@sema-agent/core 5.18.0 → 5.19.0

package/dist/core/tool-policy.js

@@ -1,10 +1,14 @@
 import { homedir } from "node:os";
-import { isAbsolute, join, normalize as normalizePath, sep } from "node:path";
+import { join, normalize as normalizePath, posix as posixPath, sep, win32 as winPath } from "node:path";
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
 import { boundInputHashOf } from "./canonical-json.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { parsePermissionRule } from "./permission-rules.js";
-import { writeTargetPath } from "../tools/fs/safety.js";
+import { isAbsolutePathForm, isWinFormPath, writeTargetPath } from "../tools/fs/safety.js";
+export const APPROVAL_SETTLED_BY_VALUES = ["human", "timeout", "aborted"];
+export function isApprovalSettledBy(v) {
+    return typeof v === "string" && APPROVAL_SETTLED_BY_VALUES.includes(v);
+}
 export function decisionText(d) {
     return d.message;
 }
@@ -19,6 +23,7 @@ export function refuseOutOfContractDecision(d) {
         return d;
     return { action: "deny", message: RETIRED_TEXT_FIELD_DENY_MESSAGE, decisionReason: "rule" };
 }
+const DEADLINE_ELAPSED = Symbol("approval.deadline_elapsed");
 function withTimeout(p, ms, onTimeout) {
     if (ms === undefined) {
         return p;
@@ -51,6 +56,18 @@ export function createAllowDenyPolicy(opts) {
             return undefined;
         const kept = [];
         for (const entry of entries) {
+            if (entry.startsWith("mcp__")) {
+                const segments = entry.slice("mcp__".length).split("__");
+                if (segments.some((seg) => seg.length === 0)) {
+                    invalid.push({
+                        entry,
+                        list,
+                        message: `"${entry}" is a malformed MCP tool name (empty segment) — it can never match any mounted tool. ` +
+                            `Use \`mcp__<server>\` for every tool of a server, or \`mcp__<server>__<tool>\` for one tool.`,
+                    });
+                    continue;
+                }
+            }
             if (parsePermissionRule(entry).ruleContent === undefined) {
                 kept.push(entry);
                 continue;
@@ -118,25 +135,37 @@ export function createApprovalPolicy(opts) {
             }
             if (need.has(toolName)) {
                 if (signal?.aborted) {
-                    return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)` };
+                    return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, settledBy: "aborted" };
                 }
                 let ok;
                 try {
-                    ok = await withTimeout(Promise.resolve(opts.approve(req, signal)), opts.approvalTimeoutMs, () => false);
+                    ok = await withTimeout(Promise.resolve(opts.approve(req, signal)), opts.approvalTimeoutMs, () => DEADLINE_ELAPSED);
                 }
                 catch (err) {
                     return {
                         action: "deny",
                         message: `approval errored for "${req.toolName}": ${describeThrown(err)}`,
+                        settledBy: "aborted",
+                    };
+                }
+                if (ok === DEADLINE_ELAPSED) {
+                    return {
+                        action: "deny",
+                        message: `no one answered the approval request for "${req.toolName}" — the approval window elapsed ` +
+                            `(${opts.approvalTimeoutMs}ms) with no answer; denied fail-closed`,
+                        settledBy: "timeout",
                     };
                 }
+                if (signal?.aborted) {
+                    return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, settledBy: "aborted" };
+                }
                 const okRaw = ok;
                 if (okRaw === true)
-                    return ALLOW;
+                    return { action: "allow", settledBy: "human" };
                 if (okRaw !== false) {
-                    return { action: "deny", message: `approval callback for "${req.toolName}" returned an out-of-contract value (${typeof ok}) — denied fail-closed (this policy's \`approve\` returns a boolean: return true or false)` };
+                    return { action: "deny", message: `approval callback for "${req.toolName}" returned an out-of-contract value (${typeof ok}) — denied fail-closed (this policy's \`approve\` returns a boolean: return true or false)`, settledBy: "aborted" };
                 }
-                return { action: "deny", message: `approval denied for "${req.toolName}"` };
