fix(permissions): keep scanning after a temp-only rm -rf

A later dangerous command in the same Bash call must still ask.

Author: elkaix

packages/agent-core-v2/src/agent/permissionPolicy/policies/dangerous-command-ask.ts

@@ -204,10 +204,17 @@ function analyzeSource(
   if (!parsed.ok || parsed.hasError) return { kind: 'unanalyzable' };
   const commands: BashSyntaxNode[] = [];
   collectCommands(parsed.root, commands);
+  const tempOperands: string[] = [];
   for (const command of commands) {
     const verdict = analyzeCommand(command, depth, parse);
-    if (verdict !== undefined) return verdict;
+    if (verdict === undefined) continue;
+    if (verdict.kind === 'temp-rm') {
+      tempOperands.push(...verdict.operands);
+      continue;
+    }
+    return verdict;
   }
+  if (tempOperands.length > 0) return { kind: 'temp-rm', operands: tempOperands };
   return undefined;
 }
 

packages/agent-core-v2/test/agent/permissionPolicy/permissionPolicyService.test.ts

@@ -286,6 +286,7 @@ describe('AgentPermissionPolicyService chain', () => {
     ['systemctl --user reboot', 'systemctl reboot'],
     ['bash -c "shutdown now"', 'shutdown'],
     ['rm -rf /tmp/build /root', 'rm -rf'],
+    ['rm -rf /tmp/build && rm -rf /root', 'rm -rf'],
     ['rm -rf /tmp/../etc', 'rm -rf'],
     ['rm -rf /tmpfoo', 'rm -rf'],
     ['rm -fr dir', 'rm -rf'],
@@ -324,7 +325,12 @@ describe('AgentPermissionPolicyService chain', () => {
     });
   });
 
-  it.each(['rm -rf /tmp/build', 'rm -rf /temp/cache', 'rm -rf -- /tmp/build'])(
+  it.each([
+    'rm -rf /tmp/build',
+    'rm -rf /temp/cache',
+    'rm -rf -- /tmp/build',
+    'rm -rf /tmp/build && rm -rf /temp/cache',
+  ])(
     'approves `%s` in yolo mode',
     async (command) => {
       mode = 'yolo';