OrchestKit · adopt all, wave 1 · CC 2.1.246 · 2026-08-29

A wildcard before the subcommand grants more than it reads

CC 2.1.246 warns at startup about Bash allow rules shaped Bash(git * main). ork ships its permission rules to every user, so a rule of that shape would put the warning in everyone's session and quietly widen an allow. This PR adds the lint that keeps the shape out.

1 · the shape

Why the star in the middle is the problem

A glob is not a grammar. git * main reads as "any git subcommand on main", but the star also swallows options placed before the subcommand.

Bash(git * main)        matches   git push main            intended
                        matches   git -c core.hooksPath=/x push main   not intended
                        matches   git --exec-path=/evil push main      not intended

Bash(git *)             fine: the star is the tail, nothing follows it
Bash(gh pr *)           fine, same reason
Bash(* && rm -rf *)     a deny; widening a deny is the safe direction
What it meansOnly an allow rule with text after a mid-pattern star is a risk.
If we do nothingOne future rule of that shape ships to every user with a startup warning.
2 · the lint

What it checks, and the measured baseline

CheckResult at adoption
Every Bash(...) entry in src/settings/*.settings.json (3 files, 55 rules, 35 of them Bash) against ^Bash\([^)]*\*\s+[^)\s]0 allow rules flagged
Deny / ask rules with the shape are counted as informational, not failures0 today
Positive control: Bash(git * main) must be caughtcaught
Negative controls: Bash(git *), Bash(gh pr *), a literal rulenot flagged
Runs in tests/manifests/, discovered by the existing test-*.sh glob (no roster change)13 passed via scripts/ci/run-tests.sh tests/manifests
What it meansA regression guard with its own positive control, so a broken regex cannot pass vacuously.
What it does not doIt does not rewrite rules or inspect a user's own settings; that is CC's startup warning.