@wernerbisschoff/pi-gatekeeper 0.1.4 → 0.1.6

package/dist/gatekeeper.js

@@ -609,7 +609,7 @@ const MODE_COLORS = {
  */
 export function updateStatus(ctx) {
     const label = MODE_LABELS[currentMode];
-    const text = `● ${label} /perm`;
+    const text = `● ${label} · /perm`;
     const colorKey = MODE_COLORS[currentMode];
     const styled = typeof ctx.ui.theme?.fg === "function" ? ctx.ui.theme.fg(colorKey, text) : text;
     ctx.ui.setStatus(PERMISSION_STATUS_KEY, styled);
@@ -952,11 +952,19 @@ function commitSubstitution(wrapper, inner, segments) {
  * position `i` consumes the longest matching operator first — otherwise `|` would consume the first
  * char of `||` and leave a stray `|` in the next segment.
  *
+ * The newline operator (`\n`) is intentionally listed LAST so the multi-character forms still take
+ * precedence. Per shell semantics (Bash Reference Manual §3.2.1 "Shell Syntax"), an unquoted newline
+ * is a command separator equivalent to `;` — `cmd1\ncmd2` runs both commands sequentially. The
+ * pending-heredoc-delimiter check in the main loop runs BEFORE the operator check, so a `\n` that
+ * activates a heredoc body is consumed by the body walker instead of triggering a split. Likewise
+ * `tryMatchOperator` returns `null` inside any quote context, so newlines inside `"..."` / `'...'`
+ * strings stay literal.
+ *
  * Adding a new split operator is a single array append here plus a contract update; the parser loop
  * body stays declarative. Future phases (TSK-002-03..06) extend the operator set with heredoc openings,
  * subshell/process-substitution boundaries, etc.
  */
-const SPLIT_OPERATORS = ["&&", "||", ";", "|"];
+const SPLIT_OPERATORS = ["&&", "||", ";", "|", "\n"];
 /**
  * Peek ahead from index `i` and report whether a split operator starts there. Returns `null` when
  * `i` is inside a quoted region so the caller stays a pure operator-table lookup without quote-state
@@ -1922,7 +1930,10 @@ const BARE_PATH_METACHAR_RE = /[|&;<>()$`\\\s'"*?{}\[\]!#]/;
  * candidate is a pure file-system path rather than a compound command fragment. Used by
  * {@link getAllowListEntries} to drop `/tmp/out` / `~/notes.md`-style entries from the prompt
  * preview and the on-disk allowlist so a developer cannot accidentally approve only the file
- * portion of `cat /tmp/output.txt`.
+ * portion of `cat /tmp/output.txt`. Composed of (a) the `isBarePath` predicate used by
+ * {@link isFilePath} for the bare-prefix case and (b) the {@link isFileOnlySegment} check
+ * applied to the trimmed entry to also drop single-token relative paths and known-extension
+ * filenames that survive the multiline split.
  *
  * Order of checks matters: the empty-string short-circuit returns `false` BEFORE the regex
  * matches, so an empty entry never collides with the `/^[/~].*$/` anchor; the leading-`/` or
@@ -1940,6 +1951,122 @@ export function isBarePath(entry) {
         return false;
     return true;
 }
+/**
+ * Known file extensions that mark a single token as a file path rather than a command name. The
+ * list is intentionally narrow — covering shell/JS/Python/Ruby sources, common data formats
+ * (JSON/YAML/TOML/TXT/MD/LOG), and a handful of well-known security/credential extensions
+ * (.pem/.key/.crt/.env) — so that a bare `script.sh` token is correctly identified as a file
+ * even though it contains no path separator. A segment is only filtered as "file-only" if it
+ * consists of a SINGLE such token (see {@link isFileOnlySegment}); compound segments like
+ * `rm foo.sh` are unaffected.
+ */
+const FILE_EXTENSION_RE = /\.(sh|bash|zsh|ts|js|mjs|cjs|tsx|jsx|py|rb|json|ya?ml|toml|txt|md|log|pem|key|crt|env|cfg|conf|ini|out)$/i;
+/**
+ * Set of command interpreters that EXECUTE a script file as their first non-flag argument. When
+ * the first word of a segment is in this set, {@link extractCommandStem} preserves the second
+ * word (the script file) in the stem so `bash script.sh` is persisted as `bash script.sh *`
+ * (not just `bash *`, which would be overly broad). Direct invocations (`./script.sh`,
+ * `../script.sh`) are recognized by {@link isDirectScriptInvocation} on the first word itself.
+ */
+const SCRIPT_INVOKERS = {
+    bash: true,
+    sh: true,
+    zsh: true,
+    dash: true,
+    ksh: true,
+    fish: true,
+    node: true,
+    deno: true,
+    bun: true,
+    tsx: true,
+    "ts-node": true,
+    python: true,
+    python2: true,
+    python3: true,
+    py: true,
+    ruby: true,
+    rb: true,
+    perl: true,
+    php: true,
+};
+/**
+ * True when `word` is a direct script-invocation token: `./script.sh`, `../bin/run.sh`,
+ * `~/bin/run.sh`. These are the user-facing forms that "invoke a file as a script" — distinct
+ * from `script.sh` (which is a bare token the shell may or may not resolve via PATH). Used by
+ * {@link isScriptInvocation} and {@link extractCommandStem} to recognize the "INVOKING the
+ * file as a script" exception that keeps the script argument in the persisted stem.