+                return { action: "deny", message: `approval denied for "${req.toolName}"`, settledBy: "human" };
             }
             if (opts.denyByDefault && !auto.has(toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" requires explicit allow` };
@@ -153,6 +182,7 @@ export function combinePolicies(...policies) {
             let asked;
             let current = req;
             let rewrite;
+            let settled;
             for (const p of policies) {
                 const d = refuseOutOfContractDecision(await p.check(current, signal));
                 if (d.action === "deny") {
@@ -162,6 +192,11 @@ export function combinePolicies(...policies) {
                     current = { ...current, args: d.updatedInput };
                     rewrite = d;
                 }
+                if (d.action === "allow") {
+                    const supplied = d.settledBy;
+                    if (supplied !== undefined)
+                        settled = supplied;
+                }
                 if (d.action === "ask" && (asked === undefined || (d.requiresRealApproval === true && asked.requiresRealApproval !== true))) {
                     asked = d;
                 }
@@ -170,7 +205,8 @@ export function combinePolicies(...policies) {
                 const merged = rewrite?.updatedInput;
                 return merged !== undefined ? { ...asked, updatedInput: merged } : asked;
             }
-            return rewrite ?? ALLOW;
+            const allowed = rewrite ?? ALLOW;
+            return settled !== undefined ? { ...allowed, settledBy: settled } : allowed;
         },
     };
 }
@@ -490,13 +526,16 @@ export function createTranscriptIntegrityPolicy(opts) {
     const readAllow = new Set(opts?.readAllow ?? BASH_READONLY_DEFAULT_ALLOW);
     const shellTools = canonicalToolNameSet(opts?.tools);
     const dirSegs = dirs.map((d) => pathSegments(d).map(foldPathCase));
-    const inProtectedDir = (p) => {
-        const abs = lexicalPath(p, home);
+    const inProtectedDir = (p, liveCwd) => {
+        const rawRelative = !isAbsolutePathForm(p);
+        const joinInFamily = (base, rel) => isWinFormPath(base) ? winPath.join(base, rel) : posixPath.join(base, rel);
+        const abs = liveCwd !== undefined && rawRelative ? lexicalPath(joinInFamily(liveCwd, p), home) : lexicalPath(p, home);
         const segs = pathSegments(abs).map(foldPathCase);
-        if (isAbsolute(abs)) {
-            return dirSegs.some((d) => d.length <= segs.length && d.every((s, i) => s === segs[i]));
-        }
-        return dirSegs.some((d) => relativeContinuesDirTail(segs, d));
+        if (isAbsolutePathForm(abs) && dirSegs.some((d) => d.length <= segs.length && d.every((s, i) => s === segs[i])))
+            return true;
+        if (!rawRelative)
+            return false;
+        return dirSegs.some((d) => relativeContinuesDirTail(pathSegments(lexicalPath(p, home)).map(foldPathCase), d));
     };
     const referencesProtectedDir = (cmd) => {
         const hay = foldPathCase(cmd);
@@ -535,18 +574,21 @@ export function createTranscriptIntegrityPolicy(opts) {
                 if (typeof command !== "string")
                     return ALLOW;
                 const cmd = command.normalize("NFC");
-                if (!referencesProtectedDir(cmd))
+                const cwdInsideProtected = req.cwd !== undefined && inProtectedDir(req.cwd);
+                if (!referencesProtectedDir(cmd) && !cwdInsideProtected)
                     return ALLOW;
                 const parsed = parseLeadingCommandName(command);
                 if ("name" in parsed && readAllow.has(parsed.name))
                     return ALLOW;
                 return askReason("name" in parsed
-                    ? `\`${parsed.name}\` is not a read-only command`
-                    : "the command references the transcript directory and is not a single read-only command (fail-closed)");
+                    ? `\`${parsed.name}\` is not a read-only command${cwdInsideProtected ? " and the shell's working directory is inside the transcript directory" : ""}`
+                    : cwdInsideProtected
+                        ? "the shell's working directory is inside the transcript directory and this is not a single read-only command (fail-closed)"
+                        : "the command references the transcript directory and is not a single read-only command (fail-closed)");
             }
             if (toolName === "Write" || toolName === "Edit" || toolName === "NotebookEdit") {
