@miphamai/cli 0.81.7 → 0.81.9

package/src/core/hooks.ts

@@ -48,6 +48,18 @@ export class HookEngine {
   /** Health tracking per hook key (event[:toolName]) */
   private health = new Map<string, HookHealth>()
 
+  /**
+   * The workspace this engine's hooks run *for*.
+   *
+   * Settled at construction because one engine belongs to one session, not to one
+   * hook. The default is exactly right for the one-shot CLI, whose process cwd
+   * *is* the session cwd — but the daemon serves many sessions from one process,
+   * so it must pass the session's cwd. Left to the executor's own
+   * `process.cwd()`, every daemon hook would run in — and be told it is in — the
+   * directory the daemon happened to be started from.
+   */
+  constructor(private readonly cwd: string = process.cwd()) {}
+
   register(hook: HookDefinition): void {
     this.hooks.push(hook)
   }
@@ -98,7 +110,12 @@ export class HookEngine {
 
   async executeStop(sessionId: string): Promise<HookResult> {
     const ctx: HookContext = { event: 'Stop', sessionId }
-    return this.runHooks('Stop', undefined, ctx)
+    const result = await this.runHooks('Stop', undefined, ctx)
+
+    // A blocking Stop hook arrives as a deny (exit code 2, `decision: block`, or
+    // `continue: false`), but the engine's Stop path reads `decision`. Derive it
+    // here rather than at each producer so every form reaches "do not stop yet".
+    return result.allowed ? result : { ...result, decision: 'block' }
   }
 
   async executeUserPromptSubmit(prompt: string, sessionId: string): Promise<HookResult> {
@@ -134,9 +151,12 @@ export class HookEngine {
     const ctx: HookContext = {
       event: 'SubagentStart',
       sessionId,
+      // The agent type plays the role a tool name plays for PreToolUse: it is
+      // what a settings.json `matcher` selects on.
+      toolName: agentType,
       toolInput: { agentType, description },
     }
-    return this.runHooks('SubagentStart', undefined, ctx)
+    return this.runHooks('SubagentStart', agentType, ctx)
   }
 
   async executeSubagentStop(
@@ -149,10 +169,12 @@ export class HookEngine {
     const ctx: HookContext = {
       event: 'SubagentStop',
       sessionId,
+      // Matcher target — see executeSubagentStart.
+      toolName: agentType,
       toolInput: { agentType, description, success },
       toolResult: result ? { success, content: result.slice(0, 2000) } : undefined,
     }
-    return this.runHooks('SubagentStop', undefined, ctx)
+    return this.runHooks('SubagentStop', agentType, ctx)
   }
 
   async executePostToolUseFailure(
@@ -268,15 +290,40 @@ export class HookEngine {
 
   // ── Core execution ──
 
+  /**
+   * Does a hook's `matcher` select this invocation?
+   *
+   * No matcher means every invocation of the event. Otherwise the stored matcher
+   * is a regex — `loadHookConfigs` compiles it as one — tested against the name
+   * this event filters on: the tool name for tool events, the agent type for the
+   * subagent events. Events that carry no such name (Stop, SessionStart, …) are
+   * not filtered here.
+   */
+  private matchesMatcher(matcher: string | undefined, name: string | undefined): boolean {
+    if (!matcher || !name) return true
+    try {
+      return new RegExp(matcher).test(name)
+    } catch {
+      // An uncompilable pattern cannot get this far through loadHookConfigs,
+      // which compiles every matcher when it loads. Keep such a hook running
+      // rather than dropping it silently.
+      return true
+    }
+  }
+
   private async runHooks(
     event: HookEvent,
     toolName: string | undefined,
     ctx: HookContext,
   ): Promise<HookResult> {
     const matching = this.hooks.filter(
-      (h) => h.event === event && (!toolName || !h.toolName || h.toolName === toolName),
+      (h) => h.event === event && this.matchesMatcher(h.toolName, toolName),
     )
 
