@sema-agent/core 7.17.0 → 7.17.1

package/dist/tools/fs/fs-bash.js

@@ -11,7 +11,7 @@ import { isRemoteExecutionEnv, hasDestroy, isIsolated } from "../../core/remote-
 import { ghRateLimitHint } from "./gh-rate-limit.js";
 import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, createShellOverflowSpoolFence, shellRecoveryHint, CWD_SENTINEL, BASH_READONLY_CONFINEMENT_NOTE, } from "./fs-shared.js";
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted } from "../../core/untrusted-text.js";
-import { BASH_CLASSIFY_DEFAULT_ALLOW, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed, classifyOutOfRootReadGate, classifySimpleCommandReadBoundary, NOT_AUTO_ALLOWED, } from "./bash-readonly-classifier.js";
+import { BASH_CLASSIFY_DEFAULT_ALLOW, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed, classifyOutOfRootReadGate, refusedCommandMayRead, classifySimpleCommandReadBoundary, NOT_AUTO_ALLOWED, } from "./bash-readonly-classifier.js";
 import { toolFace } from "../../core/tool-catalog-entries.js";
 const RECURSIVE_CAUSE_MAX_PATHS = 3;
 const RECURSIVE_READ_CAUSE_CODE = "shell.recursive_read_unbounded";
@@ -47,13 +47,16 @@ export function bashReversibilityProbe(allow, boundary) {
         const loop = classifyBoundedReadonlyPollLoopDetailed(command, allowSet, resolved);
         if (loop.reason === undefined)
             return { reversible: true };
-        if (boundaryDeclared(loop))
+        if (boundaryDeclared(loop) || unjudgedRead(command, allowSet, resolved, loop))
             return { reversible: false, mandated: true };
         return { reversible: false, ...boundaryGate(detailed) };
     };
 }
 function boundaryUnread(verdict) {
-    return (verdict.undecidedPaths !== undefined && verdict.undecidedPaths.length > 0) || (verdict.unresolvedOperands !== undefined && verdict.unresolvedOperands.length > 0);
+    return boundaryUndecided(verdict) || boundaryUnjudged(verdict);
+}
+function boundaryUndecided(verdict) {
+    return verdict.undecidedPaths !== undefined && verdict.undecidedPaths.length > 0;
 }
 function boundaryDeclared(verdict) {
     return denyJudgeSpoke(verdict) || verdict.outOfRootRead === true;
@@ -69,9 +72,23 @@ function isBackgroundShellCall(args) {
     return args?.run_in_background === true;
 }
 function readBoundaryMandate(command, allowSet, resolved, verdict) {
-    if (denyJudgeSpoke(verdict))
+    if (resolved === undefined)
+        return {};
+    if (denyJudgeSpoke(verdict) || unjudgedRead(command, allowSet, resolved, verdict))
         return { mandated: true };
-    return resolved !== undefined && classifyOutOfRootReadGate(command, allowSet, resolved).gated ? { mandated: true } : {};
+    return classifyOutOfRootReadGate(command, allowSet, resolved).gated ? { mandated: true } : {};
+}
+function boundaryUnjudged(verdict) {
+    return verdict.refusedWhole === true || (verdict.unresolvedOperands !== undefined && verdict.unresolvedOperands.length > 0);
+}
+function unjudgedRead(command, allowSet, resolved, verdict) {
+    if (verdict.unresolvedOperands !== undefined && verdict.unresolvedOperands.length > 0)
+        return true;
+    if (verdict.refusedWhole !== true)
+        return false;
+    if (refusedCommandMayRead(command, allowSet))
+        return true;
+    return resolved !== undefined && classifyOutOfRootReadGate(command, allowSet, resolved).gated;
 }
 function recursiveReadCause(detailed) {
     const recursive = detailed.recursiveReadPaths;
@@ -94,23 +111,31 @@ export function bashReadBoundaryProbe(boundary) {
         const resolved = typeof boundary === "function" ? boundary() : boundary;
         if (resolved === undefined)
             return { reversible: true };
+        const seatVerdict = (verdict) => {
+            if (boundaryDeclared(verdict) || unjudgedRead(command, allowSet, resolved, verdict)) {
+                const cause = recursiveReadCause(verdict);
+                return { reversible: false, mandated: true, ...(cause !== undefined ? { cause } : {}) };
+            }
+            if (boundaryUndecided(verdict))
+                return { reversible: false };
+            if (verdict.reason === undefined)
+                return { reversible: true };
+            return undefined;
+        };
         const detailed = classifyCompoundReadonlyDetailed(command, allowSet, resolved);
-        if (boundaryDeclared(detailed)) {
-            const cause = recursiveReadCause(detailed);
-            return { reversible: false, mandated: true, ...(cause !== undefined ? { cause } : {}) };
-        }
-        if (boundaryUnread(detailed))
-            return { reversible: false };
         if (detailed.reason === undefined)
-            return { reversible: true };
+            return seatVerdict(detailed) ?? { reversible: true };
         const loop = classifyBoundedReadonlyPollLoopDetailed(command, allowSet, resolved);
         if (loop.reason === undefined)
-            return { reversible: true };
-        if (boundaryDeclared(loop))
+            return seatVerdict(loop) ?? { reversible: true };
+        const compoundVerdict = seatVerdict(detailed);
+        const loopVerdict = seatVerdict(loop);
+        const mandated = [compoundVerdict, loopVerdict].find((verdict) => verdict?.mandated === true);
+        if (mandated !== undefined)
+            return mandated;
+        if (readBoundaryMandate(command, allowSet, resolved, detailed).mandated === true)
             return { reversible: false, mandated: true };
-        if (boundaryUnread(loop))
-            return { reversible: false };
-        return { reversible: true };
+        return compoundVerdict ?? loopVerdict ?? { reversible: true };
     };
 }
 export { FULL_SHELL_CONTRACT_ID } from "../../core/tool-catalog-entries.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.17.0",
+  "version": "7.17.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2333,
+  "count": 2335,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -2080,6 +2080,8 @@
     "peerSessionBoxHandle": "function",
     "permissionRuleSyncContract": "function",
     "pgQuery": "function",
+    "physicalPathOf": "function",
+    "physicalPathOfExisting": "function",
     "planParseRepairs": "function",
     "precheckEditedRuleText": "function",
     "predictMountedToolNames": "function",
@@ -4415,6 +4417,8 @@
     "peerSessionBoxHandle": "advanced",
     "permissionRuleSyncContract": "advanced",
     "pgQuery": "advanced",
+    "physicalPathOf": "advanced",
+    "physicalPathOfExisting": "advanced",
     "planParseRepairs": "advanced",
     "precheckEditedRuleText": "advanced",
     "predictMountedToolNames": "advanced",