From 779a102ed7e91d3c0598e0381fd70fac11340d73 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=9B=B7=E7=94=B5=E8=8A=BD=E8=A1=A3?=
 <zhangyanghaha0407@outlook.com>
Date: Thu, 16 Apr 2026 23:03:47 -0400
Subject: [PATCH] fix(agent-permissions): word-boundary-match management
 keywords

---
 src/main/agent-permissions.ts | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/main/agent-permissions.ts b/src/main/agent-permissions.ts
index d14b6906..affb059c 100644
--- a/src/main/agent-permissions.ts
+++ b/src/main/agent-permissions.ts
@@ -29,13 +29,20 @@ const MANAGEMENT_KEYWORDS = [
   "lead",
 ];
 
+/** Regex union for MANAGEMENT_KEYWORDS with `\b`-anchored matching so short
+ * tokens like "vp" or "cmo" do not false-match inside "vpc" or "economical". */
+const MANAGEMENT_KEYWORD_PATTERN = new RegExp(
+  `\\b(?:${MANAGEMENT_KEYWORDS.map((k) => k.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b`,
+  "i",
+);
+
 export function hasManagementAuthority(agent: { role: string; title: string; department: string | null }) {
   if (agent.department === "hr") {
     return true;
   }
 
-  const text = `${agent.role} ${agent.title}`.toLowerCase();
-  return MANAGEMENT_KEYWORDS.some((keyword) => text.includes(keyword));
+  const text = `${agent.role} ${agent.title}`;
+  return MANAGEMENT_KEYWORD_PATTERN.test(text);
 }
 
 function hasOrganizationPermission(db: AppDatabase, agentId: string) {