release: 2.2.0 (#24)

* fix(permissions): rank a wildcard by what was measured to ride in it

crowd.dev's settings produced 22 identical word-boundary warnings, and
exactly one of the 22 rules grants remote writes. The one that deletes
a branch read no louder than git logfoo.

Three measured mechanics now set the volume. A wildcarded gh api allow
rule is a write grant: flags ride any star, and gh switches GET to POST
the moment a parameter is added — Bash(gh api repos*) auto-approved
-X DELETE, -f description=x, and a git/refs branch deletion. A mid-rule
star spans words, so one standing before the runner's subcommand admits
an exec form: pnpm --filter web exec rm -rf ./x build was auto-approved
by Bash(pnpm --filter * build). And fusion is ranked by reach: a
one-word prefix swaps the program itself (python* covers python3),
anything longer must share the prefix and drops to info.

One fact per rule: the sharpest statement about a wildcard suppresses
the word-boundary nag on the same rule. Deliberately not curl: the same
flags ride its wildcards, but unlock writes nothing in the command is
authorised to make.

* release: 2.2.0

A minor by the project's own precedent: a repository that reported
nothing can now report a wildcarded gh api rule as a write grant, and
two thirds of the corpus's word-boundary warnings drop to info. Every
new sentence carries the measurement that grounds it. Internal ranges
move with the version, as they did the last two times.

---------

Co-authored-by: Dennis Havermans <dennis.havermans@ae.be>

Author: dennishavermans

CHANGELOG.md

@@ -9,6 +9,51 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [2.2.0] — 2026-09-03
+
+A ranking release. 2.1.1 made every finding true; this one makes the volume
+track the consequence. Running the permission audit over the Linux Foundation's
+crowd.dev produced 22 identical word-boundary warnings, and exactly one of the
+22 rules — `Bash(gh api repos*)` — grants remote writes. The one that can
+delete a branch read no louder than `git logfoo`. That is the wall of noise the
+pattern set's own comment warns about, so this release ranks the wildcard
+findings by what was measured to ride in the wildcard.
+
+### Added
+
+- **`AGF506`: a wildcarded `gh api` allow rule is reported as a write grant.**
+  A `*` matches any characters including spaces, so method and parameter flags
+  ride wherever it stands, and gh's own help documents that adding a parameter
+  switches the request from GET to POST. Measured on Claude Code 2.1.238:
+  `Bash(gh api repos*)` auto-approved `-X DELETE`, `-f description=x`, and a
+  branch deletion through `git/refs`. Deliberately scoped to `gh api`, which
+  sends the user's token on every call — the same flags ride a wildcarded curl
+  rule, but unlock writes nothing in the command is authorised to make.
+- **`AGF506`: a mid-rule wildcard that stands where the runner's subcommand
+  goes.** Measured: `pnpm --filter web exec rm -rf ./x build` is auto-approved
+  by `Bash(pnpm --filter * build)`, because a mid-rule `*` spans multiple
+  space-separated words. The check stays quiet once the subcommand is pinned
+  before the first star, so `Bash(npx rhachet run --skill x --glob '*.ts')`
+  reports nothing.
+
+### Changed
+
+- **Word-boundary findings are ranked by what the fusion can reach.** A
+  one-word prefix fuses the program name itself — `Bash(python*)` silently
+  covers `python3 -c` with anything after it — and stays a warning. After the
+  first word the fused text must still share the prefix, so `Bash(git log*)`
+  drops to info: `git logfoo` is nobody's command. Across the 344-file
+  permission corpus this moves roughly two thirds of all permission findings
+  from warning to info while 34 wildcarded `gh api` rules surface as the write
+  grants they are.
+- **One fact per rule.** A rule whose wildcard admits writes or chooses the
+  subcommand is no longer additionally nagged about its word boundary; the
+  wildcard-before-subcommand finding now carries its measured consequence
+  (`Bash(git * main)` auto-approves `git push --force origin main`).
+  Severity defaults remain documented as not stable in
+  [docs/stability.md](docs/stability.md); pin them in `agentfile.yaml` if CI
+  depends on them.
+
 ## [2.1.1] — 2026-09-01
 
 2.1.0 shipped with a claim it had only partly earned. The lesson of that

docs/diagnostics.md

@@ -471,7 +471,24 @@ not:
 
 * **`Bash(ls*)` also matches `lsof`.** A `*` with no space before it enforces no
   word boundary. `Bash(ls *)` — one space different — matches only `ls` with
-  arguments. As an allow rule this grants more than it appears to.
+  arguments. Ranked by what the fusion can reach: a one-word prefix fuses the
+  program name itself (`Bash(python*)` covers `python3` with any arguments) and
+  is a warning; after the first word the fused text must still share the prefix,
+  so `Bash(git log*)` is informational.
+* **A wildcarded `gh api` allow rule grants writes, not just reads.** A `*`
+  matches any characters including spaces, so method and parameter flags ride
+  wherever it stands — and gh switches GET to POST the moment a parameter is
+  added. Measured: `Bash(gh api repos*)` auto-approves `-X DELETE`,
+  `-f description=x`, and deleting a branch through `git/refs`.
+* **A mid-rule `*` can choose what a runner executes.** It spans multiple
+  space-separated words, so a wildcard standing before the subcommand is pinned
+  admits an exec form and everything after it. Measured:
+  `pnpm --filter web exec rm -rf ./x build` was auto-approved by
+  `Bash(pnpm --filter * build)`. Quiet once the subcommand is pinned before the
+  first star.
+
+  When one rule triggers several of these, only the sharpest is reported — a
+  rule whose wildcard admits writes is not also nagged about word boundaries.
 * **`:*` is recognised only at the end of a pattern.** In `Bash(git:* push)` the
   colon is literal and the rule matches nothing. Reported as an error: the rule
   has no effect and nothing says so at load time.