+ */
+function isDirectScriptInvocation(word) {
+    // `./script.sh`, `../bin/run.sh`, `~/bin/run.sh`. The `~user/...` form is
+    // intentionally NOT matched here — it expands to another user's home
+    // directory and is semantically a bare path, not an explicit invocation.
+    return /^\.{1,2}\//.test(word) || /^~\//.test(word);
+}
+/**
+ * True when the first word of a segment is a script invocation — either a known interpreter
+ * from {@link SCRIPT_INVOKERS} (`bash`, `node`, `python`, …) or a direct invocation token
+ * (`./script.sh`, `../script.sh`). The script-invocation segment form is the single exception
+ * to the "files are not in the allow list" rule: the WHOLE segment is a command (the user is
+ * intentionally executing the file), so the file argument is preserved in the stem.
+ */
+function isScriptInvocation(words) {
+    if (words.length === 0)
+        return false;
+    const first = words[0];
+    if (first === undefined)
+        return false;
+    return SCRIPT_INVOKERS[first] === true || isDirectScriptInvocation(first);
+}
+/**
+ * Broader file-path detector than {@link isBarePath}. Catches:
+ *   - Bare absolute / home-relative paths (`/tmp/x`, `~/x`) — delegated to {@link isBarePath}
+ *   - Relative paths with separators (`build/config.json`, `src/index.ts`)
+ *   - Standalone filenames with a known script/data extension (`script.sh`, `config.json`,
+ *     `foo.txt`)
+ *
+ * Used by {@link isFileOnlySegment} (single-token filter) and by {@link extractCommandStem}
+ * to stop stripping a command's file-argument tail. The empty-string short-circuit matches
+ * {@link isBarePath}'s ordering so the two predicates compose cleanly.
+ */
+export function isFilePath(entry) {
+    if (entry.length === 0)
+        return false;
+    if (isBarePath(entry))
+        return true;
+    if (entry.includes("/"))
+        return true;
+    if (FILE_EXTENSION_RE.test(entry))
+        return true;
+    return false;
+}
+/**
+ * True when `entry` is a "file-only" segment — after stripping leading env-var assignments,
+ * the segment is a SINGLE file-path token with no command word and no shell-operator
+ * punctuation (e.g., `script.sh`, `./run.sh`, `build/config.json`). Used by
+ * {@link getAllowListEntries} and {@link appendStemsToAllowList} to drop segments that point
+ * at a file rather than execute a command, so a multi-line input like
+ *   echo hello
+ *   script.sh
+ * does not produce an allowlist entry for `script.sh` (the user has to invoke the file
+ * explicitly via `bash script.sh` or `./script.sh` to land it in the allow list).
+ *
+ * Multi-token segments (`rm foo.sh`, `cat /tmp/x`) are NOT file-only — the first word is a
+ * command, the rest are arguments. The BARE_PATH_METACHAR_RE scan filters out shell-operator
+ * fragments and multi-word entries in one pass.
+ */
+export function isFileOnlySegment(entry) {
+    const cleaned = stripLeadingEnvAssignments(entry).trim();
+    if (cleaned.length === 0)
+        return false;
+    if (BARE_PATH_METACHAR_RE.test(cleaned))
+        return false;
+    // Direct script invocations (`./script.sh`, `../script.sh`, `~/bin/run.sh`)
+    // are commands, not file-only references — the user is explicitly invoking
+    // the file, so it should land in the allow list like any other command.
+    if (isDirectScriptInvocation(cleaned))
+        return false;
+    return isFilePath(cleaned);
+}
 /**
  * Regex matching a leading shell environment-variable assignment (`VAR=value`, `VAR="value"`,
  * etc.). The identifier must be a valid shell identifier (`[a-zA-Z_][a-zA-Z0-9_]*`) immediately
@@ -2044,59 +2171,56 @@ export function stripLeadingEnvAssignments(command) {
         return command;
     return words.slice(firstNonEnv).join(" ");
 }
-/**
- * Compute the list of entries that "Allow Always" will persist for `command`, in the
- * AC-008-01-mandated order: **first non-bare segment, then full trimmed command, then remaining
- * non-bare segments in parser order**. Bare-path entries are filtered by
- * {@link isBarePath} so `/tmp/out` / `~/notes.md`-style tokens do not escape as standalone
- * allowlist entries. Duplicates are removed with an order-preserving Set-then-spread pass so the
- * "full + segments" formula collapses to a single entry when the full command equals the first
- * segment (e.g. `echo hello` → `["echo hello"]`).
