@sema-agent/core 5.57.0 → 5.59.0

package/dist/core/permission-rule-model.d.ts

@@ -32,6 +32,12 @@
  * deny/ask layer (`permission-rule-org.ts`) judges every segment and runs ahead of the allow lane at
  * the gate — a compound-prefix allow can therefore never outrun a deny on any segment it admits.
  *
+ * design/375 adds upstream's OTHER half of that per-segment evaluation on the allow side: a compound
+ * whose EVERY segment is admitted by some eligible rule is covered by the CONJUNCTION of those rules
+ * (`findAdmittingRule` answers with the coverage SET). No single rule widens: the matcher predicates
+ * above are untouched, and the set form is the decision layer's answer, fenced by the same
+ * ahead-running per-segment deny/ask layer.
+ *
  * The floor is `parseLeadingCommandName` + `splitShellCompoundSegments` — the one simple-command parser
  * and the one segmentation, both already shared with the read-only classifier, the reversibility probe,
  * the coarse command-name policy and the skill tool specifier. A second tokenizer would drift, and drift
@@ -276,6 +282,40 @@ export declare const SUGGESTION_LEXICON: readonly string[];
  * through, so an ordinary rule text reads normally. The result is length-bounded.
  */
 export declare function escapeForDisclosure(value: unknown): string;
+/**
+ * Render raw, untrusted COMMAND text for a display surface — the minimal safe baseline for the seats
+ * that carry post-rewrite command bytes verbatim ({@link SegmentRuleSuggestion.segment} is the
+ * motivating one; a card's own `command`/`args` echo has the same hazard).
+ *
+ * WHAT IT DOES, and why the two character families are not handled the same way:
+ *  · `\p{Cf}` (the bidirectional controls U+061C/U+200E/U+200F/U+202A–U+202E/U+2066–U+2069 and the
+ *    zero-width formatters ZWSP/ZWNJ/ZWJ/WORD JOINER/SOFT HYPHEN/BOM) is REMOVED. These occupy no
+ *    width, so deleting them is what makes the rendered line agree with what a reader believes they
+ *    are reading — a `rm -rf x` that DISPLAYS as something benign is exactly the deception the seat
+ *    would otherwise hand on. This is the same family
+ *    {@link import("./tool-policy.js").AskRequest.hasBidiControls} raises its warning bit for; the
+ *    bit says "the raw bytes carry them", this function is what a surface renders instead.
+ *  · Controls and line/paragraph separators (C0 incl. TAB and NEWLINE, DEL, C1, U+2028/U+2029) are
+ *    FOLDED TO A SPACE with runs collapsed, not removed: they occupy width (or a whole line), and
+ *    deleting them would glue two tokens into one word that reads as a different command. TAB is not
+ *    excepted here — a one-line display value has no use for one, and a rule text's foldable-tab
+ *    exception belongs to the VALIDATOR class, not to this one.
+ * The result is then capped by code point (never splitting a surrogate pair) with a `…` marker, and
+ * carries the shared authority-envelope neutralization every untrusted inline value gets — this text
+ * can land on a model-visible line as easily as on a human one.
+ *
+ * WHAT IT IS NOT. A DISPLAY baseline, never an identity channel and never adjudication input: the
+ * transform is LOSSY and NOT injective (two distinct commands can render identically — that is the
+ * price of a readable line). Correlate, match, store and adjudicate on the RAW bytes, which the
+ * carrying seats keep unchanged: this function neither changes what those seats contain nor what any
+ * of them means. A caller that must instead tell two hostile texts APART wants
+ * {@link escapeForDisclosure} (which escapes rather than folds, so nothing collides) or
+ * {@link hasUnrenderableCharacters} (refuse instead of render).
+ *
+ * @param text the raw untrusted text (a `String(x)` is applied to anything that is not one).
+ * @param maxLen code-point cap for the rendered result; defaults to the disclosure-line budget.
+ */
+export declare function renderUntrustedCommandText(text: unknown, maxLen?: number): string;
 /**
  * Does this text carry a character of the class {@link escapeForDisclosure} exists for — the class
  * {@link CONTROL_CHARS_RE} names? Asked by a caller that must REFUSE such a value rather than render
@@ -367,35 +407,188 @@ export declare function scopeCoversCwd(scope: RuleScope, cwd: string | undefined
  *  when tombstones are applied, so a rule with an empty `adds` is a rule that no longer exists. */
 export declare function isRuleLive(rule: PersistedAllowRule): boolean;
 /**
- * Find the rule that admits this command for a task in `cwd`, or `undefined`.