+    // Stamped here rather than at each `executeX`: the cwd is a property of the
+    // engine, and every context this engine hands out needs it.
+    ctx.cwd = this.cwd
+
     const result: HookResult = { allowed: true }
 
     for (const hook of matching) {

package/src/core/paths.ts

@@ -7,8 +7,9 @@
  * 突然失去隔离保护（隔离度只许增不许减）。
  */
 
+import { realpathSync } from 'node:fs'
 import { homedir } from 'node:os'
-import { join } from 'node:path'
+import { basename, dirname, join } from 'node:path'
 import { MIPHAM_DIR } from '../shared/constants.ts'
 
 /** 只读兼容目录名。 */
@@ -33,6 +34,48 @@ export function worktreeRoots(cwd: string): string[] {
   return [worktreeRoot(cwd), join(cwd, LEGACY_CLAUDE_DIR, 'worktrees')]
 }
 
+/**
+ * 规范化 worktree 路径，两侧都过一遍才谈得上比较。
+ *
+ * 叶子不存在是常态（工作树已被删、或路径是模型编出来的），此时 `realpathSync`
+ * 会抛 —— 那就只规范父目录、最后一段按原样留着，否则「叶子没了」会被误读成
+ * 「拼法不同」（明明同一个路径，却因为 P 的拼法与 git 打印的不同而判成不在）。
+ */
+function canonicalWorktreePath(path: string): string {
+  const trimmed = path.endsWith('/') && path !== '/' ? path.slice(0, -1) : path
+  try {
+    return realpathSync(trimmed)
+  } catch {
+    try {
+      return join(realpathSync(dirname(trimmed)), basename(trimmed))
+    } catch {
+      return trimmed
+    }
+  }
+}
+
+/**
+ * `git worktree list --porcelain` 里是否**确实**列出了 `target` 这个工作树。
+ *
+ * 不能用 `output.includes(target)`：那是子串判定，本机实测（真 git，建出 `w1`
+ * 与 `w10`）它错在三个方向 ——
+ *   - `.../w1` 命中 **`.../w10` 那一行**（前缀当成同一个）⇒ 不存在被判成存在。
+ *     EnterWorktree 那侧因此连 `w1` 都建不出来：明明没有，它报 already exists；
+ *   - 带尾斜杠的 `.../w1/` 一行都不命中 ⇒ 存在被判成 not found；
+ *   - git 打印 **realpath 拼法**（`mktemp -d /tmp/x` 建的在 porcelain 里是
+ *     `/private/tmp/x/...`）⇒ 别名拼法一头都命中不了，而 EnterWorktree 的成功
+ *     文案里印的正是它自己算出来的那个拼法，模型照抄回来必然吃 not found。
+ *
+ * 判据是**相等**（名字比对），不是包含 —— 工作树列表里列的就是工作树根。
+ */
+export function listsWorktree(output: string, target: string): boolean {
+  const want = canonicalWorktreePath(target)
+  return output
+    .split('\n')
+    .filter((line) => line.startsWith('worktree '))
+    .some((line) => canonicalWorktreePath(line.slice('worktree '.length).trim()) === want)
+}
+
 /**
  * 在 `cwd` 中定位 worktree 标记，返回项目根与命中的标记。
  * 不在任何 worktree 内时返回 null。

package/src/core/permission-config.ts

@@ -20,21 +20,161 @@ export function loadPermissionConfig(raw: Partial<PermissionConfig> = {}): Permi
 }
 
