@sema-agent/core 7.8.0 → 7.9.0

package/dist/core/permission-rule-model.js

@@ -1,8 +1,32 @@
 import { homedir } from "node:os";
-import { parsePermissionRule } from "./permission-rules.js";
+import { parsePermissionRule } from "./permission-rule-syntax.js";
 import { compileReadDeny } from "../tools/fs/read-deny.js";
 import { carriesShellRedirection, parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
 import { inlineUntrusted } from "./untrusted-text.js";
+import { pathTargetOf } from "./tool-registry.js";
+export const RULE_BEHAVIORS = ["deny", "ask", "allow"];
+const RULE_BEHAVIOR_SET = new Set(RULE_BEHAVIORS);
+export function isRuleBehavior(v) {
+    return RULE_BEHAVIOR_SET.has(v);
+}
+export const RULE_BEHAVIOR_PRECEDENCE = {
+    deny: 0,
+    ask: 1,
+    allow: 2,
+};
+export const RULE_BEHAVIORS_BY_PRECEDENCE = [...RULE_BEHAVIORS].sort((a, b) => RULE_BEHAVIOR_PRECEDENCE[a] - RULE_BEHAVIOR_PRECEDENCE[b]);
+export function readRowBehavior(v) {
+    if (v === undefined)
+        return "allow";
+    return isRuleBehavior(v) ? v : undefined;
+}
+export const COMMAND_RULE_TOOL = "Bash";
+export const READ_RULE_TOOL = "Read";
+export function ruleToolGrammarOf(toolName) {
+    if (toolName === COMMAND_RULE_TOOL)
+        return "command";
+    return pathTargetOf(toolName) !== undefined ? "path" : undefined;
+}
 export const MAX_RULE_TEXT_CHARS = 512;
 export const BARE_INTERPRETER_NAMES = new Set([
     "node", "deno", "bun", "python", "python2", "python3", "perl", "ruby", "php", "osascript",
@@ -187,7 +211,11 @@ export function renderUntrustedCommandText(text, maxLen = DISCLOSED_RULE_TEXT_MA
 export function hasUnrenderableCharacters(text) {
     return CONTROL_CHARS_RE.test(text);
 }
-export function parseAllowRuleText(text, opts) {
+export function parseRuleText(text, behavior) {
+    if (!isRuleBehavior(behavior)) {
+        return reject("invalid.grammar", `rule "${text}" was parsed under behavior ${escapeForDisclosure(behavior)}, which is not one of ${RULE_BEHAVIORS.join("/")}`);
+    }
+    const tighten = behavior !== "allow";
     if (text.length > MAX_RULE_TEXT_CHARS) {
         return reject("invalid.too_long", `rule text exceeds ${MAX_RULE_TEXT_CHARS} characters`);
     }
@@ -198,28 +226,11 @@ export function parseAllowRuleText(text, opts) {
     if (parsed.ruleContent === undefined) {
         return reject("invalid.grammar", `"${text}" is not a Tool(content) rule — a bare tool name claims the whole tool and is not a command rule`);
     }
-    if (parsed.toolName === "Read") {
-        const content = parsed.ruleContent;
-        const m = /^\/\/(.+)\/\*\*$/.exec(content);
-        if (m === null) {
-            return reject("invalid.grammar", `only the Read(//abs-dir/**) directory form is a rule this version reads ("${text}") — relative, single-file, single-slash and no-tail spellings have no rule form`);
-        }
-        const bodyR = m[1];
-        if (bodyR.includes("*")) {
-            return reject("unsupported.wildcard", `a \`*\` inside the directory body matches anything at that position, which has no rule form ("${text}")`);
+    if (parsed.toolName !== COMMAND_RULE_TOOL) {
+        if (ruleToolGrammarOf(parsed.toolName) !== "path") {
+            return reject("unsupported.tool", `only Bash command rules and rules on path-targeting tools (Read, Edit, Write, …) have a rule form in this version (got "${parsed.toolName}")`);
         }
-        const segments = bodyR.split("/");
-        if (segments.some((s) => s === "" || s.trim() === "")) {
-            return reject("invalid.grammar", `the directory body of "${text}" is not in the canonical spelling (an empty or whitespace-only path segment) — the lexical normal form is the only accepted spelling`);
-        }
-        if (segments.some((s) => s === "." || s === "..")) {
-            return reject("invalid.path_traversal", `the directory body of "${text}" carries a \`.\` or \`..\` segment — the lexical normal form is the only accepted spelling, and a traversal segment is not normalized away`);
-        }
-        const dir = "/" + bodyR;
-        return { rule: { rule: formatAllowRuleText(dir, "subpath"), tool: "Read", match: "subpath", command: dir } };
-    }
-    if (parsed.toolName !== "Bash") {
-        return reject("unsupported.tool", `only Bash and Read rules are supported in this version (got "${parsed.toolName}")`);
+        return parsePathRuleContent(text, parsed.toolName, parsed.ruleContent, behavior);
     }
     const content = parsed.ruleContent;
     const prefixBody = /^(.+):\*$/.exec(content)?.[1];