+ * design/375 §5.1 — MAY this rule speak about this call's CONTEXT? Tool identity plus scope coverage,
+ * and nothing about the rule's liveness: the CONTEXT question is the half a not-yet-persisted rule (a
+ * card's proposed candidate, which has no add dots yet) can already answer.
+ *
+ * The tool conjunct is not decoration: more than one tool takes a shell command string, and matching on
+ * the command alone would let an approval given on one surface resolve a call on another. The scope
+ * conjunct is the project fence — project A's approval is not project B's, and a project rule with no
+ * cwd to compare against covers nothing (fail-closed, {@link scopeCoversCwd}).
  *
- * Order is defined only for reporting (the first match wins and its text is what the decision names);
- * no rule is stronger than another — they are all the same one answer, "the person already said yes to
- * this".
+ * `scope` rides beside the rule rather than inside it for the PROPOSED half's sake: a
+ * {@link ParsedAllowRule} carries no scope, so a proposal is judged against the scope it would LAND in.
+ */
+export declare function eligibleContext(rule: {
+    tool: string;
+    scope: RuleScope;
+}, call: {
+    tool: string;
+    cwd: string | undefined;
+}): boolean;
+/**
+ * design/375 §5.1 — MAY this PERSISTED rule participate in admitting this call at all? The liveness
+ * layer on top of {@link eligibleContext}: a tombstoned rule (zero surviving adds) is a rule that no
+ * longer exists and must not count as coverage anywhere.
+ *
+ * THE single eligibility predicate for every consumer that reads the persisted store — the gate's
+ * conjunction arm and its coverage-set selection here, the suggestion face's coverage judgement and the
+ * consent prepare's ({@link segmentCoverageOf} is the shared instrument). One predicate, so a rule that
+ * one consumer refuses cannot be a rule another counts: the historically inlined trio of checks
+ * (live / tool / scope) is this function, verbatim.
+ */
+export declare function eligiblePersisted(rule: PersistedAllowRule, call: {
+    tool: string;
+    cwd: string | undefined;
+}): boolean;
+/**
+ * Find the rules that admit this command for a task in `cwd`, or `undefined`.
+ *
+ * THE ANSWER IS A COVERAGE SET (design/375 §5.1, the upstream per-segment form): a single rule that
+ * admits the whole command is a one-element set — the historical arm, table order preserved verbatim —
+ * and a COMPOUND whose every segment is admitted by some eligible rule is covered by the CONJUNCTION of
+ * those rules, returned as the set that covered it. The judging ladder, in order:
+ *  1. the fail-closed floor (a shape the lane cannot read matches nothing), evaluated once;
+ *  2. the single-rule arm — whole-string exact, single/compound-prefix — exactly the historical loop:
+ *     first table-order match wins and is what the decision names. A single rule naming the command is
+ *     found BEFORE any conjunction: reporting one rule is narrower than reporting a set;
+ *  3. the conjunction arm, compounds only: every segment must be admitted by some eligible rule under
+ *     the MATCH reading (the allow side's own under-approximating instrument — never the deny side's
+ *     wider PROGRAM_RUNS reading). Per segment the FIRST table-order admitting rule is selected, and
+ *     the coverage set is those selections in segment order, de-duplicated — the same command against
+ *     the same rule table always names the same set (reporting-order determinism, the historical
+ *     "order is defined only for reporting" contract extended to sets).
+ *
+ * What the conjunction arm deliberately does NOT change: {@link ruleAdmitsCommand} itself. A
+ * single-command prefix body still never admits a chain — `Bash(npm:*)` does not admit
+ * `npm test && curl evil.example` — but the chain is now admitted when EVERY segment has a standing
+ * yes, which is the upstream decision form (per-segment allow, any-segment deny decided strictly
+ * earlier at the gate's org layer). A trailing-terminator spelling (`a && b ;`) keeps the conservative
+ * answer by construction: under the MATCH reading its tail is an empty segment the floor refuses, so
+ * the whole command is outside the lane and asks.
+ *
+ * Order is defined only for reporting (what the decision names); no rule is stronger than another —
+ * they are all the same one answer, "the person already said yes to this".
  */
 export declare function findAdmittingRule(rules: readonly PersistedAllowRule[], call: {
     tool: string;
     command: string;
     cwd: string | undefined;
-}): PersistedAllowRule | undefined;
-/** A rule the engine offers to mint, as carried on an approval card. */
-export interface RuleSuggestion {
+}): readonly PersistedAllowRule[] | undefined;
+/**
+ * design/375 §5.2 — the per-segment coverage table for `command`: which segments an eligible rule
+ * already admits, judged with the SAME split, the same MATCH reading and the same eligibility
+ * predicates as the gate's conjunction arm — one instrument, so the suggestion face and the consent
+ * prepare can never call a segment covered that the gate would ask about (or vice versa).
