Without this, "jj log && rm -rf /" passes the jj auto-allow check.

Assisted-by: Claude Opus 4 via pi

diff --git a/.pi/agent/extensions/permission-gate.ts b/.pi/agent/extensions/permission-gate.ts
index afbd7166..5d41675c 100644
--- a/.pi/agent/extensions/permission-gate.ts
+++ b/.pi/agent/extensions/permission-gate.ts
@@ -79,6 +79,7 @@ function isAllowed(toolName: string, input: Record<string, unknown>, ctx: Extens
 
   if (toolName === "bash") {
     const cmd = stripCdToCwd(String(input.command ?? "").trimStart(), ctx.cwd);
+    if (cmd.includes("&&") || cmd.includes(";")) return false;
     if (cmd.startsWith("jj ")) {
       const subcommand = cmd.slice(3).trimStart().split(/\s/)[0];
       return ALLOWED_JJ_SUBCOMMANDS.includes(subcommand);