fix(secret-guard): extras-deny dir-scoped grep and shell ask legs

Author: TheGreatAxios

src/agent/posix-tool-plugins.ts

@@ -109,6 +109,15 @@ export function buildCorePosixToolPlugins(
   // One shared workspace-roots provider for every bound in this stack, so
   // pathEscape and delete_file admit the same registered sibling worktrees.
   const rootsProvider = createWorktreeRootsProvider(cwd);
+  // CL-1187 finding 2: the gate's shell legs (segmentGuard, auto-allow, auto
+  // policy) must treat the extras-denied paths as sensitive exactly like the
+  // secret-guard plugin below does. The gate is built before this stack and
+  // shared across stacks, so forward the list here — the single funnel every
+  // entry point (exec, TUI) and worker flows through — rather than wiring
+  // each runner's gate construction separately.
+  if (secretGuardExtraDeniedPaths !== undefined) {
+    permissionGate.setSensitiveExtraDeniedPaths?.(secretGuardExtraDeniedPaths);
+  }
   const truncationOptions =
     getBlobWriter !== undefined ||
     getContextDir !== undefined ||
@@ -146,7 +155,7 @@ export function buildCorePosixToolPlugins(
       ? [evidenceArchiveSearchPlugin(getEvidenceArchive)]
       : []),
     readFileGuardPlugin(cwd, readFileGuard),
-    ripgrepPlugin(cwd),
+    ripgrepPlugin(cwd, {}, undefined, secretGuardExtraDeniedPaths ?? []),
     // Verify wraps the line-range short-circuit (composeMiddleware runs plugins
     // outer-to-inner in array order) so its before/after check still covers
     // start_line/end_line edits instead of only substring-mode edit_file calls.

src/permission/auto-shell-policy.ts

@@ -504,6 +504,7 @@ export function autoShellRuleForCall(
   isRestricted: (path: string, isWrite: boolean) => boolean = () => false,
   cwd: string = process.cwd(),
   rootsProvider: RootsProvider = NO_ROOTS,
+  isExtraDenied: (value: string) => boolean = () => false,
 ): AutoShellRule | undefined {
   if (call.name !== "run_shell") return undefined;
   const command = call.arguments.command;
@@ -533,7 +534,9 @@ export function autoShellRuleForCall(
   }
 
   for (const subject of subjects) {
-    if (commandReferencesSensitivePath(subject, cwd) !== undefined)
+    if (
+      commandReferencesSensitivePath(subject, cwd, isExtraDenied) !== undefined
+    )
       return SENSITIVE_PATH_ASK_RULE;
   }
 

src/permission/classify.ts

@@ -420,25 +420,27 @@ export function isAutoAllowedShellSegment(
   segment: string,
   cwd: string = process.cwd(),
   rootsProvider: RootsProvider = NO_ROOTS,
+  isExtraDenied: (value: string) => boolean = () => false,
 ): boolean {
   const trimmed = segment.trim();
   // Empty is not auto-allowed as a "command"; full-line comments and pure shell
   // no-ops (true/false/: and bare control-flow keywords) never need approval.
   if (trimmed.length === 0) return false;
   if (isShellCommentOnly(trimmed) || isShellNoOp(trimmed)) return true;
   if (runShellAuthzSegmentBlockReason(trimmed) !== undefined) return false;
-  return isAutoAllowedSegment(segment, cwd, rootsProvider);
+  return isAutoAllowedSegment(segment, cwd, rootsProvider, isExtraDenied);
 }
 
