fix(hooks): require all segments to match allow rules (#1213)

[pszymkowiak]

Summary

Fixes #1213 — a compound command permission escalation where a single allowed segment granted auto-allow to the entire chain.

Before (broken):

rtk rewrite "git status"                    # exit 3 (ask) ✓
rtk rewrite "git add ."                     # exit 3 (ask) ✓
rtk rewrite "git status && git add ."       # exit 0 (allow) ❌ BUG

After (fixed):

rtk rewrite "git status && git add ."       # exit 3 (ask) ✓
rtk rewrite "cargo test && git add . && git commit -m foo"  # exit 3 (ask) ✓

Root cause

check_command_with_rules used an any_allow flag that was set by the first matching segment and never unset. Once set, subsequent segments skipped the allow check entirely, escalating the whole chain.

Fix

Replace any_allow with all_segments_allowed logic. Every non-empty segment must independently match an allow rule — otherwise the chain demotes to Default (ask). Also add:

• saw_segment guard to prevent vacuous Allow on empty commands
• !allow_rules.is_empty() check in the final verdict

Precedence is unchanged: Deny > Ask > Allow > Default.

Impact

Closes a permission escalation vector: an LLM agent could construct <allowed_cmd> && <unapproved_cmd> to bypass user confirmation on the second command.

Test plan

• 6 new regression tests covering:
  • Reproduction case from security: compound command permission escalation — single allowed segment grants auto-allow to entire chain #1213 (git status && git add .)
  • Three-segment chain with middle unallowed
  • Reversed ordering (unallowed first)
  • All 4 compound separators: &&, ||, |, ;
  • Ask-wins-over-partial-allow precedence
• All 35 permissions tests pass (29 existing + 6 new)
• Full suite: 1377 tests pass, 0 failures
• cargo fmt clean

Related

• security: hook auto-allow bypasses agent permission model for rewritten commands #1155 (general hook auto-allow bypass)
• glob_matches fails to match middle-wildcard patterns when command has no trailing arguments #1105 (glob_matches bug in permissions.rs)

[FlorianBruniaux]

LGTM — security fix, reviewed diff, tests pass.