 /**
- * Permission modes ordered from least to most permissive.
- * Used to enforce maxAllowedMode: any mode ranked higher than the cap is forbidden.
+ * Nominal permissiveness ranking, least → most permissive. Two consumers only:
+ * `maxAllowedMode` (drop every mode ranked above the cap) and `clampMode` (walk
+ * downward to the nearest allowed mode below the one requested).
+ *
+ * **The four modes are not totally ordered in reality**, so this array carries
+ * only the relations that are actually measurable:
+ *
+ * - `plan` is strictly the narrowest. It passes only Read/Grep/Glob and sends
+ *   *everything* else to approval, while `default` passes every tool that
+ *   declares `permission: 'auto'` — git, task, web-fetch, cron, memory, … So a
+ *   cap of `'plan'` must not admit `default`, and `plan` belongs at the bottom.
+ * - `acceptEdits` and `default` are **incomparable**: acceptEdits auto-approves
+ *   Write/Edit and verification-only Bash that `default` asks about, while
+ *   `default` auto-approves the non-file `'auto'` tools that acceptEdits asks
+ *   about. No total order is faithful there, so the ranking only needs to carry
+ *   the relations the two consumers rely on.
+ *
+ * The array used to read `default → acceptEdits → plan → …`, which **inverted**
+ * both `plan` relations rather than merely approximating them: `maxAllowedMode:
+ * 'plan'` admitted acceptEdits *and* default — the ceiling let through the wider
+ * mode each time. The pairs are pinned by a probe in `test/core/permission.test.ts`
+ * (P4) so the claim stays measured rather than asserted.
  */
 export const PERMISSION_MODE_HIERARCHY: PermissionMode[] = [
+  'plan',
   'default',
   'acceptEdits',
-  'plan',
   'bypassPermissions',
 ]
 