 function isAutoAllowedSegment(
   segment: string,
   cwd: string,
   rootsProvider: RootsProvider,
+  isExtraDenied: (value: string) => boolean = () => false,
 ): boolean {
   const trimmed = segment.trim();
   if (trimmed.length === 0) return false;
   if (isShellCommentOnly(trimmed) || isShellNoOp(trimmed)) return true;
-  if (commandReferencesSensitivePath(trimmed, cwd)) return false;
+  if (commandReferencesSensitivePath(trimmed, cwd, isExtraDenied)) return false;
   // Same metacharacter gate as isAutoAllowedShellCommand: this classifier also
   // runs standalone per pipeline/chain segment (see isAutoAllowedShellSegment),
   // so a segment carrying its own command substitution or redirect must not
@@ -466,7 +468,11 @@ function isAutoAllowedSegment(
   // symlink into a secret file (notes.txt -> .env) asks exactly like the
   // secret name itself. Pure name-listings skip the resolve leg: `ls
   // notes.txt` lists freely (CL-5420), and an impure listing fails above.
-  if (args.some((token) => isSensitiveShellToken(token, cwd, !pureListing)))
+  if (
+    args.some((token) =>
+      isSensitiveShellToken(token, cwd, !pureListing, isExtraDenied),
+    )
+  )
     return false;
   // Pure directory listing may target outside-workspace paths (names only).
   // Content readers must stay inside the workspace.
@@ -483,6 +489,7 @@ export function isAutoAllowedShellCommand(
   command: string,
   cwd: string = process.cwd(),
   rootsProvider: RootsProvider = NO_ROOTS,
+  isExtraDenied: (value: string) => boolean = () => false,
 ): boolean {
   const trimmed = command.trim();
   if (trimmed.length === 0) return false;
@@ -495,7 +502,7 @@ export function isAutoAllowedShellCommand(
     (isShellCommentOnly(trimmed) || isShellNoOp(trimmed))
   )
     return true;
-  if (commandReferencesSensitivePath(trimmed, cwd)) return false;
+  if (commandReferencesSensitivePath(trimmed, cwd, isExtraDenied)) return false;
   // Never auto-allow a command the authz layer would hard-deny at execution.
   if (runShellAuthzBlockReason(trimmed) !== undefined) return false;
   // Reject anything with metacharacters that compose or redirect (& ; < > ` $ etc).
@@ -504,19 +511,23 @@ export function isAutoAllowedShellCommand(
 
   // Split on pipe and require every segment to be a safe read-only program.
   const segments = trimmed.split("|");
-  return segments.every((seg) => isAutoAllowedSegment(seg, cwd, rootsProvider));
+  return segments.every((seg) =>
+    isAutoAllowedSegment(seg, cwd, rootsProvider, isExtraDenied),
+  );
 }
 
 export function isAutoAllowedShellCall(
   call: ToolCall,
   cwd: string = process.cwd(),
   rootsProvider: RootsProvider = NO_ROOTS,
+  isExtraDenied: (value: string) => boolean = () => false,
 ): boolean {
   if (canonicalToolName(call.name) !== "run_shell") return false;
   return isAutoAllowedShellCommand(
     stringArg(call, "command"),
     cwd,
     rootsProvider,
+    isExtraDenied,
   );
 }
 

