@sema-agent/core 7.17.5 → 7.17.6

package/dist/tools/fs/fs-bash.js

@@ -6,8 +6,8 @@ import { TASK_OUTPUT_TOOL_NAME, TASK_STOP_TOOL_NAME, TASK_OUTPUT_MISSING_ID_MESS
 import { hasBackgroundShell } from "../../core/background-shell.js";
 import { delimitUntrusted } from "../../core/untrusted-text.js";
 import { MCP_IMAGE_MAX_BASE64 } from "../../core/mcp.js";
-import { imageMagicMatches, withinAnyRoot } from "./safety.js";
-import { isRemoteExecutionEnv, hasDestroy, isIsolated } from "../../core/remote-env.js";
+import { imageMagicMatches, normalizeAbsPathLexically, withinAnyRoot } from "./safety.js";
+import { boundaryIsTheSandbox, hasDestroy, isIsolated } from "../../core/remote-env.js";
 import { ghRateLimitHint } from "./gh-rate-limit.js";
 import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, createShellOverflowSpoolFence, shellRecoveryHint, CWD_SENTINEL, BASH_READONLY_CONFINEMENT_NOTE, } from "./fs-shared.js";
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted } from "../../core/untrusted-text.js";
@@ -631,8 +631,10 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
             classifyCompoundReadonlyDetailed(command, recheckReaders, resolvedBoundary),
             classifyBoundedReadonlyPollLoopDetailed(command, recheckReaders, resolvedBoundary),
         ];
-        const literal = [...new Set(faces.flatMap((v) => v.checkedPaths ?? []))];
-        return await canonicalEscapeRefusal(canonicalBoundaryFor(resolvedBoundary.roots), { literal, patterns: [] }, resolvedBoundary.roots, FULL_SHELL_FACE_ESCAPE_PROSE, signal);
+        const literal = [...new Set(faces.flatMap((v) => [...(v.checkedPaths ?? []), ...(v.checkedSpellings ?? [])]))];
+        const asked = new Set(faces.flatMap((v) => v.outOfRootPaths ?? []));
+        const patterns = [...new Set(faces.flatMap((v) => [...(v.undecidedPaths ?? []), ...(v.undecidedSpellings ?? [])]))].filter((p) => !asked.has(normalizeAbsPathLexically(p)));
+        return await canonicalEscapeRefusal(canonicalBoundaryFor(resolvedBoundary.roots), { literal, patterns }, resolvedBoundary.roots, FULL_SHELL_FACE_ESCAPE_PROSE, signal);
     };
     return defineTool({
         name: "Bash",
@@ -928,7 +930,7 @@ function pathSegmentsFrom(p, from) {
     return segs;
 }
 function createCanonicalReadBoundary(env, readRoots) {
-    const lexicalOnly = isRemoteExecutionEnv(env);
+    const lexicalOnly = boundaryIsTheSandbox(env);
     let rootsOnce;
     const canonicalRoots = async (signal) => {
         rootsOnce ??= (async () => {
@@ -941,20 +943,60 @@ function createCanonicalReadBoundary(env, readRoots) {
         })();
         return await rootsOnce;
     };
-    const resolve = async (p, signal) => {
+    const resolveWithoutParentSteps = async (p, signal) => {
         const parts = p.split(/[\\/]/);
         const tail = [];
+        let allAbsent = true;
         while (parts.length > 0) {
             const canon = await env.canonicalPath(parts.join("/") || "/", signal);
             if (canon.ok) {
                 if (tail.length === 0)
-                    return canon.value;
-                return [canon.value.replace(/[\\/]+$/, ""), ...[...tail].reverse()].join("/");
+                    return { value: canon.value, exact: true };
+                return { value: [canon.value.replace(/[\\/]+$/, ""), ...[...tail].reverse()].join("/"), exact: false, missing: allAbsent };
             }
+            if (canon.error.code !== "not_found" && canon.error.code !== "not_directory")
+                allAbsent = false;
             tail.push(parts.pop());
         }
         return undefined;
     };
+    const parentOf = (canonical) => normalizeAbsPathLexically(`${canonical}/..`);
+    const resolve = async (p, signal) => {
+        const parts = p.split(/[\\/]/);
+        const first = parts.findIndex((seg) => seg === "..");
+        if (first < 0)
+            return await resolveWithoutParentSteps(p, signal);
+        const headEnd = parts.slice(0, first).reduce((n, seg) => n + seg.length + 1, 0);
+        let head = await resolveWithoutParentSteps(p.slice(0, headEnd) || "/", signal);
+        if (head === undefined)
+            return undefined;
+        let pending = [];
+        const flush = async () => {
+            if (pending.length === 0)
+                return true;
+            const next = await resolveWithoutParentSteps([head.value.replace(/[\\/]+$/, ""), ...pending].join("/"), signal);
+            pending = [];
+            if (next === undefined)
+                return false;
+            head = next;
+            return true;
+        };
+        for (let i = first; i < parts.length; i++) {
+            const seg = parts[i];
+            if (seg === "" || seg === ".")
