@sema-agent/core 5.65.0 → 7.0.0

package/dist/core/permission-rule-consent.d.ts

@@ -29,6 +29,7 @@
  */
 import { type RuleOffer, type RuleRejectCode, type RuleScope, type RuleDot } from "./permission-rule-model.js";
 import type { PermissionRuleStoreProvider, RuleOwner } from "./permission-rule-store.js";
+import type { SessionRuleOverlay } from "./permission-rule-session.js";
 /** One candidate rule inside an approval record: the exact text and where it would apply. */
 export interface RuleCandidate {
     rule: string;
@@ -199,6 +200,15 @@ export interface RuleConsentDeps {
      * happened, and withholding the receipt helps no one.
      */
     cardEdits?: boolean;
+    /**
+     * design/382 §4.3 — the SESSION-RULE OVERLAY: where a `{kind:"session"}` scoped candidate lands at
+     * redemption (the store write leg is never taken for one), and where the prepare-time coverage read
+     * merges a session's standing rows from. Host-provided, session-lifetime, never synced — see
+     * `permission-rule-session.ts` for the contract and the reference implementation. Absent ⇒ a
+     * session-scope candidate's redemption refuses loudly (there is nowhere for it to land), and
+     * coverage reads see no session rows — both fail toward asking.
+     */
+    sessionRules?: SessionRuleOverlay;
 }
 /** In-memory approval records — the test backend and the reference CAS semantics, the stale-row
  *  envelope read included. */
@@ -257,8 +267,27 @@ export declare function prepareCardApproval(opts: {
     /** The ask's call id and argument digest, recorded for reconciliation. */
     toolCallId?: string;
     boundInputHash?: string;
-    /** Where a redeemed rule would apply. Defaults to global. */
+    /**
+     * Where a redeemed rule would apply — any of the three consent dimensions (design/382 §4.1).
+     *
+     * design/382 §4.4 (#490②, BREAKING B2) — the DEFAULT is no longer global:
+     *  · present ⇒ used as given (the explicit channel; all three members legal, garbage refused loudly);
+     *  · absent with `cwd` present ⇒ `{ kind: "project", root: cwd }`. Root = the adjudicated call's
+     *    cwd is a deliberately NARROW default — the engine is a library and repository semantics are
+     *    host business; a host wanting the true project root passes an explicit scope. The narrow cost
+     *    is more asks (a nested-directory rule does not cover siblings), the safe direction;
+     *  · both absent ⇒ a LOUD refusal (`config.missing_scope`): silent-global was the #490② defect,
+     *    silent-project has no root to anchor, and "where does this consent land" is not guessable.
+     */
     scope?: RuleScope;
+    /**
+     * design/382 §4.3 — the SESSION IDENTITY of the adjudicated call, threaded by the caller from the
+     * original call context exactly like `cwd` (never inferred from the process). It is the coverage
+     * read's third eligibility axis: with it, a standing session rule of that session counts as
+     * coverage; without it, no session rule covers anything (fail-closed). Independent of `scope` on
+     * purpose — `scope` names where a NEW consent would land, this names where the CALL is running.
+     */
+    sessionId?: string;
     /**
      * The working directory of the ADJUDICATED CALL — the same task root the gate's lane judged
      * with — threaded by the caller from the original call context. Never inferred from `scope`
@@ -400,7 +429,12 @@ export type EditedRuleTextPrecheck = {
  * so the surface's move is to not offer the edit box at all.
  */
 export declare function precheckEditedRuleText(text: string, command: string): EditedRuleTextPrecheck;
-/** What a redemption produced. `alreadyRedeemed` marks the replay path — the same dot, no second rule. */
+/** What a redemption produced. `alreadyRedeemed` marks the replay path — the same dot, no second rule.
+ *
+ *  `rev` is the DURABLE store's revision. A session-scope redemption (design/382 §4.3) lands in the
+ *  session overlay and does not move it: its `rev` is a best-effort read of the store's current
+ *  revision (0 when the store could not be read — the landing is in the overlay either way, and the
+ *  durable revision is reporting, not the landing's identity). */
 export type RedeemResult = {
     status: "redeemed";
     rule: string;
@@ -448,6 +482,26 @@ export interface ImportPreview {
         rule: string;
         reason: string;
     }>;
+    /**
+     * #490 件4 — the entries whose SPELLING was rewritten on the way in, `from` as the settings file
+     * writes it and `to` as this lane will hold it (`Bash(npm run *)` → `Bash(npm run:*)`).