- *
- * **Ordering contract** (PRD AC-008-01 verbatim — pinned by `test/allowlist.test.ts`):
- *   - `getAllowListEntries("grep -l pattern")` → `["grep"]` (command name extracted)
- *   - `getAllowListEntries("ls && grep pattern")` → `["ls", "grep"]` (one command per segment)
- *   - `getAllowListEntries("npm install express && npm test")` → `["npm", "npm test"]`
- *     (command names; duplicates collapsed; `npm test` is a different command from `npm install`
- *      but both share `npm` as command name; kept only once)
- *   - `getAllowListEntries("cat /tmp/output.txt")` → `["cat"]`
- *   - `getAllowListEntries("echo hello")` → `["echo"]` (single segment command name)
- *
- * Contract anchors:
- *   - `data-model.md:177-228` (FR-008: allowlist entry computation)
- *   - PRD AC-008-01 / AC-008-02 / AC-008-03 (`["npm install express", "npm install express && npm test", "npm test"]`)
- *   - `architecture.md:152-163` (prompt preview ordering)
- *
- * Pure data transformation — no I/O, no `ExtensionContext`, no `os.homedir()` access. The
- * empty-input early-return keeps dedup logic clean and matches PRD's "empty command → empty array"
- * exception strategy.
- */
 /**
  * Extract the command stem from a command string — the command name plus any
  * fixed subcommand (e.g. `git diff`, `docker compose`). Everything before the
- * first flag argument (word starting with `-`) or path argument (word starting
- * with `/`, `~`, `.`). This produces entries that, when persisted with ` *`,
- * match the same subcommand pattern without being overly broad (`git diff *`
- * rather than `git *`).
+ * first flag argument (word starting with `-`) or file-path argument (anything
+ * {@link isFilePath} recognizes, e.g. `/tmp/x`, `build/y.json`, `script.sh`).
+ * This produces entries that, when persisted with ` *`, match the same
+ * subcommand pattern without being overly broad (`git diff *` rather than `git *`).
+ *
+ * **Script-invocation exception** (ISS-002 follow-up — see `SCRIPT_INVOKERS`):
+ * when the first word is a known interpreter (`bash`, `node`, `python`, …) or a
+ * direct script-invocation token (`./script.sh`, `../script.sh`), the FIRST file
+ * argument (the script) is preserved in the stem so `bash script.sh` produces
+ * `bash script.sh` (not just `bash`). This matches the "INVOKING the file as a
+ * script" carve-out and keeps the persisted rule from over-allowing every
+ * invocation of the interpreter.
  *
  * For single-word commands without subcommands (e.g. `grep`, `ls`), returns
- * just the command name.
+ * just the command name. Single-token file paths (`script.sh`, `./run.sh`)
+ * return themselves as the stem — the file IS the command in that case; the
+ * downstream {@link getAllowListEntries} / {@link appendStemsToAllowList}
+ * filter is responsible for keeping them out of the allow list.
  */
 function extractCommandStem(segment) {
     const cleaned = stripLeadingEnvAssignments(segment);
     const words = splitShellWords(cleaned);
     if (words.length === 0)
         return cleaned;
-    // Take words until we hit something that looks like a flag or path.
+    const scriptInv = isScriptInvocation(words);
+    // Take words until we hit something that looks like a flag or a file path.
     const stem = [];
-    for (const w of words) {
+    for (let i = 0; i < words.length; i++) {
+        const w = words[i];
+        if (w === undefined)
+            continue;
         if (w.startsWith("-"))
             break; // flag argument starts here
-        if (w.startsWith("/") || w.startsWith("~") || w.startsWith(".")) {
-            // Bare path — stop before it UNLESS this is the very first word
-            // (a bare-path command like `/usr/bin/ls`).
-            if (stem.length > 0)
-                break;
+        if (isFilePath(w)) {
+            if (stem.length === 0) {
+                // First word is a file path (e.g., `/usr/bin/python`, `./script.sh`,
+                // `/tmp/run.sh`) — keep it as the command.
+                stem.push(w);
+                continue;
+            }
+            // File-path argument after the command — stop UNLESS this is a script
+            // invocation and the file is the script being invoked.
+            if (scriptInv && i === 1) {
+                stem.push(w);
+                continue;
+            }
+            break;
         }
         stem.push(w);
     }
@@ -2124,11 +2248,29 @@ export function getAllowListEntries(command) {
     // Strip leading env-var assignments from each segment so transient `VAR=val`
     // prefixes do not leak into entries.
     const cleanSegments = rawSegments.map((s) => stripLeadingEnvAssignments(s));
-    // Filter bare paths.
-    const segments = cleanSegments.filter((s) => !isBarePath(s));
+    // Filter bare paths AND file-only segments (e.g., a multi-line input where one
+    // line is just `script.sh` — that's a file, not a command). Multi-token
+    // segments like `rm foo.sh` pass through unchanged because {@link isFileOnlySegment}
+    // only matches single-token file paths; the file argument inside a command is
+    // the caller's responsibility (see {@link extractCommandStem}). Direct script
+    // invocations (`./script.sh`, `../bin/run.sh`, `~/bin/run.sh`) bypass the
+    // filter — the user is intentionally executing the file, so it belongs in
+    // the allowlist like any other command.
+    const segments = cleanSegments.filter((s) => isDirectScriptInvocation(s) || (!isBarePath(s) && !isFileOnlySegment(s)));
     if (segments.length === 0) {
-        // Fallback: no non-bare segments.
-        return isBarePath(trimmed) ? [] : [trimmed];
+        // Fallback: every parsed segment was filtered. The whole command is
+        // either a single direct invocation (preserved), a single file path
+        // (dropped), or — in the multi-line "all file paths" case — the
+        // trimmed input is a newline-joined string that {@link isFileOnlySegment}
+        // refuses to classify as file-only because of the embedded `\n`. Walk
+        // the original rawSegments and check EACH one individually so a
+        // `script.sh\n/tmp/output.txt` input correctly resolves to `[]`.