@@ -256,7 +267,7 @@ export function parseAllowRuleText(text, opts) {
         return reject("unsupported.wildcard", `a \`<chain> *\` pattern names more than one command, and the trailing-star form has no chain reading — the compound-prefix form spells one with the \`:*\` marker ("${text}")`);
     }
     const head = commandBasename(shape.names[shape.names.length - 1] ?? "");
-    if ((match === "prefix" || match === "wildcard") && BARE_INTERPRETER_NAMES.has(head) && opts?.direction !== "tighten") {
+    if ((match === "prefix" || match === "wildcard") && BARE_INTERPRETER_NAMES.has(head) && !tighten) {
         return reject("invalid.bare_interpreter_prefix", shape.segments.length > 1
             ? `prefix rule "${text}" leaves its final segment open-ended under the interpreter "${head}" — such a rule authorizes running arbitrary programs, which one approval click cannot be read as having granted (an exact rule naming the whole command line is accepted)`
             : `prefix rule "${text}" is headed by the interpreter "${head}" — such a rule authorizes running arbitrary programs, which one approval click cannot be read as having granted (an exact rule naming the whole command line is accepted)`);
@@ -265,12 +276,132 @@ export function parseAllowRuleText(text, opts) {
     if (command === undefined) {
         return reject("invalid.unbalanced_quotes", `rule "${text}" has unbalanced quoting, so the command it names is not determinable`);
     }
-    return { rule: { rule: formatAllowRuleText(command, match), tool: "Bash", match, command } };
+    return { rule: { behavior, rule: formatRuleText(command, match, COMMAND_RULE_TOOL), tool: COMMAND_RULE_TOOL, match, command } };
 }
-export function formatAllowRuleText(command, match) {
+export function formatRuleText(command, match, tool) {
     if (match === "subpath")
-        return `Read(//${command.startsWith("/") ? command.slice(1) : command}/**)`;
-    return `Bash(${command}${match === "prefix" ? ":*" : match === "wildcard" ? " *" : ""})`;
+        return `${tool}(//${command.startsWith("/") ? command.slice(1) : command}/**)`;
+    if (match === "path")
+        return `${tool}(${command})`;
+    return `${tool}(${command}${match === "prefix" ? ":*" : match === "wildcard" ? " *" : ""})`;
+}
+function parsePathRuleContent(text, tool, content, behavior) {
+    const dirForm = /^\/\/(.+)\/\*\*$/.exec(content);
+    if (dirForm !== null) {
+        const bodyR = dirForm[1];
+        if (bodyR.includes("*")) {
+            return reject("unsupported.wildcard", `a \`*\` inside the directory body matches anything at that position, which has no rule form ("${text}")`);
+        }
+        const segments = bodyR.split("/");
+        if (segments.some((sg) => sg === "" || sg.trim() === "")) {
+            return reject("invalid.grammar", `the directory body of "${text}" is not in the canonical spelling (an empty or whitespace-only path segment) — the lexical normal form is the only accepted spelling`);
+        }
+        if (segments.some((sg) => sg === "." || sg === "..")) {
+            return reject("invalid.path_traversal", `the directory body of "${text}" carries a \`.\` or \`..\` segment — the lexical normal form is the only accepted spelling, and a traversal segment is not normalized away`);
+        }
+        if (behavior === "allow" && tool !== READ_RULE_TOOL) {
+            return reject("unsupported.tool", `an allow rule on a path tool speaks for the Read directory form only — a standing approval of a WRITE by directory is not a rule form ("${text}"); write it as a deny or an ask, or approve the call`);
+        }
+        const dir = "/" + bodyR;
+        return { rule: { behavior, rule: formatRuleText(dir, "subpath", tool), tool, match: "subpath", command: dir } };
+    }
+    if (behavior === "allow") {
+        return tool === READ_RULE_TOOL
+            ? reject("invalid.grammar", `only the Read(//abs-dir/**) directory form is a rule this version reads ("${text}") — relative, single-file, single-slash and no-tail spellings have no rule form`)
+            : reject("unsupported.tool", `an allow rule on "${tool}" has no rule form — only the Read directory form is a standing approval by path ("${text}"); write it as a deny or an ask, or approve the call`);
+    }
+    if (content.trim() !== content || content === "") {
+        return reject("invalid.grammar", `the path pattern of "${text}" is empty or carries surrounding whitespace — the pattern is stored as spelled, so the spelling must be the one meant`);
+    }
+    if (content.startsWith("!"))
