fix(permissions): deny env and exec -a wrapper invocations of the remote shell utilities (Gentleman-Programming#4324)

Close the remaining resolution bypasses flagged by the Gentleman-Programming#4330 review: env(1)
execs the utility after optional flags and NAME=VALUE assignments, and exec -a
renames argv[0] before executing it, so both fell through the wildcard allow
as single parsed command nodes.

Both overlays now enumerate, per tool: the env exact/prefix forms (env X,
env X:*) and the internal-glob forms (env * X *, exec -a * X *) covering
env -i X and env NAME=VALUE X. Verified against OpenCode wildcard.ts (every
* compiles to .*) and Claude Code glob docs (internal wildcards supported;
bare forms kept separate per #26229).

The boundary fixtures flip with the policy: env/-i/assignment and exec -a
invocations are denied matcher inputs, while &&-chains and interpreter
programs remain out of scope. Glob entries are deliberately conservative:
benign commands like env LC_ALL=C sort ssh_keys.txt also match and are
denied — the safe side of a remote-execution boundary.

Author: danielgap

internal/components/permissions/inject.go

@@ -38,6 +38,15 @@ func TargetPath(homeDir string, adapter agents.Adapter) string {
 // custom /usr/local/bin, Apple Silicon /opt/homebrew/bin, NixOS
 // /run/current-system/sw/bin). Agents whose ssh lives elsewhere still hit the
 // always-on routing guidance "Remote execution boundary" section.
+// The env(1) and exec -a wrapper entries (#4330 review follow-up) close the
+// remaining resolution bypasses: env execs the utility after optional flags
+// and NAME=VALUE assignments (env ssh, env -i ssh, env FOO=1 ssh ...), and
+// exec -a renames argv[0] before executing it. "env X" keeps its own exact
+// and ":*" prefix forms because the internal-glob "env * X *" pattern needs
+// a space-delimited " X" token. The glob entries are deliberately
+// conservative: a benign command like `env LC_ALL=C sort ssh_keys.txt` also
+// matches "env * ssh *" and is denied — a false positive toward deny is the
+// safe side of a remote-execution boundary.
 var claudeCodeOverlayJSON = []byte(`{
   "permissions": {
     "defaultMode": "bypassPermissions",
@@ -76,6 +85,10 @@ var claudeCodeOverlayJSON = []byte(`{
       "Bash(\\ssh:*)",
       "Bash(command ssh:*)",
       "Bash(exec ssh:*)",
+      "Bash(env ssh)",
+      "Bash(env ssh:*)",
+      "Bash(env * ssh *)",
+      "Bash(exec -a * ssh *)",
       "Bash(scp)",
       "Bash(scp:*)",
       "Bash(/bin/scp:*)",
@@ -86,6 +99,10 @@ var claudeCodeOverlayJSON = []byte(`{
       "Bash(\\scp:*)",
       "Bash(command scp:*)",
       "Bash(exec scp:*)",
+      "Bash(env scp)",
+      "Bash(env scp:*)",
+      "Bash(env * scp *)",
+      "Bash(exec -a * scp *)",
       "Bash(sftp)",
       "Bash(sftp:*)",
       "Bash(/bin/sftp:*)",
@@ -96,6 +113,10 @@ var claudeCodeOverlayJSON = []byte(`{
       "Bash(\\sftp:*)",
       "Bash(command sftp:*)",
       "Bash(exec sftp:*)",