+        if (isDirectScriptInvocation(trimmed))
+            return [trimmed];
+        const allFiltered = cleanSegments.every((s) => !isDirectScriptInvocation(s) && (isBarePath(s) || isFileOnlySegment(s)));
+        if (allFiltered)
+            return [];
+        return [trimmed];
     }
     // Dedup full segments (preserving order).
     const seen = new Set();
@@ -2335,50 +2477,6 @@ export function sessionAllow(command) {
 export function isSessionAllowed(command) {
     return sessionAllowList.has(command);
 }
-/* ─── Allow All Once — ephemeral flag for compound commands (FLOW-12) ───
- *
- * Module-level boolean that when set causes `runPermissionGate` to return
- * `{ allow: true }` for remaining segments without prompting. Cleared after
- * execution completes (does NOT persist across bash tool invocations).
- *
- * Lifecycle: setAllowAllOnce → consumeAllowAllOnce (read-and-clear,
- * one-shot, returns true once) → resetAllowAllOnce (unconditional clear).
- *
- * Flow references: FLOW-12 Step 3 + Step 8 + FLOW-08 Step 3. */
-let allowAllOnceActive = false;
-/**
- * Set the Allow All Once flag. After this call, the next
- * {@link consumeAllowAllOnce} returns `true` and clears the flag.
- * Exported so the TSK-009-03 lifecycle tests can drive it directly
- * without going through {@link promptForCompoundCommand}.
- */
-export function setAllowAllOnce() {
-    allowAllOnceActive = true;
-}
-/**
- * Consume (read-and-clear) the Allow All Once flag. Returns `true`
- * exactly once when the flag was set by a prior {@link setAllowAllOnce}
- * call; subsequent calls return `false` until the flag is re-set.
- * This one-shot semantics mirrors the existing {@link isEphemeralAllowed}
- * pattern.
- */
-export function consumeAllowAllOnce() {
-    if (allowAllOnceActive) {
-        allowAllOnceActive = false;
-        return true;
-    }
-    return false;
-}
-/**
- * Unconditionally clear the Allow All Once flag. Idempotent — calling
- * when the flag is already `false` is a no-op. Primed as the test-teardown
- * seam (per-test `beforeEach` in the FLOW-12 lifecycle describe); intended
- * for cleanup after compound command execution resolves (FLOW-12 Step 8 —
- * integration pending).
- */
-export function resetAllowAllOnce() {
-    allowAllOnceActive = false;
-}
 /**
  * shared by {@link appendStemsToAllowList} and {@link appendToDenyList} — both writers push
  * entries onto a per-level pattern list and MUST preserve the
@@ -2405,12 +2503,31 @@ function appendUnique(list, entries) {
  * glued-wildcard forms (`"git*"`) so future programmatic callers (FLOW-12's
  * `promptForCompoundCommand`) cannot seed `perm-rules.json` with an over-broad
  * pattern that would match `gitlog` / `git-fetch`. Empty input is a no-op (no write).
+ *
+ * Scope parameter:
+ *   - `"session"` — in-memory only; adds each stem to {@link sessionAllowList} so it
+ *     survives the rest of the session without ever touching disk. No file-only
+ *     filtering or pattern expansion (matches the existing `sessionAllow` contract).
+ *   - `"always"` (default) — persist to `perm-rules.json` per the original contract.
  */
-export function appendStemsToAllowList(stems, ctx) {
+export function appendStemsToAllowList(stems, ctx, scope = "always") {
+    if (scope === "session") {
+        for (const stem of stems) {
+            sessionAllow(stem);
+        }
+        return;
+    }
     const rules = loadRules(ctx);
     const mode = getCurrentMode();
     const expanded = [];
     for (const stem of stems) {
+        // Drop file-only segments BEFORE persistence — a stem that is just a file
+        // path (e.g., `script.sh` from a multi-line input) must never end up in
+        // `perm-rules.json`. Script invocations (`bash script.sh`, `./script.sh`)
+        // have their first word as a real command so the stem is multi-word and
+        // passes through this filter.
+        if (isFileOnlySegment(stem))
+            continue;
         const wild = `${stem} *`;
         if (validateFullTokenBoundary(stem))
             expanded.push(stem);
@@ -2517,44 +2634,75 @@ async function promptForPermission(reason, command, askPreview, ctx) {
     }
 }
 /**
- * Build the option list for the compound command prompt from positional wildcard
- * candidates. Pure function — no I/O, no side effects.
+ * Build the option list for the compound command prompt from the segment's stem
+ * and (if present) parent stem. Pure function — no I/O, no side effects.
+ *
+ * Single-word segments emit a flat 4-option list:
+ *   Allow "{stem}" once
+ *   Allow "{stem}" this session
+ *   Allow "{stem}" always
+ *   Deny "{stem}"
  *
- * Order: Allow All Once, then each candidate with This Session / Always suffixes,
- * then Deny as the final entry.
+ * Multi-word segments (e.g. `git diff`) emit a 6-option list that adds the
+ * parent-stem expansion (e.g. `Allow "git" this session`, `Allow "git" always`)
+ * so the developer can grant just the parent tool without locking in the
+ * specific subcommand.
