@sema-agent/core 7.8.0 → 7.9.1

package/dist/core/permission-rule-model.js

@@ -1,8 +1,33 @@
 import { homedir } from "node:os";
-import { parsePermissionRule } from "./permission-rules.js";
+import { parsePermissionRule } from "./permission-rule-syntax.js";
 import { compileReadDeny } from "../tools/fs/read-deny.js";
 import { carriesShellRedirection, parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
 import { inlineUntrusted } from "./untrusted-text.js";
+import { pathTargetOf } from "./tool-registry.js";
+import { readShellCommand } from "./shell-lexer.js";
+export const RULE_BEHAVIORS = ["deny", "ask", "allow"];
+const RULE_BEHAVIOR_SET = new Set(RULE_BEHAVIORS);
+export function isRuleBehavior(v) {
+    return RULE_BEHAVIOR_SET.has(v);
+}
+export const RULE_BEHAVIOR_PRECEDENCE = {
+    deny: 0,
+    ask: 1,
+    allow: 2,
+};
+export const RULE_BEHAVIORS_BY_PRECEDENCE = [...RULE_BEHAVIORS].sort((a, b) => RULE_BEHAVIOR_PRECEDENCE[a] - RULE_BEHAVIOR_PRECEDENCE[b]);
+export function readRowBehavior(v) {
+    if (v === undefined)
+        return "allow";
+    return isRuleBehavior(v) ? v : undefined;
+}
+export const COMMAND_RULE_TOOL = "Bash";
+export const READ_RULE_TOOL = "Read";
+export function ruleToolGrammarOf(toolName) {
+    if (toolName === COMMAND_RULE_TOOL)
+        return "command";
+    return pathTargetOf(toolName) !== undefined ? "path" : undefined;
+}
 export const MAX_RULE_TEXT_CHARS = 512;
 export const BARE_INTERPRETER_NAMES = new Set([
     "node", "deno", "bun", "python", "python2", "python3", "perl", "ruby", "php", "osascript",
@@ -120,7 +145,6 @@ function reject(code, message) {
 }
 const RULE_LANE_FLOOR = { pathPrefixedNameIsText: true };
 const MATCH_READING = { terminator: "keep", quotedOperatorsAreText: false, redirection: "reject" };
-const PROGRAM_RUNS_READING = { terminator: "strip", quotedOperatorsAreText: true, redirection: "reject" };
 const OFFER_READING = { terminator: "keep", quotedOperatorsAreText: false, redirection: "tolerate" };
 function commandBasename(name) {
     return name.slice(name.lastIndexOf("/") + 1);
@@ -187,7 +211,11 @@ export function renderUntrustedCommandText(text, maxLen = DISCLOSED_RULE_TEXT_MA
 export function hasUnrenderableCharacters(text) {
     return CONTROL_CHARS_RE.test(text);
 }
-export function parseAllowRuleText(text, opts) {
+export function parseRuleText(text, behavior) {
+    if (!isRuleBehavior(behavior)) {
+        return reject("invalid.grammar", `rule "${text}" was parsed under behavior ${escapeForDisclosure(behavior)}, which is not one of ${RULE_BEHAVIORS.join("/")}`);
+    }
+    const tighten = behavior !== "allow";
     if (text.length > MAX_RULE_TEXT_CHARS) {
         return reject("invalid.too_long", `rule text exceeds ${MAX_RULE_TEXT_CHARS} characters`);
     }
@@ -198,28 +226,11 @@ export function parseAllowRuleText(text, opts) {
     if (parsed.ruleContent === undefined) {
         return reject("invalid.grammar", `"${text}" is not a Tool(content) rule — a bare tool name claims the whole tool and is not a command rule`);
     }
-    if (parsed.toolName === "Read") {
-        const content = parsed.ruleContent;
-        const m = /^\/\/(.+)\/\*\*$/.exec(content);
-        if (m === null) {
-            return reject("invalid.grammar", `only the Read(//abs-dir/**) directory form is a rule this version reads ("${text}") — relative, single-file, single-slash and no-tail spellings have no rule form`);
-        }
-        const bodyR = m[1];
-        if (bodyR.includes("*")) {
-            return reject("unsupported.wildcard", `a \`*\` inside the directory body matches anything at that position, which has no rule form ("${text}")`);
+    if (parsed.toolName !== COMMAND_RULE_TOOL) {
+        if (ruleToolGrammarOf(parsed.toolName) !== "path") {
+            return reject("unsupported.tool", `only Bash command rules and rules on path-targeting tools (Read, Edit, Write, …) have a rule form in this version (got "${parsed.toolName}")`);
         }
-        const segments = bodyR.split("/");
-        if (segments.some((s) => s === "" || s.trim() === "")) {
-            return reject("invalid.grammar", `the directory body of "${text}" is not in the canonical spelling (an empty or whitespace-only path segment) — the lexical normal form is the only accepted spelling`);
-        }
-        if (segments.some((s) => s === "." || s === "..")) {
-            return reject("invalid.path_traversal", `the directory body of "${text}" carries a \`.\` or \`..\` segment — the lexical normal form is the only accepted spelling, and a traversal segment is not normalized away`);
-        }
-        const dir = "/" + bodyR;
-        return { rule: { rule: formatAllowRuleText(dir, "subpath"), tool: "Read", match: "subpath", command: dir } };
-    }
-    if (parsed.toolName !== "Bash") {
