Summary

Hand-curated table maps git -> 2, npm run -> 3, aws -> 3, etc. so allow-rules can be command-prefix form instead of regex. Pure lookup.

Acceptance criteria

• New bash_arity module.
• Allow rules in config support command-prefix form.
• Existing exact matches still work.
• 30+ common commands covered.

Files

crates/execpolicy/src/bash_arity.rs (new); crates/tui/src/command_safety.rs

Size

S

Source

Source tag: OPENCODE. Add exact upstream/opencode source links during implementation if they are not already known. Do not copy external code blindly; port the behavior into this repo's architecture.

Filed from 2026-05-02 v0.8.8 intake.