  *
- * @param candidates — output of {@link unfoldPositionalCandidates}
+ * @param stem — `extractCommandStem(segment)`, the command without arguments
+ * @param parent — null for single-word stems, else the first word of `stem`
  * @returns a string array suitable for `ctx.ui.select({ options })`
  */
-function buildCompoundOptions(candidates) {
-    const options = ["Allow All Once"];
-    for (const c of candidates) {
-        options.push(`${c} This Session`);
-        options.push(`${c} Always`);
+function buildCompoundOptions(stem, parent) {
+    if (parent !== null) {
+        return [
+            `Allow "${stem}" once`,
+            `Allow "${parent}" this session`,
+            `Allow "${stem}" this session`,
+            `Allow "${parent}" always`,
+            `Allow "${stem}" always`,
+            `Deny "${stem}"`,
+        ];
     }
-    options.push("Deny");
-    return options;
+    return [
+        `Allow "${stem}" once`,
+        `Allow "${stem}" this session`,
+        `Allow "${stem}" always`,
+        `Deny "${stem}"`,
+    ];
 }
 /**
  * Parse a selected option string from the compound command prompt back into
  * a structured {@link CompoundSelection}. Pure function — no I/O, no side effects.
  *
+ * The shape is unambiguous because each option has a unique label suffix:
+ *   - ` <something>" once`            → once
+ *   - `Deny "<something>"`            → deny
+ *   - `Allow "<something>" this session` → session
+ *   - `Allow "<something>" always`    → always
+ * Both parent and self options share the `"Allow "<stem>" this session"`
+ * shape, but their `stem` values are different — that's OK, since the parent
+ * is the FIRST whitespace token of the multi-word self and is never itself
+ * ambiguous.
+ *
  * Returns `null` for unrecognised selections (the caller treats this as a
  * conservative deny per Constitution §1.6).
  */
 function parseCompoundSelection(selected) {
-    if (selected === "Allow All Once")
-        return { type: "allow-all-once" };
-    if (selected === "Deny")
-        return { type: "deny" };
-    // Must be a candidate option — determine if This Session or Always.
-    if (selected.endsWith(" This Session")) {
-        const pattern = selected.slice(0, -" This Session".length);
-        return { type: "candidate", pattern, isSession: true };
-    }
-    if (selected.endsWith(" Always")) {
-        const pattern = selected.slice(0, -" Always".length);
-        return { type: "candidate", pattern, isSession: false };
+    const onceMatch = /^Allow "(.+)" once$/.exec(selected);
+    if (onceMatch) {
+        return { type: "once", stem: onceMatch[1] ?? "" };
+    }
+    const denyMatch = /^Deny "(.+)"$/.exec(selected);
+    if (denyMatch) {
+        return { type: "deny", stem: denyMatch[1] ?? "" };
+    }
+    const sessionMatch = /^Allow "(.+)" this session$/.exec(selected);
+    if (sessionMatch) {
+        return { type: "session", stem: sessionMatch[1] ?? "" };
+    }
+    const alwaysMatch = /^Allow "(.+)" always$/.exec(selected);
+    if (alwaysMatch) {
+        return { type: "always", stem: alwaysMatch[1] ?? "" };
     }
     // Unexpected selection.
     return null;
@@ -2562,62 +2710,65 @@ function parseCompoundSelection(selected) {
 /**
  * Apply a parsed compound selection decision: construct the decision entry,
  * append it to `resultSegments`, and execute any persistence side effects
- * (session allow, allow-always persistence). Intended as the inner workhorse
- * of {@link promptForCompoundCommand}'s segment loop.
+ * (`appendStemsToAllowList` for session/always, `ephemeralAllow` for once,
+ * `appendToDenyList` for deny). Intended as the inner workhorse of
+ * {@link promptForCompoundCommand}'s segment loop.
  *
- * Returns `true` when the caller should short-circuit (Allow All Once selected
- * — the flag has been set and the function has already returned early by
- * returning the compound decision with `allowAllOnceUsed: true`); returns
- * `false` to continue to the next segment.
+ * Side effects:
+ *   - `once`    → `ephemeralAllow(stem)`                           (consume-on-match)
+ *   - `session` → `appendStemsToAllowList([stem], ctx, "session")` (in-memory only)
+ *   - `always`  → `appendStemsToAllowList([stem], ctx, "always")`  (persists `stem` and `stem *`)
+ *   - `deny`    → `appendToDenyList(stem, ctx)`                   (persists stem to current level)
  *
- * Pure-ish: writes to `resultSegments` (mutating push), calls `setAllowAllOnce`,
- * `sessionAllow`, or `appendStemsToAllowList` as side effects. The caller owns
- * `resultSegments` and must not reuse it after this returns `true` (the return
- * already contains the final compound decision).
+ * Mutation: pushes onto `resultSegments` in place, including `pattern: parsed.stem`
+ * on every pushed entry so downstream consumers can reconstruct the chosen stem
+ * (the parent-stem session/always selections arrive here with `stem === parent`).
