@sema-agent/core 7.17.0 → 7.17.2

package/dist/stores/file/mailbox-store.js

@@ -1,18 +1,11 @@
 import { join, resolve, sep } from "node:path";
 import { randomBytes } from "node:crypto";
 import { assertRetentionPolicy } from "../../core/retention-policy.js";
-import { existsSync, linkSync, readdirSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync, linkSync, readdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { detachMailboxMessage, newestSentAt, readMailboxPeerMeta, } from "../../core/mailbox-store.js";
 import { AppendLog, atomicWriteFile, canonicalStoreKey, ensureDir, readJsonlRecords, sanitizeScope, sanitizePathComponent } from "./fs-atomic.js";
+import { physicalPathOf } from "../../core/physical-path.js";
 import { assertAdoptionBootGate } from "./adoption/marker.js";
-function realpathSyncSafe(p) {
-    try {
-        return realpathSync(p);
-    }
-    catch {
-        return p;
-    }
-}
 function diskMarkOf(path) {
     try {
         const st = statSync(path);
@@ -361,8 +354,8 @@ export class FileMailboxStore {
         const lexicalTmp = resolve(join(root, "tmp"));
         ensureDir(lexicalDir);
         ensureDir(lexicalTmp);
-        this.dir = realpathSyncSafe(lexicalDir);
-        this.tmpDir = realpathSyncSafe(lexicalTmp);
+        this.dir = physicalPathOf(lexicalDir);
+        this.tmpDir = physicalPathOf(lexicalTmp);
     }
     boxPath(scope, handle) {
         return join(this.dir, sanitizeScope(scope), `${sanitizePathComponent(handle).toLowerCase()}.jsonl`);

package/dist/tools/artifact/local-stub.js

@@ -1,7 +1,8 @@
 import { randomBytes } from "node:crypto";
-import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve, sep } from "node:path";
 import {} from "../../core/artifact-host.js";
+import { physicalPathOf } from "../../core/physical-path.js";
 import { acquireStoreDirLock } from "../../stores/file/fs-atomic.js";
 import { normalizePublishedPath } from "./artifact-tool.js";
 export const EVAL_STUB_URL_PREFIX = "eval-stub://artifact/";
@@ -112,9 +113,9 @@ export class LocalArtifactStub {
     }
     #snapshotOf(row) {
         const base = this.#versionDir(row.slug, row.version);
-        const realBase = realpathSync(base);
+        const realBase = physicalPathOf(base);
         const files = row.files.map((f) => {
-            const target = realpathSync(resolve(base, ...f.path.split("/")));
+            const target = physicalPathOf(resolve(base, ...f.path.split("/")));
             if (!target.startsWith(realBase + sep))
                 throw new Error(`artifact stub ledger is corrupt (a file resolves outside its version directory): ${this.#ledgerPath()}`);
             return { path: f.path, content: new Uint8Array(readFileSync(target)), ...(f.mediaType !== undefined ? { mediaType: f.mediaType } : {}) };

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -321,9 +321,18 @@ export interface CompoundReadonlyVerdict {
      * (`cd -`, bare `cd`, a pattern). The STRUCTURAL form of the unresolvable sentence: `reason` carries the
      * first one's sentence, this member every one of them, and both survive whatever other sentence (a shape
      * refusal) takes precedence. CONSUMER CONTRACT: non-empty ⇒ the boundary could not read where the command
-     * reads — a fail-closed ask (plain: nothing was declared), never a vouch.
+     * reads — a fail-closed ask, never a vouch (plain on the classify seat, whose classifier asks beside it; MANDATED on the
+     * boundary-only seat, where nothing else would ask).
      */
     unresolvedOperands?: readonly string[];
+    /**
+     * The grammar gate refused the WHOLE command before the walk ran (an escape, a substitution, a subshell, a
+     * redirection, a line break — see {@link rejectedSansRedirection} and the compound gate): no operand was judged,
+     * and what the shell would run is not knowable from the text (a reader can be spelled `ca\t`, fed by `<`, or hidden
+     * in `$(…)`). CONSUMER CONTRACT: present ⇒ the boundary judged nothing — MANDATED on both probe seats (a name-reading
+     * arm or a stored allow rule must not retire a read nobody judged). Structure, never the sentence.