-        return reject("unsupported.tool", `only Bash and Read rules are supported in this version (got "${parsed.toolName}")`);
+        return parsePathRuleContent(text, parsed.toolName, parsed.ruleContent, behavior);
     }
     const content = parsed.ruleContent;
     const prefixBody = /^(.+):\*$/.exec(content)?.[1];
@@ -256,7 +267,7 @@ export function parseAllowRuleText(text, opts) {
         return reject("unsupported.wildcard", `a \`<chain> *\` pattern names more than one command, and the trailing-star form has no chain reading — the compound-prefix form spells one with the \`:*\` marker ("${text}")`);
     }
     const head = commandBasename(shape.names[shape.names.length - 1] ?? "");
-    if ((match === "prefix" || match === "wildcard") && BARE_INTERPRETER_NAMES.has(head) && opts?.direction !== "tighten") {
+    if ((match === "prefix" || match === "wildcard") && BARE_INTERPRETER_NAMES.has(head) && !tighten) {
         return reject("invalid.bare_interpreter_prefix", shape.segments.length > 1
             ? `prefix rule "${text}" leaves its final segment open-ended under the interpreter "${head}" — such a rule authorizes running arbitrary programs, which one approval click cannot be read as having granted (an exact rule naming the whole command line is accepted)`
             : `prefix rule "${text}" is headed by the interpreter "${head}" — such a rule authorizes running arbitrary programs, which one approval click cannot be read as having granted (an exact rule naming the whole command line is accepted)`);
@@ -265,12 +276,132 @@ export function parseAllowRuleText(text, opts) {
     if (command === undefined) {
         return reject("invalid.unbalanced_quotes", `rule "${text}" has unbalanced quoting, so the command it names is not determinable`);
     }
-    return { rule: { rule: formatAllowRuleText(command, match), tool: "Bash", match, command } };
+    return { rule: { behavior, rule: formatRuleText(command, match, COMMAND_RULE_TOOL), tool: COMMAND_RULE_TOOL, match, command } };
 }
-export function formatAllowRuleText(command, match) {
+export function formatRuleText(command, match, tool) {
     if (match === "subpath")
-        return `Read(//${command.startsWith("/") ? command.slice(1) : command}/**)`;
-    return `Bash(${command}${match === "prefix" ? ":*" : match === "wildcard" ? " *" : ""})`;
+        return `${tool}(//${command.startsWith("/") ? command.slice(1) : command}/**)`;
+    if (match === "path")
+        return `${tool}(${command})`;
+    return `${tool}(${command}${match === "prefix" ? ":*" : match === "wildcard" ? " *" : ""})`;
+}
+function parsePathRuleContent(text, tool, content, behavior) {
+    const dirForm = /^\/\/(.+)\/\*\*$/.exec(content);
+    if (dirForm !== null) {
+        const bodyR = dirForm[1];
+        if (bodyR.includes("*")) {
+            return reject("unsupported.wildcard", `a \`*\` inside the directory body matches anything at that position, which has no rule form ("${text}")`);
+        }
+        const segments = bodyR.split("/");
+        if (segments.some((sg) => sg === "" || sg.trim() === "")) {
+            return reject("invalid.grammar", `the directory body of "${text}" is not in the canonical spelling (an empty or whitespace-only path segment) — the lexical normal form is the only accepted spelling`);
+        }
+        if (segments.some((sg) => sg === "." || sg === "..")) {
+            return reject("invalid.path_traversal", `the directory body of "${text}" carries a \`.\` or \`..\` segment — the lexical normal form is the only accepted spelling, and a traversal segment is not normalized away`);
+        }
+        if (behavior === "allow" && tool !== READ_RULE_TOOL) {
+            return reject("unsupported.tool", `an allow rule on a path tool speaks for the Read directory form only — a standing approval of a WRITE by directory is not a rule form ("${text}"); write it as a deny or an ask, or approve the call`);
+        }
+        const dir = "/" + bodyR;
+        return { rule: { behavior, rule: formatRuleText(dir, "subpath", tool), tool, match: "subpath", command: dir } };
+    }
+    if (behavior === "allow") {
+        return tool === READ_RULE_TOOL
+            ? reject("invalid.grammar", `only the Read(//abs-dir/**) directory form is a rule this version reads ("${text}") — relative, single-file, single-slash and no-tail spellings have no rule form`)
+            : reject("unsupported.tool", `an allow rule on "${tool}" has no rule form — only the Read directory form is a standing approval by path ("${text}"); write it as a deny or an ask, or approve the call`);
+    }
+    if (content.trim() !== content || content === "") {
+        return reject("invalid.grammar", `the path pattern of "${text}" is empty or carries surrounding whitespace — the pattern is stored as spelled, so the spelling must be the one meant`);
+    }
+    if (content.startsWith("!"))