+     *
+     * Exactly ONE row per candidate the translation produced, in candidate order, carrying that
+     * candidate's `scope`. The scope is load-bearing rather than decoration: the same file line can
+     * appear in two layers and become two candidates in two scopes, and a report keyed on the text alone
+     * would show one row for two consents (independent-review finding — the row count and the candidate
+     * count must be readable against each other).
+     *
+     * Always present, empty when nothing was translated: a person confirming this batch is being shown
+     * rule texts that are not the ones in their file, and a preview that let that pass silently would be
+     * asking for consent to something it had not shown them. Entries refused AFTER translation are not
+     * here — they are in `skipped`, named as the file writes them.
+     */
+    translated: Array<{
+        from: string;
+        to: string;
+        scope: RuleScope;
+    }>;
     layers: Array<{
         path: string;
         layer: ImportedSettingsLayer;
@@ -488,6 +542,12 @@ export interface ImportPreview {
  * `false` AND `deduped` — the two axes answer different questions and neither implies the other).
  * A refused row always carries its `reason`. `deduped` counts as LANDED: an equivalent rule
  * already standing means the consent is already in effect.
+ *
+ * design/382 §4.3 — on a SESSION-scope member the two landed words mean the same thing about a
+ * different home: landed in / already in the session's OVERLAY (a session rule's home store), never
+ * the persisted store. The words state that the landing happened; DURABILITY is what the member's own
+ * `scope` says, so a consumer never has to guess it off the status (deliberately no fourth status
+ * value — the closed set names landing outcomes, not storage classes).
  */
 export type RedeemedBatchMember = {
     readonly candidateIndex: number;

package/dist/core/permission-rule-consent.js

@@ -1,6 +1,6 @@
 import { randomBytes } from "node:crypto";
-import { escapeForDisclosure, hasUnrenderableCharacters, parseAllowRuleText, ruleAdmitsCommand, segmentCoverageOf, suggestRulesForCommand, } from "./permission-rule-model.js";
-import { errText, sameRuleOwner, sameScope, writerOf } from "./permission-rule-store.js";
+import { escapeForDisclosure, hasUnrenderableCharacters, parseAllowRuleText, ruleAdmitsCommand, segmentCoverageOf, suggestRulesForCommand, translateImportedWildcardRule, } from "./permission-rule-model.js";
+import { errText, isValidConsentScope, normalizePersistedRule, sameRuleOwner, sameScope, writerOf } from "./permission-rule-store.js";
 export class InMemoryRuleApprovalRecordStore {
     rows = new Map();
     async get(id) {
@@ -121,6 +121,9 @@ function approvalRecordDamageOf(rec) {
             if (typeof cand !== "object" || cand === null || typeof cand.rule !== "string") {
                 return `offer ${at} references candidate ${member}, which is not a candidate row`;
             }
+            if (!isValidConsentScope(cand.scope)) {
+                return `offer ${at} references candidate ${member}, whose scope is not a consent-face scope (global, project, or session)`;
+            }
             if (seen.has(member))
                 return `batch offer ${at} references candidate ${member} twice`;
             seen.add(member);
@@ -196,11 +199,42 @@ export async function prepareCardApproval(opts) {
     }
     if (opts.toolName !== CARD_RULE_TOOL)
         return undefined;
-    const scope = opts.scope ?? { kind: "global" };
+    const scope = (() => {
+        if (opts.scope !== undefined) {
+            if (!isValidConsentScope(opts.scope)) {
+                const e = new Error("prepareCardApproval got a scope that is not a consent-face scope (global, project with a non-empty root, or session with a non-empty sessionId) — refusing to guess where this consent should land");
+                e.code = "config.invalid_argument";
+                throw e;
+            }
+            return opts.scope;
+        }
+        if (opts.cwd !== undefined) {
+            if (typeof opts.cwd !== "string" || opts.cwd === "") {
+                const e = new Error("prepareCardApproval got a cwd that is not a usable path — it cannot anchor the derived project scope, and refusing beats minting a rule scoped to garbage");
+                e.code = "config.invalid_argument";
+                throw e;
+            }
+            return { kind: "project", root: opts.cwd };
+        }
+        const e = new Error("prepareCardApproval was given neither a scope nor a cwd — there is nowhere for this consent to land, and no direction of silence is honest (config.missing_scope): pass an explicit scope, or thread the adjudicated call's cwd");
+        e.code = "config.missing_scope";
+        throw e;
+    })();
     let coverage;
     try {
         const listed = await storeForOwner(opts.deps.provider, owner).list();
