create-walle 0.9.21 → 0.9.23

package/template/wall-e/coding/frontend-verification.js

@@ -0,0 +1,258 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const FRONTEND_FILE_RE = /\.(html?|css|scss|sass|less|jsx|tsx|vue|svelte|astro)\b/i;
+const HTML_FILE_RE = /\.html?\b/i;
+const JS_FILE_RE = /\.(?:mjs|cjs|js|jsx|ts|tsx)\b/i;
+const ASSET_ATTR_RE = /\b(?:src|href|poster)\s*=\s*["']([^"']+)["']/gi;
+const SRCSET_RE = /\bsrcset\s*=\s*["']([^"']+)["']/gi;
+const CSS_URL_RE = /url\(\s*(['"]?)([^'")]+)\1\s*\)/gi;
+const EVENT_HANDLER_ATTR_RE = /\bon([a-z][a-z0-9_-]*)\s*=\s*(["'])([\s\S]*?)\2/gi;
+const SCRIPT_SRC_RE = /<script\b[^>]*\bsrc\s*=\s*(["'])([^"']+)\1[^>]*>/gi;
+const INLINE_SCRIPT_RE = /<script\b(?![^>]*\bsrc\b)[^>]*>([\s\S]*?)<\/script>/gi;
+const JS_CALL_RE = /(?:^|[^\w$.\]])(?:window\.|globalThis\.)?([A-Za-z_$][\w$]*)\s*\(/g;
+const JS_KEYWORDS = new Set([
+  'if',
+  'for',
+  'while',
+  'switch',
+  'catch',
+  'function',
+  'return',
+  'typeof',
+  'void',
+  'new',
+  'do',
+  'else',
+  'class',
+  'super',
+  'import',
+  'export',
+]);
+
+function isFrontendFile(filePath = '') {
+  return FRONTEND_FILE_RE.test(String(filePath || ''));
+}
+
+function isHtmlFile(filePath = '') {
+  return HTML_FILE_RE.test(String(filePath || ''));
+}
+
+function isScriptFile(filePath = '') {
+  return JS_FILE_RE.test(String(filePath || ''));
+}
+
+function shouldSkipReference(ref = '') {
+  const value = String(ref || '').trim();
+  if (!value) return true;
+  return value.startsWith('#')
+    || /^(?:https?:|data:|mailto:|tel:|javascript:|blob:|about:)/i.test(value);
+}
+
+function cleanReference(ref = '') {
+  const value = String(ref || '').trim();
+  const hashIdx = value.indexOf('#');
+  const queryIdx = value.indexOf('?');
+  const cut = [hashIdx, queryIdx].filter((n) => n >= 0).sort((a, b) => a - b)[0];
+  return cut >= 0 ? value.slice(0, cut) : value;
+}
+
+function srcsetReferences(value = '') {
+  return String(value || '')
+    .split(',')
+    .map((entry) => entry.trim().split(/\s+/)[0])
+    .filter(Boolean);
+}
+
+function extractLocalAssetReferences(content = '') {
+  const refs = [];
+  let match;
+  while ((match = ASSET_ATTR_RE.exec(content))) refs.push(match[1]);
+  while ((match = CSS_URL_RE.exec(content))) refs.push(match[2]);
+  while ((match = SRCSET_RE.exec(content))) refs.push(...srcsetReferences(match[1]));
+  return refs
+    .map(cleanReference)
+    .filter((ref) => !shouldSkipReference(ref));
+}
+
+function resolveReference(cwd, sourceFile, ref) {
+  if (/^file:\/\//i.test(ref)) {
+    try {
+      return new URL(ref).pathname;
+    } catch {
+      return ref;
+    }
+  }
+  if (ref.startsWith('/')) return path.resolve(cwd, `.${ref}`);
+  return path.resolve(path.dirname(sourceFile), ref);
+}
+
+function extractInlineHandlerCalls(content = '') {
+  const calls = [];
+  let match;
+  while ((match = EVENT_HANDLER_ATTR_RE.exec(content))) {
+    const event = match[1];
+    const expression = match[3] || '';
+    let callMatch;
+    while ((callMatch = JS_CALL_RE.exec(expression))) {
+      const name = callMatch[1];
+      if (!name || JS_KEYWORDS.has(name)) continue;
+      calls.push({ event, expression, name });
+    }
+  }
+  return calls;
+}
+
+function extractScriptSources(content = '') {
+  const refs = [];
+  let match;
+  while ((match = SCRIPT_SRC_RE.exec(content))) refs.push(match[2]);
+  return refs
+    .map(cleanReference)
+    .filter((ref) => !shouldSkipReference(ref));
+}
+
+function extractInlineScripts(content = '') {
+  const scripts = [];
+  let match;
+  while ((match = INLINE_SCRIPT_RE.exec(content))) scripts.push(match[1] || '');
+  return scripts;
+}
+
+function extractDeclaredGlobalNames(content = '') {
+  const names = new Set();
+  const patterns = [
+    /\bfunction\s+([A-Za-z_$][\w$]*)\s*\(/g,
+    /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s*)?(?:function\b|\([^)]*\)\s*=>|[A-Za-z_$][\w$]*\s*=>)/g,
+    /\b(?:window|globalThis)\.([A-Za-z_$][\w$]*)\s*=/g,
+  ];
+  for (const pattern of patterns) {
+    let match;
+    while ((match = pattern.exec(content))) names.add(match[1]);
+  }
+  return names;
+}
