Permission prompt truncates URLs with shell variable expansion (${VAR}), e.g. shows "https://api.$" #5257

When a command run by Copilot CLI includes a shell parameter expansion inside a URL string (e.g. curl -s -X POST "https://api.${DD_SITE}/api/v2/logs/analytics/aggregate"), the "Do you want to allow this access?" permission prompt mis-parses the URL and displays only https://api.$, truncating at the $ instead of either:

• the literal unexpanded command text (https://api.${DD_SITE}/api/v2/logs/analytics/aggregate), or
• the shell-expanded value (https://api.<site>/...).

Impact:

• The prompt doesn't show the actual host being accessed, so users can't make an informed approval decision.
• Options 2 and 3 ("approve all URLs from this host for the session/permanently") persist an approval rule keyed on the truncated/garbage host https://api.$ rather than the real API host, making those options ineffective or confusing.

Steps to reproduce:

1. Set an env var, e.g. DD_SITE=<some-domain>.
2. Ask Copilot CLI to run a shell command with set -a; source .env; set +a; curl -s -X POST "https://api.${DD_SITE}/api/v2/logs/analytics/aggregate" ....
3. Observe the permission dialog shows https://api.$ as the URL instead of the real host.

Expected: The approval prompt should show the full, correct URL/host (either literal command text or shell-expanded), so "approve this host" options are meaningful.

Screenshot:

Screenshot: the approval dialog read "Copilot is attempting to access the following URL: https://api.$" with options to allow once, allow for session, allow permanently, or deny — none of which reflect the actual intended host.

Version: Copilot CLI 1.0.103