fix(permissions): param-aware DIS dead-allow + CNF conflict matching

The DIS scanner collapsed Tool(param) rules to the bare tool name, so
Agent(model:opus) deny + Agent(model:sonnet) allow (and the same for
WebFetch(domain:...)) were flagged as dead config — a false positive now
that CC 2.1.178 matches Tool(param:value) and 2.1.172 adds domain rules.
The conflict-detector shared the blind spot from the other side: a
wildcard deny like WebFetch(domain:*) did not cover a
WebFetch(domain:good.com) allow, so a genuine cross-scope conflict was
missed (false negative).

New shared scanners/lib/permission-rules.mjs:
- parseRule / paramMatches (glob)
- dominates(deny, allow) -> DIS dead-allow (deny fully covers allow)
- rulesIntersect(a, b)   -> CNF cross-scope conflict (match sets intersect)

DIS now delegates to dominates; conflict-detector :156 delegates to
rulesIntersect. A bare deny still covers all params, so true positives
are preserved (Bash deny + Bash(npm:*) allow still flagged).

Re-seeded the marketplace-medium snapshots: the false-positive CA-DIS
finding (Read(src/**) allow + Read(./.env) deny) is correctly gone. This
changes snapshot CONTENT only — envelope schema is unchanged, so --json
and --raw stay byte-stable.

Full suite: 837/837 green (+25). self-audit PASS, A(100)/A(97).

scanners/conflict-detector.mjs

@@ -10,24 +10,13 @@ import { finding, scannerResult } from './lib/output.mjs';
 import { SEVERITY } from './lib/severity.mjs';
 import { parseJson } from './lib/yaml-parser.mjs';
 import { truncate } from './lib/string-utils.mjs';
+import { rulesIntersect } from './lib/permission-rules.mjs';
 
 const SCANNER = 'CNF';
 
 // Keys checked separately or not meaningful to compare
 const SKIP_KEYS = new Set(['$schema', 'hooks', 'permissions']);
 
-/**
- * Extract the tool name prefix from a permission rule.
- * e.g., "Bash(npm run *)" → "Bash", "Read(src/**)" → "Read"
- * @param {string} rule
- * @returns {{ tool: string, pattern: string }}
- */
-function parsePermissionRule(rule) {
-  const match = rule.match(/^(\w+)\((.+)\)$/);
-  if (match) return { tool: match[1], pattern: match[2] };
-  return { tool: rule, pattern: '*' };
-}
-
 /**
  * Flatten an object's top-level keys into a simple key→value map.
  * Only first level — we compare top-level settings, not nested.
@@ -150,10 +139,8 @@ export async function scan(targetPath, discovery) {
 
       // Check: allow in A, deny in B (and vice versa)
       for (const allowRule of aAllow) {
-        const { tool: aTool, pattern: aPattern } = parsePermissionRule(allowRule);
         for (const denyRule of bDeny) {
-          const { tool: dTool, pattern: dPattern } = parsePermissionRule(denyRule);
-          if (aTool === dTool && (aPattern === dPattern || aPattern === '*' || dPattern === '*')) {
+          if (rulesIntersect(allowRule, denyRule)) {
             findings.push(finding({
               scanner: SCANNER,
               severity: SEVERITY.high,
@@ -169,10 +156,8 @@ export async function scan(targetPath, discovery) {
 
       // Reverse: allow in B, deny in A
       for (const allowRule of bAllow) {
-        const { tool: bTool, pattern: bPattern } = parsePermissionRule(allowRule);
         for (const denyRule of aDeny) {
-          const { tool: dTool, pattern: dPattern } = parsePermissionRule(denyRule);
-          if (bTool === dTool && (bPattern === dPattern || bPattern === '*' || dPattern === '*')) {
+          if (rulesIntersect(allowRule, denyRule)) {
             findings.push(finding({
               scanner: SCANNER,
               severity: SEVERITY.high,

scanners/disabled-in-schema-scanner.mjs

@@ -7,9 +7,11 @@
  * intent. Often arises from copy-paste edits where one list was updated and
  * the other was forgotten.
  *
- * Compares tool identity by the bare tool name (everything before the first
- * `(`). `Bash(npm:*)` and `Bash` are treated as the same tool for collision
- * purposes — a deny on `Bash` blocks all `Bash(...)` allows.
+ * Compares rule identity param-aware (CC 2.1.178 `Tool(param:value)`,
+ * 2.1.172 `domain:` rules). An allow entry is dead only when some deny entry
+ * fully COVERS it: a bare `Bash` deny blocks all `Bash(...)` allows, but
+ * `Agent(model:opus)` deny does NOT kill an `Agent(model:sonnet)` allow.
+ * Coverage logic lives in `lib/permission-rules.mjs` (shared with CNF).
  *
  * Finding ID: CA-DIS-NNN. Severity: low.
  *
@@ -20,21 +22,13 @@ import { readTextFile } from './lib/file-discovery.mjs';
 import { finding, scannerResult } from './lib/output.mjs';
 import { SEVERITY } from './lib/severity.mjs';
 import { parseJson } from './lib/yaml-parser.mjs';
+import { dominates, parseRule } from './lib/permission-rules.mjs';
 
 const SCANNER = 'DIS';
 
