gh api* -X DELETE*": "ask"
}This command bypasses the permission check entirely:
gh api repos/owner/repo/code-scanning/analyses --paginate -q '.[] | .id' | xargs -I{} gh api -X DELETE repos/owner/repo/code-scanning/analyses/{}The bash tool parses this as two commands via tree-sitter:
gh api repos/... --paginate -q '...'- matches*: allowxargs -I{} gh api -X DELETE ...- starts withxargs, notgh api, so matches*: allow
The dangerous gh api -X DELETE is never checked because it appears as arguments to xargs, not as a standalone command.
Proposed Solution
The bash tool could recognize common command wrappers and extract their inner commands for permission checking:
xargs [-I...] <command>- extract command after flagsfind ... -exec <command> \;or-exec <command> +- extract command between -exec and terminatorparallel <command>- extract commandwatch [-n...] <command>- extract command after flagsenv [VAR=val...] <command>- extract command after env vars
When a wrapper is detected, both the wrapper invocation AND the inner command should be checked against permission rules.
Workaround
Users can currently work around this by adding a leading * to patterns:
"*gh api* -X DELETE*": "ask"This matches the pattern anywhere in the command string, but it's non-obvious and easy to miss.
Activity
github-actions commentedon Jan 19, 2026
This issue might be a duplicate of existing issues. Please check:
ais not accepted as always accept permission #9390: [BUG]ais not accepted as always accept permission - Related to permission system bugsFeel free to ignore if none of these address your specific case.
HeySora commentedon Feb 6, 2026
I will also add that
awkcan do system calls too, through something likeawk '{system("<command>")}'aspiers commentedon Feb 16, 2026
And
perl/python/ruby/node... in fact pretty much any language interpreter will allow that! If your default policy is allow then all bets are off and you will need some other form of protection e.g. kernel-level sandboxing.Chetic commentedon Mar 9, 2026
This also affects simple execution wrappers like
timeout,time,nice,nohup,ionice, andstdbuf. These don't change what runs, only how — but the permission system treats them as the command:These wrappers have simpler argument patterns than
xargs/find -exec, so they'd be a good starting point for implementation.feat(permission): extract inner commands from wrapper commands for pe…
Chetic commentedon Mar 9, 2026
I've opened a PR implementing this: #16724
It adds a
BashWrappermodule that extracts inner commands from wrapper commands (timeout,sudo,xargs,nohup,nice,env,find -exec, etc.) so both the wrapper and inner command get checked against permission rules. This prevents bypasses likesudo rm -rf /evading"rm *": "deny".github-actions commentedon May 9, 2026
To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.