fix(rules): prevent flag negation from being consumed as preceding flag's value

src/rules/pattern_matcher/mod.rs

@@ -1068,6 +1068,22 @@ mod tests {
     #[case::flag_negation_empty_tokens_single("sort !-o *", "sort", true)]
     #[case::flag_negation_empty_tokens_alt("sort !-o|--output|--compress-program *", "sort", true)]
     #[case::flag_negation_empty_tokens_find("find !-delete *", "find", true)]
+    // Long flag negation with preceding literals
+    #[case::long_flag_negation_empty_after_literals(
+        "git interpret-trailers --parse !--in-place *",
+        "git interpret-trailers --parse",
+        true
+    )]
+    #[case::long_flag_negation_with_safe_arg(
+        "git interpret-trailers --parse !--in-place *",
+        "git interpret-trailers --parse file.txt",
+        true
+    )]
+    #[case::long_flag_negation_rejects_banned(
+        "git interpret-trailers --parse !--in-place *",
+        "git interpret-trailers --parse --in-place",
+        false
+    )]
     // Positional negation with empty tokens should still be false
     #[case::positional_negation_empty_tokens("kubectl !describe *", "kubectl", false)]
     fn negation_matching(

src/rules/pattern_parser.rs

@@ -359,6 +359,10 @@ fn should_consume_as_value(next: &LexToken, has_more_after: bool, inside_group:
         LexToken::Alternation(alts) if alts.iter().any(|a| is_flag(a)) => false,
         LexToken::Placeholder(_) => false,
         LexToken::Wildcard => inside_group || has_more_after,
+        // A negation whose inner value is a flag (e.g., `!--in-place`) should
+        // not be consumed as a flag value — it is an independent negation token.
+        LexToken::Negation(s) if is_flag(s) => false,
+        LexToken::NegationAlternation(alts) if alts.iter().any(|a| is_flag(a)) => false,
         _ => true,
     }
 }
@@ -538,6 +542,11 @@ mod tests {
             value: Box::new(PatternToken::Literal("/".into())),
         },
     ])]
+    #[case::flag_not_consuming_flag_negation("git --parse !--in-place *", "git", vec![
+        PatternToken::Alternation(vec!["--parse".into()]),
+        PatternToken::Negation(Box::new(PatternToken::Literal("--in-place".into()))),
+        PatternToken::Wildcard,
+    ])]
     fn parse_bare_flag(
         #[case] input: &str,
         #[case] expected_command: &str,

tests/integration/config_to_rule_evaluation.rs

@@ -1135,3 +1135,39 @@ fn flag_negation_empty_tokens(
     let result = evaluate_command(&config, command, &empty_context).unwrap();
     expected(&result.action);
 }
+
+// ========================================
+// Long flag negation with preceding literal tokens (no trailing arguments)
+// ========================================
+
+#[rstest]
+#[case::no_trailing_args_allowed(
+    "git interpret-trailers --parse",
+    assert_allow as ActionAssertion,
+)]
+#[case::safe_trailing_arg_allowed(
+    "git interpret-trailers --parse file.txt",
+    assert_allow as ActionAssertion,
+)]
+#[case::banned_flag_rejected(
+    "git interpret-trailers --parse --in-place",
+    assert_ask as ActionAssertion,
+)]
+#[case::banned_flag_with_arg_rejected(
+    "git interpret-trailers --parse --in-place file.txt",
+    assert_ask as ActionAssertion,
+)]
+fn long_flag_negation_with_preceding_literals(
+    #[case] command: &str,
+    #[case] expected: ActionAssertion,
+    empty_context: EvalContext,
+) {
+    let config = parse_config(indoc! {"
+        rules:
+          - allow: 'git interpret-trailers --parse !--in-place *'
+    "})
+    .unwrap();
+
+    let result = evaluate_command(&config, command, &empty_context).unwrap();
+    expected(&result.action);
+}

tests/integration/property_based.rs

@@ -640,6 +640,62 @@ proptest! {
     }
 }
 
+// ========================================
+// Flag negation after preceding literals
+// `{cmd} {literal} !{flag} *` allows when flag absent, rejects when present
+// ========================================
+
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(256))]
+
+    #[test]
+    fn prop_flag_negation_after_literal_allows_when_absent(
+        cmd_name in arb_cmd_name(),
+        literal in arb_safe_positional(),
+        negated_flag in arb_flag(),
+        positionals in proptest::collection::vec(arb_safe_positional(), 0..=2),
+    ) {
+        let pattern = format!("{cmd_name} {literal} !{negated_flag} *");
+        let yaml = build_yaml_config("allow", &pattern);
+        let config = parse_config(&yaml).unwrap();
+        let ctx = empty_context();
+
+        // Command with the literal but without the negated flag
+        let mut tokens = vec![literal];
+        tokens.extend(positionals);
+        let command = build_command(&cmd_name, &tokens);
+        let result = evaluate_command(&config, &command, &ctx).unwrap();
+        prop_assert_eq!(result.action, Action::Allow,
+            "flag negation after literal should allow when flag absent: pattern={:?} command={:?}",
+            pattern, command);
+    }
+
+    #[test]
+    fn prop_flag_negation_after_literal_rejects_when_present(
+        cmd_name in arb_cmd_name(),
+        literal in arb_safe_positional(),
+        negated_flag in arb_flag(),
+        positionals in proptest::collection::vec(arb_positional(), 0..=2),
+    ) {
+        let pattern = format!("{cmd_name} {literal} !{negated_flag} *");
+        let yaml = build_yaml_config("allow", &pattern);
+        let config = parse_config(&yaml).unwrap();
+        let ctx = empty_context();
+
+        // Command with the literal and the negated flag present
+        let mut tokens = vec![literal];
+        tokens.push(negated_flag.clone());
+        tokens.extend(positionals);
+        let command = build_command(&cmd_name, &tokens);
+        let result = evaluate_command(&config, &command, &ctx).unwrap();
+        prop_assert!(
+            !matches!(result.action, Action::Allow),
+            "flag negation after literal should reject when flag present: pattern={:?} command={:?}",
+            pattern, command
+        );
+    }
+}
+
 // ========================================
 // Value negation correctness (position-dependent)
 // `{cmd} !{value} *` rejects when first token matches, allows otherwise