  */
 function applyCompoundSegmentDecision(segment, parsed, resultSegments, ctx) {
-    if (parsed.type === "allow-all-once") {
-        setAllowAllOnce();
-        resultSegments.push({ segment, decision: "allow", scope: "ephemeral" });
-        return true;
-    }
     if (parsed.type === "deny") {
-        resultSegments.push({ segment, decision: "deny", scope: "persist" });
+        appendToDenyList(parsed.stem, ctx);
+        resultSegments.push({ segment, decision: "deny", scope: "persist", pattern: parsed.stem });
+        return false;
+    }
+    if (parsed.type === "once") {
+        ephemeralAllow(parsed.stem);
+        resultSegments.push({ segment, decision: "allow", scope: "ephemeral", pattern: parsed.stem });
         return false;
     }
-    // Candidate — extract the stem (remove trailing ` *` for persistence).
-    const stem = parsed.pattern.endsWith(" *") ? parsed.pattern.slice(0, -2) : parsed.pattern;
-    if (parsed.isSession) {
-        sessionAllow(stem);
-        resultSegments.push({
-            segment,
-            decision: "allow",
-            scope: "session",
-            pattern: parsed.pattern,
-        });
-    }
-    else {
-        appendStemsToAllowList([stem], ctx);
-        resultSegments.push({
-            segment,
-            decision: "allow",
-            scope: "persist",
-            pattern: parsed.pattern,
-        });
+    if (parsed.type === "session") {
+        appendStemsToAllowList([parsed.stem], ctx, "session");
+        resultSegments.push({ segment, decision: "allow", scope: "session", pattern: parsed.stem });
+        return false;
     }
+    // "always"
+    appendStemsToAllowList([parsed.stem], ctx, "always");
+    resultSegments.push({ segment, decision: "allow", scope: "always", pattern: parsed.stem });
     return false;
 }
 /**
  * Segment-by-segment interactive prompt for compound commands (FLOW-12).
  *
- * For each "ask" segment, computes positional wildcard candidates via
- * {@link unfoldPositionalCandidates}, presents them in a `ctx.ui.select()`
- * dialog with Allow All Once / This Session / Always / Deny options, and
- * returns a {@link CompoundDecision} mapping each segment to its scoped result.
- *
- * The Allow All Once option short-circuits remaining segments without prompting
- * and sets the Allow All Once flag so {@link runPermissionGate} can skip
- * re-prompting for subsequent segments of the same compound execution.
+ * For each "ask" segment, computes the command stem (and parent stem for
+ * multi-word commands), presents them in a `ctx.ui.select()` dialog with
+ * a per-segment menu (Allow "{stem}" once, Allow "{stem}" this session,
+ * Allow "{stem}" always, Deny "{stem}"; multi-word segments also expose
+ * parent-stem session/always variants), and returns a {@link CompoundDecision}
+ * mapping each segment to its scoped result.
+ *
+ * After applying a per-segment decision, the function short-circuits when
+ * the user commits to a session or always scope (remaining segments are
+ * auto-allowed through that scope without further prompting); "once" and
+ * "deny" continue iterating so each segment is decided individually.
+ *
+ * **Classifier-aware pre-pass** (FLOW-12 Step 2 enhancement): segments
+ * whose per-segment classifier verdict is `allow` (e.g. cascade-matched
+ * `git diff *` for a `cd /repo; git diff HEAD` chain) are recorded as
+ * `decision: "allow"` in the result WITHOUT prompting — the cascade rule
+ * already gates them, so re-prompting wastes UI cycles and trains the user
+ * to deny out of habit. Per-segment `deny` is unreachable here because
+ * `runPermissionGate` routes denies through `classifyCommand`'s combined
+ * precedence before reaching this prompt (the compound branch only fires
+ * when combined decision is `ask`).
  *
  * Headless short-circuit (FLOW-11): when `ctx.hasUI === false`, returns an empty
  * `CompoundDecision` immediately without calling `ctx.ui.select` — the caller
@@ -2627,25 +2778,64 @@ function applyCompoundSegmentDecision(segment, parsed, resultSegments, ctx) {
  *
  * Flow references:
  *   - FLOW-12 Step 3 ("segment-by-segment prompt loop")
- *   - FLOW-12 Step 8 ("Allow All Once flag lifecycle")
  *   - FLOW-08 Step 3 ("scope-based persistence routing")
  */
 export async function promptForCompoundCommand(segments, ctx) {
     if (!ensureSelectAvailable(ctx)) {
-        return { segments: [], allowAllOnceUsed: false };
+        return { segments: [], cancelled: false };
     }
     if (segments.length === 0) {
-        return { segments: [], allowAllOnceUsed: false };
+        return { segments: [], cancelled: false };
     }
     const resultSegments = [];
     const promptSelect = ctx.ui.select;
-    for (const segment of segments) {
-        const candidates = unfoldPositionalCandidates(segment);
-        const options = buildCompoundOptions(candidates);
+    // Pre-classify every segment so cascade-allowed pieces of a compound
+    // command (`cd /repo; git diff HEAD; echo done` at medium mode where
+    // `cd *`, `git diff *`, and `echo *` all cascade-allow) never reach the
+    // per-segment prompt. The classifier runs in a single pipeline (no I/O)
+    // and mirrors `classifyCommand`'s per-segment walker at
+    // `src/gatekeeper.ts:1799-1858`.