+        return reject("invalid.grammar", `a negated path pattern ("${text}") is not a rule — a rule says what it reaches, never what it excepts`);
+    if (/[?[\]{}]/.test(content)) {
+        return reject("unsupported.wildcard", `the path pattern of "${text}" carries a glob class (\`?\`, \`[]\`, \`{}\`) this lane does not read — only \`*\` inside a segment and \`**\` as a whole segment have a rule form`);
+    }
+    const body = content.startsWith("//") ? content.slice(2) : content.startsWith("~/") ? content.slice(2) : content.startsWith("/") ? content.slice(1) : content.startsWith("./") ? content.slice(2) : content;
+    const segments = body.split("/");
+    if (segments.some((sg) => sg === "" || sg.trim() === "")) {
+        return reject("invalid.grammar", `the path pattern of "${text}" carries an empty path segment — the lexical normal form is the only accepted spelling`);
+    }
+    if (segments.some((sg) => sg === "." || sg === "..")) {
+        return reject("invalid.path_traversal", `the path pattern of "${text}" carries a \`.\` or \`..\` segment — the lexical normal form is the only accepted spelling, and a traversal segment is not normalized away`);
+    }
+    if (segments.some((sg) => sg.includes("**") && sg !== "**")) {
+        return reject("unsupported.wildcard", `\`**\` in the path pattern of "${text}" must stand as a whole segment (\`a/**/b\`), never inside one`);
+    }
+    return { rule: { behavior, rule: formatRuleText(content, "path", tool), tool, match: "path", command: content } };
+}
+function resolvePathPattern(pattern, bases) {
+    if (pattern.startsWith("//"))
+        return "/" + pattern.slice(2);
+    const under = (base, rest) => {
+        const normal = base === undefined ? undefined : lexicalNormalAbsolutePathOf(base);
+        if (normal === undefined)
+            return undefined;
+        return (normal === "/" ? "" : normal) + "/" + rest;
+    };
+    if (pattern.startsWith("~/"))
+        return under(bases.home ?? homedir(), pattern.slice(2));
+    if (pattern.startsWith("/"))
+        return under(bases.root, pattern.slice(1));
+    return under(bases.cwd ?? bases.root, pattern.startsWith("./") ? pattern.slice(2) : pattern);
+}
+export function isUsablePathBase(base) {
+    return base !== undefined && lexicalNormalAbsolutePathOf(base) !== undefined;
+}
+function segmentGlobMatches(glob, segment) {
+    if (!glob.includes("*"))
+        return glob === segment;
+    const parts = glob.split("*");
+    let at = 0;
+    for (let i = 0; i < parts.length; i++) {
+        const part = parts[i];
+        if (i === 0) {
+            if (!segment.startsWith(part))
+                return false;
+            at = part.length;
+            continue;
+        }
+        if (i === parts.length - 1)
+            return part === "" || (segment.endsWith(part) && segment.length - part.length >= at);
+        const k = segment.indexOf(part, at);
+        if (k === -1)
+            return false;
+        at = k + part.length;
+    }
+    return true;
+}
+function globSegmentsReach(globs, target) {
+    const seen = new Set();
+    const width = target.length + 1;
+    const walk = (g, t) => {
+        if (g === globs.length)
+            return true;
+        const key = g * width + t;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        if (globs[g] === "**")
+            return walk(g + 1, t) || (t < target.length && walk(g, t + 1));
+        if (t >= target.length)
+            return false;
+        return segmentGlobMatches(globs[g], target[t]) && walk(g + 1, t + 1);
+    };
+    return walk(0, 0);
+}
+export function pathRuleReaches(rule, target, bases) {
+    if (rule.match === "subpath")
+        return directoryRuleAdmits(rule, target);
+    if (rule.match !== "path")
+        return false;
+    if (!isLexicalNormalAbsoluteDir(target) && target !== "/")
+        return false;
+    const resolved = resolvePathPattern(rule.command, bases);
+    if (resolved === undefined)
+        return false;
+    const globs = resolved.split("/").filter((sg) => sg !== "");
+    const segments = target.split("/").filter((sg) => sg !== "");
+    return globSegmentsReach(globs, segments);
 }
 function hasUnescapedStar(s) {
     for (let i = 0; i < s.length; i++) {
