[Repo Assist] fix(security): block dangerous stem+wildcard allow patterns in execApprovals.set

[github-actions]

🤖 This PR was created by Repo Assist, an automated AI assistant.

Summary

ValidateExecApprovalRules checked for dangerous command fragments ending in trailing space (e.g. "rm ", "del ", "net ") but missed the case where the wildcard character replaces the space. A pattern like "rm*" passes the "rm " contains-check yet generates the regex ^rm.*$, which matches rm -rf /, effectively bypassing the intended block.

Root Cause

// Before — only checked for trailing-space form
if (normalizedPattern.Contains(dangerous))   // "rm*" does NOT contain "rm "
    return Error("Dangerous allow rule...");

A remote AI agent could call system.execApprovals.set with {"pattern":"rm*","action":"allow"}, pass validation, and then run rm -rf / without further approval prompts.

Fix

For each dangerous fragment that ends with whitespace, the fix also rejects patterns containing the trimmed stem immediately followed by * or ?:

// After — also catches stem+wildcard forms
var stem = dangerous.TrimEnd();
if (stem.Length < dangerous.Length)   // only for trailing-space fragments
{
    if (normalizedPattern.Contains(stem + "*") ||
        normalizedPattern.Contains(stem + "?"))
        return Error("Dangerous allow rule...");
}

Relationship to PR #247

PR #247 blocks all-wildcard patterns ("*", "**", "??"). This PR is complementary — it closes the gap for dangerous-stem + wildcard patterns. Both should be merged together.

Trade-offs

• Slightly broader rejection: a pattern like "netcat*" is now rejected because it contains "net*" (stem of "net "). This is intentionally conservative — the security policy validation is the right place to err on the side of caution, and netcat can always be added as an explicit allow pattern by a human administrator.
• No change to programmatic SetRules() or on-disk policy loading — only the remote system.execApprovals.set command path is affected.

Test Status

✅ New 7-case [Theory] test: ExecApprovalsSet_RejectsDangerousStemPlusWildcardAllowRule
Patterns covered: rm*, rm?, del*, del?, remove-item*, shutdown*, net*

✅ Full OpenClaw.Shared.Tests — all pass
✅ Full OpenClaw.Tray.Tests — all pass

Generated by 🌈 Repo Assist, see workflow run. Learn more.

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@97143ac59cb3a13ef2a77581f929f06719c7402a