@sema-agent/core 2.13.0 → 4.0.0

package/dist/tools/fs/fs-bash.js

@@ -1,11 +1,13 @@
 import { Type } from "typebox";
 import { defineTool, errorResult } from "../../core/tools.js";
 import { defaultTaskRegistry } from "../../core/task-registry.js";
+import { accountDroppedBytes, spoolDropNote } from "../../core/task-registry-shared.js";
 import { TASK_OUTPUT_TOOL_NAME, TASK_STOP_TOOL_NAME, TASK_OUTPUT_ALIASES, TASK_STOP_ALIASES, TASK_OUTPUT_CONTRACT, TASK_STOP_CONTRACT, TASK_OUTPUT_MISSING_ID_MESSAGE, TASK_STOP_MISSING_ID_MESSAGE, TASK_STOP_PARAMS, resolveTaskIdArg, ENV_DIRECT_TASK_TOOL_CAPS, composeTaskOutputDescription, composeTaskOutputParams, composeTaskStopDescription, } from "../../core/task-tool-shape.js";
 import { hasBackgroundShell } from "../../core/background-shell.js";
 import { delimitUntrusted } from "../../core/untrusted-text.js";
 import { MCP_IMAGE_MAX_BASE64 } from "../../core/mcp.js";
 import { imageMagicMatches, withinAnyRoot } from "./safety.js";
+import { isRemoteExecutionEnv } from "../../core/remote-env.js";
 import { ghRateLimitHint } from "./gh-rate-limit.js";
 import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, createShellOverflowSpoolFence, shellRecoveryHint, CWD_SENTINEL, } from "./fs-shared.js";
 import { BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyCompoundReadonly, classifySimpleCommandReadBoundary, } from "./bash-readonly-classifier.js";
@@ -137,7 +139,71 @@ function commandBasename(token) {
     const idx = token.lastIndexOf("/");
     return idx === -1 ? token : token.slice(idx + 1);
 }
-export function canAutoBackground(command) {
+const COMMAND_STRING_SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh", "ash"]);
+function commandStringPayload(tokens) {
+    const word = commandBasename(tokens[0] ?? "");
+    if (word === "eval")
+        return tokens.slice(1).join(" ");
+    if (!COMMAND_STRING_SHELLS.has(word))
+        return undefined;
+    const flagIdx = tokens.findIndex((t, i) => i > 0 && /^-[A-Za-z]*c[A-Za-z]*$/.test(t));
+    return flagIdx === -1 ? undefined : tokens.slice(flagIdx + 1).join(" ");
+}
+function unquotePayload(payload) {
+    const s = payload.trim();
+    const ansiC = /^\$'([\s\S]*)'$/.exec(s);
+    if (ansiC)
+        return (ansiC[1] ?? "").replace(/\\n/g, "\n").replace(/\\t/g, "\t");
+    const quoted = /^(['"])([\s\S]*)\1$/.exec(s);
+    return quoted ? (quoted[2] ?? "") : s;
+}
+const AUTO_BACKGROUND_MAX_WRAPPER_DEPTH = 3;
+function splitTopLevelStatements(command) {
+    const out = [];
+    let cur = "";
+    let quote;
+    for (let i = 0; i < command.length; i++) {
+        const c = command[i];
+        if (quote !== undefined) {
+            cur += c;
+            if (c === quote)
+                quote = undefined;
+            continue;
+        }
+        if (c === '"' || c === "'") {
+            quote = c;
+            cur += c;
+            continue;
+        }
+        if (c === ";" || c === "\n" || c === "|" || (c === "&" && command[i + 1] === "&")) {
+            if ((c === "&" || c === "|") && command[i + 1] === c)
+                i++;
+            out.push(cur);
+            cur = "";
+            continue;
+        }
+        if (c === "\r" && command[i + 1] === "\n") {
+            out.push(cur);
+            cur = "";
+            i++;
+            continue;
+        }
+        cur += c;
+    }
+    out.push(cur);
+    return out.map((s) => s.trim()).filter((s) => s.length > 0);
+}
+export function canAutoBackground(command, depth = 0) {
+    if (depth < AUTO_BACKGROUND_MAX_WRAPPER_DEPTH) {
+        for (const stmt of splitTopLevelStatements(command)) {
+            const tokens = stripAutoBackgroundWrapperPrefixes(stmt).split(/\s+/);
+            for (let i = 0; i < tokens.length; i++) {
+                const stmtPayload = commandStringPayload(tokens.slice(i));
+                if (stmtPayload !== undefined && stmtPayload.trim() !== "" && !canAutoBackground(unquotePayload(stmtPayload), depth + 1))
+                    return false;
+            }
+        }
+    }
     const segments = command
         .split(/&&|\|\||;|\||\r?\n/)
         .map((s) => s.trim())
@@ -149,6 +215,9 @@ export function canAutoBackground(command) {
         const word = commandBasename(tokens[0] ?? "");
         if (word === "git")
             return false;
+        const payload = depth < AUTO_BACKGROUND_MAX_WRAPPER_DEPTH ? commandStringPayload(tokens) : undefined;
+        if (payload !== undefined && payload.trim() !== "" && !canAutoBackground(unquotePayload(payload), depth + 1))
+            return false;
         if (word === "xargs" && tokens.slice(1).some((t) => commandBasename(t) === "git"))
             return false;
     }
@@ -389,6 +458,53 @@ ${coAuthorLines}
 - The shell is NOT sandboxed by this tool: a command can read or write any reachable path and use the network. Every call is subject to the deployment's approval policy (it may be denied or require confirmation); a denied call should not be retried verbatim.