-        coverage = segmentCoverageOf(opts.command, { persisted: listed.rules }, { tool: CARD_RULE_TOOL, cwd: opts.cwd });
+        let table = listed.rules;
+        const overlay = opts.deps.sessionRules;
+        if (overlay !== undefined && opts.sessionId !== undefined) {
+            const served = structuredClone(await overlay.read(opts.sessionId));
+            const sessionRows = served.filter((r) => {
+                const scope = r?.scope;
+                return scope?.kind === "session" && scope.sessionId === opts.sessionId && !("reject" in normalizePersistedRule(r));
+            });
+            if (sessionRows.length > 0)
+                table = [...sessionRows, ...listed.rules];
+        }
+        coverage = segmentCoverageOf(opts.command, { persisted: table }, { tool: CARD_RULE_TOOL, cwd: opts.cwd, sessionId: opts.sessionId });
     }
     catch {
         coverage = undefined;
@@ -497,6 +531,41 @@ async function applyRedemption(args) {
     if (writer === undefined)
         return { status: "refused", reason: "the resolved permission-rule store has no write face" };
     const origin = originOfRecordKind(args.kind);
+    if (args.candidate.scope.kind === "session") {
+        const overlay = args.deps.sessionRules;
+        if (overlay === undefined) {
+            return {
+                status: "refused",
+                reason: "this deployment wired no session-rule overlay (RuleConsentDeps.sessionRules) — a session-scope authorization has nowhere to land",
+            };
+        }
+        let outcome;
+        try {
+            outcome = await overlay.apply(args.candidate.scope.sessionId, {
+                rule: args.parsedRule.rule,
+                tool: args.parsedRule.tool,
+                match: args.parsedRule.match,
+                command: args.parsedRule.command,
+                add: { dot: args.dot, origin, createdAt: nowIso(args.deps) },
+            });
+        }
+        catch (err) {
+            return { status: "refused", reason: `the session-rule overlay refused the write: ${errText(err)}` };
+        }
+        if ("refused" in outcome) {
+            return {
+                status: "refused",
+                reason: "the session this authorization targets has ended — a session rule dies with its session, and a late or replayed redemption cannot revive it (re-trigger the command in a live session for a fresh card)",
+            };
+        }
+        let rev = 0;
+        try {
+            rev = (await store.list()).rev;
+        }
+        catch {
+        }
+        return { status: "redeemed", rule: args.parsedRule.rule, scope: args.candidate.scope, dot: args.dot, rev, alreadyRedeemed: args.replay };
+    }
     for (let attempt = 0; attempt < REDEEM_MAX_ATTEMPTS; attempt++) {
         let rev;
         try {
@@ -538,6 +607,7 @@ export async function prepareCcImport(opts) {
     const owner = resolveCallerOwner(opts.principal, opts.owner, "prepareCcImport");
     const candidates = [];
     const skipped = [];
+    const translated = [];
     const layers = [];
     const denyAskBuckets = { deny: 0, ask: 0 };
     for (const layer of opts.layers) {
@@ -614,17 +684,25 @@ export async function prepareCcImport(opts) {
                 skipped.push({ rule: entry, reason });
                 continue;
             }
-            const parsed = parseAllowRuleText(entry);
+            const wildcard = translateImportedWildcardRule(entry);
+            if (wildcard !== undefined && "skip" in wildcard) {
+                skipped.push({ rule: entry, reason: wildcard.skip });
+                continue;
+            }
+            const text = wildcard?.rule ?? entry;
+            const parsed = parseAllowRuleText(text);
             if ("reject" in parsed) {
                 skipped.push({ rule: entry, reason: `${parsed.reject.code}: ${parsed.reject.message}` });
                 continue;
             }
             if (candidates.some((c) => c.rule === parsed.rule.rule && sameScope(c.scope, scope)))
                 continue;
+            if (wildcard !== undefined)
+                translated.push({ from: entry, to: parsed.rule.rule, scope });
             candidates.push({ rule: parsed.rule.rule, scope });
         }
     }
-    const preview = { candidates, skipped, layers, uncovered: { ...IMPORT_UNCOVERED_LAYERS, denyAskBuckets } };
+    const preview = { candidates, skipped, translated, layers, uncovered: { ...IMPORT_UNCOVERED_LAYERS, denyAskBuckets } };
     if (candidates.length === 0)
         return { preview };
     const record = {
@@ -708,14 +786,27 @@ export async function redeemRuleBatch(opts) {
         const candidate = rec.candidates[candidateIndex];
         const row = { candidateIndex, rule: candidate.rule, scope: candidate.scope };
         let alreadyThere = false;
-        try {
-            const snap = await store.list();
-            rev = snap.rev;