@@ -287,11 +418,97 @@ function hasUnescapedStar(s) {
 export function ruleAdmitsCommand(rule, command) {
     return admitsUnder(rule, command, MATCH_READING);
 }
-export function ruleAdmitsProgramRun(rule, command) {
-    return admitsUnder(rule, command, PROGRAM_RUNS_READING);
+export const PROGRAM_RUN_REACHES = ["reached", "not_reached", "unreadable"];
+const REACHED = { reach: "reached" };
+const NOT_REACHED = { reach: "not_reached" };
+export function programRunReachOf(rule, command) {
+    if (rule.match === "subpath" || rule.match === "path")
+        return NOT_REACHED;
+    const body = readRuleBody(rule.command);
+    if (body === undefined)
+        return NOT_REACHED;
+    const shape = readCommandMemo(command);
+    const exact = rule.match === "exact";
+    if (body.segments.length > 1) {
+        const broken = shape.segments.find((s) => s.unreadable !== undefined);
+        if (broken !== undefined)
+            return { reach: "unreadable", reason: broken.unreadable };
+        const hidden = shape.segments.find((s) => s.peelUnreadable !== undefined);
+        const shaped = !shape.grouped && shape.segments.length === body.segments.length && shape.connectors.every((c, i) => c === body.connectors[i]);
+        if (!shaped)
+            return hidden === undefined ? NOT_REACHED : { reach: "unreadable", reason: hidden.peelUnreadable };
+        let outcome = REACHED;
+        for (let i = 0; i < body.segments.length; i++) {
+            const r = segmentReachOf(body.segments[i].argv, shape.segments[i], exact || i < body.segments.length - 1);
+            if (r.reach === "not_reached")
+                return hidden === undefined ? NOT_REACHED : { reach: "unreadable", reason: hidden.peelUnreadable };
+            if (r.reach === "unreadable")
+                outcome = r;
+        }
+        return outcome;
+    }
+    const bodyArgv = body.segments[0].argv;
+    let unreadable;
+    for (const segment of shape.segments) {
+        const r = segmentReachOf(bodyArgv, segment, exact);
+        if (r.reach === "reached")
+            return REACHED;
+        if (r.reach === "unreadable")
+            unreadable ??= r;
+    }
+    return unreadable ?? NOT_REACHED;
+}
+export function ruleReachesProgramRun(rule, command) {
+    return programRunReachOf(rule, command).reach === "reached";
+}
+function segmentReachOf(bodyArgv, segment, exact) {
+    if (segment.unreadable !== undefined)
+        return { reach: "unreadable", reason: segment.unreadable };
+    let unreadable;
+    for (const argv of [segment.argv, ...segment.peeled]) {
+        const r = argvReachOf(bodyArgv, argv, exact);
+        if (r.reach === "reached")
+            return REACHED;
+        if (r.reach === "unreadable")
+            unreadable ??= r;
+    }
+    if (segment.peelUnreadable !== undefined)
+        unreadable ??= { reach: "unreadable", reason: segment.peelUnreadable };
+    return unreadable ?? NOT_REACHED;
+}
+function argvReachOf(bodyArgv, argv, exact) {
+    for (let i = 0; i < bodyArgv.length; i++) {
+        const word = argv[i];
+        const wanted = bodyArgv[i];
+        if (word === undefined)
+            return NOT_REACHED;
+        if (word.expands !== false) {
+            if (word.raw === wanted.raw)
+                continue;
+            return { reach: "unreadable", reason: i === 0 ? "the program name is an expansion" : `an expansion (${word.raw}) stands where the rule reads a word` };
+        }
+        if (word.text !== wanted.text)
+            return NOT_REACHED;
+    }
+    if (!exact || argv.length === bodyArgv.length)
+        return REACHED;
+    const loose = argv.slice(bodyArgv.length).find((w) => w.expands === "many");
+    return loose === undefined ? NOT_REACHED : { reach: "unreadable", reason: `an unquoted expansion (${loose.raw}) may expand to nothing` };
+}
+function readRuleBody(body) {
+    const shape = readShellCommand(body);
+    if (shape.grouped || shape.segments.length === 0)
+        return undefined;
+    return shape.segments.every((s) => s.unreadable === undefined && s.argv.length > 0) ? shape : undefined;
+}
+let lastRead;
+function readCommandMemo(command) {
+    if (lastRead?.command !== command)
+        lastRead = { command, shape: readShellCommand(command) };
+    return lastRead.shape;
 }