 - Treat evidence of a deployment restriction — "Operation not permitted", "Read-only file system", a denied path, or a network failure — as a boundary, not a bug: adjust within the allowed scope or report the limit; don't reach for a destructive or privilege-escalating workaround.`;
 }
+async function adoptBackgroundShell(req) {
+    const { env, shellId, registry, description, toolUseId, ctxTaskId, ctxPrincipal, wiring } = req;
+    const sessionScoped = wiring.sessionId !== undefined;
+    const owner = sessionScoped ? wiring.sessionId : (ctxTaskId ?? wiring.taskOwner);
+    const scope = ctxPrincipal ?? wiring.taskScope;
+    const onNotify = wiring.onNotify;
+    let outputFile;
+    if (onNotify !== undefined) {
+        const tf = await env.createTempFile({ prefix: "bash-task-", suffix: ".output" });
+        if (tf.ok) {
+            const tfCanon = await env.canonicalPath(tf.value);
+            outputFile = tfCanon.ok ? tfCanon.value : tf.value;
+        }
+    }
+    try {
+        const taskId = registry.registerBackgroundBash({
+            env,
+            shellId,
+            description,
+            toolUseId,
+            ...(owner !== undefined ? { owner } : {}),
+            ...(scope !== undefined ? { scope } : {}),
+            ...(sessionScoped ? { sessionScoped: true } : {}),
+            ...(outputFile !== undefined ? { outputFile } : {}),
+            ...(onNotify !== undefined ? { onTerminal: (n) => onNotify(n, { priority: "next" }) } : {}),
+        });
+        return { ok: true, taskId, outputFile };
+    }
+    catch (e) {
+        const reason = e instanceof Error ? e.message : String(e);
+        let kill;
+        try {
+            kill = await env.killBackground(shellId);
+        }
+        catch {
+            kill = undefined;
+        }
+        if (kill !== undefined && (kill.ok || kill.error.code === "not_found"))
+            return { ok: false, reason, killed: true };
+        return { ok: false, reason, killed: false, killMsg: kill !== undefined && !kill.ok ? kill.error.message : "killBackground threw" };
+    }
+}
+function backgroundLifetimeNote(caps) {
+    return caps.retainBackgroundProcesses === true
+        ? ""
+        : ` NOTE: background processes do NOT survive the session (reaped at task end). If this is a deliverable service that must stay alive afterwards, host it with a FOREGROUND command instead: \`nohup cmd >log 2>&1 &\` (self-detaching — survives the session).`;
+}
 export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = { current: rootCanonical }, taskOpts = {}) {
     const timeoutCaps = resolveBashTimeoutCaps(taskOpts);
     const timeoutCapsSecView = bashTimeoutCapsSec(timeoutCaps);
@@ -456,57 +572,33 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
                         ? ` Time budget: requested ${requestedTimeoutSec}s, capped at ${bgCaps.maxBgTimeoutSec}s (env ceiling: requests above ${bgCaps.maxBgTimeoutSec}s are reduced to it) — auto-terminates if still running after ${appliedTimeoutSec}s.`
                         : ` Time budget: auto-terminates if still running after ${appliedTimeoutSec}s (hard cap ${bgCaps.maxBgTimeoutSec}s).`
                     : "";
-                const lifetimeNote = bgCaps.retainBackgroundProcesses === true
-                    ? ""
-                    : ` NOTE: background processes do NOT survive the session (reaped at task end). If this is a deliverable service that must stay alive afterwards, host it with a FOREGROUND command instead: \`nohup cmd >log 2>&1 &\` (self-detaching — survives the session).`;
-                if (taskOpts.taskRegistry) {
-                    const sessionScoped = taskOpts.sessionId !== undefined;
-                    const owner = sessionScoped ? taskOpts.sessionId : (ctx.taskId ?? taskOpts.taskOwner);
-                    const scope = ctx.principal ?? taskOpts.taskScope;
+                const lifetimeNote = backgroundLifetimeNote(bgCaps);
+                const registry = taskOpts.taskRegistry;
+                if (registry !== undefined) {
                     const onNotify = taskOpts.onTaskNotification;
-                    let outputFile;
-                    if (onNotify !== undefined) {
-                        const tf = await env.createTempFile({ prefix: "bash-task-", suffix: ".output" });
-                        if (tf.ok) {
-                            const tfCanon = await env.canonicalPath(tf.value);