-/** Valid mode transition order for Shift+Tab cycling. */
-export const MODE_CYCLE: PermissionMode[] = [...PERMISSION_MODE_HIERARCHY]
+/**
+ * Shift+Tab cycling order — deliberately **not** the permissiveness order above.
+ * The cycle is UX (manual → accept edits → plan → bypass); only the hierarchy
+ * answers "is this mode wider than that one". Keeping them separate is what lets
+ * `forbiddenModes` drop an entry from the cycle without disturbing the ranking
+ * that `clampMode` walks.
+ */
+export const MODE_CYCLE: PermissionMode[] = ['default', 'acceptEdits', 'plan', 'bypassPermissions']
+
+/** 规范形 → 把别名与大小写归一到一个键上（键一律小写）。 */
+const MODE_ALIASES: Record<string, PermissionMode> = {
+  default: 'default',
+  plan: 'plan',
+  acceptedits: 'acceptEdits',
+  bypasspermissions: 'bypassPermissions',
+  bypass: 'bypassPermissions', // 遗留 3 档名（PermissionLevel 里的 'bypass'）
+}
+
+/** 认不出的配置一律按这一档收紧 —— 层级表首位即最严的一档（与 P4 同一真源）。 */
+const STRICTEST_MODE: PermissionMode = PERMISSION_MODE_HIERARCHY[0]!
+
+const VALID_MODE_LIST = 'default, plan, acceptEdits, bypassPermissions'
+
+/** 可读的类型名 —— 报错要说清「你给的是个字符串」，而不是只说 invalid。 */
+function describeValue(value: unknown): string {
+  if (value === null) return 'null'
+  if (Array.isArray(value)) return 'array'
+  return typeof value
+}
+
+/** 认得出就返回规范形，认不出返回 undefined（调用方负责告警）。 */
+function normalizeModeName(value: unknown): PermissionMode | undefined {
+  if (typeof value !== 'string') return undefined
+  return MODE_ALIASES[value.trim().toLowerCase()]
+}
+
+/**
+ * 校验并规范化 `permissionRestrictions`。
+ *
+ * 与 `getInvalidRules()` 同一形状：写错的**规则**一直会被告警，写错的**限制**却不会
+ * —— 而限制写错的失效方向是 **fail-open**：`forbiddenModes` 里的错拼一个模式都匹配
+ * 不上；`maxAllowedMode` 认不出时 `indexOf` 返回 -1，`if (capIdx >= 0)` 之后整个上限
+ * 被跳过。于是配置里一个 typo 就让整条组织级策略静默失效，且无任何提示。
+ *
+ * `restrictions` 是规范化后的值（别名与大小写归一、认不出的条目剔除）；
+ * `invalid` 是逐条可读告警。**只要有任意一条认不出来，就按最严一档封顶** ——
+ * 拒绝而不是忽略（忽略就是上面那种 fail-open）。
+ *
+ * 幂等：已规范化的值再喂一次，`invalid` 必为空（子代理会原样转交一次）。
+ */
+export function normalizeRestrictions(raw: unknown): {
+  restrictions?: PermissionRestrictions
+  invalid: string[]
+} {
+  if (raw === undefined || raw === null) return { restrictions: undefined, invalid: [] }
+
+  if (typeof raw !== 'object' || Array.isArray(raw)) {
+    return {
+      restrictions: { maxAllowedMode: STRICTEST_MODE },
+      invalid: [`permissionRestrictions is not an object (got ${describeValue(raw)})`],
+    }
+  }
+
+  const source = raw as Record<string, unknown>
+  const invalid: string[] = []
+  const forbiddenModes: PermissionMode[] = []
+  let maxAllowedMode: PermissionMode | undefined
+  let sawForbidden = false
+  let sawMaxAllowed = false
+
+  for (const key of Object.keys(source)) {
+    if (key !== 'forbiddenModes' && key !== 'maxAllowedMode') {
+      invalid.push(
+        `permissionRestrictions has an unknown key "${key}"; valid keys: forbiddenModes, maxAllowedMode`,
+      )
+    }
+  }
+
+  if (source.forbiddenModes !== undefined) {
+    sawForbidden = true
+    if (!Array.isArray(source.forbiddenModes)) {
+      invalid.push(
+        `permissionRestrictions.forbiddenModes must be an array (got ${describeValue(source.forbiddenModes)})`,
+      )
+    } else {
+      source.forbiddenModes.forEach((entry: unknown, i: number) => {
+        const mode = normalizeModeName(entry)
+        if (mode) forbiddenModes.push(mode)
+        else
+          invalid.push(
+            `permissionRestrictions.forbiddenModes[${i}] is not a permission mode (${JSON.stringify(entry)}); valid: ${VALID_MODE_LIST}`,
+          )
+      })
+    }
+  }
+
+  if (source.maxAllowedMode !== undefined) {
+    sawMaxAllowed = true
+    const mode = normalizeModeName(source.maxAllowedMode)
+    if (mode) maxAllowedMode = mode
+    else
+      invalid.push(
+        `permissionRestrictions.maxAllowedMode is not a permission mode (${JSON.stringify(source.maxAllowedMode)}); valid: ${VALID_MODE_LIST}`,
+      )
+  }
+
+  if (invalid.length > 0) {
+    // fail-closed：认不出来就按最严一档封顶。识别得出的部分照旧保留。
+    invalid.push(
+      `permissionRestrictions could not be fully parsed → mode pinned to the strictest ("${STRICTEST_MODE}")`,
+    )
+    const restrictions: PermissionRestrictions = { maxAllowedMode: STRICTEST_MODE }
+    if (forbiddenModes.length > 0) restrictions.forbiddenModes = forbiddenModes
+    return { restrictions, invalid }
+  }
+
+  const restrictions: PermissionRestrictions = {}
+  if (sawForbidden) restrictions.forbiddenModes = forbiddenModes
+  if (sawMaxAllowed) restrictions.maxAllowedMode = maxAllowedMode
+  if (Object.keys(restrictions).length === 0) return { restrictions: undefined, invalid: [] }
+  return { restrictions, invalid }
+}
 
