fix(security): bind system.run approvals to exact argv text

src/infra/system-run-command.ts

@@ -16,6 +16,7 @@ export type SystemRunCommandValidation =
       ok: true;
       shellCommand: string | null;
       cmdText: string;
+      previewText: string | null;
     }
   | {
       ok: false;
@@ -30,6 +31,7 @@ export type ResolvedSystemRunCommand =
       rawCommand: string | null;
       shellCommand: string | null;
       cmdText: string;
+      previewText: string | null;
     }
   | {
       ok: false;
@@ -112,35 +114,35 @@ export function validateSystemRunCommandConsistency(params: {
   const envManipulationBeforeShellWrapper =
     shellWrapperResolution.isWrapper && hasEnvManipulationBeforeShellWrapper(params.argv);
   const mustBindDisplayToFullArgv = envManipulationBeforeShellWrapper || shellWrapperPositionalArgv;
-  const inferred =
-    shellCommand !== null && !mustBindDisplayToFullArgv
-      ? shellCommand.trim()
-      : formatExecCommand(params.argv);
+  const formattedArgv = formatExecCommand(params.argv);
+  const legacyShellText =
+    shellCommand !== null && !mustBindDisplayToFullArgv ? shellCommand.trim() : null;
+  const previewText = legacyShellText;
+  const cmdText = raw ?? legacyShellText ?? formattedArgv;
 
-  if (raw && raw !== inferred) {
-    return {
-      ok: false,
-      message: "INVALID_REQUEST: rawCommand does not match command",
-      details: {
-        code: "RAW_COMMAND_MISMATCH",
-        rawCommand: raw,
-        inferred,
-      },
-    };
+  if (raw) {
+    const matchesCanonicalArgv = raw === formattedArgv;
+    const matchesLegacyShellText = legacyShellText !== null && raw === legacyShellText;
+    if (!matchesCanonicalArgv && !matchesLegacyShellText) {
+      return {
+        ok: false,
+        message: "INVALID_REQUEST: rawCommand does not match command",
+        details: {
+          code: "RAW_COMMAND_MISMATCH",
+          rawCommand: raw,
+          inferred: legacyShellText ?? formattedArgv,
+          formattedArgv,
+        },
+      };
+    }
   }
 
   return {
     ok: true,
     // Only treat this as a shell command when argv is a recognized shell wrapper.
-    // For direct argv execution and shell wrappers with env prelude modifiers,
-    // rawCommand is purely display/approval text and must match the formatted argv.
-    shellCommand:
-      shellCommand !== null
-        ? envManipulationBeforeShellWrapper
-          ? shellCommand
-          : (raw ?? shellCommand)
-        : null,
-    cmdText: raw ?? inferred,
+    shellCommand: shellCommand !== null ? shellCommand : null,
+    cmdText,
+    previewText,
   };
 }
 
@@ -167,6 +169,7 @@ export function resolveSystemRunCommand(params: {
       rawCommand: null,
       shellCommand: null,
       cmdText: "",
+      previewText: null,
     };
   }
 
@@ -189,5 +192,6 @@ export function resolveSystemRunCommand(params: {
     rawCommand: raw,
     shellCommand: validation.shellCommand,
     cmdText: validation.cmdText,
+    previewText: validation.previewText,
   };
 }