+        return reject("invalid.grammar", `a negated path pattern ("${text}") is not a rule — a rule says what it reaches, never what it excepts`);
+    if (/[?[\]{}]/.test(content)) {
+        return reject("unsupported.wildcard", `the path pattern of "${text}" carries a glob class (\`?\`, \`[]\`, \`{}\`) this lane does not read — only \`*\` inside a segment and \`**\` as a whole segment have a rule form`);
+    }
+    const body = content.startsWith("//") ? content.slice(2) : content.startsWith("~/") ? content.slice(2) : content.startsWith("/") ? content.slice(1) : content.startsWith("./") ? content.slice(2) : content;
+    const segments = body.split("/");
+    if (segments.some((sg) => sg === "" || sg.trim() === "")) {
+        return reject("invalid.grammar", `the path pattern of "${text}" carries an empty path segment — the lexical normal form is the only accepted spelling`);
+    }
+    if (segments.some((sg) => sg === "." || sg === "..")) {
+        return reject("invalid.path_traversal", `the path pattern of "${text}" carries a \`.\` or \`..\` segment — the lexical normal form is the only accepted spelling, and a traversal segment is not normalized away`);
+    }
+    if (segments.some((sg) => sg.includes("**") && sg !== "**")) {
+        return reject("unsupported.wildcard", `\`**\` in the path pattern of "${text}" must stand as a whole segment (\`a/**/b\`), never inside one`);
+    }
+    return { rule: { behavior, rule: formatRuleText(content, "path", tool), tool, match: "path", command: content } };
+}
+function resolvePathPattern(pattern, bases) {
+    if (pattern.startsWith("//"))
+        return "/" + pattern.slice(2);
+    const under = (base, rest) => {
+        const normal = base === undefined ? undefined : lexicalNormalAbsolutePathOf(base);
+        if (normal === undefined)
+            return undefined;
+        return (normal === "/" ? "" : normal) + "/" + rest;
+    };
+    if (pattern.startsWith("~/"))
+        return under(bases.home ?? homedir(), pattern.slice(2));
+    if (pattern.startsWith("/"))
+        return under(bases.root, pattern.slice(1));
+    return under(bases.cwd ?? bases.root, pattern.startsWith("./") ? pattern.slice(2) : pattern);
+}
+export function isUsablePathBase(base) {
+    return base !== undefined && lexicalNormalAbsolutePathOf(base) !== undefined;
+}
+function segmentGlobMatches(glob, segment) {
+    if (!glob.includes("*"))
+        return glob === segment;
+    const parts = glob.split("*");
+    let at = 0;
+    for (let i = 0; i < parts.length; i++) {
+        const part = parts[i];
+        if (i === 0) {
+            if (!segment.startsWith(part))
+                return false;
+            at = part.length;
+            continue;
+        }
+        if (i === parts.length - 1)
+            return part === "" || (segment.endsWith(part) && segment.length - part.length >= at);
+        const k = segment.indexOf(part, at);
+        if (k === -1)
+            return false;
+        at = k + part.length;
+    }
+    return true;
+}
+function globSegmentsReach(globs, target) {
+    const seen = new Set();
+    const width = target.length + 1;
+    const walk = (g, t) => {
+        if (g === globs.length)
+            return true;
+        const key = g * width + t;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        if (globs[g] === "**")
+            return walk(g + 1, t) || (t < target.length && walk(g, t + 1));
+        if (t >= target.length)
+            return false;
+        return segmentGlobMatches(globs[g], target[t]) && walk(g + 1, t + 1);
+    };
+    return walk(0, 0);
+}
+export function pathRuleReaches(rule, target, bases) {
+    if (rule.match === "subpath")
+        return directoryRuleAdmits(rule, target);
+    if (rule.match !== "path")
+        return false;
+    if (!isLexicalNormalAbsoluteDir(target) && target !== "/")
+        return false;
+    const resolved = resolvePathPattern(rule.command, bases);
+    if (resolved === undefined)
+        return false;
+    const globs = resolved.split("/").filter((sg) => sg !== "");
+    const segments = target.split("/").filter((sg) => sg !== "");
+    return globSegmentsReach(globs, segments);
 }
 function hasUnescapedStar(s) {