 /** Resolve which modes are actually permitted given the restrictions. */
-export function getAllowedModes(restrictions?: PermissionRestrictions): PermissionMode[] {
+function getAllowedModes(restrictions?: PermissionRestrictions): PermissionMode[] {
   let allowed = [...MODE_CYCLE]
 
   if (restrictions?.forbiddenModes && restrictions.forbiddenModes.length > 0) {
@@ -52,14 +192,6 @@ export function getAllowedModes(restrictions?: PermissionRestrictions): Permissi
   return allowed
 }
 
-/** Check whether a given mode is permitted under the restrictions. */
-export function isModeAllowed(
-  mode: PermissionMode,
-  restrictions?: PermissionRestrictions,
-): boolean {
-  return getAllowedModes(restrictions).includes(mode)
-}
-
 /**
  * Return the highest allowed mode at or below `desired` given the restrictions.
  * Used to silently downgrade when a forbidden mode is requested.

package/src/core/permission-rules.ts

@@ -1,3 +1,5 @@
+import { homedir } from 'node:os'
+import { join } from 'node:path'
 import type { PermissionRuleEntry } from '../shared/index.ts'
 import { matchPath } from './credential-masker/matcher'
 
@@ -106,6 +108,9 @@ const PREFIX_COMMANDS = new Set([
   'stdbuf',
 ])
 
+/** `timeout` 的 duration 形态：`5` / `0.5` / `30s` / `2m` / `1h` / `1d`。 */
+const TIMEOUT_DURATION_RE = /^\d+(\.\d+)?[smhd]?$/
+
 /** Value-taking options of wrapper commands (consume the following token). */
 const PREFIX_VALUE_OPTIONS = new Set([
   '-u',
@@ -193,6 +198,76 @@ function stripQuotes(s: string): string {
   return s
 }
 
+/** Shell 结构符号：分组与取反 —— 它们自身不是命令，紧跟其后的是。 */
+const LEADING_SHELL_PUNCT = new Set(['(', '{', '!'])
+
+/** Shell 关键字：其后才是真正的命令（`do rm -rf x` 执行的命令是 `rm`）。 */
+const LEADING_SHELL_KEYWORDS = new Set([
+  'do',
+  'then',
+  'else',
+  'elif',
+  'if',
+  'while',
+  'until',
+  'for',
+  'case',
+  'time',
+  'coproc',
+])
+
+/** 一条前导赋值：`NAME=value`（name 是合法标识符，`=` 前无引号）。 */
+const LEADING_ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/
+
+/**
+ * 剥掉一段 shell 片段**前导**的噪声 token，露出真正的基命令。
+ *
+ * 为什么需要它：`Bash(rm *)` / `Read(secret)` 这类规则要匹配的是**命令本身**，
+ * 而 shell 允许在命令前放赋值（`IFS=x rm -rf x`）、分组符号（`( rm -rf x )`）、
+ * 关键字（`for …; do rm -rf x; done`）。这些都不改变「执行了什么命令」，却足以
+ * 让匹配器看不到 `rm`，于是 deny 规则被一个空格级的改写绕过。
+ *
+ * 只剥前导、可反复剥（`FOO=1 ! rm …`）。剥多了一律是过匹配，而 deny 规则的过
+ * 匹配是安全方向。关键字自己的裸 flag 也一并剥掉（`time -p rm …` 里的 `-p`），
+ * 否则关键字被剥走后会剩下 `-p rm …`，仍然看不见 `rm`。
+ *
+ * 不剥尾随符号（`rm -rf x )` 里的 `)`）：`wildcardMatch` 的 `*` 已经吃掉它。
+ */
+export function stripLeadingShellNoise(segment: string): string {
+  let tokens = segment.trim().split(/\s+/).filter(Boolean)
+  let stripped = false
+  let skipFlags = false
+  for (;;) {
+    const head = tokens[0]
+    if (!head) break
+    if (skipFlags && /^--?[A-Za-z]/.test(head)) {
+      tokens = tokens.slice(1)
+      stripped = true
+      continue
+    }
+    skipFlags = false
+    const bare = head.replace(/^[({!]+/, '') // `(!` 这类连写
+    if (bare !== head) {
+      tokens = bare ? [bare, ...tokens.slice(1)] : tokens.slice(1)
+      stripped = true
+      continue
+    }
+    if (LEADING_SHELL_PUNCT.has(head) || LEADING_ASSIGNMENT_RE.test(head)) {
+      tokens = tokens.slice(1)
+      stripped = true
+      continue
+    }
+    if (LEADING_SHELL_KEYWORDS.has(head)) {
+      tokens = tokens.slice(1)
+      stripped = true
+      skipFlags = true // `time -p rm …` —— 关键字自己的裸 flag 不是命令
+      continue
+    }
+    break
+  }
+  return stripped ? tokens.join(' ') : segment
+}
+
 function uniq(items: string[]): string[] {
   return [...new Set(items)]
 }
@@ -203,6 +278,29 @@ export interface BashFileAccess {
   write: string[]
 }
 