+    const mode = getCurrentMode();
+    const rules = loadRules(ctx);
+    const strippedSegments = segments.map((seg) => stripLeadingEnvAssignments(seg));
+    const perSegment = strippedSegments.map((seg) => classifySegment(seg, mode, rules));
+    for (let i = 0; i < segments.length; i += 1) {
+        const segment = segments[i];
+        const segmentClassifier = perSegment[i];
+        // Cascade-allowed segments are recorded but not prompted — the rule
+        // that already gates them (e.g. `git diff *` matched via cascade-down)
+        // is the authoritative allow signal; re-prompting would only confirm
+        // what the rule already says and creates the false-deny surface the
+        // user kept tripping on ("Blocked: All segments denied" out of habit).
+        if (segmentClassifier.decision === "allow") {
+            resultSegments.push({ segment, decision: "allow", scope: "ephemeral" });
+            continue;
+        }
+        // Per-segment `deny` is unreachable through `runPermissionGate`
+        // (combined precedence is `deny > ask > allow`), but if a future
+        // caller routes a deny-yielding compound here we surface it as a
+        // hard deny without prompting. `pattern` is omitted because the
+        // upstream deny was decided at the full-command classifier level,
+        // not from this per-segment prompt.
+        if (segmentClassifier.decision === "deny") {
+            resultSegments.push({ segment, decision: "deny", scope: "persist" });
+            return { segments: resultSegments, cancelled: false };
+        }
+        // Compute the full command stem (e.g., `pnpm exec biome check test/`,
+        // `git diff HEAD`) via `extractCommandStem`. The menu only needs the
+        // first two tokens — the bare command plus its first subcommand — to
+        // stay readable; longer stems add no meaningful choice granularity.
+        // `parent` is the first token of that two-token menu stem, used for
+        // the parent-stem "this session" / "always" expansion entries.
+        const stem = extractCommandStem(segment);
+        const tokens = stem.split(" ");
+        const menuStem = tokens.slice(0, 2).join(" ");
+        const parent = tokens.length > 1 ? (tokens[0] ?? null) : null;
+        const options = buildCompoundOptions(menuStem, parent);
         let selected;
         try {
             selected = await promptSelect({
-                message: `Segment: ${segment}`,
+                message: `Allow command "${segment}"`,
                 options,
             });
         }
@@ -2653,22 +2843,31 @@ export async function promptForCompoundCommand(segments, ctx) {
             // Fail closed per Constitution §1.6 — a thrown prompt must never silently
             // allow. The denial is recorded in the CompoundDecision and surfaced by
             // finalizeCompoundGateResult's notification, avoiding a duplicate warning.
-            resultSegments.push({ segment, decision: "deny", scope: "persist" });
-            return { segments: resultSegments, allowAllOnceUsed: false };
+            resultSegments.push({ segment, decision: "deny", scope: "persist", pattern: stem });
+            return { segments: resultSegments, cancelled: false };
         }
         if (selected === undefined) {
-            return { segments: resultSegments, allowAllOnceUsed: false };
+            // User dismissed the prompt (Escape, focus loss, TUI auto-dismiss) without
+            // choosing any option. Mark `cancelled: true` so finalizeCompoundGateResult
+            // can emit "Blocked: Prompt dismissed" — distinct from the misleading
+            // "Blocked: All segments denied" that an empty `resultSegments` would otherwise produce.
+            return { segments: resultSegments, cancelled: true };
         }
         const parsed = parseCompoundSelection(selected);
         if (parsed === null) {
-            resultSegments.push({ segment, decision: "deny", scope: "persist" });
+            resultSegments.push({ segment, decision: "deny", scope: "persist", pattern: stem });
             continue;
         }
-        if (applyCompoundSegmentDecision(segment, parsed, resultSegments, ctx)) {
-            return { segments: resultSegments, allowAllOnceUsed: true };
+        applyCompoundSegmentDecision(segment, parsed, resultSegments, ctx);
+        // Short-circuit: when the user commits to a session or always scope on
+        // the current segment, remaining segments are auto-allowed through that
+        // scope without further prompting. "once" and "deny" continue to the
+        // next segment so each is decided individually.
+        if (parsed.type === "session" || parsed.type === "always") {
+            return { segments: resultSegments, cancelled: false };
         }
     }
-    return { segments: resultSegments, allowAllOnceUsed: false };
+    return { segments: resultSegments, cancelled: false };
 }
 /**
  * Interpret a {@link CompoundDecision} returned by
@@ -2685,8 +2884,17 @@ export async function promptForCompoundCommand(segments, ctx) {
  * - No segment allowed → notify and deny.
  */
 function finalizeCompoundGateResult(compoundDecision, ctx) {
-    if (compoundDecision.allowAllOnceUsed) {
-        return { allow: true };
+    if (compoundDecision.cancelled) {
+        // User dismissed the prompt (Escape, focus loss) without choosing. This is
+        // semantically distinct from "explicitly denied every segment" — the user did
+        // not actively choose Deny, so the message must reflect that. Cancellation also
+        // MUST NOT persist anything to perm-rules.json (Constitution §1.6 — the user never
+        // opted in to a deny rule, and an unwanted "deny" entry would silently widen the
+        // deny surface for future invocations).