+
+function checkInlineEventHandlers(cwd, files = []) {
+  const missing = [];
+  const checked = [];
+  const htmlFiles = [...new Set(files || [])]
+    .filter(isHtmlFile)
+    .map((file) => path.isAbsolute(file) ? file : path.join(cwd, file));
+
+  for (const sourceFile of htmlFiles) {
+    if (!fs.existsSync(sourceFile) || !fs.statSync(sourceFile).isFile()) continue;
+    const html = fs.readFileSync(sourceFile, 'utf8');
+    const handlers = extractInlineHandlerCalls(html);
+    if (!handlers.length) continue;
+
+    const declared = new Set();
+    for (const script of extractInlineScripts(html)) {
+      for (const name of extractDeclaredGlobalNames(script)) declared.add(name);
+    }
+    for (const ref of extractScriptSources(html)) {
+      const resolved = resolveReference(cwd, sourceFile, ref);
+      if (!fs.existsSync(resolved) || !fs.statSync(resolved).isFile()) continue;
+      const js = fs.readFileSync(resolved, 'utf8');
+      for (const name of extractDeclaredGlobalNames(js)) declared.add(name);
+    }
+
+    for (const handler of handlers) {
+      const item = {
+        source: path.relative(cwd, sourceFile),
+        event: handler.event,
+        name: handler.name,
+        expression: handler.expression,
+      };
+      checked.push(item);
+      if (!declared.has(handler.name)) missing.push(item);
+    }
+  }
+
+  return {
+    ok: missing.length === 0,
+    checked,
+    missing,
+    htmlFiles: htmlFiles.map((file) => path.relative(cwd, file)),
+  };
+}
+
+function checkLocalAssetReferences(cwd, files = []) {
+  const missing = [];
+  const checked = [];
+  const frontendFiles = [...new Set(files || [])]
+    .filter(isFrontendFile)
+    .map((file) => path.isAbsolute(file) ? file : path.join(cwd, file));
+
+  for (const sourceFile of frontendFiles) {
+    if (!fs.existsSync(sourceFile) || !fs.statSync(sourceFile).isFile()) continue;
+    const content = fs.readFileSync(sourceFile, 'utf8');
+    for (const ref of extractLocalAssetReferences(content)) {
+      const resolved = resolveReference(cwd, sourceFile, ref);
+      checked.push({ source: path.relative(cwd, sourceFile), reference: ref, resolved });
+      if (!fs.existsSync(resolved)) {
+        missing.push({ source: path.relative(cwd, sourceFile), reference: ref, resolved });
+      }
+    }
+  }
+
+  return {
+    ok: missing.length === 0,
+    checked,
+    missing,
+    frontendFiles: frontendFiles.map((file) => path.relative(cwd, file)),
+  };
+}
+
+function resolveFrontendEntrypoints(cwd, files = [], { limit = 4 } = {}) {
+  const entrypoints = [];
+  const seen = new Set();
+  const add = (file) => {
+    if (!file) return;
+    const abs = path.isAbsolute(file) ? file : path.join(cwd, file);
+    if (!isHtmlFile(abs)) return;
+    if (!fs.existsSync(abs) || !fs.statSync(abs).isFile()) return;
+    const real = path.resolve(abs);
+    if (seen.has(real)) return;
+    seen.add(real);
+    entrypoints.push(real);
+  };
+
+  for (const file of files || []) add(file);
+  for (const file of files || []) {
+    const abs = path.isAbsolute(file) ? file : path.join(cwd, file);
+    if (!isFrontendFile(abs) && !isScriptFile(abs)) continue;
+    add(path.join(path.dirname(abs), 'index.html'));
+  }
+  add(path.join(cwd, 'index.html'));
+  return entrypoints.slice(0, limit);
+}
+
+function checkFrontendStaticContracts(cwd, files = []) {
+  const assets = checkLocalAssetReferences(cwd, files);
+  const handlers = checkInlineEventHandlers(cwd, files);
+  return {
+    ok: assets.ok && handlers.ok,
+    assets,
+    handlers,
+    concerns: [
+      ...assets.missing.map((item) => `[frontend-assets] ${item.source} references missing local asset ${item.reference}`),
+      ...handlers.missing.map((item) => `[frontend-js] ${item.source} ${item.event}= handler calls missing ${item.name}()`),
+    ],
+  };
+}
+
+module.exports = {
+  isFrontendFile,
+  isHtmlFile,
+  isScriptFile,
+  extractLocalAssetReferences,
+  extractInlineHandlerCalls,
+  extractDeclaredGlobalNames,
+  checkInlineEventHandlers,
+  checkLocalAssetReferences,
+  checkFrontendStaticContracts,
+  resolveFrontendEntrypoints,
+};