+/**
+ * 展开候选路径里**已知**的变量：前导 `~`、`$HOME`/`${HOME}`。
+ *
+ * 为什么需要：规则里写的是绝对路径（`Read(/Users/me/.ssh/id_rsa)`），而用户敲的
+ * 是同一个文件的另一种拼法（`cat ~/.ssh/id_rsa`）—— 不展开即等于放行。展开后
+ * 两种拼法落到同一个字符串上，绝对路径形与路径通配形（如「.ssh 下任意文件」）
+ * 规则都能命中。
+ *
+ * **只展开 HOME**。`$FOO` 这类未知变量原样保留：展开它需要求值环境，静默展开成
+ * 空串会让 `/x/$FOO/y` 变成 `/x//y` —— 那是**新增**一个漏判方向，比不展开更坏。
+ * `$PWD` 同理需要 cwd，而 `matchBashRule` 的调用点拿不到 cwd，故未覆盖。这两条
+ * 都是本函数已知的边界，不是遗漏。
+ *
+ * `~` 只在**开头**展开（`a/~/b` 里的 `~` 是普通字符，shell 也不展开它）。
+ */
+export function expandKnownPathVars(p: string): string {
+  const home = homedir() // 每次取，不在模块加载时绑定（HOME 可能被测试隔离改写）
+  let out = p
+  if (out === '~') out = home
+  else if (out.startsWith('~/')) out = join(home, out.slice(2))
+  return out.replace(/\$\{?HOME\}?/g, home)
+}
+
 /**
  * Extract the file paths a Bash command reads or writes, so Read()/Write()/
  * Edit() deny rules also apply to Bash (not just the Read/Write/Edit tools).
@@ -231,7 +329,9 @@ export function extractBashFileAccess(command: string): BashFileAccess {
   //    recursing into `$(...)` / backtick substitutions.
   scanReaderWriterCommands(command, read, write)
 
-  return { read: uniq(read), write: uniq(write) }
+  // 展开放在出口这一处，而不是每个 push 点 —— 重定向与读/写命令、以及它们的
+  // 递归内层都汇进这两个数组，一处展开即全覆盖。
+  return { read: uniq(read.map(expandKnownPathVars)), write: uniq(write.map(expandKnownPathVars)) }
 }
 
 /** Extract the inner commands of `$(...)` and backtick substitutions. */
@@ -244,6 +344,12 @@ function extractSubstitutions(command: string): string[] {
   while ((m = dollarParen.exec(command)) !== null) inners.push(m[1]!)
   const backtick = /`([^`]*)`/g
   while ((m = backtick.exec(command)) !== null) inners.push(m[1]!)
+  // 进程替换 `<(cmd)` / `>(cmd)`：`cat <(cat secret)` 里读 secret 的是里层的
+  // `cat`，外层只是把它的 stdout 当成一个文件名。参数排除 `<>` 是因为
+  // `<(cat secret)` 的捕获若允许 `>`，遇到 `>(...)` 形态会被提前截断；非嵌套组
+  // 由调用方的递归处理。
+  const procSub = /[<>]\(([^()<>]*)\)/g
+  while ((m = procSub.exec(command)) !== null) inners.push(m[1]!)
   return inners
 }
 