+        if (ctx.hasUI && ctx.ui) {
+            ctx.ui.notify("Blocked: Prompt dismissed", "warning");
+        }
+        return { allow: false };
     }
     const anyAllowed = compoundDecision.segments.some((s) => s.decision === "allow");
     if (anyAllowed) {
@@ -2745,15 +2953,6 @@ export async function runPermissionGate(command, ctx) {
     if (runtimeMode === "off") {
         return { allow: true };
     }
-    // (1.5) Allow All Once check — FLOW-12 Step 7/8. When the flag is set by
-    // promptForCompoundCommand for a preceding segment in the same compound
-    // execution, skip all processing (classifier, prompt) and return allow.
-    // The flag is consumed on first access (single-shot), so a subsequent
-    // runPermissionGate invocation without re-setting the flag goes through the
-    // normal classifier/prompt path.
-    if (consumeAllowAllOnce()) {
-        return { allow: true };
-    }
     // (2) Session allow check — persists across the session without consuming on match.
     if (isSessionAllowed(resolvedCommand)) {
         return { allow: true };
@@ -2802,7 +3001,22 @@ export async function runPermissionGate(command, ctx) {
     const strippedSegments = segments.map((seg) => stripLeadingEnvAssignments(seg));
     const perSegment = strippedSegments.map((seg) => classifySegment(seg, mode, rules));
     const askStems = perSegment
-        .map((d, i) => d.decision === "ask" ? extractCommandStem(strippedSegments[i]) : null)
+        .map((d, i) => {
+        if (d.decision !== "ask")
+            return null;
+        const seg = strippedSegments[i];
+        if (seg === undefined)
+            return null;
+        // File-only segments (a single-token file path like `script.sh`) are
+        // filtered from the preview AND from the allow-list persistence. The
+        // full command is still shown in the prompt's `Command:` line, so the
+        // user can see what is being run; the developer must invoke the file
+        // explicitly (`bash script.sh`, `./script.sh`) to land it in the
+        // allow list.
+        if (isFileOnlySegment(seg))
+            return null;
+        return extractCommandStem(seg);
+    })
         .filter((s) => s !== null);
     const askPreview = askStems.length > 0 ? askStems.join(", ") : "(no segments)";
     const choice = await promptForPermission(decision.reason, resolvedCommand, askPreview, ctx);
@@ -2925,38 +3139,28 @@ function buildBashResult(text, isError) {
  * Source anchor: `tasks.md TSK-005-03` (bash tool registration + execute handler).
  */
 async function bashExecute(_toolCallId, params, _signal, _onUpdate, ctx) {
+    // (1) Defensive non-string guard — a malformed tool payload (number, object, null,
+    // undefined) never reaches the gate. Returns BLOCKED with isError: true so the LLM
+    // surfaces a structured error to the developer.
+    if (typeof params.command !== "string") {
+        return buildBashResult("BLOCKED: bash tool command must be a string", true);
+    }
+    // (2) Permission gate — classifier + prompt + persistence routing. The gate runs BEFORE
+    // shell dispatch so a denied command never reaches `child_process.exec`.
+    const decision = await runPermissionGate(params.command, ctx);
+    if (!decision.allow) {
+        return buildBashResult(`BLOCKED: ${params.command}`, true);
+    }
+    // (3) Shell dispatch — gate approved; run the command in `ctx.cwd` and surface the
+    // merged stdout/stderr payload. A spawn failure (ENOENT, EACCES, etc.) is caught and
+    // returned as a structured error result so the LLM sees a normalized shape.
     try {
-        // (1) Defensive non-string guard — a malformed tool payload (number, object, null,
-        // undefined) never reaches the gate. Returns BLOCKED with isError: true so the LLM
-        // surfaces a structured error to the developer.
-        if (typeof params.command !== "string") {
-            return buildBashResult("BLOCKED: bash tool command must be a string", true);
-        }
-        // (2) Permission gate — classifier + prompt + persistence routing. The gate runs BEFORE
-        // shell dispatch so a denied command never reaches `child_process.exec`.
-        const decision = await runPermissionGate(params.command, ctx);
-        if (!decision.allow) {
-            return buildBashResult(`BLOCKED: ${params.command}`, true);
-        }
-        // (3) Shell dispatch — gate approved; run the command in `ctx.cwd` and surface the
-        // merged stdout/stderr payload. A spawn failure (ENOENT, EACCES, etc.) is caught and
-        // returned as a structured error result so the LLM sees a normalized shape.
-        try {
-            const { stdout, stderr } = await execBash(params.command, ctx.cwd);
-            return buildBashResult(stderr && stderr.length > 0 ? `${stdout}${stdout ? "\n" : ""}${stderr}` : stdout, false);
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            return buildBashResult(`BLOCKED: shell exec failed: ${message}`, true);
-        }
+        const { stdout, stderr } = await execBash(params.command, ctx.cwd);
+        return buildBashResult(stderr && stderr.length > 0 ? `${stdout}${stdout ? "\n" : ""}${stderr}` : stdout, false);
     }
-    finally {
-        // FLOW-12 Step 8 clearance: after any compound execution completes,
-        // unconditionally clear the Allow All Once flag so it does not persist
-        // across separate bash tool invocations. The outer try/finally guarantees
-        // this runs even if runPermissionGate throws unexpectedly, making the
-        // safety contract unbreakable (FLOW-12 Step 8, FLOW-08 Step 5).
-        resetAllowAllOnce();
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return buildBashResult(`BLOCKED: shell exec failed: ${message}`, true);
     }
 }
 /**