rubik 0.1.5 → 0.2.0

data/lib/rubik/repl/commands/buffer.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "base"
+require_relative "../../buffer/apply_contract"
 
 module Rubik
   module REPL
@@ -51,27 +52,36 @@ module Rubik
 
           shell.register_command("apply", description: "Apply dirty buffer changes to disk") do |args, ctx|
             target_path = args.first
-            if target_path && !target_path.empty?
-              applied = ctx.buffer_manager.apply!(target_path)
-              conflicts = ctx.buffer_manager.last_conflicts || []
-              if applied.empty? && conflicts.empty?
-                ctx.out.puts "No unapplied buffer changes for '#{target_path}'."
+            begin
+              if target_path && !target_path.empty?
+                applied = ctx.buffer_manager.apply!(target_path)
+                conflicts = ctx.buffer_manager.last_conflicts || []
+                if applied.empty? && conflicts.empty?
+                  ctx.out.puts "No unapplied buffer changes for '#{target_path}'."
+                else
+                  ctx.sync_context_and_ast(applied) unless applied.empty?
+                  ctx.out.puts "Applied changes to file: #{applied.first}" unless applied.empty?
+                end
               else
-                ctx.sync_context_and_ast(applied) unless applied.empty?
-                ctx.out.puts "Applied changes to file: #{applied.first}" unless applied.empty?
+                applied = ctx.buffer_manager.apply!
+                conflicts = ctx.buffer_manager.last_conflicts || []
+                if applied.empty? && conflicts.empty?
+                  ctx.out.puts "No unapplied buffer changes."
+                else
+                  ctx.sync_context_and_ast(applied) unless applied.empty?
+                  ctx.out.puts "Applied changes to #{applied.size} file(s): #{applied.join(', ')}" unless applied.empty?
+                end
               end
-            else
-              applied = ctx.buffer_manager.apply!
-              conflicts = ctx.buffer_manager.last_conflicts || []
-              if applied.empty? && conflicts.empty?
-                ctx.out.puts "No unapplied buffer changes."
-              else
-                ctx.sync_context_and_ast(applied) unless applied.empty?
-                ctx.out.puts "Applied changes to #{applied.size} file(s): #{applied.join(', ')}" unless applied.empty?
+              conflicts.each do |c|
+                ctx.out.puts "[CONFLICT] #{c}: disk content changed since last read — skipped to prevent data loss. Re-read the file to resolve."
               end
-            end
-            conflicts.each do |c|
-              ctx.out.puts "[CONFLICT] #{c}: disk content changed since last read — skipped to prevent data loss. Re-read the file to resolve."
+            rescue Rubik::Buffer::ApplyFailedError => e
+              # Partial apply (issue #146): the report names what DID reach
+              # disk before the failure — a mixed outcome must not be
+              # presented as a plain success or a plain failure.
+              lines = Rubik::Buffer::ApplyContract.failure_lines(e, sync: ->(paths) { ctx.sync_context_and_ast(paths) })
+              ctx.out.puts "❌ #{lines.first}"
+              lines[1..].each { |line| ctx.out.puts line }
             end
           end
 

data/lib/rubik/repl/commands/subagents.rb

@@ -94,6 +94,8 @@ module Rubik
           ctx.out.puts "  Uptime:      #{inst.uptime.round(2)}s"
           ctx.out.puts "  Workspace:   #{inst.workspace}"
           ctx.out.puts "  Transcript:  #{inst.transcript_uri}"
+          # Canonical read reference (issue #123): the path above is diagnostic.
+          ctx.out.puts "  Read Ref:    #{inst.transcript_ref}" if inst.respond_to?(:transcript_ref)
           ctx.out.puts "  Last Error:  #{inst.last_error}" if inst.last_error
           ctx.out.puts "  Result:      #{inst.result.to_s.slice(0, 150)}..." if inst.result
         end