-                            outputFile = tfCanon.ok ? tfCanon.value : tf.value;
-                        }
-                    }
-                    let taskId;
-                    try {
-                        taskId = taskOpts.taskRegistry.registerBackgroundBash({
-                            env,
-                            shellId: r.value.shellId,
-                            description: description ?? command,
-                            toolUseId: ctx.toolCallId,
-                            ...(owner !== undefined ? { owner } : {}),
-                            ...(scope !== undefined ? { scope } : {}),
-                            ...(sessionScoped ? { sessionScoped: true } : {}),
-                            ...(outputFile !== undefined ? { outputFile } : {}),
-                            ...(onNotify !== undefined ? { onTerminal: (n) => onNotify(n, { priority: "next" }) } : {}),
-                        });
-                    }
-                    catch (e) {
-                        const reason = e instanceof Error ? e.message : String(e);
-                        let kill;
-                        try {
-                            kill = await env.killBackground(r.value.shellId);
+                    const adopted = await adoptBackgroundShell({
+                        env,
+                        shellId: r.value.shellId,
+                        registry,
+                        description: description ?? command,
+                        toolUseId: ctx.toolCallId,
+                        ctxTaskId: ctx.taskId,
+                        ctxPrincipal: ctx.principal,
+                        wiring: { sessionId: taskOpts.sessionId, taskOwner: taskOpts.taskOwner, taskScope: taskOpts.taskScope, onNotify },
+                    });
+                    if (!adopted.ok) {
+                        if (adopted.killed) {
+                            return errorResult(`Error (Bash): background process was started but could not be registered (${adopted.reason}); it has been terminated.`);
                         }
-                        catch {
-                            kill = undefined;
-                        }
-                        if (kill !== undefined && (kill.ok || kill.error.code === "not_found")) {
-                            return errorResult(`Error (Bash): background process was started but could not be registered (${reason}); it has been terminated.`);
-                        }
-                        const killMsg = kill !== undefined && !kill.ok ? kill.error.message : "killBackground threw";
                         return {
-                            content: `Error (Bash): background process was started but could not be registered (${reason}), and the cleanup kill failed (${killMsg}). ` +
+                            content: `Error (Bash): background process was started but could not be registered (${adopted.reason}), and the cleanup kill failed (${adopted.killMsg}). ` +
                                 `The process could NOT be terminated — it may still be running, but it has no task_id, so TaskOutput/TaskStop cannot reach it. ` +
                                 `If it must be stopped, kill it manually (e.g. \`pkill -f\` on its command line).`,
                             details: { type: "bash", registerFailed: true, killFailed: true },
                             isError: true,
                         };
                     }
+                    const { taskId, outputFile } = adopted;
                     const interimNote = outputFile !== undefined
                         ? ` Output file: ${outputFile} (full output is appended there — Read it any time).`
                         : ` Use TaskOutput("${taskId}") to check interim output.`;
@@ -532,62 +624,40 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
                     budgetNote +
                     lifetimeNote);
             }
-            const detachChain = taskOpts.detachHub && taskOpts.taskRegistry && hasBackgroundShell(env) && env.backgroundCapabilities.supportsDetach === true
+            const detachHub = taskOpts.detachHub;
+            const detachRegistry = taskOpts.taskRegistry;
+            const detachEnv = hasBackgroundShell(env) ? env : undefined;
+            const detachChain = detachHub !== undefined && detachRegistry !== undefined && detachEnv !== undefined && detachEnv.backgroundCapabilities.supportsDetach === true
                 ? {