package/template/wall-e/coding/lifecycle-hooks.js

@@ -0,0 +1,75 @@
+'use strict';
+
+const { RuntimeEventWriter, createRuntimeEvent } = require('./runtime-events');
+
+class LifecycleHookBus {
+  constructor({ events = null, middleware = null, runtimeEvents = null, now = () => new Date().toISOString(), defaults = {} } = {}) {
+    this.events = events;
+    this.middleware = middleware;
+    this.runtimeEvents = runtimeEvents || new RuntimeEventWriter({ events, now, defaults });
+    this.now = now;
+    this.defaults = defaults;
+  }
+
+  async emit(type, payload = {}, defaults = {}) {
+    const event = this.runtimeEvents.emit({ type, payload }, defaults);
+    if (this.events?.emit) {
+      this.events.emit(`lifecycle.${type}`, event);
+    }
+    if (this.middleware?.run) {
+      await this.middleware.run('onEvent', {
+        ...(this.defaults || {}),
+        ...(defaults || {}),
+        lifecycleEvent: type,
+      }, {
+        ...event,
+        type: `lifecycle.${type}`,
+      });
+    }
+    return event;
+  }
+
+  async wrap(type, payload, fn, defaults = {}) {
+    await this.emit(`${type}_started`, payload, defaults);
+    try {
+      const result = await fn();
+      await this.emit(`${type}_finished`, { ...payload, result: summarizeResult(result) }, defaults);
+      return result;
+    } catch (err) {
+      await this.emit(`${type}_failed`, { ...payload, error: err.message }, defaults);
+      throw err;
+    }
+  }
+
+  child(defaults = {}) {
+    return new LifecycleHookBus({
+      events: this.events,
+      middleware: this.middleware,
+      runtimeEvents: this.runtimeEvents.child(defaults),
+      now: this.now,
+      defaults: { ...this.defaults, ...defaults },
+    });
+  }
+}
+
+function summarizeResult(result) {
+  if (result == null) return null;
+  if (typeof result === 'string') return { type: 'string', chars: result.length };
+  if (typeof result !== 'object') return { type: typeof result };
+  return {
+    type: 'object',
+    keys: Object.keys(result).sort().slice(0, 20),
+    ok: result.ok === true,
+    error: result.error ? String(result.error) : '',
+  };
+}
+
+function normalizeLifecycleEvent(input = {}, defaults = {}) {
+  return createRuntimeEvent(input, defaults);
+}
+
+module.exports = {
+  LifecycleHookBus,
+  normalizeLifecycleEvent,
+  summarizeResult,
+};