data/lib/rubik/repl/input_execution.rb

@@ -148,6 +148,13 @@ module Rubik
         # an unbound read would mask the in-flight exception with a
         # NameError, breaking the "cleanup must never mask" contract.
         interrupted = false
+        # Task ownership (issue #125): this turn owns the subagents it spawns.
+        # The token is published for the turn's duration; ^C cancels it and the
+        # supervisor stops exactly the owned descendants (detached work and
+        # older turns' executions carry different tokens and survive).
+        task = Rubik::Orchestrator::TaskCancellation.new
+        @active_task = task
+        @runtime_manager&.provide(Rubik::Coeffects::TASK_CANCELLATION, task)
         # Plan 109 staleness rule (see execute_command): a real turn's
         # context already includes the idle-injected notices. The notice
         # turn itself drains first, so this clear is a no-op for it.
@@ -271,6 +278,10 @@ module Rubik
         # at route time), so draining loses nothing the model needed.
         clear_pending_wake_notices! if respond_to?(:clear_pending_wake_notices!)
         Rubik::REPL::InterruptHandler.restore_console_after_interrupt
+        # Propagate the cancellation to owned work (issue #125) and report the
+        # fact: with nothing owned running this reads as an interrupted wait,
+        # with owned descendants it reads as a cancelled task tree.
+        task_cancellation_lines(cancel_foreground_task!(task)).each { |line| @output.puts line }
         # Dedicated event type: restore_session must NOT hydrate this as a
         # dialogue turn (the user_turn recorded at method entry already
         # carries the question; a repl_command-style pair would duplicate it).
@@ -294,6 +305,7 @@ module Rubik
         record_failed_turn!(text, "failed", "#{e.class}: #{message}", orchestrator)
       ensure
         @active_loop = nil
+        @active_task = nil
         # Flush a half-streamed markdown tail so an interrupt never eats the last
         # line. Cleanup must never mask the in-flight exception (Interrupt, LLM
         # error): each step reports its own failure to stderr instead of raising.
@@ -320,6 +332,36 @@ module Rubik
         reap_dead_kernel_units! if respond_to?(:reap_dead_kernel_units!)
       end
 
+      # Foreground task cancellation (issue #125): cancel the turn's token and
+      # stop its owned descendants within the configured grace period. Returns
+      # the supervisor's fact report (nil when no supervisor is wired).
+      def cancel_foreground_task!(task)
+        supervisor = Rubik::Coeffects.get(@runtime_manager&.context, Rubik::Coeffects::SUBAGENT_SUPERVISOR)
+        return nil unless task && supervisor.respond_to?(:cancel_owned)
+
+        supervisor.cancel_owned(task, timeout: @config.fetch("subagents.cancel_timeout", 2.0))
+      rescue StandardError => e
+        warn "[rubik] task cancellation failed: #{e.class}: #{e.message}"
+        nil
+      end
+
+      # The UI's two truths (issue #125): an interrupt with nothing owned is an
+      # interrupted WAIT; one with owned work is a cancelled TASK TREE — and
+      # remaining work is named, so an incomplete cleanup is never silent.
+      def task_cancellation_lines(outcome)
+        return ["⏸️  [Rubik] Bekleme kesildi (^C) — iptal edilecek bağlı alt ajan yok."] unless outcome&.any?
+
+        line = "🛑 [Rubik] Görev ağacı iptal edildi (^C): #{outcome.stopped.size} bağlı alt ajan durduruldu"
+        line << ", #{outcome.queued_cancelled.size} kuyruk işi iptal edildi" unless outcome.queued_cancelled.empty?
+        if outcome.complete?
+          line << "; temizlik tamamlandı."
+        else
+          remaining = outcome.remaining.map { |r| "#{r[:id]}:#{r[:state]}" }.join(", ")
+          line << "; temizlik TAMAMLANMADI — kalan: #{remaining}."
+        end
+        [line]
+      end
+
       # Shared spinner teardown. Cleanup must never mask the in-flight
       # exception (AGENTS.md §5): a spinner whose tick thread died holding
       # the mutex raises ThreadError from synchronize — report it to stderr

data/lib/rubik/repl/input_loop.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "prompt_grace"
+
 module Rubik
   module REPL
     # Öneri 3 (Kademe 1): Shell'den ayrılan girdi döngüsü sorumluluğu.
@@ -18,6 +20,7 @@ module Rubik
 
       def run_interactive
         @running = true
+        @interactive_prompt_loop = true
         multiline_buffer = []
         heredoc_delimiter = nil
         last_line_at = nil
@@ -33,6 +36,7 @@ module Rubik
           end
         end
       ensure
+        @interactive_prompt_loop = false
         stop
       end
 
@@ -45,7 +49,7 @@ module Rubik
         text = read_paste_block
         return { stop: false, buffer: [], delimiter: nil } if text.strip.empty?
 
