feat(core): make the portable shell scanner authoritative - #44016

AI code review — automated review for reference; please use your judgment.

1. packages/core/src/permission.ts:186 — In evaluated() exact mode, the condition rule.resource === resource || rule.resource === "*" || rule.effect !== "allow" returns any ask/deny rule whose action matches, even when the rule's resource pattern doesn't cover the requested resource. Why it matters: a scoped config like deny external_directory /secrets/** becomes an action-wide deny for all exact-mode requests (["*"]), diverging from wildcard-mode semantics where resource patterns gate the effect. Suggestion: only return a rule when rule.resource === resource || rule.resource === "*"; otherwise continue for every effect, falling through to the ask default — i.e. drop the || rule.effect !== "allow" arm.

2. packages/core/tool/plugin/shell.ts (behavioral) — After a user approves an unknown-directory prompt with "always allow" (saved against a concrete path), later exact-mode asserts use resources: ["*"], which no saved concrete-path allow can ever match (and evaluated skips wildcard-allow rules). Why it matters: "don't ask again" silently degrades to ask-every-time for subsequent opaque commands. Possibly intended ("unknown dirs can't inherit narrower approvals"), but it should be stated in the changeset/permissions.mdx so users understand the persistent prompting.

3. packages/core/src/permission.ts:186 (test gap) — evaluated() is a pure function carrying the subtlest logic in this PR, yet it's only exercised indirectly. Suggestion: add a direct matrix test: exact-vs-wildcard allow, "*" allow hit, wildcard-allow skip, non-matching deny (pins item 1's chosen semantics), non-matching ask, and empty-ruleset default.

4. packages/core/src/shell/parse.ts:384 — popd/pushd now unconditionally report unknown: true, and any second directory change flips directoryUnknown — correct and conservative, but note the whole command string then goes out as a single opaque resource with save: [] (shell.ts), losing the per-command breakdown in approval history/audit. Suggestion: keep the strictness, but consider still resolving/publishing the known directories for observability alongside the blanket prompt.

5. packages/core/src/shell/parse.ts:795 — ~ now expands via $HOME only; on typical Windows setups (no HOME, PowerShell default), cd ~ becomes unknown ⇒ prompt. Fail-closed is right, but mapping USERPROFILE as a fallback for the portable path would avoid a noisy UX regression on Windows while staying deterministic.

6. packages/core/src/shell/scan.ts:498 (nit) — The curly-quote blocklist covers U+2018–U+201D; other confusables (fullwidth ＂＇, angle quotes «»‹›) pass through to word parsing. Low risk since they'd rarely execute, but a broader "non-ASCII quote-like" class would be cheaper than enumerating.

Nice work overall — the BASH_ENV/BASH_FUNC_* startup gating, alias-command opacity in PowerShell, and the adversarial/generated test suites close real bypass classes.

— automated review (ox-alpha, round2)