 function admitsUnder(rule, command, reading) {
-    if (rule.match === "subpath")
+    if (rule.match === "subpath" || rule.match === "path")
         return false;
     const shape = ruleLaneShapeOf(command, reading);
     if ("reject" in shape)
@@ -332,10 +549,6 @@ export function ruleBreadthWarningsOf(rule) {
     }
     return [];
 }
-export function ruleLaneSegmentsOf(command) {
-    const shape = ruleLaneShapeOf(command, PROGRAM_RUNS_READING);
-    return "reject" in shape ? undefined : shape.segments;
-}
 export function pathWithinRoot(path, root) {
     if (path === root)
         return true;
@@ -350,9 +563,8 @@ export function lexicalNormalAbsolutePathOf(path) {
         if (seg === "" || seg === ".")
             continue;
         if (seg === "..") {
-            if (out.length === 0)
-                return undefined;
-            out.pop();
+            if (out.length > 0)
+                out.pop();
             continue;
         }
         out.push(seg);
@@ -366,7 +578,7 @@ function isLexicalNormalAbsoluteDir(path) {
     return segments.length > 0 && segments.every((s) => s !== "" && s !== "." && s !== "..");
 }
 export function directoryRuleAdmits(rule, path) {
-    if (rule.tool !== "Read" || rule.match !== "subpath")
+    if (rule.match !== "subpath")
         return false;
     if (!isLexicalNormalAbsoluteDir(rule.command))
         return false;
@@ -483,12 +695,12 @@ export function isRuleLive(rule) {
 export function eligibleContext(rule, call) {
     return rule.tool === call.tool && scopeCoversCwd(rule.scope, call.cwd, call.sessionId);
 }
-export function eligiblePersisted(rule, call) {
-    return isRuleLive(rule) && eligibleContext(rule, call);
+export function eligiblePersisted(rule, call, behavior) {
+    return rule.behavior === behavior && isRuleLive(rule) && eligibleContext(rule, call);
 }
 function firstEligibleAdmittingRule(rules, commandText, call) {
     for (const rule of rules) {
-        if (!eligiblePersisted(rule, call))
+        if (!eligiblePersisted(rule, call, "allow"))
             continue;
         if (ruleAdmitsCommand(rule, commandText))
             return rule;
@@ -521,13 +733,60 @@ export function findAdmittingRule(rules, call) {
 }
 function firstEligibleDirectoryRule(rules, directory, call) {
     for (const rule of rules) {
-        if (!eligiblePersisted(rule, { tool: "Read", cwd: call.cwd, sessionId: call.sessionId }))
+        if (!eligiblePersisted(rule, { tool: "Read", cwd: call.cwd, sessionId: call.sessionId }, "allow"))
             continue;
         if (directoryRuleAdmits(rule, directory))
             return rule;
     }
     return undefined;
 }
+export function adjudicatePersistedRules(rules, call) {
+    for (const behavior of RULE_BEHAVIORS_BY_PRECEDENCE) {
+        if (behavior === "allow") {
+            const covering = findAdmittingRule(rules, call);
+            if (covering !== undefined)
+                return { behavior, rules: covering };
+            continue;
+        }
+        let unreadable;
+        for (const rule of rules) {
+            if (!eligiblePersisted(rule, call, behavior))
+                continue;
+            const outcome = programRunReachOf(rule, call.command);
+            if (outcome.reach === "reached")
+                return { behavior, rules: [rule] };
+            if (outcome.reach === "unreadable")
+                unreadable ??= { behavior: "ask", rules: [rule], unreadable: outcome.reason };
+        }
+        if (unreadable !== undefined)
+            return unreadable;
+    }
+    return undefined;
+}
+export function adjudicatePersistedPathRules(rules, call, targets, bases) {
+    for (const behavior of RULE_BEHAVIORS_BY_PRECEDENCE) {
+        if (behavior === "allow") {
+            if (targets.allow === undefined || call.tool !== READ_RULE_TOOL)
+                continue;
+            for (const rule of rules) {
+                if (!eligiblePersisted(rule, call, behavior))
+                    continue;
+                if (directoryRuleAdmits(rule, targets.allow))
+                    return { behavior, rules: [rule] };
+            }
+            continue;
+        }
+        if (targets.tighten === undefined)
+            continue;
+        for (const rule of rules) {