     for (let i = 0; i < s.length; i++) {
@@ -290,8 +421,117 @@ export function ruleAdmitsCommand(rule, command) {
 export function ruleAdmitsProgramRun(rule, command) {
     return admitsUnder(rule, command, PROGRAM_RUNS_READING);
 }
+export function ruleReachesProgramRun(rule, command) {
+    if (rule.match === "subpath" || rule.match === "path")
+        return false;
+    if (ruleAdmitsProgramRun(rule, command))
+        return true;
+    const spelled = stripRedirections(stripFdDuplications(command) ?? command) ?? command;
+    if (spelled !== command && ruleAdmitsProgramRun(rule, spelled))
+        return true;
+    const segments = ruleLaneSegmentsOf(spelled);
+    if (segments === undefined)
+        return false;
+    return segments.some((segment) => ruleAdmitsProgramRun(rule, segment));
+}
+function stripRedirections(command) {
+    const isSpace = (c) => c === " " || c === "\t";
+    const isRedirect = (c) => c === "<" || c === ">";
+    const isConnector = (c) => c === "|" || c === "&" || c === ";";
+    let out = "";
+    let quote;
+    let i = 0;
+    while (i < command.length) {
+        const ch = command[i];
+        if (quote !== undefined) {
+            out += ch;
+            if (ch === quote)
+                quote = undefined;
+            i++;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            quote = ch;
+            out += ch;
+            i++;
+            continue;
+        }
+        if (isRedirect(ch)) {
+            let k = out.length;
+            while (k > 0 && /\d/.test(out[k - 1]))
+                k--;
+            if (k < out.length && (k === 0 || isSpace(out[k - 1]) || isConnector(out[k - 1])))
+                out = out.slice(0, k);
+            let j = i;
+            while (j < command.length && isRedirect(command[j]))
+                j++;
+            if (j < command.length && command[j] === "|" && command[i] === ">" && j === i + 1)
+                j++;
+            while (j < command.length && isSpace(command[j]))
+                j++;
+            if (j < command.length && isConnector(command[j]))
+                return undefined;
+            let q2;
+            while (j < command.length) {
+                const c = command[j];
+                if (q2 !== undefined) {
+                    if (c === q2)
+                        q2 = undefined;
+                    j++;
+                    continue;
+                }
+                if (c === "'" || c === '"') {
+                    q2 = c;
+                    j++;
+                    continue;
+                }
+                if (isSpace(c) || isRedirect(c) || isConnector(c))
+                    break;
+                j++;
+            }
+            if (q2 !== undefined)
+                return undefined;
+            if (out !== "" && !isSpace(out[out.length - 1]))
+                out += " ";
+            i = j;
+            continue;
+        }
+        out += ch;
+        i++;
+    }
+    if (quote !== undefined)
+        return undefined;
+    return out.trim();
+}
+function stripFdDuplications(command) {
+    let out = "";
+    let quote;
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        if (quote !== undefined) {
+            out += ch;
+            if (ch === quote)
+                quote = undefined;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            quote = ch;
+            out += ch;
+            continue;
+        }
+        const atWordStart = i === 0 || command[i - 1] === " " || command[i - 1] === "\t" || command[i - 1] === ";" || command[i - 1] === "|" || command[i - 1] === "&";
+        const m = (atWordStart ? /^\d*[<>]&\d+/ : /^[<>]&\d+/).exec(command.slice(i));
+        if (m !== null) {
+            i += m[0].length - 1;
+            out += " ";
+            continue;
+        }
+        out += ch;
+    }
+    return quote === undefined ? out : undefined;
+}
 function admitsUnder(rule, command, reading) {
-    if (rule.match === "subpath")
+    if (rule.match === "subpath" || rule.match === "path")
         return false;
     const shape = ruleLaneShapeOf(command, reading);
     if ("reject" in shape)
@@ -350,9 +590,8 @@ export function lexicalNormalAbsolutePathOf(path) {
         if (seg === "" || seg === ".")