package/template/wall-e/coding/local-preview-contract.js

@@ -0,0 +1,157 @@
+'use strict';
+
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
+
+function extractLoopbackUrls(text) {
+  const source = String(text || '');
+  const matches = source.match(/https?:\/\/(?:localhost|127\.0\.0\.1|\[::1\])(?::\d+)?(?:\/[^\s<>)\]]*)?/gi) || [];
+  const seen = new Set();
+  const urls = [];
+  for (const match of matches) {
+    const raw = match.replace(/[.,;:!?]+$/g, '');
+    const normalized = normalizeLoopbackUrl(raw);
+    if (!normalized || seen.has(normalized.href)) continue;
+    seen.add(normalized.href);
+    urls.push({ raw, ...normalized });
+  }
+  return urls;
+}
+
+function normalizeLoopbackUrl(raw) {
+  try {
+    const parsed = new URL(String(raw || '').trim());
+    const hostname = parsed.hostname.toLowerCase();
+    if (!LOOPBACK_HOSTS.has(hostname) && !LOOPBACK_HOSTS.has(parsed.host.toLowerCase())) return null;
+    const port = parsed.port || (parsed.protocol === 'https:' ? '443' : '80');
+    const pathname = parsed.pathname || '/';
+    const normalizedPath = pathname === '/index.html' ? '/' : pathname.replace(/\/+$/, '') || '/';
+    return {
+      href: parsed.href,
+      origin: `${parsed.protocol}//${hostname}:${port}`,
+      protocol: parsed.protocol,
+      hostname,
+      port,
+      pathname,
+      routeKey: `${parsed.protocol}//${hostname}:${port}${normalizedPath}`,
+    };
+  } catch {
+    return null;
+  }
+}
+
+function analyzeLocalPreviewClaims(text, toolCalls = []) {
+  const urls = extractLoopbackUrls(text);
+  if (urls.length === 0) {
+    return { ok: true, hasPositiveClaim: false, urls: [], unsupportedUrls: [], verifiedUrls: [] };
+  }
+  const positiveUrls = urls.filter((url) => _looksLikePositivePreviewClaim(text, url.raw));
+  if (positiveUrls.length === 0) {
+    return { ok: true, hasPositiveClaim: false, urls, unsupportedUrls: [], verifiedUrls: [] };
+  }
+  const evidence = _collectPreviewEvidence(toolCalls);
+  const unsupportedUrls = [];
+  const verifiedUrls = [];
+  for (const url of positiveUrls) {
+    const match = evidence.find((item) => _evidenceSupportsUrl(item, url));
+    if (match) verifiedUrls.push({ ...url, evidence: match });
+    else unsupportedUrls.push(url);
+  }
+  return {
+    ok: unsupportedUrls.length === 0,
+    hasPositiveClaim: true,
+    urls: positiveUrls,
+    unsupportedUrls,
+    verifiedUrls,
+    evidence,
+  };
+}
+
+function buildLocalPreviewVerificationNudge(analysis) {
+  const urls = (analysis?.unsupportedUrls || []).map((url) => url.raw).join(', ');
+  return [
+    `[System: Your previous response claimed local preview URL(s) were live or reachable without current successful preview-tool evidence: ${urls || '(local URL)'}.`,
+    'Do not claim HTTP 200, "server is back", "restarted", "serving", "live", or "reachable" from memory, terminal text, or a background/nohup shell command.',
+    'Call check_url for the exact URL now, or call start_static_server for the target directory if you need a managed server, then answer from that tool result.',
+    'If the check fails, say the URL is not reachable and include the actual error. If the URL is localhost/127.0.0.1, say it is only verified from Wall-E host loopback; phone or remote browser access needs CTM remote/tunnel context.]',
+  ].join(' ');
+}
+
+function buildUnsupportedLocalPreviewReply(analysis) {
+  const urls = (analysis?.unsupportedUrls || []).map((url) => url.raw).join(', ') || 'the local preview URL';
