/add-knowledge: powershell *Copy-Item* pre-approval is broader than needed

Start at line 4 of commands/add-knowledge.md and compare the allowed PowerShell pattern with the command body's single uploaded-file copy step. Choose the narrowest pre-approval that covers that documented step, or remove it because Bash(cp *) already covers the copy. Done means the frontmatter no longer permits unrelated PowerShell statements while preserving the needed copy workflow.

Summary

The /add-knowledge command frontmatter pre-authorizes:

allowed-tools: Read, Write, Glob, Grep, Bash(mkdir *), Bash(cp *), Bash(powershell *Copy-Item*), Bash(node *verify-knowledge-access.bundle.js*)

(commands/add-knowledge.md, line 4.)

Bash(powershell *Copy-Item*) is broader than the workflow needs. The only documented use of PowerShell in the command body is a single copy step — "uploaded file → copy the file into capabilities/knowledge/files/" — and Bash(cp *) is already allowed in the same line for it.

Why the wildcard shape over-grants

The pattern matches any command that starts with powershell and contains Copy-Item anywhere. A -Command string that continues after the copy with additional statements still matches:

powershell -Command "Copy-Item a b; <any additional statement>"

Pre-approved tools in the command frontmatter run without a per-command confirmation prompt in the host CLI, so in a session where the assistant is steered by workspace or web content, the practical effect is "any PowerShell command whose text mentions Copy-Item", not "the one copy step".

Suggested tightening

Any of these would match the documented need:

• Drop the entry entirely — the documented step is a plain file copy already covered by Bash(cp *).
• Constrain the destination: Bash(powershell *Copy-Item*capabilities/knowledge/files*).
• Allow only a structured two-path form with no free continuation (e.g. Bash(powershell *Copy-Item * capabilities/knowledge/files/*)), accepting the small false-positive cost of ordering.

The narrower the pre-approval, the less a steered session can do without the user seeing a prompt.

Verified at HEAD a0833db3 (default branch main), 2026-09-20.