             continue;
         if (seg === "..") {
-            if (out.length === 0)
-                return undefined;
-            out.pop();
+            if (out.length > 0)
+                out.pop();
             continue;
         }
         out.push(seg);
@@ -366,7 +605,7 @@ function isLexicalNormalAbsoluteDir(path) {
     return segments.length > 0 && segments.every((s) => s !== "" && s !== "." && s !== "..");
 }
 export function directoryRuleAdmits(rule, path) {
-    if (rule.tool !== "Read" || rule.match !== "subpath")
+    if (rule.match !== "subpath")
         return false;
     if (!isLexicalNormalAbsoluteDir(rule.command))
         return false;
@@ -483,12 +722,12 @@ export function isRuleLive(rule) {
 export function eligibleContext(rule, call) {
     return rule.tool === call.tool && scopeCoversCwd(rule.scope, call.cwd, call.sessionId);
 }
-export function eligiblePersisted(rule, call) {
-    return isRuleLive(rule) && eligibleContext(rule, call);
+export function eligiblePersisted(rule, call, behavior) {
+    return rule.behavior === behavior && isRuleLive(rule) && eligibleContext(rule, call);
 }
 function firstEligibleAdmittingRule(rules, commandText, call) {
     for (const rule of rules) {
-        if (!eligiblePersisted(rule, call))
+        if (!eligiblePersisted(rule, call, "allow"))
             continue;
         if (ruleAdmitsCommand(rule, commandText))
             return rule;
@@ -521,13 +760,54 @@ export function findAdmittingRule(rules, call) {
 }
 function firstEligibleDirectoryRule(rules, directory, call) {
     for (const rule of rules) {
-        if (!eligiblePersisted(rule, { tool: "Read", cwd: call.cwd, sessionId: call.sessionId }))
+        if (!eligiblePersisted(rule, { tool: "Read", cwd: call.cwd, sessionId: call.sessionId }, "allow"))
             continue;
         if (directoryRuleAdmits(rule, directory))
             return rule;
     }
     return undefined;
 }
+export function adjudicatePersistedRules(rules, call) {
+    for (const behavior of RULE_BEHAVIORS_BY_PRECEDENCE) {
+        if (behavior === "allow") {
+            const covering = findAdmittingRule(rules, call);
+            if (covering !== undefined)
+                return { behavior, rules: covering };
+            continue;
+        }
+        for (const rule of rules) {
+            if (!eligiblePersisted(rule, call, behavior))
+                continue;
+            if (ruleReachesProgramRun(rule, call.command))
+                return { behavior, rules: [rule] };
+        }
+    }
+    return undefined;
+}
+export function adjudicatePersistedPathRules(rules, call, targets, bases) {
+    for (const behavior of RULE_BEHAVIORS_BY_PRECEDENCE) {
+        if (behavior === "allow") {
+            if (targets.allow === undefined || call.tool !== READ_RULE_TOOL)
+                continue;
+            for (const rule of rules) {
+                if (!eligiblePersisted(rule, call, behavior))
+                    continue;
+                if (directoryRuleAdmits(rule, targets.allow))
+                    return { behavior, rules: [rule] };
+            }
+            continue;
+        }
+        if (targets.tighten === undefined)
+            continue;
+        for (const rule of rules) {
+            if (!eligiblePersisted(rule, call, behavior))
+                continue;
+            if (pathRuleReaches(rule, targets.tighten, bases))
+                return { behavior, rules: [rule] };
+        }
+    }
+    return undefined;
+}
 export function segmentCoverageOf(command, rules, call) {
     const folded = foldSpacing(command);
     if (folded === undefined)
@@ -569,7 +849,7 @@ export function suggestRulesForCommand(command, ctx) {
     if (folded === undefined)
         return [];
     const offers = [];
-    const exact = parseAllowRuleText(formatAllowRuleText(folded, "exact"));
+    const exact = parseRuleText(formatRuleText(folded, "exact", COMMAND_RULE_TOOL), "allow");
     if ("rule" in exact && exact.rule.match === "exact" && ruleAdmitsCommand(exact.rule, command)) {
         offers.push({ kind: "single", rule: exact.rule.rule, match: "exact", command: exact.rule.command });
     }
@@ -589,7 +869,7 @@ export function suggestRulesForCommand(command, ctx) {
         }
         if (denied)
             return undefined;