-        execute_input(text)
+        submit_interactive_prompt(text)
         { stop: false, buffer: [], delimiter: nil }
       end
 
@@ -66,6 +70,7 @@ module Rubik
         flush_subagent_notices! if respond_to?(:flush_subagent_notices!)
         @terminal_guard&.flush_notices!
         current_prompt, boxed = prepare_prompt_line(!heredoc_delimiter.nil?)
+        restored_submission = !@prompt_restore.nil?
         line = safe_readline(current_prompt, add_history: false)
         @output.puts box_bottom_border if boxed
         return handle_eof(multiline_buffer, heredoc_delimiter) if line.nil? || line == "\x04" || line == "\x1a"
@@ -82,14 +87,14 @@ module Rubik
         # "instantly", so an ungated collector would swallow consecutive test
         # lines like "x = a << 1" + "exit" into one turn (seen in test_repl).
         now = paste_clock
-        if paste_burst_eligible? && !line.strip.empty? && !heredoc_delimiter &&
+        if !restored_submission && paste_burst_eligible? && !line.strip.empty? && !heredoc_delimiter &&
            multiline_buffer.empty? &&
            (paste_line_fast?(last_line_at, now) || paste_pending?)
           return collect_paste_burst(line)
         end
 
         # Push non-empty command to history
-        @reline::HISTORY.push(line) if !line.strip.empty? && line != begin
+        @reline::HISTORY.push(line) if !prompt_grace_interactive? && !line.strip.empty? && line != begin
           @reline::HISTORY.to_a.last
         rescue
           nil
@@ -152,13 +157,15 @@ module Rubik
           collector.call
         end
         text = lines.join("\n")
-        execute_input(text)
+        submit_interactive_prompt(text)
         # Return the final line timestamp so a following paste burst chain
         # (copy #2 right after copy #1) is still detected as fast lines.
         { stop: false, buffer: [], delimiter: nil, last_line_at: last_at }
       end
 
       def safe_readline(prompt, add_history: false)
+        return read_restored_prompt(prompt) if @prompt_restore
+
         if @terminal_guard
           @terminal_guard.with_reading { @reline.readline(prompt, add_history) }
         else
@@ -179,7 +186,7 @@ module Rubik
       def process_heredoc_line(line, multiline_buffer, heredoc_delimiter)
         if line.strip == heredoc_delimiter
           full_text = multiline_buffer.join("\n")
-          execute_input(full_text)
+          submit_interactive_prompt(full_text)
           { stop: false, buffer: [], delimiter: nil }
         else
           multiline_buffer << line
@@ -190,7 +197,7 @@ module Rubik
       def process_normal_line(line, _multiline_buffer)
         # Only trigger heredoc if line explicitly opens a multiline block (e.g. `<<EOF`, `!plan <<EOF`)
         # NEVER trigger on inline operators like `array << item` or `a << b`
-        heredoc_match = line.match(/^\s*(?:[a-zA-Z0-9_!.-]+\s+)?<<[-~]?['"]?([A-Za-z0-9_]+)['"]?\s*$/)
+        heredoc_match = line.match(/\A[ \t]*(?:[a-zA-Z0-9_!.-]+[ \t]+)?<<[-~]?['"]?([A-Za-z0-9_]+)['"]?[ \t]*\z/)
         if heredoc_match && !line.strip.start_with?("#")
           delimiter = heredoc_match[1]
           prefix = line.sub(/<<[-~]?['"]?#{Regexp.escape(delimiter)}['"]?\s*$/, "").strip
@@ -200,7 +207,7 @@ module Rubik
           stop
           { stop: true, buffer: [], delimiter: nil }
         else
-          execute_input(line)
+          submit_interactive_prompt(line)
           { stop: false, buffer: [], delimiter: nil }
         end
       end
@@ -208,6 +215,49 @@ module Rubik
       def process_multiline_or_line(line)
         execute_input(line)
       end
+
+      def prompt_grace_interactive?
+        @interactive_prompt_loop && !@replaying && interactive_input?
+      end
+
+      def submit_interactive_prompt(text)
+        return execute_input(text) unless prompt_grace_interactive?
+
+        if CommandParser.parse(text).type == :prompt
+          milliseconds = @config.fetch("ui.prompt_grace_window_ms", 1000)
+          outcome = PromptGrace.new(input: @input, output: @output,
+                                    context: @runtime_manager&.context).wait(milliseconds)
+          if outcome == :edit
+            @prompt_restore = text
+            return
+          end
+          return if outcome == :cancel
+        end
+        @reline::HISTORY.push(text) unless text.strip.empty? || @reline::HISTORY.to_a.last == text
+        execute_input(text)
+      end
+
+      def read_restored_prompt(prompt)
+        text = @prompt_restore
+        @prompt_restore = nil
+        previous = @reline.pre_input_hook
+        scope = @runtime_manager ? @runtime_manager.context.extend : Rubik::Runtime::Context.new
+        scope.on_dispose { @reline.pre_input_hook = previous }
+        @reline.pre_input_hook = lambda {
+          previous&.call
+          @reline.insert_text(text)
+        }
+        reader = -> { @reline.readmultiline(prompt, false) { true } }
+        if @terminal_guard
+          # A reactive wake must never inject Enter while Reline resets an
+          # apparently empty buffer, before the restoration hook fills it.
+          @terminal_guard.with_collecting { @terminal_guard.with_reading(&reader) }
+        else
+          reader.call
+        end
+      ensure
+        scope&.dispose
+      end
     end
   end
 end