+     */
+    refusedWhole?: true;
     /**
      * Operands of a RECURSIVE/EXPANDING read form (`grep -r`, `ls -R`, `du`, … — see
      * {@link RECURSIVE_READ_FORMS}) judged with a {@link BashReadonlyRootBoundary.denyMatch} seat wired.
@@ -380,6 +389,15 @@ export declare function formatOutOfRootReadApprovalOption(directory: string): st
  *  has no filesystem and stays lexical, and a REMOTE env keeps the lexical behaviour (its
  *  `canonicalPath` is an RPC per candidate). */
 export declare function resolveOperandLexically(base: string | undefined, operand: string, homeDir: string | undefined): string | undefined;
+/** Whether a command the grammar gate REFUSED WHOLE may READ a file the boundary never judged. The answer is the
+ *  complement of a WHITELIST: the command is exempt only when every part of it is a shape the scan fully understands
+ *  and none of those shapes reads a file outside the walk's reach — everything else is read evidence, so a token the
+ *  scan does not understand mandates rather than passes. Exempt shapes, per segment: a program that reads no path
+ *  (`echo`, `python3 -`, `tee out.txt`, an unlisted program); `cat` / `wc` with payload-free flags whose input is a
+ *  here-document, a here-string or a literal in-root stdin file; a directory change (which then makes every relative
+ *  stdin literal in the command unjudged). A substitution body (`$(…)`, backticks, `<(…)`) is judged on its own: green
+ *  under the compound walk, or exempt under this whitelist; a here-document body is text, not commands. */
+export declare function refusedCommandMayRead(command: string, allow: ReadonlySet<string>, boundary?: BashReadonlyRootBoundary): boolean;
 /**
  * The home directory's VARIABLE spellings, SUBSTITUTED with the declared value before a read face segments the
  * command: `$HOME` / `${HOME}` at the START of a word (an empty quote pair before it included), unquoted or

package/dist/tools/fs/bash-readonly-classifier.js

@@ -1,4 +1,4 @@
-import { isAbsoluteForFamily, isAbsolutePathForm, isBlockedDevicePath, isShellRootedSpellingUnmapped, joinForFamily, nativeUncSpellingOf, normalizeAbsPathLexically, pathFamilyOf, withinAnyRoot } from "./safety.js";
+import { isAbsoluteForFamily, isAbsolutePathForm, isBlockedDevicePath, isShellRootedSpellingUnmapped, joinForFamily, nativeUncSpellingOf, normalizeAbsPathLexically, win32NamespaceScreen, pathFamilyOf, withinAnyRoot } from "./safety.js";
 export const NOT_AUTO_ALLOWED = "— not auto-allowed";
 export const BASH_READONLY_DEFAULT_ALLOW = [
     "ls", "cat", "head", "tail", "wc", "pwd", "echo", "whoami", "uname",
@@ -224,6 +224,8 @@ export function resolveOperandLexically(base, operand, homeDir) {
         return undefined;
     }
     const family = base === undefined ? undefined : pathFamilyOf({ root: base });
+    if (!win32NamespaceScreen(raw, family).ok)
+        return undefined;
     if (isAbsoluteForFamily(family, raw))
         return normalizeAbsPathLexically(nativeUncSpellingOf(family, raw));
     if (base === undefined || family === undefined || !isAbsoluteForFamily(family, base))
@@ -232,6 +234,361 @@ export function resolveOperandLexically(base, operand, homeDir) {
         return undefined;
     return normalizeAbsPathLexically(joinForFamily(family, base, raw));
 }
+function reheadSegment(toks, head, from = 0) {
+    return { folded: [head, ...toks.folded.slice(from + 1)], raw: [head, ...toks.raw.slice(from + 1)] };
+}
+const SHELL_CONTROL_PREFIXES = new Set(["!", "if", "then", "elif", "else", "while", "until", "do", "time"]);
+const SHELL_BLOCK_WORDS = new Set(["for", "select", "case", "esac", "fi", "done", "function", "coproc", "[[", "]]", "in"]);
+function isBareControlWord(toks, i, words) {
+    const word = toks.folded[i];
+    return word !== undefined && toks.raw[i] === word && words.has(word);
+}
+function tokensMoveBase(toks, allow) {
+    let from = 0;
+    while (from < toks.folded.length && isBareControlWord(toks, from, SHELL_CONTROL_PREFIXES))