+            if (!eligiblePersisted(rule, call, behavior))
+                continue;
+            if (pathRuleReaches(rule, targets.tighten, bases))
+                return { behavior, rules: [rule] };
+        }
+    }
+    return undefined;
+}
 export function segmentCoverageOf(command, rules, call) {
     const folded = foldSpacing(command);
     if (folded === undefined)
@@ -569,7 +828,7 @@ export function suggestRulesForCommand(command, ctx) {
     if (folded === undefined)
         return [];
     const offers = [];
-    const exact = parseAllowRuleText(formatAllowRuleText(folded, "exact"));
+    const exact = parseRuleText(formatRuleText(folded, "exact", COMMAND_RULE_TOOL), "allow");
     if ("rule" in exact && exact.rule.match === "exact" && ruleAdmitsCommand(exact.rule, command)) {
         offers.push({ kind: "single", rule: exact.rule.rule, match: "exact", command: exact.rule.command });
     }
@@ -589,7 +848,7 @@ export function suggestRulesForCommand(command, ctx) {
         }
         if (denied)
             return undefined;
-        const parsed = parseAllowRuleText(formatAllowRuleText(directory, "subpath"));
+        const parsed = parseRuleText(formatRuleText(directory, "subpath", READ_RULE_TOOL), "allow");
         if (!("rule" in parsed) || parsed.rule.match !== "subpath")
             return undefined;
         if (!directoryRuleAdmits(parsed.rule, directory))
@@ -600,7 +859,7 @@ export function suggestRulesForCommand(command, ctx) {
         if (offers.length === 1) {
             const body = bodyOf(tokensOf(folded));
             if (body !== undefined) {
-                const parsed = parseAllowRuleText(formatAllowRuleText(body, "wildcard"));
+                const parsed = parseRuleText(formatRuleText(body, "wildcard", COMMAND_RULE_TOOL), "allow");
                 if ("rule" in parsed && parsed.rule.match === "wildcard" && ruleAdmitsCommand(parsed.rule, command)) {
                     offers.push({ kind: "single", rule: parsed.rule.rule, match: "wildcard", command: parsed.rule.command });
                 }
@@ -627,12 +886,12 @@ export function suggestRulesForCommand(command, ctx) {
             return undefined;
         const body = bodyOf(tokensOf(segment));
         if (body !== undefined) {
-            const parsed = parseAllowRuleText(formatAllowRuleText(body, "wildcard"));
+            const parsed = parseRuleText(formatRuleText(body, "wildcard", COMMAND_RULE_TOOL), "allow");
             if ("rule" in parsed && parsed.rule.match === "wildcard" && ruleAdmitsCommand(parsed.rule, segment)) {
                 return { rule: parsed.rule.rule, match: "wildcard", command: parsed.rule.command };
             }
         }
-        const segExact = parseAllowRuleText(formatAllowRuleText(segment, "exact"));
+        const segExact = parseRuleText(formatRuleText(segment, "exact", COMMAND_RULE_TOOL), "allow");
         if ("rule" in segExact && segExact.rule.match === "exact" && ruleAdmitsCommand(segExact.rule, segment)) {
             return { rule: segExact.rule.rule, match: "exact", command: segExact.rule.command };
         }
@@ -655,7 +914,7 @@ export function suggestRulesForCommand(command, ctx) {
     const batchRules = minted.slice(0, 5);
     if (batchRules.length > 0) {
         const parsedBatch = batchRules.flatMap((r) => {
-            const p = parseAllowRuleText(r.rule);
+            const p = parseRuleText(r.rule, "allow");
             return "rule" in p ? [p.rule] : [];
         });
         const uncoveredDetail = [];

package/dist/core/permission-rule-org.d.ts

@@ -6,7 +6,7 @@
  * convergent merge). So the org layer has NO CRDT, no tombstones and no join: the server is the single
  * authority, a client holds a read-only versioned snapshot, an update is a whole replacement (revision
  * strictly ordered), and a rollback is a NEW revision carrying old content. Cross-layer tombstones are
- * structurally impossible — an org rule never enters `PersistedAllowRule`, and an org snapshot replace
+ * structurally impossible — an org rule never enters `PersistedRule`, and an org snapshot replace
  * never touches a personal store's bytes. The two layers meet only at the CONSUMPTION site, where org
  * deny/ask folds strict-side: **org deny > org ask (non-dismissable) > personal allow rule > bare ask**.