-        const parsed = parseAllowRuleText(formatAllowRuleText(directory, "subpath"));
+        const parsed = parseRuleText(formatRuleText(directory, "subpath", READ_RULE_TOOL), "allow");
         if (!("rule" in parsed) || parsed.rule.match !== "subpath")
             return undefined;
         if (!directoryRuleAdmits(parsed.rule, directory))
@@ -600,7 +880,7 @@ export function suggestRulesForCommand(command, ctx) {
         if (offers.length === 1) {
             const body = bodyOf(tokensOf(folded));
             if (body !== undefined) {
-                const parsed = parseAllowRuleText(formatAllowRuleText(body, "wildcard"));
+                const parsed = parseRuleText(formatRuleText(body, "wildcard", COMMAND_RULE_TOOL), "allow");
                 if ("rule" in parsed && parsed.rule.match === "wildcard" && ruleAdmitsCommand(parsed.rule, command)) {
                     offers.push({ kind: "single", rule: parsed.rule.rule, match: "wildcard", command: parsed.rule.command });
                 }
@@ -627,12 +907,12 @@ export function suggestRulesForCommand(command, ctx) {
             return undefined;
         const body = bodyOf(tokensOf(segment));
         if (body !== undefined) {
-            const parsed = parseAllowRuleText(formatAllowRuleText(body, "wildcard"));
+            const parsed = parseRuleText(formatRuleText(body, "wildcard", COMMAND_RULE_TOOL), "allow");
             if ("rule" in parsed && parsed.rule.match === "wildcard" && ruleAdmitsCommand(parsed.rule, segment)) {
                 return { rule: parsed.rule.rule, match: "wildcard", command: parsed.rule.command };
             }
         }
-        const segExact = parseAllowRuleText(formatAllowRuleText(segment, "exact"));
+        const segExact = parseRuleText(formatRuleText(segment, "exact", COMMAND_RULE_TOOL), "allow");
         if ("rule" in segExact && segExact.rule.match === "exact" && ruleAdmitsCommand(segExact.rule, segment)) {
             return { rule: segExact.rule.rule, match: "exact", command: segExact.rule.command };
         }
@@ -655,7 +935,7 @@ export function suggestRulesForCommand(command, ctx) {
     const batchRules = minted.slice(0, 5);
     if (batchRules.length > 0) {
         const parsedBatch = batchRules.flatMap((r) => {
-            const p = parseAllowRuleText(r.rule);
+            const p = parseRuleText(r.rule, "allow");
             return "rule" in p ? [p.rule] : [];
         });
         const uncoveredDetail = [];

package/dist/core/permission-rule-org.d.ts

@@ -6,7 +6,7 @@
  * convergent merge). So the org layer has NO CRDT, no tombstones and no join: the server is the single
  * authority, a client holds a read-only versioned snapshot, an update is a whole replacement (revision
  * strictly ordered), and a rollback is a NEW revision carrying old content. Cross-layer tombstones are
- * structurally impossible — an org rule never enters `PersistedAllowRule`, and an org snapshot replace
+ * structurally impossible — an org rule never enters `PersistedRule`, and an org snapshot replace
  * never touches a personal store's bytes. The two layers meet only at the CONSUMPTION site, where org
  * deny/ask folds strict-side: **org deny > org ask (non-dismissable) > personal allow rule > bare ask**.
  *
@@ -35,7 +35,7 @@
  * accept revision N−1 after a restart. Signature / predecessor chaining belongs to the privilege-
  * separation ticket; the high-water mark is the floor that needs no key distribution.
  */
-import { type PersistedAllowRule, type RuleRejectCode } from "./permission-rule-model.js";
+import { type PersistedRule, type RuleRejectCode } from "./permission-rule-model.js";
 import type { PermissionRuleStore } from "./permission-rule-provider.js";
 /** One org rule. There is structurally no allow bucket (design/179 §9: the org layer only tightens). */
 export interface OrgPermissionRule {
@@ -187,8 +187,9 @@ export declare function unenforceableOrgRules(rules: readonly OrgPermissionRule[
 /**
  * design/182 §7.2 — which org rule speaks for this command, if any. Deny outranks ask; within a
  * behavior the first textual match wins (reporting order only — all denies are the same one answer).
- * Matching uses the SAME parser and matcher the personal lane uses (tighten direction: an
- * interpreter-headed prefix deny like `Bash(node:*)` is a legitimately wide tightening and matches).
