fix: tighten shell wrapper detection

Use exact matches for known shell wrappers so command display and approval keys do not treat arbitrary shell-like paths as trusted wrappers.

Co-authored-by: Codex <noreply@openai.com>

codex-rs/shell-command/src/shell_detect.rs

@@ -1,4 +1,3 @@
-use std::path::Path;
 use std::path::PathBuf;
 
 #[derive(Debug, PartialEq, Eq, Clone, Copy)]
@@ -11,22 +10,71 @@ pub(crate) enum ShellType {
 }
 
 pub(crate) fn detect_shell_type(shell_path: &PathBuf) -> Option<ShellType> {
-    match shell_path.as_os_str().to_str() {
-        Some("zsh") => Some(ShellType::Zsh),
-        Some("sh") => Some(ShellType::Sh),
-        Some("cmd") => Some(ShellType::Cmd),
-        Some("bash") => Some(ShellType::Bash),
-        Some("pwsh") => Some(ShellType::PowerShell),
-        Some("powershell") => Some(ShellType::PowerShell),
-        _ => {
-            let shell_name = shell_path.file_stem();
-            if let Some(shell_name) = shell_name {
-                let shell_name_path = Path::new(shell_name);
-                if shell_name_path != Path::new(shell_path) {
-                    return detect_shell_type(&shell_name_path.to_path_buf());
-                }
-            }
-            None
+    let shell_text = shell_path.as_os_str().to_str()?;
+    // Keep this exact: repo-local files named like shells must not inherit
+    // shell-wrapper trust in approval or display decisions.
+    match shell_text {
+        "zsh" | "/bin/zsh" | "/usr/bin/zsh" | "/usr/local/bin/zsh" | "/opt/homebrew/bin/zsh" => {
+            Some(ShellType::Zsh)
         }
+        "sh" | "/bin/sh" | "/usr/bin/sh" => Some(ShellType::Sh),
+        "bash"
+        | "/bin/bash"
+        | "/usr/bin/bash"
+        | "/usr/local/bin/bash"
+        | "/opt/homebrew/bin/bash" => Some(ShellType::Bash),
+        "pwsh"
+        | "powershell"
+        | "pwsh.exe"
+        | "powershell.exe"
+        | "/usr/local/bin/pwsh"
+        | "/usr/bin/pwsh"
+        | "/bin/pwsh"
+        | "/opt/homebrew/bin/pwsh" => Some(ShellType::PowerShell),
+        "cmd" | "cmd.exe" => Some(ShellType::Cmd),
+        _ => match shell_text.replace('\\', "/").to_ascii_lowercase().as_str() {
+            "c:/windows/system32/cmd.exe" => Some(ShellType::Cmd),
+            "c:/windows/system32/windowspowershell/v1.0/powershell.exe"
+            | "c:/program files/powershell/7/pwsh.exe" => Some(ShellType::PowerShell),
+            _ => None,
+        },
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn detects_exact_shell_names_and_system_paths() {
+        assert_eq!(
+            detect_shell_type(&PathBuf::from("bash")),
+            Some(ShellType::Bash)
+        );
+        assert_eq!(
+            detect_shell_type(&PathBuf::from("/bin/bash")),
+            Some(ShellType::Bash)
+        );
+        assert_eq!(
+            detect_shell_type(&PathBuf::from("powershell.exe")),
+            Some(ShellType::PowerShell)
+        );
+        assert_eq!(
+            detect_shell_type(&PathBuf::from(
+                r"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
+            )),
+            Some(ShellType::PowerShell)
+        );
+    }
+
+    #[test]
+    fn rejects_shell_like_attacker_controlled_paths() {
+        assert_eq!(detect_shell_type(&PathBuf::from(".poc/bash")), None);
+        assert_eq!(detect_shell_type(&PathBuf::from("/tmp/bash")), None);
+        assert_eq!(detect_shell_type(&PathBuf::from("/tmp/bash.evil")), None);
+        assert_eq!(
+            detect_shell_type(&PathBuf::from(r"C:\tmp\powershell.exe")),
+            None
+        );
     }
 }