feat: assent window + compound read-only classification + continue-after-approval

Agent stopped after every approval step, forcing operator to type
'continue' 7× per deploy session. Root causes and fixes:

1. Compound read-only commands (e.g. 'systemctl status; journalctl')
   defaulted to config_mutation — now splits on ;/&&/||/| and classifies
   as read_only if all segments are inspection verbs. Added grep, wc,
   sort, uniq, cut, tr, dpkg -l, apt list, docker stats to allowlist.

2. curl|sh was classified destructive, forcing typed confirmation for
   legitimate installs (get.docker.com). Demoted to config_mutation —
   loose assent grants it, no typed phrase needed.

3. SOUL.md said 'STOP after queuing' — replaced with 'continue working
   on non-blocked steps'. Added assent window section instructing agent
   to carry out the full plan after approval.

4. Assent window: when operator approves a plan via chat assent, a
   30-minute window opens where config_mutation commands auto-run
   without re-approval. Agent writes expiry to autonomy_settings; MCP
   run tool checks it before gating. Destructive never auto-runs.

5. System note after approval now says 'CONTINUE executing the full
   plan — do not stop and wait for continue.'

internal/policy/command.go

@@ -52,9 +52,12 @@ var destructivePatterns = []*regexp.Regexp{
 	regexp.MustCompile(`:\(\)\s*\{.*:\|:.*\}\s*;\s*:`), // fork bomb
 	regexp.MustCompile(`(?i)\bchmod\s+-R\s+000\b|\bchmod\s+000\s+/`),
 	regexp.MustCompile(`(?i)\biptables\s+-F\b|\bufw\s+disable\b`), // wipes firewall
-	// secret/credential exfiltration or piping a remote script straight into a root shell
-	regexp.MustCompile(`(?i)\bcurl\b.*\|\s*(sudo\s+)?(ba)?sh\b`),
-	regexp.MustCompile(`(?i)\bwget\b.*\|\s*(sudo\s+)?(ba)?sh\b`),
+	// secret/credential exfiltration — reading private keys, shadow, or age
+	// keys is always destructive. (Piping a remote script into a shell via
+	// curl|sh was previously here too, but that pattern is common for
+	// legitimate installs — get.docker.com, convenience scripts — and
+	// demoting it to config_mutation means loose assent can grant it without
+	// a typed confirmation. The assent window covers the deploy case.)
 	regexp.MustCompile(`(?i)\bcat\s+.*(id_rsa|id_ed25519|\.pem|shadow|\.age)\b`),
 }
 
@@ -66,16 +69,29 @@ var destructivePatterns = []*regexp.Regexp{
 var readOnlyLeadPattern = regexp.MustCompile(
 	`^(cat|less|head|tail|ls|stat|file|du|df|free|uptime|uname|hostname|whoami|id|ip|ss|netstat|ping|` +
 		`journalctl|dmesg|ps|top|htop|env|printenv|echo|which|whereis|` +
+		`grep|egrep|fgrep|rg|wc|sort|uniq|cut|tr|tee|` +
+		`dpkg\s+(-l|-s|--list|--status)\b|apt\s+(list|search|show)\b|` +
 		`systemctl\s+(status|is-active|is-enabled|is-failed|list-units)|` +
-		`docker\s+(ps|images|inspect|logs|version|info)|` +
+		`docker\s+(ps|images|inspect|logs|version|info|stats)|` +
 		`pct\s+(status|config|list)|qm\s+(status|config|list)|pvesh\s+get|` +
 		`git\s+(status|log|diff|show|branch|remote)|` +
 		`curl\s+-.*-I\b|curl\s+.*--head\b)\b`)
 
-// compoundOpPattern matches shell operators that chain or substitute
-// commands. A "read-only lead verb" only qualifies a command for the
-// read_only fast path when the WHOLE command is simple — otherwise a
-// compound like "cat file && rm -rf /" would slip through on its first verb.
+// compoundSplitRe splits a command on shell chaining operators (;, &&, ||, |)
+// so each segment can be individually classified. A piped or chained command
+// where EVERY segment is a recognized read-only inspection verb is safe to
+// auto-run — e.g. "systemctl status caddy; journalctl -u caddy -n 5" or
+// "docker ps | grep caddy".
+var compoundSplitRe = regexp.MustCompile(`\s*(?:&&|\|\||;|\|)\s*`)
+
+// subshellRe matches command substitution ($() or backticks) that can hide
+// arbitrary execution. A command using these never qualifies for the read-only
+// fast path — the substituted content could do anything.
+var subshellRe = regexp.MustCompile("\\$\\(|`")
+
+// compoundOpPattern is retained for compatibility — matches any compound
+// operator. (Previously used to block ALL compound commands from the read-only
+// path; now the per-segment check is more precise.)
 var compoundOpPattern = regexp.MustCompile("[;&|`]|\\$\\(")
 
 // ClassifyCommand scores an arbitrary shell command for the general `run`
@@ -117,12 +133,10 @@ func computeCommandRisk(command string) string {
 		}
 	}
 
-	if !compoundOpPattern.MatchString(cmd) {
-		// Strip a leading sudo/env assignment so "sudo cat /x" still matches.
-		probe := cmd
-		probe = regexp.MustCompile(`^sudo\s+`).ReplaceAllString(probe, "")
-		probe = regexp.MustCompile(`^(\w+=\S+\s+)+`).ReplaceAllString(probe, "")
-		if readOnlyLeadPattern.MatchString(probe) {
+	// Subshell substitution ($(), backticks) can hide arbitrary execution —
+	// never auto-run, even if the visible verbs look read-only.
+	if !subshellRe.MatchString(cmd) {
+		if allSegmentsReadOnly(cmd) {
 			return RiskReadOnly
 		}
 	}
@@ -131,3 +145,27 @@ func computeCommandRisk(command string) string {
 	// default to the gated tier rather than guessing it's safe.
 	return RiskConfigMutation
 }
+
+// allSegmentsReadOnly splits a compound command on chaining operators
+// (;, &&, ||, |) and checks whether EVERY segment is a recognized read-only
+// inspection verb. If so, the whole command is safe to auto-run. Any segment
+// that isn't a recognized read-only verb disqualifies the whole command —
+// the classifier errs toward gating, not guessing.
+func allSegmentsReadOnly(cmd string) bool {
+	segments := compoundSplitRe.Split(cmd, -1)
+	for _, seg := range segments {
+		seg = strings.TrimSpace(seg)
+		if seg == "" {
+			continue
+		}
+		// Strip a leading sudo/env assignment so "sudo cat /x" still matches.
+		probe := seg
+		probe = regexp.MustCompile(`^sudo\s+`).ReplaceAllString(probe, "")
+		probe = regexp.MustCompile(`^(\w+=\S+\s+)+`).ReplaceAllString(probe, "")
+		probe = strings.TrimSpace(probe)
+		if !readOnlyLeadPattern.MatchString(probe) {
+			return false
+		}
+	}
+	return len(segments) > 0
+}