data/lib/rubik/repl/prompt_grace.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+require "io/console"
+require "io/wait"
+require_relative "../runtime/context"
+
+module Rubik
+  module REPL
+    # Synchronous admission gate: no task, recorder entry or delayed callback
+    # exists until this returns :execute. A temporary context owns all terminal
+    # effects and is pruned from its parent on every exit.
+    class PromptGrace
+      ESCAPE_TIMEOUT = 0.03
+      STATUS = "Gönderiliyor… Esc: düzenlemeye dön"
+
+      def initialize(input:, output:, context: nil, clock: nil, reader: nil)
+        @input = input
+        @output = output
+        @context = context
+        @clock = clock || -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) }
+        @reader = reader || method(:read_byte)
+      end
+
+      def wait(milliseconds)
+        return :execute if milliseconds.zero?
+
+        scope = @context ? @context.extend : Rubik::Runtime::Context.new
+        mode = @input.console_mode
+        scope.on_dispose { @input.console_mode = mode }
+        @input.raw!
+        scope.on_dispose do
+          @output.print "\r\e[2K"
+          @output.flush
+        end
+        @output.print STATUS
+        @output.flush
+        deadline = @clock.call + (milliseconds / 1000.0)
+        loop do
+          remaining = deadline - @clock.call
+          if remaining <= 0
+            # A burst arriving at the deadline can leave bytes queued after
+            # the last processed key. Do not let its Enter submit a later turn.
+            if @input.respond_to?(:nread) && @input.nread.positive?
+              @input.iflush
+              @output.print "\a\r\e[2K[Rubik] Bekleme sırasında gelen tuşlar yok sayıldı.\r\n"
+            end
+            return :execute
+          end
+
+          byte = @reader.call(remaining)
+          next if byte.nil?
+          return :cancel if [:eof, "\x03"].include?(byte)
+
+          if byte == "\e"
+            escape = classify_escape
+            return escape unless escape == :sequence
+          end
+
+          # Other keys are intentionally rejected, with immediate feedback.
+          # Enter never leaks into the next readline as an accidental submit.
+          @output.print "\a\r\e[2K#{STATUS} · Tuş yok sayıldı"
+          @output.flush
+        end
+      rescue Interrupt
+        :cancel
+      ensure
+        scope&.dispose
+      end
+
+      private
+
+      def read_byte(timeout)
+        return nil unless @input.wait_readable(timeout)
+
+        @input.read_nonblock(1)
+      rescue IO::WaitReadable
+        nil
+      rescue EOFError
+        :eof
+      end
+
+      # CSI/SS3 arrows and function keys start with Esc too. Resolve this
+      # ambiguity even when Esc arrives just before the submission deadline.
+      def classify_escape
+        following = @reader.call(ESCAPE_TIMEOUT)
+        return :edit if following.nil? || following == :eof
+        return :cancel if following == "\x03"
+        return :sequence unless ["[", "O"].include?(following)
+
+        deadline = @clock.call + ESCAPE_TIMEOUT
+        loop do
+          remaining = deadline - @clock.call
+          break if remaining <= 0
+
+          byte = @reader.call(remaining)
+          return :cancel if byte == "\x03"
+          break if byte.nil? || byte == :eof || byte.match?(/[\x40-\x7e]/)
+        end
+        :sequence
+      end
+    end
+  end
+end

