addressing codex review

pgondhi987 · pgondhi987 · commit 30de507ec38c · 2026-05-12T10:34:32.000Z
diff --git a/src/infra/exec-approvals-analysis.test.ts b/src/infra/exec-approvals-analysis.test.ts
@@ -796,6 +796,35 @@ describe("exec approvals shell analysis", () => {
       }
     });
 
+    it("rejects PowerShell inline argv payloads with trailing command tokens", () => {
+      const dir = makeTempDir();
+      const allowedPath = path.join(dir, "allowed.exe");
+      fs.writeFileSync(allowedPath, "");
+      fs.chmodSync(allowedPath, 0o755);
+      try {
+        const env = makePathEnv(dir);
+        const analysis = analyzeArgvCommand({
+          argv: ["pwsh", "-Command", "allowed.exe", ";", "unlisted.exe"],
+          cwd: dir,
+          env,
+        });
+        expect(analysis.ok).toBe(true);
+        const result = evaluateExecAllowlist({
+          analysis,
+          allowlist: [{ pattern: allowedPath }],
+          safeBins: new Set(),
+          cwd: dir,
+          env,
+          platform: "win32",
+        });
+        expect(result.allowlistSatisfied).toBe(false);
+        expect(result.segmentAllowlistEntries).toEqual([null]);
+        expect(result.segmentSatisfiedBy).toEqual([null]);
+      } finally {
+        fs.rmSync(dir, { recursive: true, force: true });
+      }
+    });
+
     it("satisfies allowlist when bare * wildcard is present", () => {
       const dir = makeTempDir();
       const binPath = path.join(dir, "mybin");
diff --git a/src/infra/exec-wrapper-resolution.test.ts b/src/infra/exec-wrapper-resolution.test.ts
@@ -483,6 +483,11 @@ describe("extractShellWrapperCommand", () => {
       expectedInline: "Get-Date",
       expectedCommand: { isWrapper: true, command: "Get-Date" },
     },
+    {
+      argv: ["pwsh", "-Command", "allowed.exe", ";", "unlisted.exe"],
+      expectedInline: "allowed.exe ; unlisted.exe",
+      expectedCommand: { isWrapper: true, command: "allowed.exe ; unlisted.exe" },
+    },
     {
       argv: ["cmd.exe", "-c", "echo", "hi"],
       expectedInline: "echo hi",
diff --git a/src/infra/shell-wrapper-resolution.ts b/src/infra/shell-wrapper-resolution.ts
@@ -217,7 +217,16 @@ function extractCmdInlineCommand(argv: string[]): string | null {
 }
 
 function extractPowerShellInlineCommand(argv: string[]): string | null {
-  return extractInlineCommandByFlags(argv, POWERSHELL_INLINE_COMMAND_FLAGS);
+  const match = resolveInlineCommandMatch(argv, POWERSHELL_INLINE_COMMAND_FLAGS);
+  if (match.command === null || match.valueTokenIndex === null) {
+    return match.command;
+  }
+  const flag = normalizeLowercaseStringOrEmpty(argv[match.valueTokenIndex - 1]);
+  if (flag === "-command" || flag === "-c" || flag === "--command") {
+    const command = argv.slice(match.valueTokenIndex).join(" ").trim();
+    return command.length > 0 ? command : null;
+  }
+  return match.command;
 }
 
 function extractInlineCommandByFlags(
diff --git a/src/infra/system-run-command.test.ts b/src/infra/system-run-command.test.ts
@@ -77,6 +77,10 @@ describe("system run command helpers", () => {
     },
     { argv: ["fish", "-c", "echo hi"], expected: "echo hi" },
     { argv: ["pwsh", "-Command", "Get-Date"], expected: "Get-Date" },
+    {
+      argv: ["pwsh", "-Command", "allowed.exe", ";", "unlisted.exe"],
+      expected: "allowed.exe ; unlisted.exe",
+    },
     { argv: ["pwsh", "-File", "script.ps1"], expected: "script.ps1" },
     { argv: ["powershell", "-f", "script.ps1"], expected: "script.ps1" },
     { argv: ["pwsh", "-ec", "ZQBjAGgAbwA="], expected: "ZQBjAGgAbwA=" },