  *
@@ -35,7 +35,7 @@
  * accept revision N−1 after a restart. Signature / predecessor chaining belongs to the privilege-
  * separation ticket; the high-water mark is the floor that needs no key distribution.
  */
-import { type PersistedAllowRule, type RuleRejectCode } from "./permission-rule-model.js";
+import { type PersistedRule, type RuleRejectCode } from "./permission-rule-model.js";
 import type { PermissionRuleStore } from "./permission-rule-provider.js";
 /** One org rule. There is structurally no allow bucket (design/179 §9: the org layer only tightens). */
 export interface OrgPermissionRule {
@@ -187,8 +187,10 @@ export declare function unenforceableOrgRules(rules: readonly OrgPermissionRule[
 /**
  * design/182 §7.2 — which org rule speaks for this command, if any. Deny outranks ask; within a
  * behavior the first textual match wins (reporting order only — all denies are the same one answer).
- * Matching uses the SAME parser and matcher the personal lane uses (tighten direction: an
- * interpreter-headed prefix deny like `Bash(node:*)` is a legitimately wide tightening and matches).
+ * Matching uses the SAME parser and the SAME tightening reach the personal deny/ask rows use
+ * ({@link programRunReachOf}: an interpreter-headed prefix deny like `Bash(node:*)` is a
+ * legitimately wide tightening and matches; a segment hit is a hit; a call the lexer cannot read
+ * against a rule is an ASK with the reason — fail closed, never silence).
  *
  * The skip below is a defensive floor, and what stands behind it is worth stating precisely: rules that
  * arrive from the org partition's `resolve` ({@link createOrgRulePartition}) have passed {@link validateOrgSnapshot} on BOTH the install
@@ -201,10 +203,15 @@ export declare function unenforceableOrgRules(rules: readonly OrgPermissionRule[
 export declare function orgRuleVerdictFor(rules: readonly OrgPermissionRule[], call: {
     tool: string;
     command: string;
-}): {
-    behavior: "deny" | "ask";
-    rule: string;
-} | undefined;
+}): OrgRuleVerdict | undefined;
+/** The org layer's answer for one call: which rule spoke, with what behavior — and, when the call could
+ *  not be READ against the org's rules, the lexer's reason beside the first rule it could not judge
+ *  (`behavior` is then `ask`: the org published a rule that may reach this call, and nobody can say). */
+export interface OrgRuleVerdict {
+    readonly behavior: "deny" | "ask";
+    readonly rule: string;
+    readonly unreadable?: string;
+}
 /**
  * design/182 §7.3 / design/389 — the SHADOW predicate the unified store's read face applies to every
  * personal allow row: does an org DENY reach this rule's own command pattern? An org deny does not
@@ -212,8 +219,8 @@ export declare function orgRuleVerdictFor(rules: readonly OrgPermissionRule[], c
  * OVERRIDE it, not to self-declare its removal — so a shadowed rule reports `shadowed-by-org` and comes
  * back by itself when the org deny is withdrawn.
  *
- * The SAME reach the gate uses (`orgRuleReaches`), so the view and the decision cannot disagree about
- * whether a deny touches this rule at all. A personal rule may name a connector chain, and a deny on one
+ * The SAME reach the gate uses ({@link ruleReachesProgramRun}), so the view and the decision cannot
+ * disagree about whether a deny touches this rule at all. A personal rule may name a connector chain, and a deny on one
  * of its segments shadows it exactly as a deny on the whole does.
  *
  * WHAT `shadowed-by-org` DOES AND DOES NOT CLAIM: the predicate asks whether the deny reaches the
@@ -232,9 +239,9 @@ export declare function orgRuleVerdictFor(rules: readonly OrgPermissionRule[], c
  * reach it, and its `command` is a PATH that must not be fed to the shell lane's segment reader as
  * though it were a command line.
