fix: prevent array assignments from triggering zsh process substitution detection

[hannesrudolph]

Summary

The zshProcessSubstitution regex in containsDangerousSubstitution() used =\([^)]+\) which incorrectly matched bash/zsh array assignments like files=(a b c) as dangerous zsh process substitutions like =(whoami).

This caused auto-approve to be bypassed (returning ask_user instead of auto_approve) even when the user had * wildcard in their allowed commands list.

Changes

• src/core/auto-approval/commands.ts: Added negative lookbehind (?<![a-zA-Z0-9_]) to the regex so that =( preceded by a variable name character (array assignment) is not flagged, while standalone =(cmd) process substitution still is
• src/core/auto-approval/commands.ts: Updated doc comment to note that array assignments are excluded from detection
• src/core/auto-approval/__tests__/commands.spec.ts: Added 7 test cases:
  • 3 tests for array assignments that should NOT be flagged (files=(a b c), var=(item1 item2), x=(hello))
  • 3 tests for actual zsh process substitution that SHOULD be flagged (=(whoami), =(ls), echo =(cat /etc/passwd))
  • 1 integration test verifying getCommandDecision returns auto_approve for array assignment commands with * wildcard

---

Important

Fixes regex in commands.ts to prevent array assignments from being flagged as zsh process substitutions, with updated tests in commands.spec.ts.

• Behavior:
  • Fixes regex in containsDangerousSubstitution() in commands.ts to exclude array assignments from zsh process substitution detection.
  • Updates doc comment in commands.ts to clarify exclusion of array assignments.
• Tests:
  • Adds 7 test cases in commands.spec.ts to verify correct detection of array assignments and process substitutions.
  • Includes integration test for getCommandDecision to ensure auto_approve for array assignments with wildcard allowlist.

^{This description was created by for f20ab30. You can customize this summary. It will automatically update as commits are pushed.}

[roomote]

Rooviewer   See task

Review complete. No issues found. The negative lookbehind fix correctly distinguishes array assignments from zsh process substitutions, and the test coverage is solid.

_{Mention @roomote in a comment to request specific changes to this pull request or fix all unresolved issues.}