+ *
+ * TWO SOURCES, two predicates, and the seat labels are the contract:
+ *  · `persisted` — rules already in the store, judged {@link eligiblePersisted} ∧ admit: a tombstoned
+ *    rule, another project's rule and another tool's rule are uniformly NOT coverage;
+ *  · `proposed` — rules of the CURRENT batch that are not yet persisted (no add dots yet), judged
+ *    {@link eligibleContext} ∧ admit against the scope each would land in. Judging these with the
+ *    persisted predicate would make "this batch, once redeemed, covers the command" permanently false
+ *    — the liveness layer is the one thing a proposal legitimately lacks.
+ *
+ * Returns `undefined` for a command the lane cannot read at all (the fail-closed floor — the caller's
+ * honest answer is then "no coverage table", which every consumer must treat as all-uncovered). The
+ * reported `segment` texts are the FOLDED spellings, trimmed — display/correlation seats, never
+ * adjudication inputs.
+ */
+export declare function segmentCoverageOf(command: string, rules: {
+    persisted: readonly PersistedAllowRule[];
+    proposed?: readonly {
+        rule: ParsedAllowRule;
+        scope: RuleScope;
+    }[];
+}, call: {
+    tool: string;
+    cwd: string | undefined;
+}): readonly SegmentCoverage[] | undefined;
+/** One row of a per-segment coverage table (see {@link segmentCoverageOf}): the FOLDED, trimmed
+ *  segment text (a display/correlation seat, never adjudication input) and whether an eligible rule
+ *  already admits it. */
+export interface SegmentCoverage {
+    readonly segment: string;
+    readonly covered: boolean;
+}
+/** One member of a {@link RuleOffer} batch: a rule the engine offers to mint for ONE segment of a
+ *  compound command. `segment` is the FOLDED segment text the member was minted from — a rendering
+ *  seat, never adjudication input. */
+export interface SegmentRuleSuggestion {
     /** The canonical rule text the host would redeem. */
-    rule: string;
-    match: PersistedRuleMatch;
+    readonly rule: string;
+    readonly match: PersistedRuleMatch;
     /** The command pattern in the rule, for a host that wants to render it without re-parsing. */
-    command: string;
+    readonly command: string;
+    /** The (folded) segment this suggestion came from. Raw post-rewrite command bytes — a substring
+     *  of the same call's `args`/`command` values riding beside it on every surface that carries
+     *  this seat — so render it with contextual escaping, exactly like those.
+     *
+     *  RAW is the contract here and does not change: this seat carries the bytes, because the bytes are
+     *  what a rule would be minted from and what a correlation keys on. The rendering side of that
+     *  contract is {@link renderUntrustedCommandText} — the shipped display baseline (bidi and
+     *  zero-width controls removed, controls/line separators folded, length capped, envelope-neutralized)
+     *  a surface can adopt instead of writing its own, since raw command bytes displayed unprocessed can
+     *  show a reader something other than what they authorize. */
+    readonly segment: string;
 }
 /**
- * The 1-2 candidates offered on an approval card for `command`.
+ * design/375 §3.1 — ONE "don't ask again" option on an approval card. A CLOSED discriminated union
+ * (`kind`); consumers parse it per element, and an element whose `kind` they do not know is dropped
+ * (single-row degrade) while keeping the ORIGINAL wire index for every element they keep — selection
+ * and redemption are keyed on original indices, so a consumer that cannot preserve the mapping must
+ * suppress its persistence actions entirely (fail toward asking).
+ *
+ *  · `kind: "single"` — one rule covering the WHOLE command (the exact spelling, or a broader
+ *    reviewed prefix form for a simple command).
+ *  · `kind: "batch"` — a CONJUNCTION batch of per-segment rules for a compound command. Choosing it
+ *    is one yes to ALL of `rules` at once — there is no per-member selection inside a batch; a
+ *    consumer that wants a narrower answer picks the single offer or approves once without a rule.
+ *    `rules` has 1..5 members (the card-lane minting cap), in segment order, deduplicated by rule
+ *    text. `uncoveredSegments` is the honest surplus disclosure of the cap: judged at MINT time
+ *    against the coverage snapshot the card was drawn from ∪ this batch's FINAL (deduplicated,
+ *    capped) rules, it counts the violating segments still admitted by neither — 0 means "once this
+ *    batch is redeemed, this compound is fully covered by that snapshot's lights". It is a statement
+ *    about the minting snapshot, not a standing guarantee: a concurrent rule removal can date it.