+      "Bash(env sftp)",
+      "Bash(env sftp:*)",
+      "Bash(env * sftp *)",
+      "Bash(exec -a * sftp *)",
       "Bash(rsync)",
       "Bash(rsync:*)",
       "Bash(/bin/rsync:*)",
@@ -105,7 +126,11 @@ var claudeCodeOverlayJSON = []byte(`{
       "Bash(/run/current-system/sw/bin/rsync:*)",
       "Bash(\\rsync:*)",
       "Bash(command rsync:*)",
-      "Bash(exec rsync:*)"
+      "Bash(exec rsync:*)",
+      "Bash(env rsync)",
+      "Bash(env rsync:*)",
+      "Bash(env * rsync *)",
+      "Bash(exec -a * rsync *)"
     ]
   }
 }
@@ -122,6 +147,17 @@ var claudeCodeOverlayJSON = []byte(`{
 // Absolute paths get one entry per canonical install prefix; the "/X *"
 // entries additionally cover backslash-escaped invocations (\ssh ...) because
 // the matcher normalizes backslashes to forward slashes before matching.
+// The env(1) and exec -a wrapper entries (#4330 review follow-up) close the
+// remaining resolution bypasses: env execs the utility after optional flags
+// and NAME=VALUE assignments (env ssh, env -i ssh, env FOO=1 ssh ...), and
+// exec -a renames argv[0] before executing it. wildcard.ts compiles every
+// "*" to ".*" (only the trailing " *" becomes an optional group), so
+// "env * X *" matches "env -i X ..." and "env NAME=VALUE X ..." while
+// "env X *" covers the flag-free form including the bare invocation. The
+// glob entries are deliberately conservative: a benign command like
+// `env LC_ALL=C sort ssh_keys.txt` also matches "env * ssh *" and is denied
+// — a false positive toward deny is the safe side of a remote-execution
+// boundary.
 var openCodeOverlayJSON = []byte(`{
   "permission": {
     "bash": {
@@ -142,6 +178,9 @@ var openCodeOverlayJSON = []byte(`{
       "/ssh *": "deny",
       "command ssh *": "deny",
       "exec ssh *": "deny",
+      "env ssh *": "deny",
+      "env * ssh *": "deny",
+      "exec -a * ssh *": "deny",
       "scp": "deny",
       "scp *": "deny",
       "/bin/scp *": "deny",
@@ -152,6 +191,9 @@ var openCodeOverlayJSON = []byte(`{
       "/scp *": "deny",
       "command scp *": "deny",
       "exec scp *": "deny",
+      "env scp *": "deny",
+      "env * scp *": "deny",
+      "exec -a * scp *": "deny",
       "sftp": "deny",
       "sftp *": "deny",
       "/bin/sftp *": "deny",
@@ -162,6 +204,9 @@ var openCodeOverlayJSON = []byte(`{
       "/sftp *": "deny",
       "command sftp *": "deny",
       "exec sftp *": "deny",
+      "env sftp *": "deny",
+      "env * sftp *": "deny",
+      "exec -a * sftp *": "deny",
       "rsync": "deny",
       "rsync *": "deny",
       "/bin/rsync *": "deny",
@@ -171,7 +216,10 @@ var openCodeOverlayJSON = []byte(`{
       "/run/current-system/sw/bin/rsync *": "deny",
       "/rsync *": "deny",
       "command rsync *": "deny",
-      "exec rsync *": "deny"
+      "exec rsync *": "deny",
+      "env rsync *": "deny",
+      "env * rsync *": "deny",
+      "exec -a * rsync *": "deny"
     },
     "read": {
       "*": "allow",