-            alreadyThere = snap.rules.some((r) => r.rule === candidate.rule && sameScope(r.scope, candidate.scope));
+        if (candidate.scope.kind === "session") {
+            const sessionScope = candidate.scope;
+            try {
+                const overlayRows = opts.deps.sessionRules === undefined ? [] : await opts.deps.sessionRules.read(sessionScope.sessionId);
+                alreadyThere = overlayRows.some((r) => r.rule === candidate.rule && sameScope(r.scope, sessionScope));
+            }
+            catch (err) {
+                members.push({ ...row, status: "refused", reason: `could not read the session-rule overlay: ${errText(err)}` });
+                continue;
+            }
         }
-        catch (err) {
-            members.push({ ...row, status: "refused", reason: `could not read the permission-rule store: ${errText(err)}` });
-            continue;
+        else {
+            try {
+                const snap = await store.list();
+                rev = snap.rev;
+                alreadyThere = snap.rules.some((r) => r.rule === candidate.rule && sameScope(r.scope, candidate.scope));
+            }
+            catch (err) {
+                members.push({ ...row, status: "refused", reason: `could not read the permission-rule store: ${errText(err)}` });
+                continue;
+            }
         }
         const res = await redeemRuleTicket({
             ticket: mintRuleTicket(rec.id, candidateIndex),
@@ -726,7 +817,7 @@ export async function redeemRuleBatch(opts) {
             members.push({ ...row, status: "refused", reason: res.reason });
             continue;
         }
-        rev = res.rev;
+        rev = candidate.scope.kind === "session" ? Math.max(rev, res.rev) : res.rev;
         members.push({ ...row, status: alreadyThere ? "deduped" : "persisted", alreadyRedeemed: res.alreadyRedeemed, dot: res.dot });
     }
     return { members, rev };

package/dist/core/permission-rule-model.d.ts

@@ -69,18 +69,43 @@ export type PersistedRuleTool = "Bash";
 /** v1 match forms. `"wildcard"` is reserved for v2 and is not a value this version ever produces. */
 export type PersistedRuleMatch = "exact" | "prefix";
 /**
- * Where a rule applies. A rule read out of a project-local settings layer applies ONLY inside that
- * project's canonical root — project A's approval is not project B's. User-layer, starter and
- * user-minted rules are global.
- *
- * `root` is expected to be already canonicalized (realpath) by whoever constructs the scope; the
- * matcher compares with word-boundary containment, never a bare `startsWith` (`/a` must not reach `/ab`).
+ * Where a rule applies — design/382 §4.1, the THREE consent dimensions.
+ *
+ *  · `global` — the personal-global dimension: this OWNER's rules, everywhere (the bucket is already
+ *    per-owner, {@link import("./permission-rule-store.js").RuleOwner}). The member keeps its historical
+ *    spelling on purpose: renaming it `personal-global` would be a no-benefit migration of every stored
+ *    row; the "personal" half lives in documentation and card wording, not in the wire byte.
+ *  · `project` — applies ONLY inside `root`. `root` is expected to be already canonicalized (realpath)
+ *    by whoever constructs the scope; the matcher compares with word-boundary containment, never a bare
+ *    `startsWith` (`/a` must not reach `/ab`).
+ *  · `session` — applies ONLY to calls of the ONE session it names, and lives in that session's own
+ *    state (the host's session-rule overlay), NEVER in the persisted store: every durable entrance —
+ *    the write deltas, sync in both directions, at-rest bytes — refuses or drops a session row
+ *    (design/382 §4.3, the durable two-member face). `sessionId` uniqueness is the HOST's duty (the
+ *    `principal` posture): reusing an id is a declaration that it is the same session. A session row
+ *    cannot be individually deleted — it dies with its session (design/382 §10, ruled; the durable
+ *    removal entry refuses it rather than answering a false no-op).
+ *
+ * ORG is deliberately NOT a member (design/382 §4.1): an approval card must be structurally unable to
+ * spell an org-wide grant — org governance is a deny/ask snapshot published by an admin surface, with
+ * no allow bucket at all. Unspellable beats runtime-refused; the consent validators refuse the spelling
+ * anyway if a foreign writer plants it.
+ *
+ * TWO NAMED VALIDATION FACES read this union (design/382 §4.3): the CONSENT face (prepare candidates,
+ * approval records, confirm/redeem, batch outcomes) admits all three members
+ * ({@link import("./permission-rule-store.js").isValidConsentScope}); the DURABLE face (the persisted
+ * store's write deltas, rule-sync in both directions, at-rest decode) admits only
+ * `{global, project}` ({@link import("./permission-rule-store.js").isValidDurableScope}). One table
+ * "for both" is exactly what would let a session row leak into the store silently.