+ *
+ * Array contract (`ruleOffers`, the durable park row, and the consent record's projection while
+ * the card is PENDING all share it): at most 2 offers; the whole-string exact single is index 0
+ * whenever present; the batch offer — at most one — is always last. It is a draw-time contract,
+ * not a settled-record invariant: confirming an EDITED candidate appends a third single offer
+ * AFTER the batch in the same write that settles the record, so a SETTLED record's projection may
+ * carry it. ADVISORY display metadata, never adjudication input, and never a
+ * rule by itself: minting is a separate act that goes through the approval-record protocol, so a
+ * surface that ignores offers entirely changes nothing about what is allowed. The authoritative
+ * render source for a card is the PREPARED record's own offers (record-is-what-you-see); the ask-time
+ * projection here may drift from it across a coverage change, and the drift direction is harmless
+ * (the record is what gets confirmed).
+ */
+export type RuleOffer = {
+    readonly kind: "single";
+    /** The canonical rule text the host would redeem. */
+    readonly rule: string;
+    readonly match: PersistedRuleMatch;
+    /** The command pattern in the rule, for a host that wants to render it without re-parsing. */
+    readonly command: string;
+} | {
+    readonly kind: "batch";
+    /** 1..5 per-segment rules, segment order, deduplicated by rule text. */
+    readonly rules: readonly SegmentRuleSuggestion[];
+    /** Mint-time honest surplus: violating segments admitted by neither the coverage snapshot nor
+     *  this batch's final rules (see the union doc above for the exact arithmetic). */
+    readonly uncoveredSegments: number;
+};
+/**
+ * The offers presented on an approval card for `command` (design/375 §5.2).
  *
- * **Array order is a documented CONTRACT, not an implementation accident**: display order = array
- * order = narrowest first. The EXACT form (this whole command line) is always index 0 whenever
- * anything is offered at all; a broader reviewed PREFIX form — at most one — follows at index 1.
- * Selection indices and redemption tickets are index-keyed against this order (a card's
- * `selectedCandidate` and its `rt.<index>.` tickets), so consumers may rely on it.
+ * **Array order is a documented CONTRACT, not an implementation accident** (see {@link RuleOffer}):
+ * the whole-string EXACT single is index 0 whenever present; a SIMPLE command may carry a broader
+ * reviewed PREFIX single after it; a COMPOUND carries at most one BATCH offer, always last.
+ * Selection indices are keyed against this order, so consumers may rely on it; redemption TICKETS
+ * are NOT — they key on the consent record's flat CANDIDATE list, and a chosen offer is redeemed
+ * via `redeemRuleBatch` (see the consent record's own doc for the two index spaces).
  *
- * The prefix candidate is the LONGEST body two sources agree to offer: {@link SUGGESTION_LEXICON}'s
+ * The prefix single is the LONGEST body two sources agree to offer: {@link SUGGESTION_LEXICON}'s
  * deeper-than-two-words rows first, and otherwise {@link genericPrefixBody}'s general two-word form
  * (`argv[0]` + a token shaped like a subcommand). Read those two for the grammar, its adopted origin,
  * and the operand false positive it accepts; the short version is that a bare verb (`git`), an
@@ -407,9 +600,10 @@ export interface RuleSuggestion {
  * "no prefix".
  *
  * Every produced candidate must survive the round trip — parse as a rule, come back as the match form
- * this seat is offering, AND admit the very command it was minted from. Enforced on BOTH seats,
- * fail-closed: a candidate that would not round-trip is silently not offered, since offering an option
- * redemption would refuse is worse than offering one fewer.
+ * its seat is offering, AND admit the very text it was minted from (the whole command for a single,
+ * its own segment for a batch member). Enforced on EVERY seat, fail-closed: a candidate that would
+ * not round-trip is silently not offered, since offering an option redemption would refuse is worse
+ * than offering one fewer.
  *
  * The FORM half of that check is not decoration. A command may end in the rule grammar's own prefix
  * marker — `rm :*` is a legal thing to type — and wrapping it as an exact rule produces the text
@@ -419,19 +613,29 @@ export interface RuleSuggestion {
  * for a lexicon command like `git status :*`, emitted twice — once mislabelled, once as the real prefix
  * candidate). The seat therefore believes the PARSER about what it got back, never its own request.