-                    signal: taskOpts.detachHub.signalFor(ctx.toolCallId),
+                    signal: detachHub.signalFor(ctx.toolCallId),
                     onDetached: async (shellId, stdoutSoFar, stderrSoFar, cause) => {
-                        const sessionScoped = taskOpts.sessionId !== undefined;
-                        const owner = sessionScoped ? taskOpts.sessionId : (ctx.taskId ?? taskOpts.taskOwner);
-                        const scope = ctx.principal ?? taskOpts.taskScope;
                         const onNotify = taskOpts.onTaskNotification;
-                        let outputFile;
-                        if (onNotify !== undefined) {
-                            const tf = await env.createTempFile({ prefix: "bash-task-", suffix: ".output" });
-                            if (tf.ok) {
-                                const tfCanon = await env.canonicalPath(tf.value);
-                                outputFile = tfCanon.ok ? tfCanon.value : tf.value;
-                            }
-                        }
-                        let taskId;
-                        try {
-                            taskId = taskOpts.taskRegistry.registerBackgroundBash({
-                                env: env,
-                                shellId: shellId,
-                                description: description ?? command,
-                                toolUseId: ctx.toolCallId,
-                                ...(owner !== undefined ? { owner } : {}),
-                                ...(scope !== undefined ? { scope } : {}),
-                                ...(sessionScoped ? { sessionScoped: true } : {}),
-                                ...(outputFile !== undefined ? { outputFile } : {}),
-                                ...(onNotify !== undefined ? { onTerminal: (n) => onNotify(n, { priority: "next" }) } : {}),
-                            });
-                        }
-                        catch (e) {
-                            const reason = e instanceof Error ? e.message : String(e);
-                            let kill;
-                            try {
-                                kill = await env.killBackground(shellId);
-                            }
-                            catch {
-                                kill = undefined;
-                            }
-                            const killed = kill !== undefined && (kill.ok || kill.error.code === "not_found");
+                        const adopted = await adoptBackgroundShell({
+                            env: detachEnv,
+                            shellId: shellId,
+                            registry: detachRegistry,
+                            description: description ?? command,
+                            toolUseId: ctx.toolCallId,
+                            ctxTaskId: ctx.taskId,
+                            ctxPrincipal: ctx.principal,
+                            wiring: { sessionId: taskOpts.sessionId, taskOwner: taskOpts.taskOwner, taskScope: taskOpts.taskScope, onNotify },
+                        });
+                        if (!adopted.ok) {
                             const outTail = stdoutSoFar.slice(-1_000);
                             const errTail = stderrSoFar.slice(-1_000);
                             const tails = (outTail ? `\n--- output so far (tail) ---\n${outTail}` : "") +
                                 (errTail ? `\n--- stderr so far (tail) ---\n${errTail}` : "");
-                            if (killed) {
+                            if (adopted.killed) {
                                 return {
-                                    content: `Error (Bash): command was detached to the background but could not be registered (${reason}); ` +
+                                    content: `Error (Bash): command was detached to the background but could not be registered (${adopted.reason}); ` +
                                         `it has been terminated (an unregistered background process would have no task_id and could not be read or stopped).` +
                                         tails,
                                     details: { type: "bash", detached: true, registerFailed: true },
                                     isError: true,
                                 };
                             }
-                            const killMsg = kill !== undefined && !kill.ok ? kill.error.message : "killBackground threw";
                             return {
