fix(perm): M3 — route bash through enforce; redirect targets gate via write rules

Closes dirge-6ab (P0 security). Second milestone of the staged
permission refactor; depends on M1 (8dd5b01).

## What

`check_bash_segments` in src/agent/tools/bash.rs migrates from the
legacy `check_perm` / `check_perm_path` to the M1 chokepoint
`enforce()`. Two behavior changes ride along:

1. **Redirect targets route through `write` tool rules.** Pre-M3 the
   C4 audit fix routed `> file` / `>> file` / `&> file` / `1> file` /
   `2> file` targets through `check_perm_path(tool="bash", &target)`
   — looking the target path up against BASH rules (command-style
   globs). No bash pattern matches a bare path, so the call fell to
   `default_action = Allow`. Result: `echo hi > /etc/passwd` ran
   without prompting even though writing to `/etc/` directly would
   be denied. Post-M3 the target routes through `tool="write"` via
   `Scope::PathResolve`, so the user's write deny lists (or M4's
   incoming Ask-default for unmatched paths) actually apply.

2. **Subshell / command-substitution / complex commands prompt
   whole-command.** Already the prior behavior, just routed through
   `enforce` now. Matches maki's `is_complex_bash` posture
   (permissions.rs:457-475): when tree-sitter can't safely split,
   the WHOLE command goes to the user for confirmation.

The compound-statement segmenting (the part the user explicitly
called out: "agent runs `git diff && rm -rf /` — Maki uses
tree-sitter to figure out the permissions requested are `git *` and
`rm *`") was already working correctly in dirge via the existing
`parse_bash_segments_full` in src/semantic/adapters/bash.rs. Each
segment is independently routed through `enforce`. The default
`rm -rf /**` deny rule catches the dangerous segment even when the
leading segment is allowed.

## Tests added

Three regression tests pin the M3 invariants:

- `compound_command_denies_dangerous_segment`: `git diff &&
  rm -rf /` — second segment hits the rm deny rule. Pins the
  segment-walking invariant end-to-end (separate from the parser
  tests which only verify the segmenting itself).
- `redirect_target_routes_through_write_rules`: write deny of
  `/etc/**` blocks `echo hi > /etc/passwd`. The exact regression
  the C4 audit fix attempted to close but mis-routed.
- `redirect_target_allowed_when_write_permits`: cwd-relative
  target with no deny rule passes — guards against an
  over-broad deny regression.

## Behavior shift for users

`echo … > /tmp/anything` (or any external path) now prompts when
no explicit write rule covers it, because the external-path
catch-all at `permission/checker.rs:434` upgrades unmatched-Allow
to Ask for paths outside the working directory. Previously the
redirect bypassed this gate via the wrong-namespace lookup.

This is a tighter posture than before but consistent with how
`write` already behaves for direct file operations. Users who
need silent /tmp redirects can add:

```jsonc
"permission": {
  "write": { "/tmp/**": "allow" }
}
```

## Test

- 1201/1202 tests pass (1 pre-existing unrelated Clojure failure
  per 8dd5b01 commit note)
- Binary at ~/bin/dirge (11:00)