data/lib/rubik/runtime/repair_probe.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+require "shellwords"
+require "tempfile"
+require "timeout"
+require_relative "discovery"
+require_relative "diagnostic_engine"
+require_relative "../lsp/client"
+
+module Rubik
+  module Runtime
+    # Functional checks own their resources through the caller's probe context.
+    class RepairProbe
+      def initialize(root_dir:)
+        @root_dir = root_dir
+      end
+
+      PROBE_TIMEOUT = 5
+      # These commands support help without running tests or formatting files.
+      HELP_PROBE_BINARIES = ["ruby", "python", "python3", "pytest", "rspec", "rake", "bundle", "rubocop", "standardrb", "ruff", "black", "rustfmt", "cargo", "go", "gofmt",
+                             "goimports", "clang-format", "zig", "prettier", "biome", "npm", "pnpm", "yarn", "bun", "mix", "dart", "crystal", "echo"].freeze
+
+      def verify(target, lang, proposed_cmd, sub_ctx, probe_args: nil)
+        return probe_failure(proposed_cmd, 1, "Unknown target component type: #{target}") unless ["lsp", "test_runner", "linter", "command"].include?(target)
+        unless Rubik::Runtime::Discovery.binary_available?(proposed_cmd, root_dir: @root_dir)
+          return probe_failure(proposed_cmd, 127, "Availability check failed: executable not found in PATH")
+        end
+
+        if target == "lsp"
+          client = Rubik::LSP::Client.new(lang, root_dir: @root_dir, server_cmd: proposed_cmd)
+          sub_ctx.on_dispose { client.stop }
+          begin
+            result = Timeout.timeout(PROBE_TIMEOUT) { client.start }
+            return probe_failure(proposed_cmd, 1, "Functional probe failed: LSP initialize handshake rejected") unless result && client.alive?
+          rescue Timeout::Error
+            return probe_failure(proposed_cmd, 124, "LSP initialize handshake timed out")
+          end
+          return [true, nil]
+        end
+
+        argv = Shellwords.split(proposed_cmd)
+        if probe_args.nil?
+          unless HELP_PROBE_BINARIES.include?(File.basename(argv.first.to_s))
+            return probe_failure(proposed_cmd, 1, "Available but unverified: provide non-mutating probe_args for this executable")
+          end
+
+          probe_args = ["--help"]
+        end
+        return probe_failure(proposed_cmd, 1, "probe_args must be a non-empty array of strings") unless probe_args.is_a?(Array) && !probe_args.empty? && probe_args.all?(String)
+
+        argv.concat(probe_args)
+        # Array-form spawn never interprets shell operators. File-backed output
+        # avoids pipe-reader threads surviving a timeout or a forked descendant.
+        output = Tempfile.new("rubik-repair-probe")
+        sub_ctx.on_dispose { output.close! }
+        options = { chdir: @root_dir, in: File::NULL, out: output, err: output }
+        options[:pgroup] = true unless Rubik::Platform.windows?
+        pid = Process.spawn(*argv, **options)
+        reaped = false
+        sub_ctx.on_dispose do
+          if Rubik::Platform.windows?
+            Rubik::Platform.kill_tree(pid) unless reaped
+          else
+            begin
+              Process.kill("KILL", -pid)
+            rescue Errno::ESRCH
+              nil
+            end
+          end
+          Process.waitpid(pid) unless reaped
+        rescue Errno::ECHILD
+          nil
+        end
+        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + PROBE_TIMEOUT
+        loop do
+          waited = Process.waitpid2(pid, Process::WNOHANG)
+          if waited
+            reaped = true
+            status = waited.last
+            return [true, nil] if status.success?
+
+            output.rewind
+            return probe_failure(proposed_cmd, status.exitstatus || 1, "Functional probe failed: #{output.read(4096)}")
+          end
+          return probe_failure(proposed_cmd, 124, "Functional probe timed out") if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
+
+          sleep 0.01
+        end
+      end
+
+      private
+
+      def probe_failure(command, code, message)
+        [false, Rubik::Runtime::DiagnosticEngine.diagnose(cmd: command, exit_code: code, stderr: message)]
+      end
+    end
+  end
+end