 /**
- * Bare tool name = everything before the first `(`. `Bash(npm:*)` → `Bash`.
- */
-function bareTool(entry) {
-  if (typeof entry !== 'string') return null;
-  const idx = entry.indexOf('(');
-  return (idx === -1 ? entry : entry.slice(0, idx)).trim();
-}
-
-/**
- * Find tools whose bare name appears in both deny and allow within the same
- * settings.json. Returns array of { tool, allowEntry, denyEntry }.
+ * Find allow entries that are dead config because some deny entry fully covers
+ * them. Returns array of { tool, allowEntry, denyEntry }.
  */
 function findDenyAllowOverlaps(settings) {
   if (!settings || typeof settings !== 'object') return [];
@@ -45,20 +39,14 @@ function findDenyAllowOverlaps(settings) {
   const denyList = Array.isArray(perms.deny) ? perms.deny : [];
   if (allowList.length === 0 || denyList.length === 0) return [];
 
-  const denyByBare = new Map();
-  for (const d of denyList) {
-    const bare = bareTool(d);
-    if (bare && !denyByBare.has(bare)) denyByBare.set(bare, d);
-  }
-
   const overlaps = [];
   const seen = new Set();
   for (const a of allowList) {
-    const bare = bareTool(a);
-    if (!bare) continue;
-    if (denyByBare.has(bare) && !seen.has(bare)) {
-      overlaps.push({ tool: bare, allowEntry: a, denyEntry: denyByBare.get(bare) });
-      seen.add(bare);
+    if (typeof a !== 'string' || seen.has(a)) continue;
+    const dominator = denyList.find(d => dominates(d, a));
+    if (dominator) {
+      overlaps.push({ tool: parseRule(a).tool, allowEntry: a, denyEntry: dominator });
+      seen.add(a);
     }
   }
   return overlaps;

scanners/lib/permission-rules.mjs

@@ -0,0 +1,89 @@
+/**
+ * Permission rule matching — shared by the DIS scanner (dead-allow detection)
+ * and the CNF conflict-detector (cross-scope allow/deny conflicts).
+ *
+ * Claude Code permission rules are either bare (`Tool`) or param-qualified
+ * (`Tool(param)`): `Bash`, `Bash(npm:*)`, `Agent(model:opus)`,
+ * `WebFetch(domain:*)`. CC 2.1.178 made `Tool(param:value)` matching
+ * meaningful and 2.1.172 added `domain:` rules, so rule identity must be
+ * param-aware — `Agent(model:opus)` and `Agent(model:sonnet)` are DISTINCT,
+ * not "the same tool".
+ *
+ * Two distinct predicates are exported because the scanners ask different
+ * questions:
+ *   - DIS asks "is this allow entry dead?" → does some deny fully COVER it
+ *     (`dominates`). A bare allow survives a specific deny.
+ *   - CNF asks "do these two cross-scope rules conflict?" → do their match
+ *     sets INTERSECT (`rulesIntersect`). A bare allow conflicts with a
+ *     specific deny, because the denied case is a real contradiction.
+ *
+ * Zero external dependencies.
+ */
+
+/**
+ * Split a permission entry into its bare tool name and optional param.
+ *   `Bash`        → { tool: 'Bash', param: null }
+ *   `Bash(npm:*)` → { tool: 'Bash', param: 'npm:*' }
+ * @param {string} entry
+ * @returns {{ tool: string|null, param: string|null }}
+ */
+export function parseRule(entry) {
+  if (typeof entry !== 'string') return { tool: null, param: null };
+  const idx = entry.indexOf('(');
+  if (idx === -1) return { tool: entry.trim() || null, param: null };
+  const tool = entry.slice(0, idx).trim();
+  let param = entry.slice(idx + 1).trim();
+  if (param.endsWith(')')) param = param.slice(0, -1).trim();
+  return { tool: tool || null, param };
+}
+
+/**
+ * Glob match a permission param against a concrete value. `*` matches any run
+ * of characters; everything else is literal. Anchored (full-string) match.
+ * @param {string} pattern
+ * @param {string} value
+ * @returns {boolean}
+ */
+export function paramMatches(pattern, value) {
+  if (typeof pattern !== 'string' || typeof value !== 'string') return false;
+  if (pattern === value) return true;
+  const rx = '^' + pattern
+    .replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+    .replace(/\\\*/g, '.*') + '$';
+  return new RegExp(rx).test(value);
+}
+
+/**
+ * Does the deny entry fully cover the allow entry, making the allow dead config?
+ * Used by DIS. Bare deny covers everything; a specific deny only covers the
+ * matching (or wildcard-subsumed) param — and does NOT cover a bare allow.
+ * @param {string} denyEntry
+ * @param {string} allowEntry
+ * @returns {boolean}
+ */
+export function dominates(denyEntry, allowEntry) {
+  const d = parseRule(denyEntry);
+  const a = parseRule(allowEntry);
+  if (!d.tool || !a.tool || d.tool !== a.tool) return false;
+  if (d.param === null) return true;   // bare deny covers all params
+  if (a.param === null) return false;  // specific deny does not kill a bare allow
+  if (d.param === a.param) return true;
+  return paramMatches(d.param, a.param); // wildcard deny covers a matching literal allow
+}
+
+/**
+ * Do two permission rules' match sets intersect (genuine cross-scope conflict)?
+ * Used by CNF. A bare rule intersects any same-tool rule; param rules intersect
+ * when equal or when either wildcard-matches the other.
+ * @param {string} ruleA
+ * @param {string} ruleB
+ * @returns {boolean}
+ */
+export function rulesIntersect(ruleA, ruleB) {
+  const a = parseRule(ruleA);
+  const b = parseRule(ruleB);
+  if (!a.tool || !b.tool || a.tool !== b.tool) return false;
+  if (a.param === null || b.param === null) return true; // bare ∩ anything (same tool)
+  if (a.param === b.param) return true;
+  return paramMatches(a.param, b.param) || paramMatches(b.param, a.param);
+}