Author: Yogthos

.beads/issues.jsonl

@@ -1,4 +1,4 @@
-{"_type":"issue","id":"dirge-6ab","title":"Perm M3: port maki's tree-sitter bash analyzer (close git\u0026\u0026rm bypass)","description":"SECURITY: 'git diff \u0026\u0026 rm -rf /' currently allowed because dirge's bash redirect-target check (src/agent/tools/bash.rs:350) routes through bash rules with the file path as input, which has no path-style match → falls to default Allow. Pre-existing pre-fix-for-7403792.\n\nSolution: port maki's tree-sitter bash analyzer verbatim from /Users/yogthos/src/maki/maki-agent/src/permissions.rs:33-43 (parser thread_local), 394-439 (collect_commands walker), 441-475 (analyze_bash + complexity gates). The walker splits compounds via 'pipeline'/'list' AST traversal and extracts every 'command' / 'redirected_statement' / 'subshell' / etc node; each segment then goes through the permission chokepoint independently.\n\nBehavior at completion:\n- 'git diff \u0026\u0026 rm -rf /' → enforce('bash', 'git diff') + enforce('bash', 'rm -rf /') — second check fires\n- Subshells / command substitution mark whole command 'complex' → forces prompt (conservative)\n- Pipes split into separate segments\n- Quoted operators correctly NOT split (AST respects quoting)\n\nDepends on: dirge-{M1}\n\nMaki license is GPL-compatible — verify before copying. Add 'Ported from maki-agent/src/permissions.rs' attribution comment.","status":"open","priority":0,"issue_type":"bug","owner":"yogthos@gmail.com","created_at":"2026-05-23T14:25:46Z","created_by":"Yogthos","updated_at":"2026-05-23T14:25:46Z","dependencies":[{"issue_id":"dirge-6ab","depends_on_id":"dirge-01s","type":"blocks","created_at":"2026-05-23T10:25:51Z","created_by":"Yogthos","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"dirge-6ab","title":"Perm M3: port maki's tree-sitter bash analyzer (close git\u0026\u0026rm bypass)","description":"SECURITY: 'git diff \u0026\u0026 rm -rf /' currently allowed because dirge's bash redirect-target check (src/agent/tools/bash.rs:350) routes through bash rules with the file path as input, which has no path-style match → falls to default Allow. Pre-existing pre-fix-for-7403792.\n\nSolution: port maki's tree-sitter bash analyzer verbatim from /Users/yogthos/src/maki/maki-agent/src/permissions.rs:33-43 (parser thread_local), 394-439 (collect_commands walker), 441-475 (analyze_bash + complexity gates). The walker splits compounds via 'pipeline'/'list' AST traversal and extracts every 'command' / 'redirected_statement' / 'subshell' / etc node; each segment then goes through the permission chokepoint independently.\n\nBehavior at completion:\n- 'git diff \u0026\u0026 rm -rf /' → enforce('bash', 'git diff') + enforce('bash', 'rm -rf /') — second check fires\n- Subshells / command substitution mark whole command 'complex' → forces prompt (conservative)\n- Pipes split into separate segments\n- Quoted operators correctly NOT split (AST respects quoting)\n\nDepends on: dirge-{M1}\n\nMaki license is GPL-compatible — verify before copying. Add 'Ported from maki-agent/src/permissions.rs' attribution comment.","status":"closed","priority":0,"issue_type":"bug","owner":"yogthos@gmail.com","created_at":"2026-05-23T14:25:46Z","created_by":"Yogthos","updated_at":"2026-05-23T15:01:11Z","started_at":"2026-05-23T14:51:42Z","closed_at":"2026-05-23T15:01:11Z","close_reason":"Closed","dependencies":[{"issue_id":"dirge-6ab","depends_on_id":"dirge-01s","type":"blocks","created_at":"2026-05-23T10:25:51Z","created_by":"Yogthos","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