+                continue;
+            if (seg !== "..") {
+                pending.push(seg);
+                continue;
+            }
+            if (!(await flush()))
+                return undefined;
+            if (!head.exact)
+                return head;
+            head = { value: parentOf(head.value), exact: true };
+        }
+        return (await flush()) ? head : undefined;
+    };
     const literalRootHead = (p, roots) => {
         let best;
         for (const r of [...readRoots, ...roots]) {
@@ -997,7 +1039,13 @@ function createCanonicalReadBoundary(env, readRoots) {
                 if (++dirsUsed > MAX_GLOB_DIRS) {
                     return { unverifiable: `"${p}" expands over more than ${MAX_GLOB_DIRS} directories, too many to enumerate to verify` };
                 }
-                const listed = await env.listDir(dir, signal);
+                const canonDir = await resolve(dir, signal);
+                if (canonDir !== undefined && canonDir.missing === true)
+                    continue;
+                if (canonDir !== undefined && !canonDir.exact) {
+                    return { unverifiable: `"${dir}" cannot be resolved to verify what "${seg}" would expand to` };
+                }
+                const listed = await env.listDir(canonDir?.value ?? dir, signal);
                 if (!listed.ok) {
                     if (listed.error.code === "not_found" || listed.error.code === "not_directory")
                         continue;
@@ -1010,9 +1058,8 @@ function createCanonicalReadBoundary(env, readRoots) {
                 }
                 let dirInside = false;
                 if (isLast) {
-                    const canonDir = await resolve(dir, signal);
-                    if (canonDir !== undefined && !withinAnyRoot(roots, canonDir)) {
-                        next.push(canonDir);
+                    if (canonDir !== undefined && !withinAnyRoot(roots, canonDir.value)) {
+                        next.push(canonDir.value);
                         continue;
                     }
                     dirInside = canonDir !== undefined;
@@ -1040,12 +1087,17 @@ function createCanonicalReadBoundary(env, readRoots) {
                 return { escaping: [] };
             const roots = await canonicalRoots(signal);
             const escaping = [];
+            let unresolvable;
             const judge = async (p) => {
                 const real = await resolve(p, signal);
                 if (real === undefined)
                     return;
-                if (!withinAnyRoot(roots, real) && !escaping.includes(real))
-                    escaping.push(real);
+                if (!real.exact && real.missing !== true) {
+                    unresolvable ??= `"${p}" cannot be resolved to verify where it reads`;
+                    return;
+                }
+                if (!withinAnyRoot(roots, real.value) && !escaping.includes(real.value))
+                    escaping.push(real.value);
             };
             for (const p of paths.literal)
                 await judge(p);
@@ -1056,7 +1108,13 @@ function createCanonicalReadBoundary(env, readRoots) {
                 for (const t of expanded !== undefined && expanded.paths.length > 0 ? expanded.paths : [p])
                     await judge(t);
             }
-            return { escaping };
+            return unresolvable === undefined ? { escaping } : { escaping, unverifiable: unresolvable };
+        },
+        canonicalOf: async (path, signal) => {
+            if (lexicalOnly)
+                return undefined;
+            const real = await resolve(path, signal);
+            return real === undefined || (!real.exact && real.missing !== true) ? undefined : real.value;
         },
         allResolveInside: async (paths, signal) => {
             if (lexicalOnly || paths.length === 0)
@@ -1064,7 +1122,9 @@ function createCanonicalReadBoundary(env, readRoots) {
             const roots = await canonicalRoots(signal);
             for (const p of paths) {
                 const real = await resolve(p, signal);
-                if (real === undefined || !withinAnyRoot(roots, real))
+                if (real === undefined || (!real.exact && real.missing !== true))
+                    return false;
+                if (!withinAnyRoot(roots, real.value))
                     return false;
             }
             return true;