  *
- * A COMPOUND (`./gradlew build && ./gradlew test`) fills the exact seat — the offered rule spells the
- * whole chain and admits exactly it (the shape this seat was missing: the ordinary build invocation is
- * a connector chain, and a card that could offer nothing for it made every such command a fresh
- * question forever) — and, when its FINAL segment yields a prefix body under the very same grammar the
- * single-command seat uses, a COMPOUND-PREFIX candidate besides: the leading segments verbatim,
- * connectors and all, with the final segment cut down to its body (`cd /tmp && adb pull /sdcard/x .`
- * offers `Bash(cd /tmp && adb pull:*)`). A final segment the grammar declines — a flag in second
- * position, a screened head, one token — leaves the chain with its exact seat alone, exactly as the
- * same shape leaves a simple command. No seat is ever minted off a NON-final segment: those are the
- * byte-exact half of the rule, so there is nothing to widen.
+ * A COMPOUND (`./gradlew build && ./gradlew test`) fills the exact single — the offered rule spells
+ * the whole chain and admits exactly it — and a BATCH offer besides: every segment NOT already
+ * covered (per `ctx.coverage`) yields its own single-segment best form — a prefix when the
+ * single-command grammar grants one for that segment's tokens (the interception screens apply
+ * unchanged), otherwise the segment's exact — deduplicated by rule text in segment order and capped
+ * at FIVE (upstream's own batch cap; the overflow is disclosed via `uncoveredSegments` rather than
+ * silently truncated away). A segment whose every form the floor refuses simply contributes no
+ * member (and stays counted as uncovered — the honest gap). The COMPOUND-PREFIX candidate this seat
+ * used to mint here is deliberately NO LONGER OFFERED (design/375 §5.3): the batch takes its card
+ * position, while the compound-prefix GRAMMAR remains a fully supported rule family — the matcher,
+ * the hand-written/edited/import channels and every persisted such rule are untouched.
+ *
+ * `ctx.coverage` is the per-segment coverage table minted by the SAME store read that adjudicated
+ * the call (see {@link segmentCoverageOf} and the gate's engine-stamped seat) — positional over this
+ * function's own folded segments, belt-checked by text: a table whose length or segment texts do not
+ * line up is discarded whole, and an absent or discarded table reads as ALL-UNCOVERED (fail toward
+ * over-offering; every offered rule still passes the validator at redemption, so an over-offer widens
+ * nothing).
  *
  * Returns an empty array for anything the rule lane cannot speak for (redirections, substitutions,
  * subshells, backgrounding) — the card then simply carries no "don't ask again" option, which is the
  * honest answer.
  */
-export declare function suggestRulesForCommand(command: string): RuleSuggestion[];
+export declare function suggestRulesForCommand(command: string, ctx?: {
+    readonly coverage?: readonly SegmentCoverage[];
+}): RuleOffer[];

package/dist/core/permission-rule-model.js

@@ -1,5 +1,6 @@
 import { parsePermissionRule } from "./permission-rules.js";
 import { parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
+import { inlineUntrusted } from "./untrusted-text.js";
 export const MAX_RULE_TEXT_CHARS = 512;
 export const BARE_INTERPRETER_NAMES = new Set([
     "node", "deno", "bun", "python", "python2", "python3", "perl", "ruby", "php", "osascript",
@@ -162,6 +163,17 @@ export function escapeForDisclosure(value) {
     });
     return escaped.length <= DISCLOSED_RULE_TEXT_MAX_CHARS ? escaped : `${escaped.slice(0, DISCLOSED_RULE_TEXT_MAX_CHARS)}…`;
 }
+const DISPLAY_STRIP_FORMAT_RE = /\p{Cf}/gu;
+export function renderUntrustedCommandText(text, maxLen = DISCLOSED_RULE_TEXT_MAX_CHARS) {
+    let raw;
+    try {
+        raw = typeof text === "string" ? text : String(text);
+    }
+    catch {
+        return "<unprintable>";
+    }
+    return inlineUntrusted(raw.replace(DISPLAY_STRIP_FORMAT_RE, ""), maxLen);
+}
 export function hasUnrenderableCharacters(text) {
     return CONTROL_CHARS_RE.test(text);