 {"_type":"issue","id":"dirge-ojn","title":"Perm M4: flip unmatched-tool default from Allow to Ask","description":"Today src/permission/checker.rs:103 has default_action = Action::Allow. Anything not explicitly configured falls through to Allow without prompting — a security gap especially for write/edit/apply_patch which currently have NO default rules installed at all (mismatch with bash which has default_bash_rules, mcp_tool which defaults Ask since 27bd70a).\n\nFlip default to Ask. Add builtin-allow list for safe read-only tools (port maki's BUILTIN_ALLOW_RULES at permissions.rs:16-24, adapted for dirge's tool set: read/glob/grep/list_dir/list_symbols/find_definition/find_callers/find_callees/get_symbol_body/repo_overview).\n\nwrite/edit/apply_patch/bash/webfetch/websearch/task/skill/memory all become Ask by default unless explicitly allowlisted. Document the migration in README + CHANGELOG. Users with existing configs unaffected — only the no-config baseline changes.\n\nAdd --yolo CLI flag (currently only via config). Maps to set the global allow_all atomic (port maki's PermissionManager::toggle_yolo at permissions.rs:219-222).\n\nDepends on: dirge-{M2}, dirge-{M3}","status":"open","priority":1,"issue_type":"feature","owner":"yogthos@gmail.com","created_at":"2026-05-23T14:25:47Z","created_by":"Yogthos","updated_at":"2026-05-23T14:25:47Z","dependencies":[{"issue_id":"dirge-ojn","depends_on_id":"dirge-6ab","type":"blocks","created_at":"2026-05-23T10:25:53Z","created_by":"Yogthos","metadata":"{}"},{"issue_id":"dirge-ojn","depends_on_id":"dirge-cep","type":"blocks","created_at":"2026-05-23T10:25:52Z","created_by":"Yogthos","metadata":"{}"}],"dependency_count":2,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"dirge-01s","title":"Perm M1: single chokepoint (port maki's enforce shape)","description":"Refactor dirge's 3 permission entry points (check_perm, check_perm_path, check_perm_path_resolve in src/agent/tools/mod.rs) into a single chokepoint patterned after maki's PermissionManager::enforce (maki-agent/src/permissions.rs:283). One function, takes (tool, scope), routes internally based on tool category. No behavior change for users — pure refactor with all existing callers updated. Behind-the-scenes the new fn calls the same PermissionChecker logic.\n\nRef: maki-agent/src/permissions.rs:283-350 — port the signature shape (async, returns Result\u003c(), PermissionError\u003e, takes \u0026EventSender + user_response_rx + cancel for UI integration). Adapt to dirge's existing AskSender + PermCheck.","status":"closed","priority":1,"issue_type":"feature","owner":"yogthos@gmail.com","created_at":"2026-05-23T14:25:25Z","created_by":"Yogthos","updated_at":"2026-05-23T14:49:19Z","started_at":"2026-05-23T14:40:51Z","closed_at":"2026-05-23T14:49:19Z","close_reason":"Closed","dependency_count":0,"dependent_count":2,"comment_count":0}
 {"_type":"issue","id":"dirge-cep","title":"Perm M2: unified rule schema (port maki's TOML shape via JSON)","description":"Replace dirge's per-tool field PermissionConfig (separate Option\u003cToolPerm\u003e per built-in tool) with maki's uniform shape: { tool_name: { allow: [patterns], deny: [patterns] } }. Single PermissionRule struct (maki-config/src/lib.rs:268-273). Keep existing JSON config (dirge uses JSON not TOML), but flatten the schema. Add a dual-read path so old config.json files (existing user configs in the wild) still parse — log a deprecation warning and auto-migrate on save. Migration test required.\n\nDepends on: dirge-{M1}","status":"open","priority":1,"issue_type":"feature","owner":"yogthos@gmail.com","created_at":"2026-05-23T14:25:25Z","created_by":"Yogthos","updated_at":"2026-05-23T14:25:25Z","dependencies":[{"issue_id":"dirge-cep","depends_on_id":"dirge-01s","type":"blocks","created_at":"2026-05-23T10:25:50Z","created_by":"Yogthos","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}