@@ -261,6 +367,12 @@ function flattenCommand(command: string, depth = 0): string[] {
     out.push(seg)
     const stripped = stripPrefixCommand(seg)
     if (stripped !== seg) out.push(stripped)
+    // 剥掉前导噪声后的形态也要参与匹配：`IFS=x rm -rf x` / `( rm -rf x )` /
+    // `for …; do rm -rf x; done` 执行的仍是 `rm`，规则必须看得见它。同一个函数
+    // 也被 scanReaderWriterCommands 用（Read/Write/Edit 桥接那条路径）—— 两条
+    // 路径共用一份归一化，只接一条就是只修一半。
+    const denoised = stripLeadingShellNoise(seg)
+    if (denoised !== seg) out.push(denoised)
     for (const inner of extractSubstitutions(seg)) {
       out.push(...flattenCommand(inner, depth + 1))
     }
@@ -303,7 +415,10 @@ function effectiveCommand(tokens: string[]): {
     if (name === 'env') {
       while (i < tokens.length && tokens[i]!.includes('=')) i++ // `VAR=value` assignments
     }
-    if (name === 'timeout') i++ // positional duration
+    // `timeout` 的位置参数是 duration，**不是**必然存在：`timeout 5 cmd` 有，
+    // `timeout --preserve-status cmd` 没有。无条件 `i++` 会把后者真正的命令
+    // （`cat`）当成 duration 吃掉，基命令退化成它的第一个参数。
+    if (name === 'timeout' && i < tokens.length && TIMEOUT_DURATION_RE.test(tokens[i]!)) i++
     // `eval`'s remaining arguments are themselves a command line, and must be
     // captured here rather than via the SHELL_COMMANDS branch below: `eval "cat
     // secret"` tokenizes to ['eval', '"cat', 'secret"'], so the base degrades to
@@ -388,7 +503,10 @@ function scanReaderWriterCommands(
   depth = 0,
 ): void {
   for (const seg of splitShellSegments(command)) {
-    const tokens = seg.split(/\s+/).filter(Boolean)
+    // 先剥前导噪声再 tokenize：`IFS=x cat secret` / `! cat secret` /
+    // `time -p cat secret` 读的是同一个文件，Read() 规则必须看得见 `cat`。
+    // 与 flattenCommand 共用 stripLeadingShellNoise —— 两条路径一份归一化。
+    const tokens = stripLeadingShellNoise(seg).split(/\s+/).filter(Boolean)
     if (tokens.length > 0) {
       const { base, args, payload } = effectiveCommand(tokens)
       if (READER_COMMANDS.has(base)) {
@@ -418,6 +536,13 @@ function scanReaderWriterCommands(
   }
 }
 
+/**
+ * `matchBashRule` 真正会按参数匹配工具名的集合。**与 matchBashRule 的分支一一
+ * 对应** —— 那里 `return false` 的工具，参数化规则在 validateRulePattern 里必须
+ * 被拒（否则规则永远不命中，是静默空防护）。改一边必须改另一边。
+ */
+const PARAMETERISED_TOOLS = new Set(['Bash', 'Read', 'Write', 'Edit', 'Grep', 'Glob'])
+
 // Match a tool(parameter) rule against an actual tool call.
 //
 // Pattern formats:
@@ -432,6 +557,7 @@ export function matchBashRule(
   pattern: string,
   toolName: string,
   toolInput: Record<string, unknown>,
+  segmentMode: 'any' | 'all' = 'any',
 ): boolean {
   // Check if pattern has a parenthesized sub-pattern
   const parenMatch = pattern.match(/^(\w+)\((.+)\)$/)
@@ -442,6 +568,20 @@ export function matchBashRule(
 