+        from++;
+    const head = toks.folded[from];
+    if (head === undefined)
+        return false;
+    if (toks.raw[from] !== head)
+        return true;
+    if (head === "cd")
+        return true;
+    if (!COMMAND_LAUNCHERS.has(head))
+        return false;
+    const unwrapped = unwrapLauncher(toks.folded.slice(from), allow);
+    return unwrapped.kind === "refused" || (unwrapped.kind === "reader" && unwrapped.head === "cd");
+}
+const SHELL_REENTRY_PROGRAM_RE = /^(?:(?:ba|z|da|k|fi)?sh|eval|source|\.)$/;
+export function refusedCommandMayRead(command, allow, boundary) {
+    return !refusedCommandExempt(command, allow, boundary, 0);
+}
+const STDIN_ONLY_READER_FLAGS = new Map([
+    ["cat", /^-[AbeEnstTuv]+$/],
+    ["wc", /^-[clmwL]+$/],
+]);
+const SUBSTITUTION_PLACEHOLDER = "\u0000subst";
+function withoutHeredocBodies(text) {
+    const lines = text.split("\n");
+    const out = [];
+    const expandedBodies = [];
+    let terminator;
+    let expanded = false;
+    let body = [];
+    for (const line of lines) {
+        if (terminator !== undefined) {
+            if (line.trim() === terminator) {
+                if (expanded)
+                    expandedBodies.push(body.join("\n"));
+                terminator = undefined;
+                body = [];
+            }
+            else
+                body.push(line);
+            continue;
+        }
+        out.push(line);
+        const header = heredocHeaderOf(line);
+        if (header === null)
+            return undefined;
+        if (header !== undefined) {
+            terminator = header.word;
+            expanded = !header.quoted;
+        }
+    }
+    return terminator === undefined ? { outer: out.join("\n"), expandedBodies } : undefined;
+}
+function heredocHeaderOf(line) {
+    let inSingle = false;
+    let inDouble = false;
+    for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        if (ch === "\\" && !inSingle) {
+            i++;
+            continue;
+        }
+        if (ch === "'" && !inDouble) {
+            inSingle = !inSingle;
+            continue;
+        }
+        if (ch === '"' && !inSingle) {
+            inDouble = !inDouble;
+            continue;
+        }
+        if (inSingle || inDouble)
+            continue;
+        if (ch === "#")
+            return undefined;
+        if (ch === "<" && line[i + 1] === "<") {
+            if (line[i + 2] === "<") {
+                i += 2;
+                continue;
+            }
+            const m = /^<<-?\s*([^\s;|&<>()]+)/.exec(line.slice(i));
+            if (m === null)
+                return null;
+            const word = m[1];
+            if (/[$`]/.test(word))
+                return null;
+            const delimiter = word.replace(/\\(.)/g, "$1").replace(/["']/g, "");
+            if (delimiter === "")
+                return null;
+            return { word: delimiter, quoted: /["'\\]/.test(word) };
+        }
+    }
+    return undefined;
+}
+function splitSubstitutions(text, quotesAreLiteral = false) {
+    let outer = "";
+    const bodies = [];
+    let i = 0;
+    let inSingle = false;
+    let inDouble = false;
+    while (i < text.length) {
+        const ch = text[i];
+        if (ch === "\\" && !inSingle) {
+            outer += text.slice(i, i + 2);
+            i += 2;
+            continue;
+        }
+        if (ch === "'" && !inDouble && !quotesAreLiteral) {
+            inSingle = !inSingle;
+            outer += ch;
+            i++;
+            continue;
+        }
+        if (ch === '"' && !inSingle && !quotesAreLiteral) {
+            inDouble = !inDouble;
+            outer += ch;
+            i++;
+            continue;
+        }
+        if (inSingle) {
+            outer += ch;
+            i++;
+            continue;
+        }
+        if (ch === "`") {
+            const close = text.indexOf("`", i + 1);
+            if (close < 0)
+                return undefined;