  */
-export declare function orgRuleShadows(orgRules: readonly OrgPermissionRule[], rule: Pick<PersistedAllowRule, "tool" | "command">): boolean;
+export declare function orgRuleShadows(orgRules: readonly OrgPermissionRule[], rule: Pick<PersistedRule, "tool" | "command">): boolean;
 /** The shadow predicate with the org denies parsed ONCE — what a read over many rows uses. */
-export declare function compileOrgShadowPredicate(orgRules: readonly OrgPermissionRule[]): (rule: Pick<PersistedAllowRule, "tool" | "command">) => boolean;
+export declare function compileOrgShadowPredicate(orgRules: readonly OrgPermissionRule[]): (rule: Pick<PersistedRule, "tool" | "command">) => boolean;
 /** Does this store carry a write face? Re-exported convenience for org-ticket integrations that need to
  *  distinguish a read-only projection from a writable personal bucket without importing the writer seam. */
 export declare function isWritablePermissionRuleStore(store: PermissionRuleStore): boolean;

package/dist/core/permission-rule-org.js

@@ -1,4 +1,4 @@
-import { escapeForDisclosure, parseAllowRuleText, ruleAdmitsProgramRun, ruleLaneSegmentsOf } from "./permission-rule-model.js";
+import { escapeForDisclosure, parseRuleText, programRunReachOf, ruleReachesProgramRun } from "./permission-rule-model.js";
 import { writerOf } from "./permission-rule-store.js";
 export const ORG_UNAVAILABLE_DECISION_REASON = "org_unavailable";
 export const ORG_ADJUDICATION_TIMEOUT_MS = 15_000;
@@ -199,7 +199,7 @@ export function unenforceableOrgRules(rules) {
     for (const r of rules) {
         if (typeof r?.rule !== "string" || r.rule === "")
             continue;
-        const parsed = parseAllowRuleText(r.rule, { direction: "tighten" });
+        const parsed = parseRuleText(r.rule, r.behavior);
         if ("reject" in parsed) {
             out.push({ rule: r.rule, code: parsed.reject.code });
             continue;
@@ -243,28 +243,26 @@ function validateOrgSnapshot(s, nowMs) {
     return undefined;
 }
 export function orgRuleVerdictFor(rules, call) {
-    const segments = ruleLaneSegmentsOf(call.command);
     let ask;
+    let unreadable;
     for (const r of rules) {
-        const parsed = parseAllowRuleText(r.rule, { direction: "tighten" });
+        const parsed = parseRuleText(r.rule, r.behavior);
         if ("reject" in parsed)
             continue;
         if (parsed.rule.tool !== call.tool)
             continue;
-        if (!orgRuleReaches(parsed.rule, call.command, segments))
+        const outcome = programRunReachOf(parsed.rule, call.command);
+        if (outcome.reach === "not_reached")
             continue;
+        if (outcome.reach === "unreadable") {
+            unreadable ??= { behavior: "ask", rule: r.rule, unreadable: outcome.reason };
+            continue;
+        }
         if (r.behavior === "deny")
             return { behavior: "deny", rule: r.rule };
         ask ??= { behavior: "ask", rule: r.rule };
     }
-    return ask;
-}
-function orgRuleReaches(rule, command, segments) {
-    if (ruleAdmitsProgramRun(rule, command))
-        return true;
-    if (segments === undefined)
-        return false;
-    return segments.some((segment) => ruleAdmitsProgramRun(rule, segment));
+    return unreadable ?? ask;
 }
 export function orgRuleShadows(orgRules, rule) {
     return compileOrgShadowPredicate(orgRules)(rule);
@@ -274,15 +272,14 @@ export function compileOrgShadowPredicate(orgRules) {
     for (const d of orgRules) {
         if (d.behavior !== "deny")
             continue;
-        const parsed = parseAllowRuleText(d.rule, { direction: "tighten" });
+        const parsed = parseRuleText(d.rule, "deny");
         if (!("reject" in parsed))
             denies.push(parsed.rule);
     }
     return (rule) => {
         if (rule.tool !== "Bash" || denies.length === 0)
             return false;
-        const segments = ruleLaneSegmentsOf(rule.command);
-        return denies.some((d) => d.tool === rule.tool && orgRuleReaches(d, rule.command, segments));
+        return denies.some((d) => d.tool === rule.tool && ruleReachesProgramRun(d, rule.command));
     };
 }
 export function isWritablePermissionRuleStore(store) {