fix(security): trim allowlist/denylist patterns to prevent config-side bypass (M4)

ActionForCommand trims the command string before matching, but the
allowlist and denylist patterns from the user's config were never
trimmed. If a user accidentally included trailing whitespace in a
pattern (e.g. via copy-paste), the match would silently fail.

Fix: apply strings.TrimSpace() to patterns before comparing, so
config-side whitespace is ignored just like command-side whitespace.

Also corrected the Denylist struct doc: it says "Exact match only"
but the code uses strings.HasPrefix (prefix match), which is the
intended behavior since the deny list is for broad-stroke blocking.

Fixes M4 from security audit.

Author: molty3000

internal/danger/classifier.go

@@ -217,7 +217,7 @@ type DangerousConfig struct {
 	Allowlist []string `json:"allowlist,omitempty"`
 
 	// Denylist is a list of command strings that are always denied,
-	// regardless of their risk classification. Exact match only.
+	// regardless of their risk classification. Prefix match (after trimming).
 	Denylist []string `json:"denylist,omitempty"`
 
 	// DefaultAction is the global default action applied to ALL risk classes
@@ -279,22 +279,22 @@ func (c *DangerousConfig) ActionFor(cls RiskClass) Action {
 }
 
 // ActionForCommand returns the action for a specific command string.
-// Allowlist and denylist are checked first (exact match), then falls
-// back to the risk-class-based action.
+// Allowlist and denylist are checked first (exact match for allowlist,
+// prefix match for denylist), then falls back to the risk-class-based action.
 func (c *DangerousConfig) ActionForCommand(cmd string) Action {
 	cmd = strings.TrimSpace(cmd)
 	if cmd == "" {
 		return Allow
 	}
-	// Allowlist has highest priority
+	// Allowlist has highest priority — exact match after trimming both sides.
 	for _, pattern := range c.Allowlist {
-		if cmd == pattern {
+		if cmd == strings.TrimSpace(pattern) {
 			return Allow
 		}
 	}
-	// Denylist is checked before classification
+	// Denylist is checked before classification — prefix match after trimming.
 	for _, pattern := range c.Denylist {
-		if strings.HasPrefix(cmd, pattern) {
+		if strings.HasPrefix(cmd, strings.TrimSpace(pattern)) {
 			return Deny
 		}
 	}

internal/danger/classifier_test.go

@@ -649,6 +649,30 @@ func TestActionForCommand_EmptyCommand(t *testing.T) {
 	}
 }
 
+func TestActionForCommand_PatternTrimmed(t *testing.T) {
+	// Patterns with trailing whitespace should still match after trimming.
+	cfg := &DangerousConfig{
+		Allowlist: []string{"git push origin main "},  // trailing space
+		Denylist:  []string{" rm -rf / "},             // leading + trailing space
+	}
+	// Allowlist: trimmed pattern matches trimmed command
+	if action := cfg.ActionForCommand("git push origin main"); action != Allow {
+		t.Errorf("allowlist with trailing space should match, got %s", action)
+	}
+	// Allowlist: command with trailing space also matches
+	if action := cfg.ActionForCommand("git push origin main "); action != Allow {
+		t.Errorf("allowlist should match command with trailing space, got %s", action)
+	}
+	// Denylist: trimmed pattern matches trimmed command
+	if action := cfg.ActionForCommand("rm -rf / --no-preserve-root"); action != Deny {
+		t.Errorf("denylist with leading space should match, got %s", action)
+	}
+	// Denylist: command with trailing space still matches
+	if action := cfg.ActionForCommand("rm -rf / "); action != Deny {
+		t.Errorf("denylist should match command with trailing space, got %s", action)
+	}
+}
+
 func TestParseAction(t *testing.T) {
 	if got := parseAction("allow"); got != Allow {
 		t.Errorf("parseAction(allow) = %s", got)