+            bodies.push(text.slice(i + 1, close));
+            outer += SUBSTITUTION_PLACEHOLDER;
+            i = close + 1;
+            continue;
+        }
+        if ((ch === "$" || ch === "<" || ch === ">") && text[i + 1] === "(") {
+            let depth = 0;
+            let j = i + 1;
+            let quoted;
+            for (; j < text.length; j++) {
+                const c = text[j];
+                if (quoted !== undefined) {
+                    if (c === "\\" && quoted === '"')
+                        j++;
+                    else if (c === quoted)
+                        quoted = undefined;
+                    continue;
+                }
+                if (c === "'" || c === '"') {
+                    quoted = c;
+                    continue;
+                }
+                if (c === "(")
+                    depth++;
+                else if (c === ")") {
+                    depth--;
+                    if (depth === 0)
+                        break;
+                }
+            }
+            if (j >= text.length)
+                return undefined;
+            bodies.push(text.slice(i + 2, j));
+            outer += SUBSTITUTION_PLACEHOLDER;
+            i = j + 1;
+            continue;
+        }
+        outer += ch;
+        i++;
+    }
+    if (inSingle)
+        return undefined;
+    return { outer, bodies };
+}
+function refusedCommandExempt(command, allow, boundary, depth, baseMovedOutside = false) {
+    if (depth > 4)
+        return false;
+    const stripped = withoutHeredocBodies(command);
+    if (stripped === undefined)
+        return false;
+    const split = splitSubstitutions(stripped.outer);
+    if (split === undefined)
+        return false;
+    const bodies = [...split.bodies];
+    for (const expandedBody of stripped.expandedBodies) {
+        const inner = splitSubstitutions(expandedBody, true);
+        if (inner === undefined)
+            return false;
+        bodies.push(...inner.bodies);
+    }
+    const fold = (w) => w.replace(/\\(.)/g, "$1").replace(/["']/g, "");
+    const programOf = (w) => {
+        const inner = fold(w);
+        return inner.includes("/") ? inner.slice(inner.lastIndexOf("/") + 1) : inner;
+    };
+    const segments = split.outer.split(/\n|;|&&|\|\||\||(?<![>&\d])&(?![>&])/).map((segment) => {
+        const toks = [];
+        for (const word of segment.trim().split(/\s+/)) {
+            let rest = word;
+            while (rest !== "") {
+                const m = /^(\d*(?:<<<|<<|<|>>|>)(?:&\d*)?|&>>?)(.*)$/.exec(rest);
+                if (m !== null) {
+                    toks.push(m[1].replace(/^\d+/, ""));
+                    rest = m[2];
+                    continue;
+                }
+                const at = rest.search(/\d*(?:<<<|<<|<|>>|>)|&>/);
+                if (at <= 0) {
+                    toks.push(rest);
+                    break;
+                }
+                toks.push(rest.slice(0, at));
+                rest = rest.slice(at);
+            }
+        }
+        const commentAt = toks.findIndex((t) => t.startsWith("#"));
+        return (commentAt >= 0 ? toks.slice(0, commentAt) : toks)
+            .map((t) => (/^[A-Za-z_][A-Za-z0-9_]*\(\)$/.test(t) ? "{" : t.replace(/^[({]+|[)}]+$/g, "")))
+            .filter((t) => t !== "");
+    });
+    const headIndex = (toks) => {
+        let i = 0;
+        while (i < toks.length) {
+            const w = fold(toks[i]);
+            if (ASSIGNMENT_WORD.test(w) || SHELL_CONTROL_PREFIXES.has(w) || SHELL_BLOCK_WORDS.has(w) || /^[{}]$/.test(w)) {
+                i++;
+                continue;
+            }
+            if (/^(?:<<<|<<|<|>>?|&>>?)$/.test(w)) {
+                i += 2;
+                continue;
+            }
+            if (/^(?:>>?|<)&\d*$/.test(w)) {
+                i++;
+                continue;
+            }
+            break;
+        }
+        return i;
+    };
+    const runProgramOf = (toks, i) => {