  */
 export type RuleScope = {
     kind: "global";
 } | {
     kind: "project";
     root: string;
+} | {
+    kind: "session";
+    sessionId: string;
 };
 /** The immutable causal identity of one add: a replica identity plus a monotonic counter. */
 export interface RuleDot {
@@ -308,7 +333,7 @@ export declare function escapeForDisclosure(value: unknown): string;
  * transform is LOSSY and NOT injective (two distinct commands can render identically — that is the
  * price of a readable line). Correlate, match, store and adjudicate on the RAW bytes, which the
  * carrying seats keep unchanged: this function neither changes what those seats contain nor what any
- * of them means. A caller that must instead tell two hostile texts APART wants
+ * of them means. A caller that must instead tell two adversarial texts APART wants
  * {@link escapeForDisclosure} (which escapes rather than folds, so nothing collides) or
  * {@link hasUnrenderableCharacters} (refuse instead of render).
  *
@@ -348,6 +373,47 @@ export declare function parseAllowRuleText(text: string, opts?: {
 };
 /** The canonical spelling of a rule for a (already folded) command and match form. */
 export declare function formatAllowRuleText(command: string, match: PersistedRuleMatch): string;
+/**
+ * #490 件4 — read ANOTHER product's `Bash(<body> *)` SPACE-STAR spelling as this lane's colon-star
+ * prefix rule, for the IMPORT door only.
+ *
+ * Why a translation is owed at all: the other product mints its prefix suggestions in that spelling
+ * (its own classifier reads `X:*` as its earlier prefix form and anything else containing an unescaped star as
+ * a wildcard), so a person migrating settings had EVERY prefix rule they had ever approved refused as
+ * `unsupported.wildcard` — the import silently emptied out exactly the rules that were the point of it.
+ *
+ * Translated ONLY for the ONE spelling whose semantics this lane can state exactly: content ending in
+ * ` *` with that star the only unescaped one. Upstream compiles a single trailing ` *` into an
+ * OPTIONAL suffix (`^body( .*)?$`), which is precisely "the body, or the body followed by a space and
+ * more" — this lane's prefix predicate. Any other star placement compiles to a real glob with no rule
+ * form here, and a bare `*` is a whole-tool grant that must never become a command rule; both are
+ * refused with a reason of their own so the import can DISCLOSE them rather than drop them.
+ *
+ * WHAT THE TRANSLATED RULE GRANTS, against the source spelling, axis by axis (the direction matters,
+ * and it is one-way with one named exception): identical on the bare body, on body-plus-arguments, on
+ * the word boundary (`npm run` never reaches `npm run-x`) and on compounds (both sides refuse a chain
+ * against a single-command body). NARROWER here on four axes, because upstream normalizes the
+ * CANDIDATE before matching and this lane never does: a candidate carrying a redirection, wrapped in
+ * `timeout`/`nice`/`nohup`-style words, fed through `xargs`, or prefixed with a `VAR=value` assignment
+ * matches there and matches nothing here. WIDER on exactly one: this lane folds runs of whitespace on
+ * both sides, so `npm  run  build` matches the imported rule where upstream's wildcard arm (which does
+ * not fold) would refuse it. That axis is NOT introduced by this translation — whitespace folding is
+ * this lane's universal reading and already applies to every imported EXACT rule, against an upstream
+ * exact arm that is byte-strict — so it is disclosed as a lane property rather than treated as a
+ * translation defect. Every other difference runs toward granting less.
+ *
+ * Returns `undefined` when the text is not a Bash wildcard spelling at all (nothing to translate; the
+ * caller proceeds with the text as written), `{ rule }` with the spelling to parse INSTEAD, or
+ * `{ skip }` with the reason a star spelling has no form here. Never bypasses the validator: the
+ * returned text goes through {@link parseAllowRuleText} exactly like a hand-written one, so the
+ * interpreter-head refusal, the control-character screen and the length bound all still apply — a
+ * translated `Bash(node *)` is refused `invalid.bare_interpreter_prefix` just as a typed one is.
+ */
+export declare function translateImportedWildcardRule(text: string): {
+    rule: string;
+} | {
+    skip: string;
+} | undefined;
 /**
  * Does this rule's command pattern admit `command`?