 }
@@ -247,60 +259,118 @@ export function scopeCoversCwd(scope, cwd) {
 export function isRuleLive(rule) {
     return rule.adds.length > 0;
 }
-export function findAdmittingRule(rules, call) {
-    const shape = ruleLaneShapeOf(call.command, MATCH_READING);
-    if ("reject" in shape)
-        return undefined;
+export function eligibleContext(rule, call) {
+    return rule.tool === call.tool && scopeCoversCwd(rule.scope, call.cwd);
+}
+export function eligiblePersisted(rule, call) {
+    return isRuleLive(rule) && eligibleContext(rule, call);
+}
+function firstEligibleAdmittingRule(rules, commandText, call) {
     for (const rule of rules) {
-        if (!isRuleLive(rule))
-            continue;
-        if (rule.tool !== call.tool)
+        if (!eligiblePersisted(rule, call))
             continue;
-        if (!scopeCoversCwd(rule.scope, call.cwd))
-            continue;
-        if (ruleAdmitsCommand(rule, call.command))
+        if (ruleAdmitsCommand(rule, commandText))
             return rule;
     }
     return undefined;
 }
-export function suggestRulesForCommand(command) {
+export function findAdmittingRule(rules, call) {
+    const shape = ruleLaneShapeOf(call.command, MATCH_READING);
+    if ("reject" in shape)
+        return undefined;
+    const whole = firstEligibleAdmittingRule(rules, call.command, call);
+    if (whole !== undefined)
+        return [whole];
+    if (shape.segments.length < 2)
+        return undefined;
+    const covering = [];
+    for (const segment of shape.segments) {
+        const first = firstEligibleAdmittingRule(rules, segment, call);
+        if (first === undefined)
+            return undefined;
+        if (!covering.includes(first))
+            covering.push(first);
+    }
+    return covering;
+}
+export function segmentCoverageOf(command, rules, call) {
+    const folded = foldSpacing(command);
+    if (folded === undefined)
+        return undefined;
+    const shape = ruleLaneShapeOf(folded, MATCH_READING);
+    if ("reject" in shape)
+        return undefined;
+    const proposed = rules.proposed ?? [];
+    return shape.segments.map((segment) => ({
+        segment: segment.trim(),
+        covered: firstEligibleAdmittingRule(rules.persisted, segment, call) !== undefined ||
+            proposed.some((p) => eligibleContext({ tool: p.rule.tool, scope: p.scope }, call) && ruleAdmitsCommand(p.rule, segment)),
+    }));
+}
+export function suggestRulesForCommand(command, ctx) {
     const shape = ruleLaneShapeOf(command, MATCH_READING);
     if ("reject" in shape)
         return [];
     const folded = foldSpacing(command);
     if (folded === undefined)
         return [];
-    const out = [];
+    const offers = [];
     const exact = parseAllowRuleText(formatAllowRuleText(folded, "exact"));
     if ("rule" in exact && exact.rule.match === "exact" && ruleAdmitsCommand(exact.rule, command)) {
-        out.push({ rule: exact.rule.rule, match: "exact", command: exact.rule.command });
+        offers.push({ kind: "single", rule: exact.rule.rule, match: "exact", command: exact.rule.command });
     }
-    const offerPrefix = (body) => {
-        if (body === undefined)
-            return;
-        const text = formatAllowRuleText(body, "prefix");
-        const parsed = parseAllowRuleText(text);
-        if ("rule" in parsed && parsed.rule.match === "prefix" && ruleAdmitsCommand(parsed.rule, command)) {
-            out.push({ rule: parsed.rule.rule, match: "prefix", command: parsed.rule.command });
-        }
-    };
     const tokensOf = (s) => s.split(/\s+/).filter((t) => t !== "");
     const bodyOf = (tokens) => longestReviewedBody(tokens) ?? genericPrefixBody(tokens);
-    if (out.length === 1) {
-        if (shape.segments.length === 1) {
-            offerPrefix(bodyOf(tokensOf(folded)));
-        }
-        else {
-            const foldedShape = ruleLaneShapeOf(folded, MATCH_READING);
-            if (!("reject" in foldedShape) && foldedShape.segments.length === shape.segments.length) {
-                const rawLast = foldedShape.segments[foldedShape.segments.length - 1] ?? "";