src/agent/tools/bash.rs

@@ -4,9 +4,7 @@ use tokio::process::Command;
 use tokio::time::Duration;
 
 use crate::agent::tools::cache::ToolCache;
-#[cfg(feature = "semantic-bash")]
-use crate::agent::tools::check_perm_path;
-use crate::agent::tools::{AskSender, BashArgs, PermCheck, ToolError, check_perm};
+use crate::agent::tools::{AskSender, BashArgs, PermCheck, Scope, ToolError, enforce};
 
 use crate::sandbox::Sandbox;
 #[cfg(feature = "semantic-bash")]
@@ -326,29 +324,47 @@ async fn check_bash_segments(
     ask_tx: &Option<AskSender>,
     command: &str,
 ) -> Result<(), ToolError> {
+    // M3 (dirge-6ab): every bash permission decision routes through
+    // the `enforce` chokepoint. Each compound-statement segment is
+    // checked independently so `git diff && rm -rf /` gets BOTH `git`
+    // AND `rm` checked against the user's bash rules — not just the
+    // leading command. Redirect targets (`> file`) additionally route
+    // through the `write` tool rules so write/edit path rules apply,
+    // closing the C4 audit gap where targets hit bash rules with
+    // path-string inputs and fell through to default Allow.
     #[cfg(feature = "semantic-bash")]
     {
         let (segments, complex) = bash::parse_bash_segments_full(command)
             .unwrap_or_else(|_| (vec![command.to_string()], false));
 
         if complex {
-            return check_perm(permission, ask_tx, "bash", command).await;
+            // Subshell / command substitution / process substitution /
+            // arithmetic expansion: tree-sitter declined to split.
+            // Force a prompt on the WHOLE command so the user
+            // confirms the unfamiliar shape. Maki does the same
+            // (maki-agent/src/permissions.rs:441-455).
+            enforce(permission, ask_tx, "bash", Scope::Raw(command)).await?;
+            return Ok(());
         }
 
         for segment in &segments {
-            check_perm(permission, ask_tx, "bash", segment).await?;
+            enforce(permission, ask_tx, "bash", Scope::Raw(segment)).await?;
         }
 