  *
@@ -400,9 +466,16 @@ export declare function ruleLaneSegmentsOf(command: string): readonly string[] |
  * not contain `/ab`. Both sides are expected to be canonical already.
  */
 export declare function pathWithinRoot(path: string, root: string): boolean;
-/** Does a rule's scope cover a task running in `cwd`? A project rule needs a cwd to compare against;
- *  without one it covers nothing (fail-closed). */
-export declare function scopeCoversCwd(scope: RuleScope, cwd: string | undefined): boolean;
+/** Does a rule's scope cover a task running in `cwd` (and, for the session dimension, in the session
+ *  named by `sessionId`)? A project rule needs a cwd to compare against; without one it covers nothing
+ *  (fail-closed). A session rule (design/382 §4.3) covers a call iff the call's `sessionId` equals the
+ *  scope's — and a call that carries NO session identity is covered by no session rule, the same
+ *  fail-closed arm as project-without-cwd: an axis the caller did not thread is an axis the rule
+ *  cannot speak on. `sessionId` is threaded from the ORIGINAL call context by the caller (the 375
+ *  r3-② cwd posture), never inferred from the process. ONE function on purpose: this is the scope
+ *  conjunct of the single eligibility predicate ({@link eligibleContext}), and a sister predicate
+ *  would be the second fact source the 375 §5.1 discipline exists to forbid. */
+export declare function scopeCoversCwd(scope: RuleScope, cwd: string | undefined, sessionId?: string): boolean;
 /** Is this rule live — i.e. does it still carry at least one add? Deleted adds are removed by the store
  *  when tombstones are applied, so a rule with an empty `adds` is a rule that no longer exists. */
 export declare function isRuleLive(rule: PersistedAllowRule): boolean;
@@ -418,6 +491,12 @@ export declare function isRuleLive(rule: PersistedAllowRule): boolean;
  *
  * `scope` rides beside the rule rather than inside it for the PROPOSED half's sake: a
  * {@link ParsedAllowRule} carries no scope, so a proposal is judged against the scope it would LAND in.
+ *
+ * design/382 §4.3 — the call context carries a THIRD axis, `sessionId` (optional: an existing caller
+ * that threads only `{tool, cwd}` still compiles and still means what it meant — no session rule can
+ * cover its calls, the fail-closed direction). It is the session dimension's whole eligibility story:
+ * every consumer of this ONE predicate (the gate's conjunction arm, the coverage table, the consent
+ * prepare) inherits it without a second judge existing anywhere.
  */
 export declare function eligibleContext(rule: {
     tool: string;
@@ -425,6 +504,7 @@ export declare function eligibleContext(rule: {
 }, call: {
     tool: string;
     cwd: string | undefined;
+    sessionId?: string;
 }): boolean;
 /**
  * design/375 §5.1 — MAY this PERSISTED rule participate in admitting this call at all? The liveness
@@ -440,6 +520,7 @@ export declare function eligibleContext(rule: {
 export declare function eligiblePersisted(rule: PersistedAllowRule, call: {
     tool: string;
     cwd: string | undefined;
+    sessionId?: string;
 }): boolean;
 /**
  * Find the rules that admit this command for a task in `cwd`, or `undefined`.
@@ -474,12 +555,24 @@ export declare function findAdmittingRule(rules: readonly PersistedAllowRule[],
     tool: string;
     command: string;
     cwd: string | undefined;
+    sessionId?: string;
 }): readonly PersistedAllowRule[] | undefined;
 /**
  * design/375 §5.2 — the per-segment coverage table for `command`: which segments an eligible rule
- * already admits, judged with the SAME split, the same MATCH reading and the same eligibility
- * predicates as the gate's conjunction arm — one instrument, so the suggestion face and the consent
- * prepare can never call a segment covered that the gate would ask about (or vice versa).
+ * already admits, judged with the SAME split and the same eligibility predicates as the gate's
+ * conjunction arm — one instrument, so the suggestion face and the consent prepare can never call a
+ * segment covered that the gate would ask about (or vice versa).
+ *
+ * The split is the OFFER reading ({@link OFFER_READING}, #490 修①), which is the MATCH reading on
+ * every axis but where a redirection is refused — this table exists to align, row for row, with
+ * {@link suggestRulesForCommand}'s own segmentation, and a table that stopped one command short of the
+ * face it aligns with is a table that face discards (its positional belt), leaving every segment
+ * reading UNCOVERED. Each ROW's verdict is still the matcher's, unchanged: `covered` is
+ * {@link ruleAdmitsCommand} under the MATCH reading, so a segment carrying a redirection is admitted
+ * by nothing and reports `false`. The gate's own conjunction arm keeps the whole-string floor and is
+ * not consulted here: for a redirection-bearing compound it has no segments at all, and this table
+ * saying "an eligible rule admits `npm test`" is a true statement about that segment either way — it
+ * is read only to keep an already-covered segment out of a batch offer, never as an admission.