+        let head = programOf(toks[i] ?? "");
+        let guard = 0;
+        while (COMMAND_LAUNCHERS.has(head) && guard++ < 8) {
+            let j = i + 1;
+            while (j < toks.length && (ASSIGNMENT_WORD.test(fold(toks[j])) || /^\d+[smhd]?$/.test(fold(toks[j]))))
+                j++;
+            const next = toks[j];
+            if (next === undefined || fold(next).startsWith("-"))
+                return undefined;
+            i = j;
+            head = programOf(next);
+        }
+        return head;
+    };
+    const baseMoved = baseMovedOutside ||
+        segments.some((toks) => {
+            const i = headIndex(toks);
+            if (i >= toks.length)
+                return false;
+            const head = runProgramOf(toks, i);
+            return head === undefined || head === "cd" || UNMODELLED_BASE_MOVERS.has(head);
+        });
+    for (const body of bodies) {
+        const walked = classifyCompoundReadonlyDetailed(body, allow, boundary);
+        const fullyGreen = !baseMoved && walked.reason === undefined && walked.readDenied !== true && walked.outOfRootRead !== true && walked.refusedWhole !== true &&
+            (walked.undecidedPaths?.length ?? 0) === 0 && (walked.unresolvedOperands?.length ?? 0) === 0 && (walked.recursiveReadPaths?.length ?? 0) === 0;
+        if (fullyGreen)
+            continue;
+        if (!refusedCommandExempt(body, allow, boundary, depth + 1, baseMoved))
+            return false;
+    }
+    const stdinFileJudgedInside = (raw) => {
+        if (raw === undefined || raw === "" || raw.includes(SUBSTITUTION_PLACEHOLDER) || /[$`()*?[\]{}~]/.test(raw))
+            return false;
+        if (boundary === undefined || baseMoved)
+            return false;
+        const resolved = resolveOperandLexically(boundary.cwd ?? boundary.roots[0], fold(raw), boundary.homeDir);
+        if (resolved === undefined || boundary.denyMatch?.(resolved) != null)
+            return false;
+        return withinAnyRoot(boundary.roots, resolved);
+    };
+    for (const toks of segments) {
+        for (let j = 0; j < toks.length; j++)
+            if (toks[j] === "<" && !stdinFileJudgedInside(toks[j + 1]))
+                return false;
+        let i = headIndex(toks);
+        if (i >= toks.length)
+            continue;
+        const headWord = fold(toks[i]);
+        if (headWord.includes(SUBSTITUTION_PLACEHOLDER) || /[$`]/.test(headWord))
+            return false;
+        let head = programOf(headWord);
+        if (COMMAND_LAUNCHERS.has(head)) {
+            const wrapped = runProgramOf(toks, i);
+            if (wrapped === undefined || /[$`]/.test(wrapped) || SHELL_REENTRY_PROGRAM_RE.test(wrapped))
+                return false;
+            const unwrapped = unwrapLauncher(toks.slice(i).map(fold), allow);
+            if (unwrapped.kind === "refused")
+                return false;
+            if (unwrapped.kind === "unlisted")
+                continue;
+            head = unwrapped.head;
+            i += unwrapped.index;
+        }
+        if (SHELL_REENTRY_PROGRAM_RE.test(head))
+            return false;
+        if (head === "cd" || UNMODELLED_BASE_MOVERS.has(head))
+            continue;
+        if (!allow.has(head) || NO_PATH_OPERAND_COMMANDS.has(head))
+            continue;
+        const flags = STDIN_ONLY_READER_FLAGS.get(head);
+        if (flags === undefined)
+            return false;
+        for (let j = i + 1; j < toks.length; j++) {
+            const t = toks[j];
+            if (t === "<<<" || t === "<<" || t === "<") {
+                j++;
+                continue;
+            }
+            if (/^(?:>>?|&>>?)$/.test(t)) {
+                j++;
+                continue;
+            }
+            if (/^(?:>>?|<)&\d*$/.test(t))
+                continue;
+            if (flags.test(fold(t)))
+                continue;
+            return false;
+        }
+    }
+    return true;
+}
+function unwrapLauncher(folded, allow) {