-        // C4 (audit fix): the segment loop above only checks each
-        // *command*. Output redirections (`> /etc/something`,
-        // `>> ~/.ssh/authorized_keys`) write files that the path
-        // permission gate would otherwise refuse. Route every
-        // redirect target through `check_perm_path` so write/edit's
-        // path rules also apply to redirects. False-positive prompts
-        // (read-side `< file`) are acceptable; bypassing the path
-        // gate via `echo … > sensitive` is not.
+        // M3 fix to the C4 redirect-target gap: route targets through
+        // the `write` tool name (not `bash`), since redirection
+        // semantically writes files. Previously this was routed as
+        // `check_perm_path(tool="bash", path=&target)`, looking the
+        // target up in BASH rules — command-style globs that don't
+        // match path strings, falling through to default Allow. With
+        // `tool="write"` the user's write rules govern: deny lists
+        // (`/etc/**`, `~/.ssh/**`, `~/.aws/credentials`) now fire on
+        // bash redirects too. Falsely-prompting `< file` (read-side)
+        // is acceptable; the `extract_redirect_targets` walker
+        // intentionally skips heredoc / herestring and only emits
+        // write-side targets (`>`, `>>`, `&>`, `1>`, `2>`).
         for target in bash::extract_redirect_targets(command) {
-            check_perm_path(permission, ask_tx, "bash", &target).await?;
+            enforce(permission, ask_tx, "write", Scope::PathResolve(&target)).await?;
         }
         Ok(())
     }
@@ -390,10 +406,11 @@ async fn check_bash_segments(
             || command.contains(">(")
             || command.contains("$'");
         if has_substitution {
-            return check_perm(permission, ask_tx, "bash", command).await;
+            enforce(permission, ask_tx, "bash", Scope::Raw(command)).await?;
+            return Ok(());
         }
         for segment in &segments {
-            check_perm(permission, ask_tx, "bash", segment).await?;
+            enforce(permission, ask_tx, "bash", Scope::Raw(segment)).await?;
         }
         Ok(())
     }
@@ -687,4 +704,103 @@ mod tests {
         assert!(segments[0].contains("a; b"));
         assert_eq!(segments[1], "ls");
     }
+
+    // M3 (dirge-6ab) — segment-level bash gating regression tests.
+    // These pin the "every command in a compound gets checked
+    // separately" invariant the user asked about
+    // ("agent runs `git diff && rm -rf /`, what happens?").
+
+    /// `git diff && rm -rf /` must be denied — the second segment
+    /// hits the default `rm -rf /**` deny rule even though the
+    /// first segment is allowlisted. Pre-this-test, the path was
+    /// covered by the parser test in `semantic::adapters::bash`,
+    /// but nothing end-to-end pinned that `check_bash_segments`
+    /// actually walks the segments through the perm checker.
+    #[cfg(feature = "semantic-bash")]
+    #[tokio::test]
+    async fn compound_command_denies_dangerous_segment() {
+        use crate::permission::{PermissionConfig, SecurityMode, checker::PermissionChecker};
+
+        let config = PermissionConfig::default();
+        let checker = PermissionChecker::new(&config, SecurityMode::Standard, None);
+        let perm = std::sync::Arc::new(std::sync::Mutex::new(checker));
+
+        let result =
+            check_bash_segments(&Some(perm), &None, "git diff && rm -rf /").await;
+        assert!(
+            result.is_err(),
+            "compound: rm segment must hit deny rule even after safe git segment; got {result:?}",
+        );
+        let msg = format!("{:?}", result);
+        assert!(
+            msg.contains("denied") || msg.contains("Denied"),
+            "expected 'denied' in error: {msg}",
+        );
+    }
+
+    /// Output redirect targets route through the `write` tool rules
+    /// (M3 fix to the C4 audit). Pre-fix: `tool="bash"` lookup with a
+    /// path string, no matching command pattern, fell through to
+    /// default Allow — `echo hi > /etc/passwd` ran without prompting.
+    /// Post-fix: routes through write rules.
+    #[cfg(feature = "semantic-bash")]
+    #[tokio::test]
+    async fn redirect_target_routes_through_write_rules() {
+        use crate::permission::{
+            Action, PermissionConfig, SecurityMode, ToolPerm, checker::PermissionChecker,
+        };
+        use std::collections::HashMap;
+
+        // Configure write to deny everywhere; without an explicit
+        // rule the M2/M4-pre default is still Allow, so we set an
+        // explicit deny to make the test robust against the
+        // default-flip.
+        let mut write_rules = HashMap::new();
+        write_rules.insert("/etc/**".to_string(), Action::Deny);
+        let config = PermissionConfig {
+            write: Some(ToolPerm::Granular(write_rules)),
+            ..Default::default()
+        };
+        let checker = PermissionChecker::new(&config, SecurityMode::Standard, None);
+        let perm = std::sync::Arc::new(std::sync::Mutex::new(checker));
+
+        let result =
+            check_bash_segments(&Some(perm), &None, "echo hi > /etc/passwd").await;
+        assert!(
+            result.is_err(),
+            "redirect to /etc/passwd should be denied by write rules; got {result:?}",
+        );
+    }
+
+    /// Sibling check: a redirect target inside the working directory
+    /// (non-external) passes the write-rules check. Without this, a
+    /// regression that over-broadly denied all redirects could pass
+    /// the negative case above and ship.
+    ///
+    /// Uses an in-cwd path because the catch-all at
+    /// `permission/checker.rs:434` upgrades unmatched-Allow to Ask
+    /// for EXTERNAL paths — so `/tmp/x` (external to the test's cwd
+    /// of the dirge repo) would test the external-path catch-all,
+    /// not the write-rules-allow path we want to exercise here.
+    /// M3 is intentionally tightening external bash-redirects to
+    /// prompt; this test pins the in-cwd happy path.
+    #[cfg(feature = "semantic-bash")]
+    #[tokio::test]
+    async fn redirect_target_allowed_when_write_permits() {
+        use crate::permission::{PermissionConfig, SecurityMode, checker::PermissionChecker};
+
+        let config = PermissionConfig::default();
+        // Use the cwd-relative target so the external-path Ask
+        // upgrade doesn't fire. `target/test-out.txt` is inside
+        // any cargo-test invocation's working directory.
+        let checker = PermissionChecker::new(&config, SecurityMode::Standard, None);
+        let perm = std::sync::Arc::new(std::sync::Mutex::new(checker));
+
+        let result =
+            check_bash_segments(&Some(perm), &None, "echo hi > target/test-out.txt").await;
+        assert!(
+            result.is_ok(),
+            "redirect to in-cwd target should pass; got {result:?}",
+        );
+    }
 }