-                                content: `Error (Bash): command was detached to the background but could not be registered (${reason}), and the cleanup kill failed (${killMsg}). ` +
+                                content: `Error (Bash): command was detached to the background but could not be registered (${adopted.reason}), and the cleanup kill failed (${adopted.killMsg}). ` +
                                     `The process could NOT be terminated — it may still be running, but it has no task_id, so TaskOutput/TaskStop cannot reach it. ` +
                                     `If it must be stopped, kill it manually (e.g. \`pkill -f\` on its command line).` +
                                     tails,
@@ -595,8 +665,9 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
                                 isError: true,
                             };
                         }
+                        const { taskId, outputFile } = adopted;
                         const tail = stdoutSoFar.slice(-1_000);
-                        const adoptCaps = env.backgroundCapabilities;
+                        const adoptCaps = detachEnv.backgroundCapabilities;
                         const adoptBudgetNote = typeof adoptCaps.defaultBgTimeoutSec === "number" && typeof adoptCaps.maxBgTimeoutSec === "number"
                             ? ` Time budget: auto-terminates if still running after ${Math.min(adoptCaps.defaultBgTimeoutSec, adoptCaps.maxBgTimeoutSec)}s (hard cap ${adoptCaps.maxBgTimeoutSec}s).`
                             : "";
@@ -615,6 +686,7 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
                                         ? `You will be notified when it completes — do not poll.`
                                         : `Poll TaskOutput until its status is no longer "running".`) +
                                 adoptBudgetNote +
+                                backgroundLifetimeNote(adoptCaps) +
                                 (tail ? `\n--- output so far (tail) ---\n${tail}` : ""),
                             details: { type: "bash", detached: true, task_id: taskId, ...(description !== undefined ? { description } : {}), ...(outputFile !== undefined ? { output_file: outputFile } : {}), ...(cause === "timeout" ? { autoBackgrounded: true } : {}) },
                         };
@@ -641,6 +713,234 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
         },
     });
 }
+const GLOB_METACHAR_RE = /[*?[]/;
+const MAX_GLOB_DIRS = 256;
+const MAX_GLOB_MATCHES = 8192;
+function compileGlobSegment(pattern) {
+    if (pattern.includes("\\"))
+        return undefined;
+    let src = "";
+    for (let i = 0; i < pattern.length; i++) {
+        const ch = pattern[i];
+        if (ch === "*") {
+            src += "[^/]*";
+        }
+        else if (ch === "?") {
+            src += "[^/]";
+        }
+        else if (ch === "[") {
+            const cls = parseBracketExpression(pattern, i);
+            if (cls === undefined)
+                src += "\\[";
+            else {
+                src += cls.source;
+                i = cls.end;
+            }
+        }
+        else {
+            src += ch.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        }
+    }
+    try {
+        return new RegExp(`^${src}$`, "s");
+    }
+    catch {
+        return undefined;
+    }
+}
+function parseBracketExpression(pattern, start) {
+    let i = start + 1;
+    let negate = false;
+    if (pattern[i] === "!" || pattern[i] === "^") {
+        negate = true;
+        i++;
+    }
+    const contentStart = i;
+    let body = "";
+    let anyChar = false;
+    for (; i < pattern.length; i++) {
+        const ch = pattern[i];
+        if (ch === "]" && i > contentStart) {
+            if (body.length === 0 && !anyChar)
+                return undefined;
+            return { source: anyChar ? "[^/]" : `[${negate ? "^" : ""}${body}]`, end: i };
+        }
+        if (ch === "[" && (pattern[i + 1] === ":" || pattern[i + 1] === "." || pattern[i + 1] === "=")) {
+            const close = pattern.indexOf(`${pattern[i + 1]}]`, i + 2);
+            if (close < 0)
+                return undefined;
+            anyChar = true;
+            i = close + 1;
+            continue;
+        }
+        body += ch === "-" ? "-" : ch.replace(/[\]\\^]/g, "\\$&");
+    }
+    return undefined;
+}
+function globSegmentMatches(re, pattern, name) {
+    if (name.startsWith(".") && !pattern.startsWith("."))