+    for (let i = 1; i < folded.length; i++) {
+        const t = folded[i];
+        if (ASSIGNMENT_WORD.test(t) || /^\d+[smhd]?$/.test(t) || COMMAND_LAUNCHERS.has(t))
+            continue;
+        if (t.startsWith("-"))
+            return { kind: "refused", reason: `"${folded[0]}" is given an option before the program it runs — which program runs is not readable without the launcher's option table ${NOT_AUTO_ALLOWED}` };
+        const head = t.includes("/") ? t.slice(t.lastIndexOf("/") + 1) : t;
+        if (SHELL_CONTROL_PREFIXES.has(head) || SHELL_BLOCK_WORDS.has(head))
+            return { kind: "refused", reason: `"${folded[0]}" is given shell control syntax ("${head}") where the program it runs would be ${NOT_AUTO_ALLOWED}` };
+        return allow.has(head) || head === "cd" ? { kind: "reader", index: i, head } : { kind: "unlisted", head };
+    }
+    return { kind: "unlisted" };
+}
 function tokenizeSegment(segment) {
     const raw = splitWordsQuoteAware(segment);
     return { folded: raw.map((r) => { const f = foldQuoteRemovalToken(r); return tildeIsLiteral(r) ? literalTildeSpelling(f) : f; }), raw };
@@ -803,12 +1160,56 @@ function segmentCompoundForReadonly(command, homeDir) {
 export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts) {
     const split = segmentCompoundForReadonly(command, boundary?.homeDir);
     if ("reject" in split)
-        return { reason: split.reject };
+        return { reason: split.reject, refusedWhole: true };
     const { segments, pipeFed } = split;
-    for (const segment of segments) {
-        const reason = coarseReadonlyCheck(segment, allow, { quotedOperatorsAreText: true });
-        if (reason !== undefined)
-            return { reason };
+    let nameRefusal;
+    const unlistedSegments = new Set();
+    const reheaded = new Map();
+    for (let si = 0; si < segments.length; si++) {
+        const toks = tokenizeSegment(segments[si]);
+        const folded = toks.folded;
+        let from = 0;
+        while (from < folded.length && isBareControlWord(toks, from, SHELL_CONTROL_PREFIXES))
+            from++;
+        const written = folded[from];
+        if (written === undefined)
+            return { reason: "empty command" };
+        if (isBareControlWord(toks, from, SHELL_BLOCK_WORDS)) {
+            unlistedSegments.add(si);
+            nameRefusal ??= `command "${written}" is not in the read-only allowlist`;
+            continue;
+        }
+        const parsed = parseLeadingCommandName(toks.raw.slice(from).join(" "), { quotedOperatorsAreText: true, pathPrefixedNameIsText: true });
+        if ("reject" in parsed)
+            return { reason: parsed.reject, refusedWhole: true };
+        const pathPrefixed = parsed.name.includes("/");
+        const name = pathPrefixed ? parsed.name.slice(parsed.name.lastIndexOf("/") + 1) : parsed.name;
+        if (pathPrefixed)
+            nameRefusal ??= "the command must be a bare name resolved via PATH (no path prefix)";
+        if (allow.has(name)) {
+            if (pathPrefixed || from > 0)
+                reheaded.set(si, { from, head: name });
+            if (from > 0)
+                nameRefusal ??= `command "${folded[0]}" is not in the read-only allowlist`;
+            continue;
+        }
+        nameRefusal ??= `command "${parsed.name}" is not in the read-only allowlist`;
+        if (SHELL_REENTRY_PROGRAM_RE.test(name))
+            return { reason: `command "${parsed.name}" runs its argument as shell text, which this walk does not judge ${NOT_AUTO_ALLOWED}`, refusedWhole: true };
+        if (COMMAND_LAUNCHERS.has(name)) {
+            const unwrapped = unwrapLauncher(folded.slice(from), allow);
+            if (unwrapped.kind === "refused")
+                return { reason: unwrapped.reason, refusedWhole: true };
+            if (unwrapped.kind === "unlisted" && unwrapped.head !== undefined && SHELL_REENTRY_PROGRAM_RE.test(unwrapped.head)) {
