Apply the same secret and restricted path guards during reconciliation

A queued shell request could auto-drain from a newly minted grant even
when it referenced a secret path or a restricted target, because
reconciliation only matched the grant pattern and skipped the guards
evaluate() enforces first. Requests like a queued .env read now stay
queued and prompt normally when a broader grant is minted.

Author: TheGreatAxios

src/permission/gate.ts

@@ -64,7 +64,8 @@ function hasExactFullCommandGrant(
 // Pure reconciliation check used to re-evaluate the TUI's pending approval
 // queue against a single newly-minted grant (see PermissionGateOptions.onGrant).
 // A queued request is covered only when this one grant, by itself, would have
-// let it skip the prompt — mirrors the matching evaluate() itself applies, so
+// let it skip the prompt AND the request clears the same secret-path and
+// restricted-path guards evaluate() enforces ahead of grant matching — so
 // reconciliation never auto-approves something evaluate() would still ask for.
 export function isRequestCoveredByGrant(
   request: PermissionRequest,
@@ -84,6 +85,10 @@ export function isRequestCoveredByGrant(
   }
   const segments = splitChainedCommand(request.subject).filter((s) => !isShellCommentOnly(s));
   if (segments.length === 0) return false;
+  const resolvedCwd = request.cwd ?? process.cwd();
+  const isRestricted = createPathRestriction(resolvedCwd, createWorktreeRootsProvider(resolvedCwd)).isRestricted;
+  if (segments.some((segment) => commandReferencesSensitivePath(segment) !== undefined)) return false;
+  if (segments.some((segment) => commandTargetsRestricted(segment, isRestricted))) return false;
   if (segments.length > 1) {
     return approval.pattern === stripCommentLines(request.subject).trim();
   }

src/tui/hooks/use-gates.test.ts

@@ -187,4 +187,74 @@ describe("useGates queue reconciliation", () => {
     await new Promise((r) => setTimeout(r, 0));
     unmount();
   });
+
+  test("a secret-path request stays queued after a covering grant mints", async () => {
+    const emitter = new EventEmitter();
+    const controllerRef: { current: GateController | null } = { current: null };
+    const element = () => createElement(Harness, { emitter, controllerRef });
+    const { rerender, unmount } = render(element());
+
+    const outcomes: ApprovalOutcome[] = [];
+    enqueuePermission(emitter, request({ subject: "cat .env" })).then((o) => outcomes.push(o));
+    rerender(element());
+
+    grant(emitter, { tool: "run_shell", pattern: "cat *" });
+    rerender(element());
+    await new Promise((r) => setTimeout(r, 0));
+    rerender(element());
+
+    expect(controllerRef.current!.permissionQueueDepth).toBe(1);
+    expect(outcomes).toHaveLength(0);
+
+    controllerRef.current!.resetGates();
+    await new Promise((r) => setTimeout(r, 0));
+    unmount();
+  });
+
+  test("a restricted-path request stays queued after a covering grant mints", async () => {
+    const emitter = new EventEmitter();
+    const controllerRef: { current: GateController | null } = { current: null };
+    const element = () => createElement(Harness, { emitter, controllerRef });
+    const { rerender, unmount } = render(element());
+
+    const outcomes: ApprovalOutcome[] = [];
+    enqueuePermission(emitter, request({ subject: "cat ../../etc/passwd" })).then((o) =>
+      outcomes.push(o),
+    );
+    rerender(element());
+
+    grant(emitter, { tool: "run_shell", pattern: "cat *" });
+    rerender(element());
+    await new Promise((r) => setTimeout(r, 0));
+    rerender(element());
+
+    expect(controllerRef.current!.permissionQueueDepth).toBe(1);
+    expect(outcomes).toHaveLength(0);
+
+    controllerRef.current!.resetGates();
+    await new Promise((r) => setTimeout(r, 0));
+    unmount();
+  });
+
+  test("a plain covered request still auto-drains despite the new guards", async () => {
+    const emitter = new EventEmitter();
+    const controllerRef: { current: GateController | null } = { current: null };
+    const element = () => createElement(Harness, { emitter, controllerRef });
+    const { rerender, unmount } = render(element());
+
+    const outcomes: ApprovalOutcome[] = [];
+    enqueuePermission(emitter, request({ subject: "cat README.md" })).then((o) => outcomes.push(o));
+    rerender(element());
+
+    grant(emitter, { tool: "run_shell", pattern: "cat *" });
+    rerender(element());
+    await new Promise((r) => setTimeout(r, 0));
+    rerender(element());
+
+    expect(controllerRef.current!.permissionQueueDepth).toBe(0);
+    expect(outcomes).toHaveLength(1);
+    expect(outcomes[0]!.allow).toBe(true);
+
+    unmount();
+  });
 });