+        return false;
+    return re.test(name);
+}
+function joinCandidate(dir, name) {
+    return `${dir.replace(/[\\/]+$/, "")}/${name}`;
+}
+function pathSegmentsFrom(p, from) {
+    const segs = [];
+    let scan = from;
+    while (scan < p.length) {
+        while (scan < p.length && (p[scan] === "/" || p[scan] === "\\"))
+            scan++;
+        const s = scan;
+        while (scan < p.length && p[scan] !== "/" && p[scan] !== "\\")
+            scan++;
+        if (scan > s)
+            segs.push({ text: p.slice(s, scan), start: s });
+    }
+    return segs;
+}
+function createCanonicalReadBoundary(env, readRoots) {
+    const lexicalOnly = isRemoteExecutionEnv(env);
+    let rootsOnce;
+    const canonicalRoots = async (signal) => {
+        rootsOnce ??= (async () => {
+            const out = [];
+            for (const r of readRoots) {
+                const c = await env.canonicalPath(r, signal);
+                out.push(c.ok ? c.value : r);
+            }
+            return out;
+        })();
+        return await rootsOnce;
+    };
+    const resolve = async (p, signal) => {
+        const parts = p.split(/[\\/]/);
+        const tail = [];
+        while (parts.length > 0) {
+            const canon = await env.canonicalPath(parts.join("/") || "/", signal);
+            if (canon.ok) {
+                return [canon.value.replace(/[\\/]+$/, ""), ...[...tail].reverse()].join("/");
+            }
+            tail.push(parts.pop());
+        }
+        return undefined;
+    };
+    const literalRootHead = (p, roots) => {
+        let best;
+        for (const r of [...readRoots, ...roots]) {
+            if (!r)
+                continue;
+            const withSep = r.endsWith("/") || r.endsWith("\\") ? r : `${r}/`;
+            if (p !== r && !p.startsWith(withSep))
+                continue;
+            if (best === undefined || r.length > best.length)
+                best = r;
+        }
+        return best;
+    };
+    const expandGlobCandidate = async (p, roots, signal) => {
+        const head = literalRootHead(p, roots);
+        let segs = pathSegmentsFrom(p, head?.length ?? 0);
+        let first = segs.findIndex((s) => GLOB_METACHAR_RE.test(s.text));
+        if (first < 0 && head !== undefined && GLOB_METACHAR_RE.test(head)) {
+            segs = pathSegmentsFrom(p, 0);
+            first = segs.findIndex((s) => GLOB_METACHAR_RE.test(s.text));
+        }
+        if (first < 0)
+            return undefined;
+        let frontier = [p.slice(0, segs[first].start).replace(/[\\/]+$/, "") || "/"];
+        let dirsUsed = 0;
+        let matches = 0;
+        for (let j = first; j < segs.length; j++) {
+            const seg = segs[j].text;
+            if (!GLOB_METACHAR_RE.test(seg)) {
+                frontier = frontier.map((d) => joinCandidate(d, seg));
+                continue;
+            }
+            const re = compileGlobSegment(seg);
+            if (re === undefined) {
+                return { unverifiable: `the pattern "${seg}" cannot be expanded to verify what it would read` };
+            }
+            const isLast = j === segs.length - 1;
+            const next = [];
+            for (const dir of frontier) {
+                if (++dirsUsed > MAX_GLOB_DIRS) {
+                    return { unverifiable: `"${p}" expands over more than ${MAX_GLOB_DIRS} directories, too many to enumerate to verify` };
+                }
+                const listed = await env.listDir(dir, signal);
+                if (!listed.ok) {
+                    if (listed.error.code === "not_found" || listed.error.code === "not_directory")
+                        continue;
+                    return { unverifiable: `"${dir}" cannot be enumerated to verify what "${seg}" would expand to (${listed.error.code})` };
+                }
+                if (seg.startsWith(".")) {
+                    for (const dot of [".", ".."])
+                        if (re.test(dot))
+                            next.push(joinCandidate(dir, dot));
+                }
+                let dirInside = false;
+                if (isLast) {
+                    const canonDir = await resolve(dir, signal);
+                    if (canonDir !== undefined && !withinAnyRoot(roots, canonDir)) {
+                        next.push(canonDir);
+                        continue;
+                    }
+                    dirInside = canonDir !== undefined;
+                }
+                for (const entry of listed.value) {
+                    if (!globSegmentMatches(re, seg, entry.name))
+                        continue;
+                    if (++matches > MAX_GLOB_MATCHES) {
+                        return { unverifiable: `"${p}" expands to more than ${MAX_GLOB_MATCHES} names, too many to enumerate to verify` };