-                const lastBody = bodyOf(tokensOf(rawLast));
-                if (lastBody !== undefined) {
-                    const cut = folded.length - rawLast.length + (rawLast.length - rawLast.trimStart().length);
-                    offerPrefix(folded.slice(0, cut) + lastBody);
+    if (shape.segments.length === 1) {
+        if (offers.length === 1) {
+            const body = bodyOf(tokensOf(folded));
+            if (body !== undefined) {
+                const parsed = parseAllowRuleText(formatAllowRuleText(body, "prefix"));
+                if ("rule" in parsed && parsed.rule.match === "prefix" && ruleAdmitsCommand(parsed.rule, command)) {
+                    offers.push({ kind: "single", rule: parsed.rule.rule, match: "prefix", command: parsed.rule.command });
                 }
             }
         }
+        return offers;
+    }
+    const foldedShape = ruleLaneShapeOf(folded, MATCH_READING);
+    if ("reject" in foldedShape || foldedShape.segments.length !== shape.segments.length)
+        return offers;
+    const segments = foldedShape.segments.map((s) => s.trim());
+    const table = ctx?.coverage;
+    const alignedTable = table !== undefined && table.length === segments.length && table.every((row, i) => row.segment === segments[i]) ? table : undefined;
+    const coveredAt = (i) => alignedTable?.[i]?.covered === true;
+    const mintSegmentRule = (segment) => {
+        const body = bodyOf(tokensOf(segment));
+        if (body !== undefined) {
+            const parsed = parseAllowRuleText(formatAllowRuleText(body, "prefix"));
+            if ("rule" in parsed && parsed.rule.match === "prefix" && ruleAdmitsCommand(parsed.rule, segment)) {
+                return { rule: parsed.rule.rule, match: "prefix", command: parsed.rule.command };
+            }
+        }
+        const segExact = parseAllowRuleText(formatAllowRuleText(segment, "exact"));
+        if ("rule" in segExact && segExact.rule.match === "exact" && ruleAdmitsCommand(segExact.rule, segment)) {
+            return { rule: segExact.rule.rule, match: "exact", command: segExact.rule.command };
+        }
+        return undefined;
+    };
+    const minted = [];
+    for (let i = 0; i < segments.length; i++) {
+        if (coveredAt(i))
+            continue;
+        const segment = segments[i];
+        const rule = mintSegmentRule(segment);
+        if (rule !== undefined && !minted.some((m) => m.rule === rule.rule))
+            minted.push({ ...rule, segment });
+    }
+    const batchRules = minted.slice(0, 5);
+    if (batchRules.length > 0) {
+        const parsedBatch = batchRules.flatMap((r) => {
+            const p = parseAllowRuleText(r.rule);
+            return "rule" in p ? [p.rule] : [];
+        });
+        const uncoveredSegments = segments.filter((segment, i) => !coveredAt(i) && !parsedBatch.some((p) => ruleAdmitsCommand(p, segment))).length;
+        offers.push({ kind: "batch", rules: batchRules, uncoveredSegments });
     }
-    return out;
+    return offers;
 }

package/dist/core/permission-rules.d.ts

@@ -7,7 +7,7 @@
  * run-loop 介入的「声明式数据→ToolPolicy」工厂(`createCoarseCommandNamePolicy` 同形态先例)。
  * core 不读设置文件、不管 source 层级合并 —— Settings-loader 把各层合并成**单一规则表**后编译
  * **一个** policy(不要按层各编译再组合:combinePolicies 的 fold 里 ask 胜 allow,跨 policy 的
- * 显式 allow 规则会被另一 policy 的 ask 吞掉 —— codex 127 审 B3)。
+ * 显式 allow 规则会被另一 policy 的 ask 吞掉)。
  *
  * 🔴 与 CC 的三处有意差(design/127 r2):
  *  - CC 参数级 generic 道无 allow lane(gnn 只有 deny/ask)—— 我们同样:`allow` + 参数级 content =
@@ -16,7 +16,7 @@
  *    **工厂 validator strict**:降级即 invalid(fail-fast 世界观,写错的规则不能静默变宽)。
  *  - 已知主字段参数规则(如 `Bash(command:…)`)默认 **reject**:通配是 trim 后**整串 lexical**
  *    匹配,不是 shell AST / 前缀 lane —— `Bash(command:git push*)` 匹配不了 `cd /x && git push`,
- *    「以为挡住了」比没挡更危险(codex 127 审 M2)。`primaryFieldGeneric:"allow-lexical"` 显式解锁。
+ *    「以为挡住了」比没挡更危险。`primaryFieldGeneric:"allow-lexical"` 显式解锁。
  */
 import type { NamedToolPolicy } from "./tool-policy.js";
 /** [K-PLATFORM-SWEEP] MINOR#11: Bash's REAL non-primary arg names, accepted as generic param rules
@@ -28,7 +28,7 @@ export interface PermissionRule {