                 const p = writeTargetPath(toolName, req.args);
-                if (typeof p === "string" && inProtectedDir(p)) {
+                if (typeof p === "string" && inProtectedDir(p, req.cwd)) {
                     return askReason(`"${p}" is inside the session-transcript directory`);
                 }
             }
@@ -643,7 +685,7 @@ export async function resolveAsk(req, onAsk, signal) {
         };
     }
     if (signal?.aborted) {
-        return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, decisionReason: "mode" };
+        return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, decisionReason: "mode", settledBy: "aborted" };
     }
     const presented = tryCloneArgs(req.args);
     if (!presented.ok) {
@@ -651,6 +693,7 @@ export async function resolveAsk(req, onAsk, signal) {
             action: "deny",
             message: `approval for "${req.toolName}" could not present the args safely (unclonable value: ${presented.reason}) — denied fail-closed`,
             decisionReason: "mode",
+            settledBy: "aborted",
         };
     }
     let ok;
@@ -661,6 +704,7 @@ export async function resolveAsk(req, onAsk, signal) {
                 action: "deny",
                 message: `approval for "${req.toolName}" could not present the args safely (unclonable value: ${approverView.reason}) — denied fail-closed`,
                 decisionReason: "mode",
+                settledBy: "aborted",
             };
         }
         ok = await onAsk({ ...req, boundInputHash: boundInputHashOf(presented.value), args: approverView.value }, signal);
@@ -670,42 +714,49 @@ export async function resolveAsk(req, onAsk, signal) {
             action: "deny",
             message: `approval errored for "${req.toolName}": ${describeThrown(err)}`,
             decisionReason: "mode",
+            settledBy: "aborted",
         };
     }
+    if (signal?.aborted) {
+        return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, decisionReason: "mode", settledBy: "aborted" };
+    }
     if (ok === "unavailable") {
         return {
             action: "deny",
             message: `approval required for "${req.toolName}" but the approver reported unavailable (no reachable ` +
                 `operator for this ask) and no durable approval gate is armed — denied fail-closed: ${req.message}`,
             decisionReason: "mode",
+            settledBy: "aborted",
             approverUnavailable: true,
         };
     }
     if (typeof ok === "object" && ok !== null) {
         if (ok.allow !== true) {
-            return { action: "deny", message: `approval denied for "${req.toolName}": ${req.message}`, decisionReason: "mode" };
+            return { action: "deny", message: `approval denied for "${req.toolName}": ${req.message}`, decisionReason: "mode", settledBy: "human" };
         }
         if (ok.updatedInput === undefined)
-            return { action: "allow", decisionReason: "mode", presentedInput: presented.value };
+            return { action: "allow", decisionReason: "mode", presentedInput: presented.value, settledBy: "human" };
         const edit = tryCloneArgs(ok.updatedInput);
         if (!edit.ok) {
             return {
                 action: "deny",
                 message: `the approved edit for "${req.toolName}" is not safely clonable (${edit.reason}) — denied fail-closed`,
                 decisionReason: "mode",
+                settledBy: "aborted",
             };
         }
-        return { action: "allow", updatedInput: edit.value, decisionReason: "mode" };
+        return { action: "allow", updatedInput: edit.value, decisionReason: "mode", settledBy: "human" };
     }
     const okRaw = ok;
     if (okRaw === true)
-        return { action: "allow", decisionReason: "mode", presentedInput: presented.value };
+        return { action: "allow", decisionReason: "mode", presentedInput: presented.value, settledBy: "human" };
     if (okRaw !== false) {
         return {
             action: "deny",
             message: `the approver for "${req.toolName}" returned an out-of-contract value (${typeof ok}) — denied fail-closed (return true, false, "unavailable", or the {allow} object)`,
             decisionReason: "mode",
+            settledBy: "aborted",
         };
     }
-    return { action: "deny", message: `approval denied for "${req.toolName}": ${req.message}`, decisionReason: "mode" };
+    return { action: "deny", message: `approval denied for "${req.toolName}": ${req.message}`, decisionReason: "mode", settledBy: "human" };
 }