+  return [
+    `I cannot honestly confirm ${urls} is live yet.`,
+    '',
+    'The previous answer attempted to claim a local preview was reachable, but this turn has no successful `check_url`, `start_static_server`, or `browser_screenshot` evidence for that URL. A `localhost` or `127.0.0.1` link also only proves Wall-E host loopback access; phone or remote browser access needs the CTM remote/tunnel path.',
+  ].join('\n');
+}
+
+function _looksLikePositivePreviewClaim(text, rawUrl) {
+  const source = String(text || '');
+  const idx = source.indexOf(rawUrl);
+  const window = idx >= 0
+    ? source.slice(Math.max(0, idx - 180), Math.min(source.length, idx + rawUrl.length + 220))
+    : source;
+  const lower = window.toLowerCase();
+  const positive = /\b(?:http\s*200|status\s*200|server(?:\s+is)?\s+(?:back|up|running)|back\s+up|reachable|accessible|available|live|serving|started|restarted|ready|works|open\s+(?:it|this|the)|visit|you\s+can\s+(?:open|use|view|access))\b/.test(lower)
+    || /(?:→|->)\s*http\s*200/i.test(window);
+  if (!positive) return false;
+  const negative = /\b(?:not|isn['’]?t|cannot|can['’]?t|couldn['’]?t|failed|failure|refused|timed\s*out|unreachable|inaccessible|not\s+reachable|not\s+accessible|not\s+available|down|no\s+listener|connection\s+refused|does\s+not)\b/.test(lower);
+  if (!negative) return true;
+  return /\b(?:now|after|restarted|server(?:\s+is)?\s+back|http\s*200|status\s*200)\b/.test(lower)
+    && !/\b(?:still|remains)\s+(?:not\s+)?(?:down|unreachable|inaccessible|broken)\b/.test(lower);
+}
+
+function _collectPreviewEvidence(toolCalls = []) {
+  const evidence = [];
+  for (const call of Array.isArray(toolCalls) ? toolCalls : []) {
+    const name = call?.tool || call?.name;
+    if (!['check_url', 'start_static_server', 'browser_screenshot'].includes(name)) continue;
+    if (call?.ok !== true) continue;
+    const result = call.result || {};
+    const ok = result.ok === true
+      || result.health?.ok === true
+      || (name === 'browser_screenshot' && result.path && !result.error);
+    if (!ok) continue;
+    const candidateUrls = [
+      result.url,
+      result.health?.url,
+      call.args?.url,
+      call.input?.url,
+    ].filter(Boolean);
+    for (const candidate of candidateUrls) {
+      const normalized = normalizeLoopbackUrl(candidate);
+      if (!normalized) continue;
+      evidence.push({
+        tool: name,
+        url: candidate,
+        ...normalized,
+      });
+    }
+  }
+  return evidence;
+}
+
+function _evidenceSupportsUrl(evidence, claim) {
+  if (!evidence || !claim) return false;
+  if (evidence.routeKey === claim.routeKey) return true;
+  if (evidence.origin !== claim.origin && !_sameLoopbackEndpoint(evidence, claim)) return false;
+  const evidencePath = evidence.pathname || '/';
+  const claimPath = claim.pathname || '/';
+  return (evidencePath === '/index.html' && claimPath === '/')
+    || (evidencePath === '/' && claimPath === '/index.html');
+}
+
+function _sameLoopbackEndpoint(a, b) {
+  return a.protocol === b.protocol
+    && String(a.port || '') === String(b.port || '')
+    && LOOPBACK_HOSTS.has(String(a.hostname || '').toLowerCase())
+    && LOOPBACK_HOSTS.has(String(b.hostname || '').toLowerCase());
+}
+
+module.exports = {
+  analyzeLocalPreviewClaims,
+  buildLocalPreviewVerificationNudge,
+  buildUnsupportedLocalPreviewReply,
+  extractLoopbackUrls,
+  normalizeLoopbackUrl,
+};