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentfile/agentfile",
-  "version": "2.1.1",
+  "version": "2.2.0",
   "description": "Find what is wrong with the AI agent configuration your repository already has",
   "type": "module",
   "bin": {
@@ -42,7 +42,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@agentfile/cli": "^2.1.1"
+    "@agentfile/cli": "^2.2.0"
   },
   "devDependencies": {
     "@types/node": "^22.19.0",

packages/agentfile/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentfile/cli",
-  "version": "2.1.1",
+  "version": "2.2.0",
   "description": "Find what is wrong with the AI agent configuration your repository already has — doctor, check, lint, audit, adopt, compile, eval",
   "type": "module",
   "main": "./dist/bin.js",
@@ -45,7 +45,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@agentfile/core": "^2.1.1",
+    "@agentfile/core": "^2.2.0",
     "chalk": "^6.0.0",
     "commander": "^14.0.3",
     "enquirer": "^2.4.1"

packages/cli/package.json

@@ -1075,6 +1075,74 @@ describe("auditPermissions", () => {
     });
   });
 
+  // ─── ranking: the sharpest statement about a wildcard wins ─────────────
+
+  describe("wildcard consequence ranking", () => {
+    // crowd.dev's settings: 22 rules with trailing stars, of which exactly one
+    // grants remote writes. Measured on Claude Code 2.1.238: under
+    // Bash(gh api repos*), `-X DELETE`, `-f description=x` (gh switches GET to
+    // POST when parameters are added), and a git/refs branch deletion were all
+    // auto-approved.
+    it("raises gh api ride-along above the word-boundary noise", () => {
+      const findings = audit([rule("allow", "Bash(gh api repos*)")]);
+      expect(findings).toHaveLength(1);
+      expect(findings[0].severity).toBe("warning");
+      expect(findings[0].data?.problem).toBe("api-method-ride-along");
+      expect(findings[0].message).toContain("writes, not just reads");
+    });
+
+    it("stays quiet on an exact gh api endpoint, which no flag can ride", () => {
+      expect(audit([rule("allow", "Bash(gh api repos/o/r/pulls/42/comments --paginate)")])).toHaveLength(0);
+    });
+
+    // prisma's shape. Measured: `pnpm --filter web exec rm -rf ./x build` was
+    // auto-approved by Bash(pnpm --filter * build) and the trailing-star form.
+    it("reports a wildcard standing where the runner's subcommand goes", () => {
+      const findings = audit([rule("allow", "Bash(pnpm --filter * test*)")]);
+      expect(findings).toHaveLength(1);
+      expect(findings[0].severity).toBe("warning");
+      expect(findings[0].data?.problem).toBe("exec-admitting-wildcard");
+    });
+
+    it("stays quiet once the subcommand is pinned before the star", () => {
+      expect(audit([rule("allow", "Bash(npx rhachet run --skill sedreplace --glob src/*.ts)")])).toHaveLength(0);
+    });
+
+    it("does not double-report fusion on a rule already carrying a sharper fact", () => {
+      const problems = audit([rule("allow", "Bash(gh api repos*)"), rule("allow", "Bash(pnpm --filter * build*)")]).map(
+        (item) => item.data?.problem,
+      );
+      expect(problems).toEqual(["api-method-ride-along", "exec-admitting-wildcard"]);
+    });
+
+    // rodekruis's rule. Measured: git push --force origin main and
+    // git push --delete origin main were both auto-approved under it.
+    it("names the measured consequence when the wildcard is the verb", () => {
+      const [found] = audit([rule("allow", "Bash(git * main)")]);
+      expect(found.data?.problem).toBe("wildcard-before-subcommand");
+      expect(found.explanation).toContain("git push --force origin main");
+    });
+
+    // The fused text must share the prefix, so `git logfoo` is nobody's
+    // command — but a one-word prefix fuses the program name itself, and
+    // `python*` covers `python3 -c` with anything after it.
+    it("ranks fusion by what it can reach", () => {
+      const single = audit([rule("allow", "Bash(python*)")]);
+      expect(single[0].severity).toBe("warning");
+      expect(single[0].data?.consequence).toBe("program-substitution");
+
+      const multi = audit([rule("allow", "Bash(git log*)")]);
+      expect(multi[0].severity).toBe("info");
+      expect(multi[0].data?.consequence).toBe("prefix-fusion");
+    });
+
+    it("leaves a trailing star on a runner to the fusion check, where it belongs", () => {
+      const [found] = audit([rule("allow", "Bash(pnpm test*)")]);
+      expect(found.data?.problem).toBe("missing-word-boundary");
+      expect(found.severity).toBe("info");
+    });
+  });
+
   // ─── fragile argument patterns ─────────────────────────────────────────
 
   describe("fragile argument patterns", () => {

packages/core/__tests__/security.test.ts

@@ -1,6 +1,6 @@
 {
   "name": "@agentfile/core",
-  "version": "2.1.1",
+  "version": "2.2.0",
   "description": "Read, analyse and compile AI agent configuration — discovery, a normalized IR, a resolver, diagnostics, and static security analysis",
   "type": "module",
   "main": "./dist/index.js",