package/dist/core/types.d.ts

@@ -568,6 +568,7 @@ export type TaskEvent = ({
     output?: unknown;
     structured?: unknown;
     errorCode?: string;
+    settledBy?: import("./tool-policy.js").ApprovalSettledBy;
     truncated?: boolean;
     totalChars?: number;
 } & TaskEventIdentity) | ({

package/dist/index.d.ts

@@ -122,14 +122,14 @@ export type { SchedulerCapability, SchedulerErrorCode, ScheduledIntent, Schedule
 export { createSchedulerTools, type SchedulerToolContext, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTINEL, AUTONOMOUS_LOOP_DYNAMIC_SENTINEL, } from "./tools/scheduler-tools.js";
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, type AutonomousLoopPromptOptions, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
-export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, } from "./core/tool-policy.js";
+export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, type ApprovalSettledBy, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, } from "./core/tool-policy.js";
 export { parseAutoModeResponse, createAutoModeDecider, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassifyFn, type AutoModeClassifyInput, } from "./core/auto-mode.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, type AutoModeRules, type BuildAutoModePromptOptions, type AutoModeWindowOptions, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, type PermissionRule, type ParsedPermissionRule, type PermissionRuleIssue, type PermissionRuleCaps, type PermissionRulePolicyOptions, } from "./core/permission-rules.js";
 export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleSuggestion, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, type PermissionRuleStore, type PermissionRuleStoreProvider, type StoredAllowRules, type RemoveResult, type PutResult, } from "./core/permission-rule-store.js";
-export { prepareCardApproval, confirmRuleApproval, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, type RuleTicket, type RuleCandidate, type RuleApprovalKind, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleConsentDeps, type RedeemResult, type CcImportLayer, type ImportedSettingsLayer, type ImportPreview, type ImportResult, } from "./core/permission-rule-consent.js";
+export { prepareCardApproval, confirmRuleApproval, type ConfirmResult, type ConfirmRefusalReason, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, type RuleTicket, type RuleCandidate, type RuleApprovalKind, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleConsentDeps, type RedeemResult, type CcImportLayer, type ImportedSettingsLayer, type ImportPreview, type ImportResult, } from "./core/permission-rule-consent.js";
 export { FilePermissionRuleStoreProvider } from "./stores/file/permission-rule-store.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, type Hooks, type HookToolContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, } from "./core/memory.js";

package/dist/index.js

@@ -107,7 +107,7 @@ export { hasScheduler, isValidCronExpr, SchedulerError } from "./core/scheduler.
 export { createSchedulerTools, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTINEL, AUTONOMOUS_LOOP_DYNAMIC_SENTINEL, } from "./tools/scheduler-tools.js";
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
-export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, } from "./core/tool-policy.js";
+export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, } from "./core/tool-policy.js";
 export { parseAutoModeResponse, createAutoModeDecider, } from "./core/auto-mode.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";

package/dist/orchestration/run-spec.js

@@ -26,7 +26,7 @@ function frozenDenyPolicy(rootDir, frozenResolved) {
             if (typeof raw !== "string" || raw.length === 0)
                 return { action: "allow" };
             const absForm = isAbsolutePathForm(raw);
-            const abs = pathKey(absForm ? raw : resolve(rootDir, raw));
+            const abs = pathKey(absForm ? raw : resolve(req.cwd || rootDir, raw));
             if (frozen.has(abs)) {
                 return { action: "deny", message: `${raw} is part of the frozen specification surface (read-only).` };
             }