package/template/wall-e/coding/permission-service.js

@@ -3,11 +3,37 @@
 const crypto = require('node:crypto');
 const path = require('node:path');
 const { checkPermission } = require('../tools/permission-checker');
-const { analyzeShellCommand, initParser: initShellParser } = require('../tools/shell-analyzer');
+const { analyzeShellCommand, initParser: initShellParser, bashArityPrefix } = require('../tools/shell-analyzer');
+
+// Shell builtins that only navigate; skipped when choosing the approval card's
+// display pattern so a leading `cd` doesn't label the request as "cd *".
+const _DISPLAY_NAV = new Set(['cd', 'pushd', 'popd', 'dirs']);
+
+// Pick the pattern shown on the approval card (and stored for "always" rules)
+// for a compound run_shell command: the first meaningful (non-navigation)
+// clause, so `cd /x && git push` is labelled `git push *`, not `cd *`.
+function pickShellDisplayPattern(clauses, command) {
+  const meaningful = clauses.find((t) => Array.isArray(t) && t.length > 0 && !_DISPLAY_NAV.has(t[0]))
+    || (clauses.length > 0 ? clauses[0] : null);
+  if (meaningful && meaningful.length > 0) {
+    return `${bashArityPrefix(meaningful).join(' ')} *`;
+  }
+  return `${String(command).split(/\s+/)[0] || '*'} *`;
+}
 const { PermissionRulesStore } = require('./permission-rules-store');
 const { inferPatchPaths } = require('./snapshot-service');
 
 const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
+// Timeout semantics for a permission request:
+//   > 0                  -> auto-deny after N ms (used for headless/automated runs)
+//   === 0                -> headless: resolve immediately via headlessPolicy (no prompt)
+//   WAIT_FOR_REPLY (< 0) -> interactive: never auto-deny; stay pending until the user
+//                           replies or the session is cleared (matches Claude Code /
+//                           opencode, which wait for the user instead of timing out).
+// The < 0 case needs no special branch: ask() only arms a timer when the effective
+// timeout is > 0, and authorize()'s headless shortcut matches exactly === 0, so a
+// negative value naturally falls through to a no-timer wait.
+const WAIT_FOR_REPLY = -1;
 const _sharedPending = new Map();
 
 class PermissionService {
@@ -27,20 +53,21 @@ class PermissionService {
   }
 
   async authorize({ sessionId = '', tool, input = {}, cwd = '', projectRoot = '', mode = '', metadata = {}, timeoutMs, headless = false } = {}) {
+    const permissionContextId = metadata.permissionContextId || metadata.permission_context_id || createPermissionContextId();
     const requests = await buildToolPermissionRequests(tool, input, {
       cwd,
       projectRoot: projectRoot || cwd,
       sessionId,
       mode,
-      metadata,
+      metadata: { ...metadata, permissionContextId },
     });
-    if (requests.length === 0) return { decision: 'allow', source: 'default', reason: 'No permission required' };
+    if (requests.length === 0) return { decision: 'allow', source: 'default', reason: 'No permission required', permissionContextId };
 
     for (const request of requests) {
       const evaluated = await this.evaluatePermission(request.check);
       if (evaluated.decision === 'allow') continue;
       if (evaluated.decision === 'deny') {
-        return { ...evaluated, request };
+        return { ...evaluated, request, permissionContextId };
       }
 
       const always = this.rulesStore.findAlways({
@@ -60,6 +87,7 @@ class PermissionService {
           source: 'headless',
           reason: `Permission required for ${request.permission}/${request.pattern}`,
           request,
+          permissionContextId,
         };
       }
 
@@ -67,17 +95,19 @@ class PermissionService {
         ...request,
         sessionId,
         metadata: { ...metadata, ...request.metadata, evaluated },
+        permissionContextId,
         timeoutMs,
       });
-      if (reply.decision !== 'allow') return { ...reply, request };
+      if (reply.decision !== 'allow') return { ...reply, request, permissionContextId };
     }
 
-    return { decision: 'allow', source: 'permissions', reason: 'Permission checks passed' };
+    return { decision: 'allow', source: 'permissions', reason: 'Permission checks passed', permissionContextId };
   }
 