src/permission/gate.ts

@@ -20,7 +20,10 @@ import {
   safeWorktreeCommand,
   isWorktreeForceFlag,
 } from "./auto-shell-policy.js";
-import { commandReferencesSensitivePath } from "../plugins/secret-guard-plugin.js";
+import {
+  commandReferencesSensitivePath,
+  createExtraDeniedPathMatcher,
+} from "../plugins/secret-guard-plugin.js";
 import {
   normalizePathArguments,
   pathEscapeBlockReason,
@@ -133,8 +136,9 @@ function segmentGuard(
   isRestricted: (path: string, isWrite: boolean) => boolean,
   cwd?: string,
   rootsProvider?: RootsProvider,
+  isExtraDenied: (value: string) => boolean = () => false,
 ): SegmentGuard | undefined {
-  if (commandReferencesSensitivePath(segment, cwd) !== undefined)
+  if (commandReferencesSensitivePath(segment, cwd, isExtraDenied) !== undefined)
     return { kind: "secret" };
   if (
     cwd !== undefined &&
@@ -223,6 +227,7 @@ export function preGrantGuardReason(
   request: PermissionRequest,
   isRestricted: (path: string, isWrite: boolean) => boolean,
   rootsProvider?: RootsProvider,
+  isExtraDenied: (value: string) => boolean = () => false,
 ): string | undefined {
   if (request.tool !== "run_shell") return undefined;
   const fullCommand = request.subject;
@@ -239,7 +244,13 @@ export function preGrantGuardReason(
       ? bindRestrictedToProcessCwd(isRestricted, request.cwd)
       : isRestricted;
   for (const segment of segments) {
-    const guard = segmentGuard(segment, restricted, request.cwd, rootsProvider);
+    const guard = segmentGuard(
+      segment,
+      restricted,
+      request.cwd,
+      rootsProvider,
+      isExtraDenied,
+    );
     if (guard !== undefined) {
       return guard.kind === "secret"
         ? `${segment} references a sensitive path`
@@ -268,6 +279,7 @@ export function isRequestCoveredByGrant(
   isRestricted: (path: string, isWrite: boolean) => boolean,
   workspace: GrantWorkspace,
   rootsProvider?: RootsProvider,
+  isExtraDenied: (value: string) => boolean = () => false,
 ): boolean {
   return isRequestCoveredByApprovals(
     request,
@@ -276,6 +288,7 @@ export function isRequestCoveredByGrant(
     isRestricted,
     workspace,
     rootsProvider,
+    isExtraDenied,
   );
 }
 
@@ -290,6 +303,7 @@ function isRequestCoveredByApprovals(
   isRestricted: (path: string, isWrite: boolean) => boolean,
   workspace: GrantWorkspace,
   rootsProvider?: RootsProvider,
+  isExtraDenied: (value: string) => boolean = () => false,
 ): boolean {
   const scoped = approvals.filter((a) =>
     grantScopeMatches(
@@ -304,7 +318,10 @@ function isRequestCoveredByApprovals(
   if (request.tool !== "run_shell") {
     return scoped.some((a) => matchesPattern(request.subject, a.pattern));
   }
-  if (preGrantGuardReason(request, isRestricted, rootsProvider) !== undefined)
+  if (
+    preGrantGuardReason(request, isRestricted, rootsProvider, isExtraDenied) !==
+    undefined
+  )
     return false;
   const segments = splitChainedCommand(request.subject).filter(
     (s) => !isShellCommentOnly(s),
@@ -313,7 +330,12 @@ function isRequestCoveredByApprovals(
   const cwd = request.cwd ?? workspace.resolvedCwd;
   return segments.every((segment) => {
     if (scoped.some((a) => matchesPattern(segment, a.pattern))) return true;
-    return isAutoAllowedShellSegment(segment, cwd, rootsProvider);
+    return isAutoAllowedShellSegment(
+      segment,
+      cwd,
+      rootsProvider,
+      isExtraDenied,
+    );
   });
 }
 
@@ -382,6 +404,13 @@ export interface PermissionGateOptions {
   // Writes and deletes remain path-escape denies; plugin trust is not write
   // consent.
   trustedPluginRoots?: RootsProvider;
+  // Extras-denied config paths the shell legs treat as sensitive (CL-9386):
+  // the active settings source, including a --config override. Mirrors the
+  // secret-guard plugin's extraDeniedPaths so a custom config path asks in
+  // shell commands exactly like the default settings file. May also be set
+  // after construction via setSensitiveExtraDeniedPaths when the paths are
+  // learned later (the toolset builder forwards them).
+  sensitiveExtraDeniedPaths?: readonly string[];
   // Tiers learned from connected MCP servers (tools/list annotations). Tests may
   // inject a shared registry; production gates create one when omitted.
   mcpTiers?: McpToolPermissionRegistry;
@@ -488,6 +517,11 @@ export interface PermissionGate {
   // posix plugin stack reads this so authorize-time and execution-time
   // containment share one list.
   getTrustedPluginRoots: () => readonly string[];
+  // Replace the extras-denied config paths the shell legs treat as sensitive
+  // (CL-9386). The toolset builder calls this to forward the active settings
+  // source after gate construction, so the gate and the secret-guard plugin
+  // share one list. Optional so test doubles of this interface keep compiling.
+  setSensitiveExtraDeniedPaths?: (paths: readonly string[]) => void;
 }
 