     /** CC 语法:`"Tool"` 或 `"Tool(param:pattern)"`。`Tool()`/`Tool(*)` 归一为裸规则;括号可 `\(`/`\)` 转义。 */
     rule: string;
     behavior: "deny" | "ask" | "allow";
-    /** Provenance(codex 127 审 M7):进 deny/ask 的 message 供审计(e.g. `"policySettings"`)。层级
+    /** Provenance:进 deny/ask 的 message 供审计(e.g. `"policySettings"`)。层级
      *  优先级/tighten-only 语义在 Settings-loader,不在这里。 */
     source?: string;
 }
@@ -40,7 +40,7 @@ export interface ParsedPermissionRule {
 }
 export interface PermissionRuleIssue {
     rule: string;
-    /** `invalid.*` = 语法/语义错;`unsupported.*` = CC 合法但 v1 不支持的 lane(codex 127 审 B5:独立
+    /** `invalid.*` = 语法/语义错;`unsupported.*` = CC 合法但 v1 不支持的 lane(独立
      *  分类,绝不静默 no-op —— `Bash(npm run:*)` 被当 generic 参数规则接受后永不匹配是最危险的失败形态)。 */
     code: "invalid.empty_tool" | "invalid.paren" | "invalid.param_split" | "invalid.allow_param_rule" | "invalid.primary_field" | "invalid.cap_exceeded" | "unsupported.bash_prefix"
     /** design/179 D7: a Bash prefix rule under `bashPrefixLane:"rules-store"` — reported so a migration
@@ -65,20 +65,20 @@ export interface PermissionRuleCaps {
     maxStars: number;
     /** Scalar arg values longer than this are NOT matched textually — the rule **fail-closes** to its
      *  lane (a deny rule targeting an oversized value denies; an ask rule asks). 租户规则 × 模型巨串
-     *  的热路径成本上界(codex 127 审 M6)。 */
+     *  的热路径成本上界。 */
     maxScalarValueChars: number;
 }
 export interface PermissionRulePolicyOptions {
     /** Invalid/unsupported rules: `"throw"`(default — 部署作者写错要立刻知道)aggregates ALL issues
      *  into one error; `"skip"` drops them (pair with {@link validatePermissionRules} for a report, and/or
-     *  supply {@link onIssue}). Exception(codex 实现审 M3):`invalid.cap_exceeded` on the WHOLE rule set
+     *  supply {@link onIssue}). Exception(实现审 M3):`invalid.cap_exceeded` on the WHOLE rule set
      *  (maxRules) throws EVEN under `"skip"` — skipping it would compile an EMPTY table and fail-open. */
     onInvalidRule?: "throw" | "skip";
     /** Called once per dropped rule under `"skip"` (audit surface — silent drops are how a deployment
      *  discovers, months later, that its deny never existed). Default: one aggregated `console.warn`. */
     onIssue?: (issue: PermissionRuleIssue) => void;
     /** What the policy returns when NO rule matches. Default `"allow"` = 本 policy 无意见(组合语义)。
-     *  default-closed 部署用 `"ask"`/`"deny"` —— 必须在这 INSIDE the policy(codex 127 审 B3:链尾
+     *  default-closed 部署用 `"ask"`/`"deny"` —— 必须在这 INSIDE the policy(链尾
      *  ask policy 会在 fold 里吞掉本 policy 的显式 allow)。 */
     defaultAction?: "allow" | "ask" | "deny";
     /** 已知主字段参数规则(`Bash(command:…)` 等)的处置。默认 `"reject"`(整串 lexical ≠ 前缀/AST,
@@ -136,7 +136,7 @@ export declare function namespacedRuleNameCovers(ruleName: string, toolName: str
 export declare function isNamespacedCoveringRuleName(name: string): boolean;
 /** Exported for the lockstep guard only (see {@link FILE_TOOL_PARAMS}) — not part of the rule DSL. */
 export declare const fileToolParamVocabulary: (canonicalTool: string) => ReadonlySet<string> | undefined;
-/** Dry-run 校验/迁移报告(codex 127 审 B5):不 throw,返回全部 issues(含 `unsupported.*` 分类,
+/** Dry-run 校验/迁移报告:不 throw,返回全部 issues(含 `unsupported.*` 分类,
  *  供从 CC settings 迁移的部署逐条对照)。 */
 export declare function validatePermissionRules(rules: PermissionRule[], opts?: Pick<PermissionRulePolicyOptions, "primaryFieldGeneric" | "caps" | "bashPrefixLane">): PermissionRuleIssue[];
 /**
@@ -145,7 +145,7 @@ export declare function validatePermissionRules(rules: PermissionRule[], opts?:
  * bare allow → `defaultAction`. `check()` is idempotent and side-effect-free (combinePolicies 契约);
  * all parsing/validation happens HERE, the hot path never re-parses.
  *
- * ⚠️ Composition note (codex 127 审 B3): an `allow` from this policy is "no objection", NOT a
+ * ⚠️ Composition note: an `allow` from this policy is "no objection", NOT a
  * cross-policy override — another policy's ask/deny still outranks it in the combinePolicies fold.
  * Express default-closed via `defaultAction`, never via a trailing always-ask policy.
  */