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -1,11 +1,14 @@
 export declare const NOT_AUTO_ALLOWED = "\u2014 not auto-allowed";
 export declare const BASH_READONLY_DEFAULT_ALLOW: readonly string[];
-export declare function parseLeadingCommandName(command: string): {
+export interface LeadingCommandNameOptions {
+    quotedOperatorsAreText?: boolean;
+}
+export declare function parseLeadingCommandName(command: string, options?: LeadingCommandNameOptions): {
     name: string;
 } | {
     reject: string;
 };
-export declare function coarseReadonlyCheck(command: string, allow: ReadonlySet<string>): string | undefined;
+export declare function coarseReadonlyCheck(command: string, allow: ReadonlySet<string>, options?: LeadingCommandNameOptions): string | undefined;
 export interface BashReadonlyRootBoundary {
     roots: readonly string[];
     cwd?: string;

package/dist/tools/fs/bash-readonly-classifier.js

@@ -5,11 +5,41 @@ export const BASH_READONLY_DEFAULT_ALLOW = [
     "grep", "cut", "tr", "basename", "dirname", "stat", "du", "df", "which",
 ];
 const SHELL_OPERATORS = /[;&|<>$()`\n\r\\]/;
-export function parseLeadingCommandName(command) {
+function quoteMask(s) {
+    const quoted = new Array(s.length).fill(false);
+    let open;
+    for (let i = 0; i < s.length; i++) {
+        const ch = s[i];
+        if (open === undefined && (ch === '"' || ch === "'")) {
+            open = ch;
+            quoted[i] = true;
+            continue;
+        }
+        if (open !== undefined) {
+            quoted[i] = true;
+            if (open === ch)
+                open = undefined;
+        }
+    }
+    return { quoted, balanced: open === undefined };
+}
+function hasBareShellOperator(s, quotedOperatorsAreText) {
+    if (!quotedOperatorsAreText)
+        return SHELL_OPERATORS.test(s);
+    const mask = quoteMask(s);
+    if (!mask.balanced)
+        return SHELL_OPERATORS.test(s);
+    for (let i = 0; i < s.length; i++) {
+        if (!mask.quoted[i] && SHELL_OPERATORS.test(s[i]))
+            return true;
+    }
+    return false;
+}
+export function parseLeadingCommandName(command, options) {
     const trimmed = command.trim();
     if (!trimmed)
         return { reject: "empty command" };
-    if (SHELL_OPERATORS.test(trimmed)) {
+    if (hasBareShellOperator(trimmed, options?.quotedOperatorsAreText === true)) {
         return {
             reject: "shell operators (pipes, redirects, ;, &&, command substitution, subshells, variable expansion) are not allowed — run a single simple command",
         };
@@ -23,8 +53,8 @@ export function parseLeadingCommandName(command) {
         return { reject: "the command name must be a bare token (no quotes, braces, globs, or ~)" };
     return { name: first };
 }
-export function coarseReadonlyCheck(command, allow) {
-    const parsed = parseLeadingCommandName(command);
+export function coarseReadonlyCheck(command, allow, options) {
+    const parsed = parseLeadingCommandName(command, options);
     if ("reject" in parsed)
         return parsed.reject;
     if (!allow.has(parsed.name))
@@ -32,6 +62,35 @@ export function coarseReadonlyCheck(command, allow) {
     return undefined;
 }
 const SHELL_SEGMENT_HARD_REJECT = /[<>$()`\n\r\\]/;
+const EXEMPT_REDIRECTION = /^(?:2>\/dev\/null|[12]?>&[12])$/;
+function stripExemptRedirections(command) {
+    if (!command.includes(">"))
+        return command;
+    const mask = quoteMask(command);
+    if (!mask.balanced)
+        return command;
+    let out = "";
+    let word = "";
+    let wordQuoted = false;
+    const flush = () => {
+        out += wordQuoted || !EXEMPT_REDIRECTION.test(word) ? word : "";
+        word = "";
+        wordQuoted = false;
+    };
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        if (!mask.quoted[i] && (ch === " " || ch === "\t")) {