+                return { reason: `"${written}" runs "${unwrapped.head}", which runs its argument as shell text this walk does not judge ${NOT_AUTO_ALLOWED}`, refusedWhole: true };
+            }
+            if (unwrapped.kind === "unlisted")
+                unlistedSegments.add(si);
+            else
+                reheaded.set(si, { from: from + unwrapped.index, head: unwrapped.head });
+            continue;
+        }
+        unlistedSegments.add(si);
     }
     const HEAD_AUTO_ALLOW_MAX = 1_000_000;
     const headBoundIsSmall = (name, toks) => {
@@ -840,9 +1241,12 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
     };
     const STDIN_FILE_FLOOR = { cat: 1, grep: 2, head: 1, tail: 1, wc: 1, cut: 1, tr: Infinity, diff: 2, cmp: 2, comm: 2, sed: 2 };
     const foldedSegments = [];
-    let shapeRefusal;
+    let shapeRefusal = nameRefusal;
     for (let si = 0; si < segments.length; si++) {
-        const segmentTokens = tokenizeSegment(segments[si]);
+        if (unlistedSegments.has(si))
+            continue;
+        const rehead = reheaded.get(si);
+        const segmentTokens = rehead === undefined ? tokenizeSegment(segments[si]) : reheadSegment(tokenizeSegment(segments[si]), rehead.head, rehead.from);
         const toks = segmentTokens.folded;
         if (toks.length === 0)
             continue;
@@ -1187,10 +1591,7 @@ export function classifyBoundedReadonlyPollLoopDetailed(command, allow, boundary
     if (readSegments.length === 0) {
         return { reason: "the loop body has no read command — a sleep-only loop observes nothing and is not auto-allowed" };
     }
-    const bodyHasCd = readSegments.some((seg) => {
-        const p = parseLeadingCommandName(seg);
-        return "name" in p && p.name === "cd";
-    });
+    const bodyHasCd = readSegments.some((seg) => tokensMoveBase(tokenizeSegment(seg), allow));
     const modelled = bodyHasCd ? Array.from({ length: beats }, () => readSegments.join("; ")).join("; ") : readSegments.join("; ");
     const verdict = classifyCompoundReadonlyDetailed(modelled, allow, boundary, { iterated: bodyHasCd });
     if (verdict.reason !== undefined)

package/dist/tools/fs/fs-bash.js

@@ -11,7 +11,7 @@ import { isRemoteExecutionEnv, hasDestroy, isIsolated } from "../../core/remote-
 import { ghRateLimitHint } from "./gh-rate-limit.js";
 import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, createShellOverflowSpoolFence, shellRecoveryHint, CWD_SENTINEL, BASH_READONLY_CONFINEMENT_NOTE, } from "./fs-shared.js";
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted } from "../../core/untrusted-text.js";
-import { BASH_CLASSIFY_DEFAULT_ALLOW, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed, classifyOutOfRootReadGate, classifySimpleCommandReadBoundary, NOT_AUTO_ALLOWED, } from "./bash-readonly-classifier.js";
+import { BASH_CLASSIFY_DEFAULT_ALLOW, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed, classifyOutOfRootReadGate, refusedCommandMayRead, classifySimpleCommandReadBoundary, NOT_AUTO_ALLOWED, } from "./bash-readonly-classifier.js";
 import { toolFace } from "../../core/tool-catalog-entries.js";
 const RECURSIVE_CAUSE_MAX_PATHS = 3;
 const RECURSIVE_READ_CAUSE_CODE = "shell.recursive_read_unbounded";
@@ -47,13 +47,16 @@ export function bashReversibilityProbe(allow, boundary) {
         const loop = classifyBoundedReadonlyPollLoopDetailed(command, allowSet, resolved);
         if (loop.reason === undefined)
             return { reversible: true };
-        if (boundaryDeclared(loop))
+        if (boundaryDeclared(loop) || unjudgedRead(command, allowSet, resolved, loop))
             return { reversible: false, mandated: true };
         return { reversible: false, ...boundaryGate(detailed) };
     };
 }
 function boundaryUnread(verdict) {
-    return (verdict.undecidedPaths !== undefined && verdict.undecidedPaths.length > 0) || (verdict.unresolvedOperands !== undefined && verdict.unresolvedOperands.length > 0);
+    return boundaryUndecided(verdict) || boundaryUnjudged(verdict);
