Hey! Thanks for the detailed write-up — you’re right on both counts, and neither is something you misconfigured. Definitely don’t add sh to the allowlist.
What should unblock you today: emit the rewritten command directly instead of wrapping it, so the first token stays the real executable. pytest tests/ --color=no keeps matching your existing pytest entry; sh -c 'pytest tests/ --color=no' doesn’t. Compound commands are fine unwrapped too - each part is matched separately, so a && b still hits your entries for a and b. And if the wrapper is only there to change directory or extend the timeout, updated_input takes cwd and timeout alongside command, so you can drop sh -c entirely.
If your rewrite needs something you genuinely can’t express without a wrapper, what’s it doing? That’d help me pass along the right shape.
We’ve let the team know and this is an issue we’re tracking - same underlying gap as your earlier request for authoritative hook verdicts. I’ll post here when there’s an update.