+            flush();
+            out += ch;
+            continue;
+        }
+        if (mask.quoted[i])
+            wordQuoted = true;
+        word += ch;
+    }
+    flush();
+    return out;
+}
 function foldQuoteRemovalToken(tok) {
     if (!tok.includes('"') && !tok.includes("'"))
         return tok;
@@ -77,12 +136,30 @@ function resolveOperandLexically(base, operand, homeDir) {
     return normalizeAbsPathLexically(`${base.replace(/[/\\]+$/, "")}/${raw}`);
 }
 function tokenizeSegment(segment) {
-    const raw = segment
-        .trim()
-        .split(/\s+/)
-        .filter((t) => t.length > 0);
+    const raw = splitWordsQuoteAware(segment);
     return { folded: raw.map(foldQuoteRemovalToken), raw };
 }
+function splitWordsQuoteAware(segment) {
+    const s = segment.trim();
+    const mask = quoteMask(s);
+    if (!mask.balanced)
+        return s.split(/\s+/).filter((t) => t.length > 0);
+    const out = [];
+    let cur = "";
+    for (let i = 0; i < s.length; i++) {
+        const ch = s[i];
+        if (!mask.quoted[i] && /\s/.test(ch)) {
+            if (cur.length > 0)
+                out.push(cur);
+            cur = "";
+            continue;
+        }
+        cur += ch;
+    }
+    if (cur.length > 0)
+        out.push(cur);
+    return out;
+}
 function hasUnquotedExpansionMetachar(rawToken) {
     let open;
     for (const ch of rawToken) {
@@ -147,6 +224,26 @@ function isCutDelimiterPayloadLongOption(tok) {
     const name = longOptionNameOf(tok);
     return name !== undefined && (isLongOptionAbbrevOf(name, "delimiter") || isLongOptionAbbrevOf(name, "output-delimiter"));
 }
+function isGrepClusterFileStdin(tok) {
+    if (tok.startsWith("--") || !/^-[A-Za-z0-9]/.test(tok))
+        return false;
+    for (let i = 1; i < tok.length; i++) {
+        const ch = tok[i];
+        if (ch === "e")
+            return false;
+        if (ch === "f")
+            return tok.slice(i + 1) === "-";
+        if (!/[A-Za-z0-9]/.test(ch))
+            return false;
+    }
+    return false;
+}
+function isCutSeparatedDelimiterOption(tok) {
+    if (tok.includes("="))
+        return false;
+    const name = longOptionNameOf(tok);
+    return name !== undefined && (isLongOptionAbbrevOf(name, "delimiter") || isLongOptionAbbrevOf(name, "output-delimiter"));
+}
 function isGrepFileStdinLongOption(tok) {
     const eq = tok.indexOf("=");
     if (eq < 0 || tok.slice(eq + 1) !== "-")
@@ -285,16 +382,22 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
     const trimmed = command.trim();
     if (!trimmed)
         return { reason: "empty command" };
-    if (SHELL_SEGMENT_HARD_REJECT.test(trimmed)) {
+    const redirectionStripped = stripExemptRedirections(trimmed);
+    if (SHELL_SEGMENT_HARD_REJECT.test(redirectionStripped)) {
         return { reason: "redirection, command/variable substitution, subshells, escapes, and line breaks are not allowed" };
     }
-    const source = trimmed.endsWith(";") ? trimmed.slice(0, -1) : trimmed;
+    const source = redirectionStripped.endsWith(";") ? redirectionStripped.slice(0, -1) : redirectionStripped;
     const segments = [];
     const pipeFed = [false];
+    const mask = quoteMask(source);
+    const quoted = (i) => mask.balanced && mask.quoted[i] === true;
     let cur = "";
     for (let i = 0; i < source.length; i++) {
         const c = source[i];
-        if (c === "&") {
+        if (quoted(i)) {
+            cur += c;
+        }
+        else if (c === "&") {
             if (source[i + 1] === "&") {
                 segments.push(cur);
                 cur = "";
@@ -327,7 +430,7 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
     }
     segments.push(cur);
     for (const segment of segments) {
-        const reason = coarseReadonlyCheck(segment, allow);
