Cursor runner: constrained Bash(...) rules are blocked at preToolUse Shell gate #1423

Summary

When using the Cursor runner with constrained Bash permissions such as Bash(git:*) or Bash(npm:*), the session is blocked at Cursor's preToolUse hook before the command-level permission can be evaluated.

This appears inconsistent with the documented Cyrus allowedTools semantics, where patterns like Bash(git:*) are shown as the intended way to allow only Git commands.

Reproduction

Self-hosted Cyrus, Cursor runner, repository config:

{
  "allowedTools": [
    "Read",
    "Edit",
    "Write",
    "Bash(git:*)",
    "Bash(npm:*)",
    "Skill"
  ]
}

Trigger a GitHub-driven Cursor session whose first shell command is for example:

git branch --show-current && git status

Observed failure:

Cyrus blocked: no allow rule matched
(event=preToolUse, candidates=[{"kind":"Tool","value":"Shell"}])

The command never reaches the beforeShellExecution gate where the constrained Bash(git:*) rule could be evaluated.

Expected behavior

Bash(git:*) should allow the Shell tool at the generic preToolUse stage, while still restricting the concrete command at beforeShellExecution to matching Git commands only.

Conceptually:

preToolUse:
  Tool(Shell) -> allow because at least one Bash(...) rule exists

beforeShellExecution:
  git status -> allow
  npm run lint -> allow if Bash(npm:*) exists
  rm -rf ... -> deny

Current implementation detail

In packages/cursor-runner/src/permissions.ts, a bare Bash maps to:

Tool(Shell)
Shell(*)

but a constrained rule such as Bash(git:*) maps only to command-level patterns such as:

Shell(git)
Shell(git:*)

so it does not satisfy the earlier preToolUse candidate Tool(Shell).

This is reproducible with the current Cursor permission helper and matches the runtime error above.

Why this matters

Adding bare Bash is not an acceptable workaround for a least-privilege setup, because it also expands to Shell(*), effectively allowing unrestricted shell commands.

The documented configuration examples include constrained rules such as:

["Read", "Edit", "Bash(git:*)", "Task"]

so constrained Bash permissions should work with the Cursor runner without requiring unrestricted Bash.

Suggested direction

For constrained Bash(...) / Shell(...) rules, consider also emitting Tool(Shell) for the generic preToolUse gate, while keeping the command-level allow list constrained.

There may also be value in reviewing whether emitting both Shell(git) and Shell(git:*) is intentionally broad, since the helper currently allows when any candidate matches.

Happy to provide additional logs or test cases if useful.