  *
  * TWO SOURCES, two predicates, and the seat labels are the contract:
  *  · `persisted` — rules already in the store, judged {@link eligiblePersisted} ∧ admit: a tombstoned
@@ -503,6 +596,7 @@ export declare function segmentCoverageOf(command: string, rules: {
 }, call: {
     tool: string;
     cwd: string | undefined;
+    sessionId?: string;
 }): readonly SegmentCoverage[] | undefined;
 /** One row of a per-segment coverage table (see {@link segmentCoverageOf}): the FOLDED, trimmed
  *  segment text (a display/correlation seat, never adjudication input) and whether an eligible rule
@@ -632,9 +726,17 @@ export type RuleOffer = {
  * over-offering; every offered rule still passes the validator at redemption, so an over-offer widens
  * nothing).
  *
- * Returns an empty array for anything the rule lane cannot speak for (redirections, substitutions,
- * subshells, backgrounding) — the card then simply carries no "don't ask again" option, which is the
- * honest answer.
+ * Returns an empty array for anything the rule lane cannot speak for (substitutions, subshells,
+ * backgrounding, an unreadable segment) — the card then simply carries no "don't ask again" option,
+ * which is the honest answer.
+ *
+ * A REDIRECTION is the one member of that list judged per SEGMENT rather than over the whole string
+ * (#490 修①, {@link OFFER_READING}): `a && b 2>/dev/null && c` offers a batch for `a` and `c` with
+ * `uncoveredSegments: 1`, exactly as the same compound dirtied by a glob always has. A SIMPLE command
+ * carrying one still offers nothing — its only segment is the dirty one — and no offer this function
+ * mints ever admits the redirection-bearing text: the minting grammar and the matcher keep the
+ * whole-string floor, so the compound stays un-admitted and the honest `uncoveredSegments` count says
+ * so (design/382 §3.2: neither a sanitized rule text nor a widened matcher is on the table).
  */
 export declare function suggestRulesForCommand(command: string, ctx?: {
     readonly coverage?: readonly SegmentCoverage[];

package/dist/core/permission-rule-model.js

@@ -1,5 +1,5 @@
 import { parsePermissionRule } from "./permission-rules.js";
-import { parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
+import { carriesShellRedirection, parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export const MAX_RULE_TEXT_CHARS = 512;
 export const BARE_INTERPRETER_NAMES = new Set([
@@ -117,17 +117,22 @@ function reject(code, message) {
     return { reject: { code, message } };
 }
 const RULE_LANE_FLOOR = { pathPrefixedNameIsText: true };
-const MATCH_READING = { terminator: "keep", quotedOperatorsAreText: false };
-const PROGRAM_RUNS_READING = { terminator: "strip", quotedOperatorsAreText: true };
+const MATCH_READING = { terminator: "keep", quotedOperatorsAreText: false, redirection: "reject" };
+const PROGRAM_RUNS_READING = { terminator: "strip", quotedOperatorsAreText: true, redirection: "reject" };
+const OFFER_READING = { terminator: "keep", quotedOperatorsAreText: false, redirection: "tolerate" };
 function commandBasename(name) {
     return name.slice(name.lastIndexOf("/") + 1);
 }
 function ruleLaneShapeOf(command, reading) {
-    const split = splitShellCompoundSegments(command, { trailingTerminator: reading.terminator });
+    const split = splitShellCompoundSegments(command, { trailingTerminator: reading.terminator, redirection: reading.redirection });
     if ("reject" in split)
         return { reject: split.reject };
     const names = [];
     for (const segment of split.segments) {
+        if (reading.redirection === "tolerate" && carriesShellRedirection(segment)) {
+            names.push(undefined);
+            continue;
+        }
         const floor = parseLeadingCommandName(segment, { ...RULE_LANE_FLOOR, quotedOperatorsAreText: reading.quotedOperatorsAreText });
         if ("reject" in floor) {
             return {
@@ -219,6 +224,45 @@ export function parseAllowRuleText(text, opts) {
 export function formatAllowRuleText(command, match) {
     return `Bash(${command}${match === "prefix" ? ":*" : ""})`;
 }
+function hasUnescapedStar(s) {
+    for (let i = 0; i < s.length; i++) {
+        if (s[i] !== "*")
+            continue;
+        let backslashes = 0;
+        for (let j = i - 1; j >= 0 && s[j] === "\\"; j--)