+        const reason = coarseReadonlyCheck(segment, allow, { quotedOperatorsAreText: true });
         if (reason !== undefined)
             return { reason };
     }
@@ -368,21 +471,21 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
             continue;
         foldedSegments.push(segmentTokens);
         const name = toks[0];
-        const nonOption = toks.slice(1).filter((t) => !t.startsWith("-"));
         if (!(pipeFed[si] ?? false)) {
             const floor = STDIN_FILE_FLOOR[name];
             const restArgs = toks.slice(1);
             const grepPatternSuppliedByFlag = name === "grep" && restArgs.some(isGrepPatternFlagToken);
             let sawNonFlagOperand = false;
             let hasStdinDash = false;
+            let operandCount = 0;
             if (name !== "tr") {
                 for (let k = 0; k < restArgs.length; k++) {
                     const t = restArgs[k];
-                    if (name === "cut" && (t === "-d" || t === "--delimiter")) {
+                    if (name === "cut" && (t === "-d" || isCutSeparatedDelimiterOption(t))) {
                         k++;
                         continue;
                     }
-                    if (name === "grep" && (t === "-f-" || isGrepFileStdinLongOption(t))) {
+                    if (name === "grep" && (isGrepClusterFileStdin(t) || isGrepFileStdinLongOption(t))) {
                         hasStdinDash = true;
                         break;
                     }
@@ -390,6 +493,7 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
                         continue;
                     const isGrepPatternPosition = name === "grep" && !grepPatternSuppliedByFlag && !sawNonFlagOperand;
                     sawNonFlagOperand = true;
+                    operandCount++;
                     if (isGrepPatternPosition)
                         continue;
                     if (t === "-") {
@@ -401,7 +505,7 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
             if (floor !== undefined && hasStdinDash) {
                 return { reason: `"${name}" reads stdin via an explicit "-" argument and would block until the tool timeout ${NOT_AUTO_ALLOWED}` };
             }
-            if (floor !== undefined && nonOption.length < floor) {
+            if (floor !== undefined && operandCount < floor) {
                 return { reason: `"${name}" with no file argument reads stdin and would block until the tool timeout ${NOT_AUTO_ALLOWED}` };
             }
         }
@@ -409,7 +513,15 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
             return { reason: "`tail` in follow mode never terminates " + NOT_AUTO_ALLOWED };
         }
         const GENERATOR_DEVICES = new Set(["/dev/zero", "/dev/random", "/dev/urandom", "/dev/full"]);
-        const deviceArgs = toks.slice(1).filter((t) => !t.startsWith("-")).map(normalizeAbsPathLexically).filter(isBlockedDevicePath);
+        const deviceCandidates = [];
+        for (const t of toks.slice(1)) {
+            if (t.startsWith("-") && t !== "-") {
+                deviceCandidates.push(...attachedOptionPayloads(t));
+                continue;
+            }
+            deviceCandidates.push(t);
+        }
+        const deviceArgs = deviceCandidates.map(normalizeAbsPathLexically).filter(isBlockedDevicePath);
         const rescuedByHead = headBoundIsSmall(name, toks) && deviceArgs.every((d) => GENERATOR_DEVICES.has(d));
         if (!rescuedByHead && deviceArgs.length > 0) {
             return { reason: "reads a device/special file that is either unbounded (/dev/zero, /dev/stdin, /proc/<pid>/fd/0, … — blocks the pipeline until the tool timeout) or process-private (/proc/<pid>/environ, /proc/<pid>/mem, …) " + NOT_AUTO_ALLOWED };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.18.0",
+  "version": "5.19.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",