fix(bash): decide auto-approval from the parsed command, not its prefix

Reapplies the change reverted in charmbracelet#3565 (revert of charmbracelet#3426), unchanged.

The original PR was merged before @meowgorithm had finished checking it
against @taciturnaxolotl's sysadmin mode, so it was reverted to take main
back to a known state. This restores the branch as a live PR so that
review can finish before it lands a second time.

The tree for the four touched files is byte-identical to the post-charmbracelet#3426
state; no behavior was changed while it was out.

Co-authored-by: joestump-agent <joestump-agent@users.noreply.github.com>
Assisted-by: Claude Opus 5

Author: joestump

README.md

@@ -509,6 +509,13 @@ permissions. Use this with care.
 permissions allow view ls grep edit mcp_context7_get-library-doc
 ```
 
+The `bash` tool additionally runs a small set of read-only commands (`ls`,
+`pwd`, `git status`, `git log`, …) without prompting. Crush parses the command
+to decide, so it applies only when the whole command is provably inert: a
+redirection, a variable assignment, a command substitution, a pipeline, or an
+argument that mutates state (`git branch -D`, `git remote set-url`) all fall
+back to the normal permission prompt.
+
 ### Disabling Built-In Tools
 
 You can also deny tools, hiding then from the agent entirely:

internal/agent/tools/bash.go

@@ -206,25 +206,13 @@ func NewBashTool(permissions permission.Service, workingDir string, attribution
 			// Determine working directory
 			execWorkingDir := cmp.Or(params.WorkingDir, workingDir)
 
-			isSafeReadOnly := false
-			cmdLower := strings.ToLower(params.Command)
-
-			if !containsCommandChaining(params.Command) {
-				for _, safe := range safeCommands {
-					if strings.HasPrefix(cmdLower, safe) {
-						if len(cmdLower) == len(safe) || cmdLower[len(safe)] == ' ' || cmdLower[len(safe)] == '-' {
-							isSafeReadOnly = true
-							break
-						}
-					}
-				}
-			}
+			safeReadOnly := isSafeReadOnly(params.Command)
 
 			sessionID := GetSessionFromContext(ctx)
 			if sessionID == "" {
 				return fantasy.ToolResponse{}, fmt.Errorf("session ID is required for executing shell command")
 			}
-			if !isSafeReadOnly {
+			if !safeReadOnly {
 				p, err := permissions.Request(
 					ctx,
 					permission.CreatePermissionRequest{