+ * Matching uses the SAME parser and the SAME tightening reach the personal deny/ask rows use
+ * ({@link ruleReachesProgramRun}: an interpreter-headed prefix deny like `Bash(node:*)` is a
+ * legitimately wide tightening and matches; a segment hit is a hit).
  *
  * The skip below is a defensive floor, and what stands behind it is worth stating precisely: rules that
  * arrive from the org partition's `resolve` ({@link createOrgRulePartition}) have passed {@link validateOrgSnapshot} on BOTH the install
@@ -212,8 +213,8 @@ export declare function orgRuleVerdictFor(rules: readonly OrgPermissionRule[], c
  * OVERRIDE it, not to self-declare its removal — so a shadowed rule reports `shadowed-by-org` and comes
  * back by itself when the org deny is withdrawn.
  *
- * The SAME reach the gate uses (`orgRuleReaches`), so the view and the decision cannot disagree about
- * whether a deny touches this rule at all. A personal rule may name a connector chain, and a deny on one
+ * The SAME reach the gate uses ({@link ruleReachesProgramRun}), so the view and the decision cannot
+ * disagree about whether a deny touches this rule at all. A personal rule may name a connector chain, and a deny on one
  * of its segments shadows it exactly as a deny on the whole does.
  *
  * WHAT `shadowed-by-org` DOES AND DOES NOT CLAIM: the predicate asks whether the deny reaches the
@@ -232,9 +233,9 @@ export declare function orgRuleVerdictFor(rules: readonly OrgPermissionRule[], c
  * reach it, and its `command` is a PATH that must not be fed to the shell lane's segment reader as
  * though it were a command line.
  */
-export declare function orgRuleShadows(orgRules: readonly OrgPermissionRule[], rule: Pick<PersistedAllowRule, "tool" | "command">): boolean;
+export declare function orgRuleShadows(orgRules: readonly OrgPermissionRule[], rule: Pick<PersistedRule, "tool" | "command">): boolean;
 /** The shadow predicate with the org denies parsed ONCE — what a read over many rows uses. */
-export declare function compileOrgShadowPredicate(orgRules: readonly OrgPermissionRule[]): (rule: Pick<PersistedAllowRule, "tool" | "command">) => boolean;
+export declare function compileOrgShadowPredicate(orgRules: readonly OrgPermissionRule[]): (rule: Pick<PersistedRule, "tool" | "command">) => boolean;
 /** Does this store carry a write face? Re-exported convenience for org-ticket integrations that need to
  *  distinguish a read-only projection from a writable personal bucket without importing the writer seam. */
 export declare function isWritablePermissionRuleStore(store: PermissionRuleStore): boolean;

package/dist/core/permission-rule-org.js

@@ -1,4 +1,4 @@
-import { escapeForDisclosure, parseAllowRuleText, ruleAdmitsProgramRun, ruleLaneSegmentsOf } from "./permission-rule-model.js";
+import { escapeForDisclosure, parseRuleText, ruleReachesProgramRun } from "./permission-rule-model.js";
 import { writerOf } from "./permission-rule-store.js";
 export const ORG_UNAVAILABLE_DECISION_REASON = "org_unavailable";
 export const ORG_ADJUDICATION_TIMEOUT_MS = 15_000;
@@ -199,7 +199,7 @@ export function unenforceableOrgRules(rules) {
     for (const r of rules) {
         if (typeof r?.rule !== "string" || r.rule === "")
             continue;
-        const parsed = parseAllowRuleText(r.rule, { direction: "tighten" });
+        const parsed = parseRuleText(r.rule, r.behavior);
         if ("reject" in parsed) {
             out.push({ rule: r.rule, code: parsed.reject.code });
             continue;
@@ -243,15 +243,14 @@ function validateOrgSnapshot(s, nowMs) {
     return undefined;
 }
 export function orgRuleVerdictFor(rules, call) {
-    const segments = ruleLaneSegmentsOf(call.command);
     let ask;
     for (const r of rules) {
-        const parsed = parseAllowRuleText(r.rule, { direction: "tighten" });
+        const parsed = parseRuleText(r.rule, r.behavior);
         if ("reject" in parsed)
             continue;
         if (parsed.rule.tool !== call.tool)
             continue;
-        if (!orgRuleReaches(parsed.rule, call.command, segments))
+        if (!ruleReachesProgramRun(parsed.rule, call.command))
             continue;
         if (r.behavior === "deny")
             return { behavior: "deny", rule: r.rule };
@@ -259,13 +258,6 @@ export function orgRuleVerdictFor(rules, call) {
     }
     return ask;
 }