data/lib/rubik/security/blocked_guidance.rb

@@ -59,6 +59,25 @@ module Rubik
                     "If genuinely required and safe, the operator can allowlist it once:",
                     "  !allow-cmd add #{quoted}"
                   ]
+                elsif kind == :classifier_error
+                  # AST walk crashed (fail-closed): the command was never
+                  # classified, so no rule matched — blame-free guidance
+                  # plus the explicit statement that AST evaluation failed.
+                  [
+                    "Security blocked: #{message}",
+                    "The command AST could not be evaluated (classifier error), so the command was not classified.",
+                    "If genuinely required and safe, the operator can allowlist the exact simple command once:",
+                    "  !allow-cmd add #{quoted}"
+                  ]
+                elsif kind == :parse_ambiguous
+                  # Tree-sitter reported syntax errors: a partial verdict is
+                  # not a verdict — the command was blocked unparsed.
+                  [
+                    "Security blocked: #{message}",
+                    "The command AST could not be fully parsed (tree-sitter syntax error), so the command was not classified.",
+                    "If genuinely required and safe, the operator can allowlist it once:",
+                    "  !allow-cmd add #{quoted}"
+                  ]
                 elsif cmd && err.respond_to?(:probe_like) && err.probe_like
                   # Probe branch first: `python3 --version` is probe-shaped and
                   # must not be hijacked by the text-munging variant below.

data/lib/rubik/security/guard.rb

@@ -109,6 +109,13 @@ module Rubik
       # whose ONLY arguments are these flags is read-only by construction.
       SAFE_PROBE_FLAGS = ["--version", "-v", "--help", "-h"].freeze
 
+      # Shell metacharacters that make a raw (AST-less) token-prefix allowlist
+      # match dishonest: they can join, redirect, substitute, or line-split
+      # the string, so "the first tokens match" would not mean "the whole
+      # simple command matches". The classifier-crash rescue only accepts a
+      # single simple command; anything else fails closed.
+      RAW_ALLOWLIST_UNSAFE_PATTERN = /[;&|<>`$(){}\[\]\\\n\r]/
+
       attr_reader :audit_log_path
 
       # Live-reconfigurable audit destination (ConfigWiring applies config
@@ -486,16 +493,55 @@ module Rubik
             )
           end
 
+          # Ambiguous parse (tree-sitter syntax errors) is a classification
+          # failure, not a pass: the walk cannot vouch for the whole
+          # expression, so a safe-looking partial verdict must not fall
+          # through to the catastrophic-only regex gate. The allowlist stays
+          # the valve because a real AST exists — every segment is checked
+          # against the operator entries.
+          if !allow_unknown && ast.parse_warnings.to_a.any?
+            allowlisted = begin
+              command_allowlisted?(ast, cmd_str: cmd_str)
+            rescue StandardError => e
+              warn "[Guard] allowlist evaluation failed, failing closed: #{e.class}: #{e.message}"
+              false
+            end
+            if allowlisted
+              log_audit("allowed_command", command: cmd_str, reason: "operator_allowlist")
+              verify_command_fallback_regex!(cmd_str)
+              return true
+            end
+            log_audit("blocked_command", command: cmd_str, reason: "parse_ambiguous",
+                                         parse_warnings: ast.parse_warnings.to_a.size)
+            raise BlockedWriteError.new(
+              "Command AST could not be fully parsed (tree-sitter syntax error); execution blocked (fail-closed): #{cmd_str}",
+              kind: :parse_ambiguous,
+              blocked_command: cmd_str,
+              rule_name: "parse_ambiguous",
+              probe_like: probe_shape?(cmd_str),
+              segment_report: nil
+            )
+          end
+
           return true if [:readonly, :local_effects, :external_effects].include?(ast.classification) && ast.parse_warnings.empty?
         rescue BlockedWriteError
           raise
         rescue StandardError => e
-          # Unconditional warn + audit trail: a classifier crash downgrades
-          # this verification to the narrow fallback regex, silently skipping
-          # allowlist/probe logic — a security-observable downgrade nobody
-          # should need RUBIK_DEBUG to notice.
-          warn "[WARN] AST classification error, falling back to regex gate: #{e.message}"
-          log_audit("classifier_error", command: cmd_str, reason: "#{e.class}: #{e.message}")
+          # Unconditional warn + audit trail: a classifier crash is a
+          # security-observable downgrade nobody should need RUBIK_DEBUG to
+          # notice. The shell gate fails closed — an exception must never
+          # mint execution permission; the operator allowlist is the one
+          # sanctioned valve. The synthesis seam (allow_unknown) keeps
+          # flowing into its own deny layers (DANGEROUS_SYNTHESIS_PATTERNS
+          # + RubyVM walk), which run after this gate.
+          if allow_unknown
+            warn "[WARN] AST classification error on non-shell input, continuing to synthesis deny layers: #{e.message}"
+            log_audit("classifier_error", command: cmd_str, reason: "#{e.class}: #{e.message}",
+                                          decision: "synthesis_layers")
+          else
+            warn "[WARN] AST classification error, failing closed: #{e.class}: #{e.message}"
+            block_on_classifier_failure!(cmd_str, e)
+          end
         end
 