 // True when splitChainedCommand can be trusted to yield only real segments for
@@ -570,6 +604,14 @@ export function createPermissionGate(
   // Session grants live only in this array; persisted grants are seeded in via
   // options.approvals and re-routed to a store by the persist callback.
   const sessionGrants: Approval[] = [];
+  // CL-9386: the extras-denied config paths (the active settings source) the
+  // shell legs consult, mirrored from the secret-guard plugin's own matcher so
+  // both agree on what "denied" means. Mutable via
+  // setSensitiveExtraDeniedPaths because the toolset builder learns the paths
+  // after the gate is constructed.
+  let isExtraDenied = createExtraDeniedPathMatcher(
+    options.sensitiveExtraDeniedPaths ?? [],
+  );
 
   // Record an operator-granted approval in the live list and route it to the
   // scope-appropriate home: session grants stay in memory, everything else is
@@ -638,6 +680,7 @@ export function createPermissionGate(
           isRestricted,
           grantWorkspace(),
           rootsProvider,
+          isExtraDenied,
         ),
       );
     }
@@ -798,14 +841,15 @@ export function createPermissionGate(
     // segment mentions a secret path.
     const shellReferencesSecret =
       shellCmd !== undefined &&
-      commandReferencesSensitivePath(shellCmd, effectiveCwd) !== undefined;
+      commandReferencesSensitivePath(shellCmd, effectiveCwd, isExtraDenied) !==
+        undefined;
     if (!restricted && classifyTool(call.name, mcpTiers) === "allow") {
       return { kind: "allow" };
     }
     if (
       !restricted &&
       !shellReferencesSecret &&
-      isAutoAllowedShellCall(call, effectiveCwd, rootsProvider)
+      isAutoAllowedShellCall(call, effectiveCwd, rootsProvider, isExtraDenied)
     ) {
       return { kind: "allow" };
     }
@@ -821,6 +865,7 @@ export function createPermissionGate(
           isRestrictedHere,
           effectiveCwd,
           rootsProvider,
+          isExtraDenied,
         );
         if (shellRule?.effect === "deny") {
           recordAutoDecision(call.name, shellRule.name, "auto-deny");
@@ -876,6 +921,7 @@ export function createPermissionGate(
             isRestrictedHere,
             effectiveCwd,
             rootsProvider,
+            isExtraDenied,
           );
           if (guard !== undefined) {
             if (guard.kind === "secret") anySecret = true;
@@ -912,7 +958,14 @@ export function createPermissionGate(
           }
           // Safe pipeline tails (`| sort`) and pure no-ops (`|| true`) skip.
           // Containment is judged against the process cwd, not the session cwd.
-          if (isAutoAllowedShellSegment(segment, effectiveCwd, rootsProvider)) {
+          if (
+            isAutoAllowedShellSegment(
+              segment,
+              effectiveCwd,
+              rootsProvider,
+              isExtraDenied,
+            )
+          ) {
             continue;
           }
           needsOperator = true;
@@ -1141,8 +1194,11 @@ export function createPermissionGate(
   ) => {
     const anySecret =
       request.tool === "run_shell" &&
-      commandReferencesSensitivePath(request.subject, request.cwd) !==
-        undefined;
+      commandReferencesSensitivePath(
+        request.subject,
+        request.cwd,
+        isExtraDenied,
+      ) !== undefined;
     const decision = {
       kind: "ask" as const,
       request,
@@ -1256,5 +1312,10 @@ export function createPermissionGate(
     registerMcpClient,
     unregisterMcpServer,
     getTrustedPluginRoots: () => trustedPluginRoots(),
+    setSensitiveExtraDeniedPaths: (paths: readonly string[]) => {
+      isExtraDenied = createExtraDeniedPathMatcher(paths);
+      // The denied set changed — cached denies re-evaluate.
+      denialMemory.clear();
+    },
   };
 }