-  ask({ sessionId = '', permission, pattern = '*', patterns = null, tool = '', fingerprint = '', metadata = {}, timeoutMs } = {}) {
+  ask({ sessionId = '', permission, pattern = '*', patterns = null, tool = '', fingerprint = '', metadata = {}, permissionContextId = '', timeoutMs } = {}) {
     if (!permission) throw new Error('permission is required');
     const id = `perm_${crypto.randomUUID().slice(0, 8)}`;
+    const contextId = permissionContextId || metadata.permissionContextId || metadata.permission_context_id || createPermissionContextId();
     const effectiveTimeout = timeoutMs ?? this.timeoutMs;
 
     return new Promise((resolve) => {
@@ -92,7 +122,8 @@ class PermissionService {
         patterns: patterns || [pattern],
         tool,
         fingerprint: fingerprint || metadata.fingerprint || '',
-        metadata,
+        permissionContextId: contextId,
+        metadata: { ...metadata, permissionContextId: contextId },
         createdAt: Date.now(),
         timer,
         resolve,
@@ -152,8 +183,9 @@ class PermissionService {
   _resolveEntry(entry, result) {
     if (entry.timer) clearTimeout(entry.timer);
     this.pending.delete(entry.id);
-    this._emit('permission.replied', { ...publicEntry(entry), result });
-    entry.resolve(result);
+    const resolved = { ...result, permissionContextId: entry.permissionContextId || entry.metadata?.permissionContextId || '' };
+    this._emit('permission.replied', { ...publicEntry(entry), result: resolved });
+    entry.resolve(resolved);
   }
 
   _expire(id) {
@@ -181,14 +213,19 @@ async function buildToolPermissionRequests(tool, input = {}, { cwd = '', project
     const command = input.command || '';
     await initShellParser();
     const analysis = await analyzeShellCommand(command, input.cwd || cwd || root);
-    const commandTokens = analysis.commandTokens.length > 0 ? analysis.commandTokens[0] : undefined;
-    const pattern = commandTokens && commandTokens.length > 0 ? `${commandTokens[0]} *` : `${String(command).split(/\s+/)[0] || '*'} *`;
+    // commandTokens is an array of per-clause token arrays (split on && ; | etc).
+    // The whole compound command must be permission-checked clause-by-clause, so
+    // pass the full list through to checkPermission; keep the first clause in
+    // metadata.commandTokens so the approval fingerprint stays stable.
+    const commandClauses = Array.isArray(analysis.commandTokens) ? analysis.commandTokens : [];
+    const commandTokens = commandClauses.length > 0 ? commandClauses[0] : undefined;
+    const pattern = pickShellDisplayPattern(commandClauses, command);
     return withApprovalFingerprints([{
       ...base,
       permission: 'bash',
       pattern,
       metadata: { ...base.metadata, command, commandTokens },
-      check: { tool: 'run_shell', command, commandTokens, projectPath: root, sessionId, mode },
+      check: { tool: 'run_shell', command, commandTokens, commandClauses, projectPath: root, sessionId, mode },
     }], input);
   }
 
@@ -339,6 +376,7 @@ function publicEntry(entry) {
   return {
     id: entry.id,
     sessionId: entry.sessionId,
+    permissionContextId: entry.permissionContextId || entry.metadata?.permissionContextId || '',
     permission: entry.permission,
     pattern: entry.pattern,
     patterns: entry.patterns,
@@ -349,6 +387,10 @@ function publicEntry(entry) {
   };
 }
 
+function createPermissionContextId() {
+  return `permctx_${crypto.randomUUID().slice(0, 8)}`;
+}
+
 function getDefaultPermissionService() {
   return new PermissionService();
 }
@@ -365,7 +407,9 @@ module.exports = {
   buildToolPermissionRequests,
   approvalFingerprint,
   approvalFingerprintInput,
+  createPermissionContextId,
   getDefaultPermissionService,
   clearPendingPermissions,
   DEFAULT_TIMEOUT_MS,
+  WAIT_FOR_REPLY,
 };