         verify_command_fallback_regex!(cmd_str)
@@ -685,6 +731,69 @@ module Rubik
         report ? report[:segments].size : 0
       end
 
+      # Classifier-crash gate for the shell path: structured block by
+      # default, one sanctioned rescue — an operator allowlist entry
+      # covering the exact single-command prefix (the same explicit
+      # authorization contract as the unknown-command gate). The
+      # catastrophic fallback regex still runs afterwards on the rescue
+      # path; on the block path it gets first refusal so a catastrophic
+      # command keeps its precise :dangerous_pattern reason.
+      def block_on_classifier_failure!(cmd_str, error)
+        allowlisted = begin
+          command_allowlisted_raw?(cmd_str)
+        rescue StandardError => e
+          warn "[Guard] raw allowlist evaluation failed, failing closed: #{e.class}: #{e.message}"
+          false
+        end
+        log_audit("classifier_error", command: cmd_str, reason: "#{error.class}: #{error.message}",
+                                      decision: allowlisted ? "operator_allowlist" : "blocked")
+
+        if allowlisted
+          log_audit("allowed_command", command: cmd_str, reason: "operator_allowlist_classifier_error")
+          return
+        end
+
+        verify_command_fallback_regex!(cmd_str)
+        log_audit("blocked_command", command: cmd_str, reason: "classifier_error")
+        raise BlockedWriteError.new(
+          "AST evaluation failed, so the command could not be classified; execution blocked (fail-closed): #{cmd_str}",
+          kind: :classifier_error,
+          blocked_command: cmd_str,
+          rule_name: "classifier_error",
+          probe_like: probe_shape?(cmd_str),
+          segment_report: nil
+        )
+      end
+
+      # Token-prefix allowlist check for an input whose AST does not exist
+      # (classifier crashed). Only a single simple command qualifies: with
+      # shell metacharacters present the string may hold several segments
+      # and the gate's "every segment must match" contract cannot be
+      # honored — fail closed instead of over-promising the prefix match.
+      # Quoting is handled by Shellwords; an unparseable string (unbalanced
+      # quote) fails closed.
+      def command_allowlisted_raw?(cmd_str)
+        return false if @command_allowlist.empty?
+        return false if cmd_str.match?(RAW_ALLOWLIST_UNSAFE_PATTERN)
+
+        tokens = nil
+        begin
+          tokens = Shellwords.split(cmd_str)
+        rescue ArgumentError
+          return false
+        end
+        return false if tokens.empty?
+        return false if Rubik::Security::Classifier::Matcher::BUILTIN_DANGEROUS_CMDS.include?(tokens[0].to_s)
+
+        @command_allowlist.any? do |entry|
+          next false if entry.length > tokens.length
+
+          entry.each_with_index.all? do |token, i|
+            i.zero? ? binary_allowlist_match?(tokens[i], token) : tokens[i] == token
+          end
+        end
+      end
+
       def verify_command_fallback_regex!(cmd_str)
         return true unless DANGEROUS_COMMAND_PATTERNS.any? { |p| cmd_str.match?(p) }