@@ -1103,11 +1163,14 @@ export function createBashReadonlyTool(env, rootCanonical, allow, opts) {
     const readsOnlyEngineOverflowSpool = async (verdict) => {
         if (verdict.outOfRootRead !== true)
             return false;
+        if ((verdict.unresolvedOperands ?? []).length > 0)
+            return false;
         const paths = verdict.outOfRootPaths ?? [];
         if (paths.length === 0)
             return false;
-        for (const p of paths) {
-            if (!(await overflowSpoolFence(p)))
+        for (const p of [...paths, ...(verdict.outOfRootSpellings ?? [])]) {
+            const real = await canonicalBoundary.canonicalOf(p);
+            if (!(await overflowSpoolFence(real ?? p)))
                 return false;
         }
         return true;
@@ -1120,7 +1183,7 @@ export function createBashReadonlyTool(env, rootCanonical, allow, opts) {
             "operators (pipes, redirects, ;, &&, command substitution, subshells) are rejected and only " +
             "allowlisted commands run. Reads are confined to the workspace root(s): a path outside them is " +
             "refused, as is one that cannot be resolved statically (e.g. a `~` path). " +
-            (isRemoteExecutionEnv(env) ? "" : "A path that leads outside via a symlink counts as outside, including one a glob pattern expands to. ") +
+            (boundaryIsTheSandbox(env) ? "" : "A path that leads outside via a symlink counts as outside, including one a glob pattern expands to. ") +
             "Still subject to the deployment's approval policy.",
         parameters: Type.Object({
             command: Type.String({ description: "A single allowlisted read-only command (no shell operators)." }),
@@ -1136,12 +1199,15 @@ export function createBashReadonlyTool(env, rootCanonical, allow, opts) {
                 return errorResult(`Error (Bash): ${reason}`);
             const boundary = classifySimpleCommandReadBoundary(command, { roots: readRoots, cwd: rootCanonical });
             if (boundary.reason !== undefined) {
-                const rescued = boundary.outOfRootRead === true && (await canonicalBoundary.allResolveInside(boundary.outOfRootPaths ?? [], ctx.signal));
+                const rescueCandidates = [...(boundary.outOfRootPaths ?? []), ...(boundary.outOfRootSpellings ?? [])];
+                const rescued = boundary.outOfRootRead === true &&
+                    (boundary.unresolvedOperands ?? []).length === 0 &&
+                    (await canonicalBoundary.allResolveInside(rescueCandidates, ctx.signal));
                 if (!rescued && !(await readsOnlyEngineOverflowSpool(boundary))) {
                     return errorResult(`Error (Bash): ${boundary.reason}. ${BASH_READONLY_CONFINEMENT_NOTE}`, { type: "readonly_out_of_root", code: "readonly_out_of_root", paths: boundary.outOfRootPaths ?? [] });
                 }
             }
-            const escape = await canonicalEscapeRefusal(canonicalBoundary, { literal: boundary.checkedPaths ?? [], patterns: boundary.undecidedPaths ?? [] }, readRoots, READONLY_FACE_ESCAPE_PROSE, ctx.signal);
+            const escape = await canonicalEscapeRefusal(canonicalBoundary, { literal: [...(boundary.checkedPaths ?? []), ...(boundary.checkedSpellings ?? [])], patterns: [...(boundary.undecidedPaths ?? []), ...(boundary.undecidedSpellings ?? [])] }, readRoots, READONLY_FACE_ESCAPE_PROSE, ctx.signal);
             if (escape !== undefined)
                 return escape;
             return await runShell(env, rootCanonical, "Bash", command, msTimeoutToRequestedSec(timeout), timeoutCapsSecView, ctx.signal, undefined, undefined, true);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.17.5",
+  "version": "7.17.6",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.17.5.json

@@ -2,7 +2,7 @@
   "repo": "core",
   "version": "7.17.5",
   "from": "dd51253ac702ab232224dac50de33eb0dd09e40f",
-  "to": "99b9ef8d61e5b2a67d62ec6a6cdf65e831c4752f",
+  "to": "3dfd4ff66bfd1c6ea217fa251d2f28df79052f87",
   "added": [],
   "removed": [],
   "changed": [],
@@ -60,7 +60,7 @@
     "cli": [],
     "server": [],
     "sdk": [],
-    "note": "scanned cli@846136de server@82cf402c sdk@6910789 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+    "note": "scanned cli@0a45f646 server@82cf402c sdk@6910789 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
   },
   "breakingCount": 0,
   "breakingItems": []