+            backslashes++;
+        if (backslashes % 2 === 0)
+            return true;
+    }
+    return false;
+}
+function isImportedWildcardContent(content) {
+    return !content.endsWith(":*") && hasUnescapedStar(content);
+}
+export function translateImportedWildcardRule(text) {
+    const parsed = parsePermissionRule(text);
+    const content = parsed.ruleContent;
+    if (content === undefined || parsed.toolName !== "Bash" || !isImportedWildcardContent(content))
+        return undefined;
+    const body = /^(.+) \*$/.exec(content)?.[1];
+    if (body === undefined || body.trim() === "") {
+        return {
+            skip: "unsupported.wildcard: only the trailing `<command> *` form has a prefix-rule equivalent here — it stays in the settings file, unimported",
+        };
+    }
+    if (hasUnescapedStar(body)) {
+        return {
+            skip: "unsupported.wildcard: a `*` before the end of the pattern matches anything at that position, which has no rule form in this version — it stays in the settings file, unimported",
+        };
+    }
+    const bodyShape = ruleLaneShapeOf(body, MATCH_READING);
+    if (!("reject" in bodyShape) && bodyShape.segments.length > 1) {
+        return {
+            skip: "unsupported.wildcard: a `<chain> *` pattern names more than one command, and the trailing-star form has no equivalent for a chain — it stays in the settings file, unimported",
+        };
+    }
+    return { rule: formatAllowRuleText(body, "prefix") };
+}
 export function ruleAdmitsCommand(rule, command) {
     return admitsUnder(rule, command, MATCH_READING);
 }
@@ -251,16 +295,18 @@ export function pathWithinRoot(path, root) {
     const base = root.endsWith("/") ? root : root + "/";
     return path.startsWith(base);
 }
-export function scopeCoversCwd(scope, cwd) {
+export function scopeCoversCwd(scope, cwd, sessionId) {
     if (scope.kind === "global")
         return true;
+    if (scope.kind === "session")
+        return sessionId !== undefined && sessionId === scope.sessionId;
     return cwd !== undefined && pathWithinRoot(cwd, scope.root);
 }
 export function isRuleLive(rule) {
     return rule.adds.length > 0;
 }
 export function eligibleContext(rule, call) {
-    return rule.tool === call.tool && scopeCoversCwd(rule.scope, call.cwd);
+    return rule.tool === call.tool && scopeCoversCwd(rule.scope, call.cwd, call.sessionId);
 }
 export function eligiblePersisted(rule, call) {
     return isRuleLive(rule) && eligibleContext(rule, call);
@@ -297,7 +343,7 @@ export function segmentCoverageOf(command, rules, call) {
     const folded = foldSpacing(command);
     if (folded === undefined)
         return undefined;
-    const shape = ruleLaneShapeOf(folded, MATCH_READING);
+    const shape = ruleLaneShapeOf(folded, OFFER_READING);
     if ("reject" in shape)
         return undefined;
     const proposed = rules.proposed ?? [];
@@ -308,7 +354,7 @@ export function segmentCoverageOf(command, rules, call) {
     }));
 }
 export function suggestRulesForCommand(command, ctx) {
-    const shape = ruleLaneShapeOf(command, MATCH_READING);
+    const shape = ruleLaneShapeOf(command, OFFER_READING);
     if ("reject" in shape)
         return [];
     const folded = foldSpacing(command);
@@ -333,7 +379,7 @@ export function suggestRulesForCommand(command, ctx) {
         }
         return offers;
     }
-    const foldedShape = ruleLaneShapeOf(folded, MATCH_READING);
+    const foldedShape = ruleLaneShapeOf(folded, OFFER_READING);
     if ("reject" in foldedShape || foldedShape.segments.length !== shape.segments.length)
         return offers;
     const segments = foldedShape.segments.map((s) => s.trim());
@@ -341,6 +387,8 @@ export function suggestRulesForCommand(command, ctx) {
     const alignedTable = table !== undefined && table.length === segments.length && table.every((row, i) => row.segment === segments[i]) ? table : undefined;
     const coveredAt = (i) => alignedTable?.[i]?.covered === true;
     const mintSegmentRule = (segment) => {
+        if (carriesShellRedirection(segment))
+            return undefined;
         const body = bodyOf(tokensOf(segment));
         if (body !== undefined) {
             const parsed = parseAllowRuleText(formatAllowRuleText(body, "prefix"));