internal/components/permissions/inject_test.go

@@ -67,15 +67,21 @@ func TestRemoteMatcherBoundaryFixtures(t *testing.T) {
 	// wrapper invocations of the remote shell utilities are denied by the
 	// overlay itself. Pattern-only rules are bypassable through these forms
 	// (the command token is not the bare utility name), so the deny entries
-	// enumerate them explicitly instead of relying on guidance alone.
-	for _, input := range []string{"/usr/bin/ssh example.invalid", "/bin/scp file example.invalid:file", "\\ssh example.invalid", "command ssh example.invalid", "exec rsync -a src dst"} {
+	// enumerate them explicitly instead of relying on guidance alone. The
+	// env(1) and exec -a forms join the boundary after the #4330 review: env
+	// execs the utility as one parsed command node, so the full node text
+	// ("env -i ssh ...", "env NAME=VALUE ssh ...", "exec -a alias ssh ...")
+	// reaches the matcher and must be denied there.
+	for _, input := range []string{"/usr/bin/ssh example.invalid", "/bin/scp file example.invalid:file", "\\ssh example.invalid", "command ssh example.invalid", "exec rsync -a src dst", "env ssh example.invalid", "env -i scp file example.invalid:file", "env CUSTOM=1 sftp example.invalid", "exec -a benign rsync -a src dst"} {
 		if got := remoteAction(t, openCodeOverlayJSON, input); got != "deny" {
 			t.Errorf("bypass invocation %q not denied: %s", input, got)
 		}
 	}
 	// These remain matcher inputs, not shell programs. bash.ts extracts command
-	// nodes separately; no claim is made about parsing arbitrary shell syntax.
-	for _, input := range []string{"env ssh example.invalid", "true && ssh example.invalid", `python -c 'import subprocess'`} {
+	// nodes separately, so the "&&" chain never reaches the matcher as one
+	// string and the python program is a different command entirely; no claim
+	// is made about parsing arbitrary shell syntax.
+	for _, input := range []string{"true && ssh example.invalid", `python -c 'import subprocess'`} {
 		if got := remoteAction(t, openCodeOverlayJSON, input); got != "allow" {
 			t.Errorf("unsupported matcher input %q unexpectedly intercepted: %s", input, got)
 		}
@@ -719,6 +725,20 @@ func remoteShellEscapeForms(tool, openCodeSuffix, claudeCodeSuffix string) (open
 	return openCode, claudeCode
 }
 
+// remoteShellEnvWrapperForms returns the env(1) and exec -a wrapper deny
+// surfaces one tool needs (#4330 review follow-up): env execs the utility
+// after optional flags and NAME=VALUE assignments, and exec -a renames
+// argv[0] before executing it. "env T" keeps its own exact and prefix forms
+// because the internal-glob patterns require a space-delimited " T" token,
+// which a bare "env T" invocation does not contain. Claude Code entries use
+// the space-star glob style for internal wildcards (documented glob syntax);
+// OpenCode entries rely on wildcard.ts compiling every "*" to ".*".
+func remoteShellEnvWrapperForms(tool string) (openCode []string, claudeCode []string) {
+	openCode = []string{"env " + tool + " *", "env * " + tool + " *", "exec -a * " + tool + " *"}
+	claudeCode = []string{"Bash(env " + tool + ")", "Bash(env " + tool + ":*)", "Bash(env * " + tool + " *)", "Bash(exec -a * " + tool + " *)"}
+	return openCode, claudeCode
+}
+
 // TestInjectOpenCodeDeniesRemoteShellUtilities verifies that the remote shell
 // utilities used to reach machines outside the workspace (ssh, scp, sftp,
 // rsync) are denied in the OpenCode/Kilocode bash permission map in their
@@ -739,6 +759,8 @@ func TestInjectOpenCodeDeniesRemoteShellUtilities(t *testing.T) {
 	for _, tool := range remoteShellTools {
 		openCode, _ := remoteShellEscapeForms(tool, " *", ":*")
 		remoteDenyRules = append(remoteDenyRules, openCode...)
+		envOpenCode, _ := remoteShellEnvWrapperForms(tool)
+		remoteDenyRules = append(remoteDenyRules, envOpenCode...)
 	}
 
 	tests := []struct {
@@ -816,6 +838,8 @@ func TestInjectClaudeCodeDeniesRemoteShellUtilities(t *testing.T) {
 	for _, tool := range remoteShellTools {
 		_, claudeCode := remoteShellEscapeForms(tool, " *", ":*")
 		remoteDenyRules = append(remoteDenyRules, claudeCode...)
+		_, envClaudeCode := remoteShellEnvWrapperForms(tool)
+		remoteDenyRules = append(remoteDenyRules, envClaudeCode...)
 	}
 
 	home := t.TempDir()