   const [, baseTool, subPattern] = parenMatch
 
+  // How a *compound* command is judged when only some parts match:
+  //   'any' (deny / ask) — one matching part is enough. Deliberately wide: a
+  //     deny rule that misses a part is a hole, so `foo && rm -rf /` must be
+  //     caught by `Bash(rm *)`.
+  //   'all' (allow) — every part must match. An allow rule is a *grant*, and
+  //     granting on one matching part hands over the whole compound command:
+  //     `Bash(git:*)` plus `git status && rm -rf ./src` used to return
+  //     `bypass` with no prompt at all.
+  // The `length > 0` guard is load-bearing: `[].every()` is `true`, so a
+  // command with no matchable segment (or no extracted file access) would
+  // otherwise satisfy **any** allow rule — a fail-open of its own.
+  const qualifies = (items: string[], match: (s: string) => boolean): boolean =>
+    segmentMode === 'all' ? items.length > 0 && items.every(match) : items.some(match)
+
   // A Read/Write/Edit rule must also refuse a Bash command that touches the
   // same file (via a reader/editor command or a redirect), not only the
   // Read/Write/Edit tool itself. Otherwise `cat .git-credentials` bypasses a
@@ -450,7 +590,7 @@ export function matchBashRule(
     const cmd = String(toolInput.command || '')
     const access = extractBashFileAccess(cmd)
     const paths = baseTool === 'Read' ? access.read : access.write
-    return paths.some((p) => matchPath(p, subPattern!))
+    return qualifies(paths, (p) => matchPath(p, subPattern!))
   }
 
   if (toolName !== baseTool!) return false
@@ -460,7 +600,7 @@ export function matchBashRule(
   // `$(...)`/backtick substitution, so `Bash(rm *)` catches `x=$(rm -rf ~)`).
   if (baseTool === 'Bash') {
     const cmd = String(toolInput.command || '')
-    return flattenCommand(cmd).some((seg) => wildcardMatch(subPattern!, seg))
+    return qualifies(flattenCommand(cmd), (seg) => wildcardMatch(subPattern!, seg))
   }
 
   // For Write/Edit/Read: match against the file_path with path-glob semantics.
@@ -500,6 +640,10 @@ export function wildcardMatch(pattern: string, input: string): boolean {
  * `Bash()`) is silently dead today — this returns a human-readable reason so
  * the caller can report it as an invalid setting instead of ignoring it.
  *
+ * 校验的是**结构 + 工具名**（后者见 PARAMETERISED_TOOLS）。**不**校验子模式本身
+ * 能否匹配任何东西 —— `Bash(zzz *)` 合法、装得上、只是不会命中，那是用户自己的
+ * 选择，不是配置错误。
+ *
  * Returns null when the pattern is valid, or a reason string when malformed.
  */
 export function validateRulePattern(pattern: string): string | null {
@@ -510,9 +654,16 @@ export function validateRulePattern(pattern: string): string | null {
     // Empty parameter: `Bash()` or `Bash( )`
     if (/\(\s*\)$/.test(pattern)) return 'empty parameter'
     // Must be exactly `ToolName(param)` with nothing before or after.
-    if (!/^(\w+)\((.+)\)$/.test(pattern)) {
+    const shape = pattern.match(/^(\w+)\((.+)\)$/)
+    if (!shape) {
       return 'unexpected text after the closing parenthesis'
     }
+    // 工具名必须落在 matchBashRule 真正会按参数匹配的那一集合里，否则这条规则是
+    // **静默空防护**：语法合法、装得上、永远不命中，而用户以为配了保护。
+    const tool = shape[1]!
+    if (!PARAMETERISED_TOOLS.has(tool)) {
+      return `parameterised rules are not supported for tool "${tool}" (it would never match)`
+    }
     return null
   }