+}
+function boundaryUndecided(verdict) {
+    return verdict.undecidedPaths !== undefined && verdict.undecidedPaths.length > 0;
 }
 function boundaryDeclared(verdict) {
     return denyJudgeSpoke(verdict) || verdict.outOfRootRead === true;
@@ -69,9 +72,23 @@ function isBackgroundShellCall(args) {
     return args?.run_in_background === true;
 }
 function readBoundaryMandate(command, allowSet, resolved, verdict) {
-    if (denyJudgeSpoke(verdict))
+    if (resolved === undefined)
+        return {};
+    if (denyJudgeSpoke(verdict) || unjudgedRead(command, allowSet, resolved, verdict))
         return { mandated: true };
-    return resolved !== undefined && classifyOutOfRootReadGate(command, allowSet, resolved).gated ? { mandated: true } : {};
+    return classifyOutOfRootReadGate(command, allowSet, resolved).gated ? { mandated: true } : {};
+}
+function boundaryUnjudged(verdict) {
+    return verdict.refusedWhole === true || (verdict.unresolvedOperands !== undefined && verdict.unresolvedOperands.length > 0);
+}
+function unjudgedRead(command, allowSet, resolved, verdict) {
+    if (verdict.unresolvedOperands !== undefined && verdict.unresolvedOperands.length > 0)
+        return true;
+    if (verdict.refusedWhole !== true)
+        return false;
+    if (refusedCommandMayRead(command, allowSet, resolved))
+        return true;
+    return resolved !== undefined && classifyOutOfRootReadGate(command, allowSet, resolved).gated;
 }
 function recursiveReadCause(detailed) {
     const recursive = detailed.recursiveReadPaths;
@@ -94,23 +111,31 @@ export function bashReadBoundaryProbe(boundary) {
         const resolved = typeof boundary === "function" ? boundary() : boundary;
         if (resolved === undefined)
             return { reversible: true };
+        const seatVerdict = (verdict) => {
+            if (boundaryDeclared(verdict) || unjudgedRead(command, allowSet, resolved, verdict)) {
+                const cause = recursiveReadCause(verdict);
+                return { reversible: false, mandated: true, ...(cause !== undefined ? { cause } : {}) };
+            }
+            if (boundaryUndecided(verdict))
+                return { reversible: false };
+            if (verdict.reason === undefined)
+                return { reversible: true };
+            return undefined;
+        };
         const detailed = classifyCompoundReadonlyDetailed(command, allowSet, resolved);
-        if (boundaryDeclared(detailed)) {
-            const cause = recursiveReadCause(detailed);
-            return { reversible: false, mandated: true, ...(cause !== undefined ? { cause } : {}) };
-        }
-        if (boundaryUnread(detailed))
-            return { reversible: false };
         if (detailed.reason === undefined)
-            return { reversible: true };
+            return seatVerdict(detailed) ?? { reversible: true };
         const loop = classifyBoundedReadonlyPollLoopDetailed(command, allowSet, resolved);
         if (loop.reason === undefined)
-            return { reversible: true };
-        if (boundaryDeclared(loop))
+            return seatVerdict(loop) ?? { reversible: true };
+        const compoundVerdict = seatVerdict(detailed);
+        const loopVerdict = seatVerdict(loop);
+        const mandated = [compoundVerdict, loopVerdict].find((verdict) => verdict?.mandated === true);
+        if (mandated !== undefined)
+            return mandated;
+        if (readBoundaryMandate(command, allowSet, resolved, detailed).mandated === true)
             return { reversible: false, mandated: true };
-        if (boundaryUnread(loop))
-            return { reversible: false };
-        return { reversible: true };
+        return compoundVerdict ?? loopVerdict ?? { reversible: true };
     };
 }
 export { FULL_SHELL_CONTRACT_ID } from "../../core/tool-catalog-entries.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.17.0",
+  "version": "7.17.2",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",