+                    }
+                    if (isLast && dirInside && entry.kind !== "symlink")
+                        continue;
+                    next.push(joinCandidate(dir, entry.name));
+                }
+            }
+            frontier = next;
+            if (frontier.length === 0)
+                return { paths: [] };
+        }
+        return { paths: frontier };
+    };
+    return {
+        escapesAfterResolution: async (paths, signal) => {
+            if (lexicalOnly || (paths.literal.length === 0 && paths.patterns.length === 0))
+                return { escaping: [] };
+            const roots = await canonicalRoots(signal);
+            const escaping = [];
+            const judge = async (p) => {
+                const real = await resolve(p, signal);
+                if (real === undefined)
+                    return;
+                if (!withinAnyRoot(roots, real) && !escaping.includes(real))
+                    escaping.push(real);
+            };
+            for (const p of paths.literal)
+                await judge(p);
+            for (const p of paths.patterns) {
+                const expanded = await expandGlobCandidate(p, roots, signal);
+                if (expanded !== undefined && "unverifiable" in expanded)
+                    return { escaping, unverifiable: expanded.unverifiable };
+                for (const t of expanded !== undefined && expanded.paths.length > 0 ? expanded.paths : [p])
+                    await judge(t);
+            }
+            return { escaping };
+        },
+        allResolveInside: async (paths, signal) => {
+            if (lexicalOnly || paths.length === 0)
+                return false;
+            const roots = await canonicalRoots(signal);
+            for (const p of paths) {
+                const real = await resolve(p, signal);
+                if (real === undefined || !withinAnyRoot(roots, real))
+                    return false;
+            }
+            return true;
+        },
+    };
+}
 export function createBashReadonlyTool(env, rootCanonical, allow, execClamp, opts) {
     const timeoutCaps = resolveBashTimeoutCaps(opts);
     const timeoutCapsSecView = bashTimeoutCapsSec(timeoutCaps);
@@ -659,14 +959,16 @@ export function createBashReadonlyTool(env, rootCanonical, allow, execClamp, opt
         }
         return true;
     };
+    const canonicalBoundary = createCanonicalReadBoundary(env, readRoots);
     return defineTool({
         name: "Bash",
         contract: { contractId: "core.bash_readonly@1", implementationRevision: "1" },
         description: `Run a SINGLE read-only inspection command (e.g. ${sample}, …) and return its output. Shell ` +
             "operators (pipes, redirects, ;, &&, command substitution, subshells) are rejected and only " +
             "allowlisted commands run. Reads are confined to the workspace root(s): a path outside them is " +
-            "refused, as is one that cannot be resolved statically (e.g. a `~` path). Still subject to the " +
-            "deployment's approval policy.",
+            "refused, as is one that cannot be resolved statically (e.g. a `~` path). " +
+            (isRemoteExecutionEnv(env) ? "" : "A path that leads outside via a symlink counts as outside, including one a glob pattern expands to. ") +
+            "Still subject to the deployment's approval policy.",
         parameters: Type.Object({
             command: Type.String({ description: "A single allowlisted read-only command (no shell operators)." }),
             timeout: Type.Optional(Type.Number({ description: `Timeout in milliseconds (default ${timeoutCaps.defaultMs}, max ${timeoutCaps.maxMs}; requests above the max are capped to it).` })),
@@ -678,8 +980,21 @@ export function createBashReadonlyTool(env, rootCanonical, allow, execClamp, opt
             if (reason)
                 return errorResult(`Error (Bash): ${reason}`);
             const boundary = classifySimpleCommandReadBoundary(command, { roots: readRoots, cwd: rootCanonical });
-            if (boundary.reason !== undefined && !(await readsOnlyEngineOverflowSpool(boundary))) {
-                return errorResult(`Error (Bash): ${boundary.reason}. bash_readonly is confined to the workspace roots; it has no approval path, so the call is refused rather than escalated.`, { code: "readonly_out_of_root", paths: boundary.outOfRootPaths ?? [] });
+            if (boundary.reason !== undefined) {
+                const rescued = boundary.outOfRootRead === true && (await canonicalBoundary.allResolveInside(boundary.outOfRootPaths ?? [], ctx.signal));
+                if (!rescued && !(await readsOnlyEngineOverflowSpool(boundary))) {
