fix(pi-permission-system): bash 命令枚举下降进入控制流与赋值载荷

for/while/if/case/{ }/函数体此前只按整段文本匹配，
"for d in ...; do n=$(find ...); done" 中的 find 绕过了 find* deny（真实会话复现）；
x=$(grep ...)、export X=$(find ...)、! grep ... 同样绕过。

控制流语句仍整段判定，并逐条枚举条件与体内命令；do/else/case 分支容器只下降不单独成单元；
其余语句兜底额外枚举其中的 $(…)。结果只会更严，hard guard 共享同一枚举。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

pi-permission-system/test/handlers/gates/bash-command-metamorphic.test.ts

@@ -14,10 +14,13 @@ import { BashProgram } from "#src/access-intent/bash/program";
 import { resolveBashCommandCheck } from "#src/handlers/gates/bash-command";
 import { pathFlavorForPlatform } from "#src/path/path-flavor";
 import { PathNormalizer } from "#src/path-normalizer";
+import { PermissionResolver } from "#src/permission-resolver";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
-import type { PermissionState } from "#src/types";
+import { SessionRules } from "#src/session-rules";
+import type { DenyWithReason, PermissionState } from "#src/types";
 
 import { makeCheckResult } from "#test/helpers/handler-fixtures";
+import { createInMemoryManager } from "#test/helpers/manager-harness";
 
 /** Decision strength ordering: deny (2) > ask (1) > allow (0). */
 const STRENGTH: Record<PermissionState, number> = {
@@ -146,3 +149,103 @@ describe("bash command gate — nested execution hosts do not weaken", () => {
     expect(await decide("cat <<'EOF'\n$(rm x)\nEOF", resolver)).toBe("allow");
   });
 });
+
+/**
+ * The same totality property for control-flow bodies.
+ *
+ * A `for`/`while`/`if`/`case`/function was once emitted whole without
+ * descending, so `for d in …; do find …; done` only ever matched patterns
+ * starting with `for` — a `find*: deny` rule was bypassed. The enumerator now
+ * emits the whole statement AND its body commands, so hosting a gated command
+ * inside control flow cannot weaken its decision.
+ */
+describe("bash command gate — control-flow bodies do not weaken", () => {
+  /** Real pattern matching over a bash map: `*` allow, the rest deny-with-reason. */
+  function makePolicyResolver(
+    bash: Record<string, PermissionState | DenyWithReason>,
+  ): ScopedPermissionResolver {
+    const manager = createInMemoryManager({
+      global: { permission: { "*": "allow", bash } },
+    });
+    return new PermissionResolver(manager, new SessionRules());
+  }
+
+  async function checkWith(
+    command: string,
+    resolver: ScopedPermissionResolver,
+  ) {
+    const program = await BashProgram.parse(
+      command,
+      new PathNormalizer(pathFlavorForPlatform(process.platform), "/cwd"),
+    );
+    return resolveBashCommandCheck(command, program.commands(), undefined, resolver);
+  }
+
+  it("denies the reported repro: find inside a for-loop command substitution", async () => {
+    const resolver = makePolicyResolver({
+      "*": "allow",
+      "find*": { action: "deny", reason: "use the find tool" },
+      "grep*": { action: "deny", reason: "use the grep tool" },
+    });
+
+    const result = await checkWith(
+      'cd /Users/sia/code/my-pi && ls -1 extensions/ && echo "=== LOC by ext ===" && for d in pi-*/; do n=$(find "$d" -name \'*.ts\' -not -path \'*/node_modules/*\' -not -path \'*/dist/*\' -not -path \'*/test*\' | xargs wc -l 2>/dev/null | tail -1 | awk \'{print $1}\'); echo "$d $n"; done && echo "=== extensions ts ===" && wc -l extensions/*.ts | tail -3',
+      resolver,
+    );
+
+    expect(result.state).toBe("deny");
+    expect(result.command).toBe(
+      'find "$d" -name \'*.ts\' -not -path \'*/node_modules/*\' -not -path \'*/dist/*\' -not -path \'*/test*\'',
+    );
+    expect(result.matchedPattern).toBe("find*");
+    expect(result.reason).toBe("use the find tool");
+    expect(result.commandContext).toBe("command_substitution");
+  });
+
+  it.each([
+    'for d in a b; do find "$d" -name x; done',
+    'while read l; do grep x "$l"; done < list',
+    "if grep -q x f; then echo y; else echo n; fi",
+    "case $x in a) find . ;; esac",
+    "{ grep x f; }",
+    "f() { grep x f; }",
+    "for a in 1; do for b in 2; do find .; done; done",
+    "x=$(grep foo f)",
+    "export X=$(find .)",
+    "f() { local y=$(rg z); }",
+    "! grep -q x f",
+    "if ! grep -q x f; then :; fi",
+  ])("denies a gated command inside `%s`", async (command) => {
+    const resolver = makePolicyResolver({
+      "*": "allow",
+      "find*": "deny",
+      "grep*": "deny",
+      "rg*": "deny",
+    });
+
+    expect((await checkWith(command, resolver)).state).toBe("deny");
+  });
+
+  it("denies a hard-guard payload hidden in a loop body", async () => {
+    const resolver = makePolicyResolver({
+      "*": "allow",
+      "rm -rf*": "deny",
+    });
+
+    const result = await checkWith("for f in a; do rm -rf /; done", resolver);
+    expect(result.state).toBe("deny");
+    expect(result.matchedPattern).toBe("rm -rf*");
+  });
+
+  it("allows a control-flow statement whose body commands are allowed", async () => {
+    const resolver = makePolicyResolver({
+      "*": "allow",
+      "find*": "deny",
+      "grep*": "deny",
+    });
+
+    expect(
+      (await checkWith('for d in a b; do echo "$d"; done', resolver)).state,
+    ).toBe("allow");
+  });
+});