-function orgRuleReaches(rule, command, segments) {
-    if (ruleAdmitsProgramRun(rule, command))
-        return true;
-    if (segments === undefined)
-        return false;
-    return segments.some((segment) => ruleAdmitsProgramRun(rule, segment));
-}
 export function orgRuleShadows(orgRules, rule) {
     return compileOrgShadowPredicate(orgRules)(rule);
 }
@@ -274,15 +266,14 @@ export function compileOrgShadowPredicate(orgRules) {
     for (const d of orgRules) {
         if (d.behavior !== "deny")
             continue;
-        const parsed = parseAllowRuleText(d.rule, { direction: "tighten" });
+        const parsed = parseRuleText(d.rule, "deny");
         if (!("reject" in parsed))
             denies.push(parsed.rule);
     }
     return (rule) => {
         if (rule.tool !== "Bash" || denies.length === 0)
             return false;
-        const segments = ruleLaneSegmentsOf(rule.command);
-        return denies.some((d) => d.tool === rule.tool && orgRuleReaches(d, rule.command, segments));
+        return denies.some((d) => d.tool === rule.tool && ruleReachesProgramRun(d, rule.command));
     };
 }
 export function isWritablePermissionRuleStore(store) {

package/dist/core/permission-rule-provider.d.ts

@@ -34,7 +34,7 @@
  * durable backend keeps refusing a session row loudly should one ever reach it — the route is the
  * store's, the fence stays the partition's.
  */
-import type { PersistedAllowRule, RuleScope } from "./permission-rule-model.js";
+import type { PersistedRule, RuleScope } from "./permission-rule-model.js";
 import { type DurableRulePartitionProvider, type QuarantinedRuleAdd, type RuleOwner } from "./permission-rule-store.js";
 import { type OrgRulePartitionConfig, type OrgRuleResolution } from "./permission-rule-org.js";
 import type { SessionRulePartition } from "./permission-rule-session.js";
@@ -44,8 +44,10 @@ export type RuleSource = "org" | "user" | "project" | "session";
 /** The source of a row is a projection of its scope — `global` is the `user` source. */
 export declare function ruleSourceOf(scope: RuleScope): Exclude<RuleSource, "org">;
 /** One live personal rule in the effective view: the row itself, its source, and its standing under the
- *  org partition (`shadowed-by-org` = an org deny reaches its command pattern; see `orgRuleShadows`). */
-export interface EffectivePermissionRule extends PersistedAllowRule {
+ *  org partition (`shadowed-by-org` = an org deny reaches an ALLOW row's command pattern; see
+ *  `orgRuleShadows` — a personal deny/ask row is never shadowed: it only ever tightens, and the org
+ *  partition's power over the personal store is to override an allow, not a refusal). */
+export interface EffectivePermissionRule extends PersistedRule {
     source: Exclude<RuleSource, "org">;
     status: "live" | "shadowed-by-org";
 }
@@ -53,6 +55,7 @@ export interface EffectivePermissionRule extends PersistedAllowRule {
  *  tombstone identity is still visible in the partition. Session rows never appear here (they die
  *  with their session and leave no tombstone). */
 export interface RemovedPermissionRule {
+    behavior: import("./permission-rule-model.js").RuleBehavior;
     rule: string;
     scope: RuleScope;
     source: "user" | "project";
@@ -84,9 +87,10 @@ export interface EffectivePermissionRules {
  * The host-visible store, already anchored to one owner. One read verb, which never throws: each
  * partition reports its own failure in the view — the DURABLE partition's read failure as `unreadable`
  * (zero rows; the caller maps it to "unreadable": a loud disclosure, fail toward asking, exactly as the
- * old `list()` throw did), the SESSION partition's as zero session rows plus a `disclosures` line, the
- * ORG partition's as its `status`. The three are independent on purpose: the org verdict must stand
- * while a personal store is down, and the personal rows must stand while an org source is down.
+ * old `list()` throw did), the SESSION partition's read failure as `unreadable` too (it may hold a
+ * deny/ask row of this session, and zero rows would erase it — served-but-non-canonical rows stay a
+ * `disclosures` line), the ORG partition's as its `status`. The org verdict stands while a personal
+ * partition is down, and the personal rows stand while an org source is down.
  */
 export interface PermissionRuleStore {
     effective(query?: {