+                    return errorResult(`Error (Bash): ${boundary.reason}. bash_readonly is confined to the workspace roots; it has no approval path, so the call is refused rather than escalated.`, { code: "readonly_out_of_root", paths: boundary.outOfRootPaths ?? [] });
+                }
+            }
+            const resolved = await canonicalBoundary.escapesAfterResolution({ literal: boundary.checkedPaths ?? [], patterns: boundary.undecidedPaths ?? [] }, ctx.signal);
+            if (resolved.unverifiable !== undefined) {
+                return errorResult(`Error (Bash): ${resolved.unverifiable}, so this command cannot be confirmed to read only inside the allowed directories for this session: ${readRoots.join(", ")}. ` +
+                    "bash_readonly is confined to the workspace roots; it has no approval path, so the call is refused rather than escalated.", { code: "readonly_out_of_root", paths: [] });
+            }
+            if (resolved.escaping.length > 0) {
+                const quoted = resolved.escaping.map((p) => `"${p}"`).join(", ");
+                return errorResult(`Error (Bash): a path this command reads resolves through a symlink to ${quoted}, outside the allowed directories for this session: ${readRoots.join(", ")} — not auto-allowed. ` +
+                    "bash_readonly is confined to the workspace roots; it has no approval path, so the call is refused rather than escalated.", { code: "readonly_out_of_root", paths: resolved.escaping });
             }
             return await runShell(env, rootCanonical, "Bash", command, msTimeoutToRequestedSec(timeout), timeoutCapsSecView, ctx.signal, undefined, undefined, execClamp, ctx.toolCallId, true);
         },
@@ -715,8 +1030,9 @@ export function createEnvTaskOutputTool(env) {
                 return errorResult(`Error (TaskOutput): ${r.error.message}`);
             const shape = (text) => clipShellOutput(rx ? text.split(/\r?\n/).filter((l) => rx.test(l)).join("\n") : text);
             const status = r.value.status === "exited" ? `exited(code ${r.value.exitCode})` : r.value.status;
-            const dropped = r.value.bytesDroppedBeforeCursor ?? 0;
-            const droppedNote = dropped > 0 ? `[!] ${dropped} earlier byte(s) permanently dropped before this window (8MB buffer evicted)\n` : "";
+            const dropAcct = {};
+            accountDroppedBytes(dropAcct, r.value);
+            const droppedNote = spoolDropNote(dropAcct);
             const body = `status: ${status}\n${droppedNote}--- new stdout ---\n${shape(r.value.stdout) || "(none)"}\n` +
                 `--- new stderr ---\n${shape(r.value.stderr) || "(none)"}`;
             return delimitUntrusted(`TaskOutput ${id}`, body);

package/dist/tools/fs/fs-pdf.d.ts

@@ -1,21 +1,11 @@
 import { errorResult } from "../../core/tools.js";
+import type { DocumentContent, ImageContent, TextContent } from "../../internal/llm.js";
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { type PdfModelCapabilities } from "./pdf.js";
 import { type ReadImageDownsamplerOption } from "./fs-shared.js";
 export { pdfModelCapabilitiesOf, type PdfModelCapabilities } from "./pdf.js";
 type ReadPdfReturn = string | {
-    content: Array<{
-        type: "text";
-        text: string;
-    } | {
-        type: "image";
-        data: string;
-        mimeType: string;
-    } | {
-        type: "document";
-        data: string;
-        mimeType: string;
-    }>;
+    content: Array<TextContent | ImageContent | DocumentContent>;
     details: unknown;
 };
 export declare function readPdfFile(env: ExecutionEnv, path: string, key: string, pages: string | undefined, signal: AbortSignal | undefined, downsamplerOpt: ReadImageDownsamplerOption, cwd: string, preRead?: Uint8Array, caps?: PdfModelCapabilities): Promise<ReadPdfReturn>;

package/dist/tools/fs/fs-shared.js

@@ -1,6 +1,6 @@
 import { Type } from "typebox";
 import { clipWithFilePointer } from "../../core/tool-errors.js";
-import { sha256, similarNameSuggestion, OVERSIZE_READ_ESCAPE_HINT, PARTIAL_VIEW_READ_ESCAPE_HINT, } from "./safety.js";
+import { normalizeAbsPathLexically, sha256, similarNameSuggestion, OVERSIZE_READ_ESCAPE_HINT, PARTIAL_VIEW_READ_ESCAPE_HINT, } from "./safety.js";
 import { decodeTextBytes, normalizeFileText } from "./encoding.js";
 import { shellQuote } from "./search.js";
 import { isNotebookPath } from "./notebook.js";
@@ -117,7 +117,7 @@ export function createShellOverflowSpoolFence(env) {
         return cut > 0 ? resolved.slice(0, cut) : undefined;
     };
     return async (path) => {
-        const target = toPosixPathKey(path);
+        const target = normalizeAbsPathLexically(toPosixPathKey(path));
         const cut = target.lastIndexOf("/");
         if (cut <= 0 || !isShellOverflowFileName(target.slice(cut + 1)))
             return false;