@sema-agent/core 7.17.5 → 7.17.7

package/dist/core/runner/prepare-hands-readface.js

@@ -1,7 +1,7 @@
 import { emitTrace } from "../trace.js";
 import { StubExecutionEnv } from "../stub-env.js";
 import { hasBackgroundShell } from "../background-shell.js";
-import { isRemoteExecutionEnv } from "../remote-env.js";
+import { boundaryIsTheSandbox } from "../remote-env.js";
 import { defaultTaskRegistry } from "../task-registry.js";
 import { bashReadBoundaryProbe, bashReversibilityProbe, compileReadDeny, createHandsToolkit, deploymentReadFaceClampNotice, pdfModelCapabilitiesOf, resolveReadDenyBuiltins, inheritSessionReadFileState, resolveReadFace, seedReadFileStateFromContext, seedReadFileStateFromTranscript, } from "../../tools/fs/index.js";
 import { resolveKey, sha256 } from "../../tools/fs/safety.js";
@@ -355,7 +355,7 @@ export async function prepareHandsMount(input) {
         if (!(executionEnv instanceof StubExecutionEnv) && spec.handsReadOnly !== true) {
             if (shellGate === "off") {
                 deps.onError?.(new Error(`shell gate doctrine is "off" while a real writable shell (Bash) is mounted — the read boundary is ` +
-                    `still judged on every command (a deny-listed or out-of-root read asks; the ask is mandated${isRemoteExecutionEnv(executionEnv) ? "" : "; a read that only leaves the roots after symlink resolution is refused before it runs"}), but no ` +
+                    `still judged on every command (a deny-listed or out-of-root read asks; the ask is mandated${boundaryIsTheSandbox(executionEnv) ? "" : "; a read that only leaves the roots after symlink resolution is refused before it runs"}), but no ` +
                     `residual shell-risk classifier is installed: writes, egress and unknown commands are adjudicated by ` +
                     `the ordinary policy/hook chain only. Set spec.shellGate to "classify" or "always" if this deployment ` +
                     `expects doctrine-gated shell behavior.`), { phase: "config", sessionId, classification: "shell-gate-off" });

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -327,6 +327,20 @@ export interface CompoundReadonlyVerdict {
      * and miss the other.
      */
     undecidedPaths?: readonly string[];
+    /** The KERNEL spellings of the {@link checkedPaths} / {@link undecidedPaths} entries whose operand
+     *  traverses `..`: the same absolute path, `..` UNCOLLAPSED ({@link OperandSpellings.spelled}). A fold
+     *  names a different file whenever a parent step follows a symlink — `<root>/link/../x` is
+     *  `dirname(realpath(link))/x` to the kernel, `<root>/x` to the text. Absent when nothing traverses
+     *  `..`, and never a replacement: a resolving caller judges these BESIDE the folded entries, list for
+     *  list. Containment, deny judgment and every `reason` here stay decided on the FOLDED form — this file
+     *  is zero-I/O, and only a caller holding the filesystem can tell the two apart. */
+    checkedSpellings?: readonly string[];
+    /** The kernel spellings of {@link undecidedPaths} — see {@link checkedSpellings}. */
+    undecidedSpellings?: readonly string[];
+    /** The kernel spellings of {@link outOfRootPaths} — see {@link checkedSpellings}. A caller GRANTING
+     *  anything off a resolved out-of-root path judges this beside it: the two can disagree about whether
+     *  the target is back inside. */
+    outOfRootSpellings?: readonly string[];
     /**
      * Operands (written spellings) the walk could NOT resolve at all — a `~user` form, a `~` under no declared
      * home, an argument the shell rewrites (brace/variable/command expansion), a `cd` target it cannot follow
@@ -401,6 +415,20 @@ export declare function formatOutOfRootReadApprovalOption(directory: string): st
  *  has no filesystem and stays lexical, and a REMOTE env keeps the lexical behaviour (its
  *  `canonicalPath` is an RPC per candidate). */
 export declare function resolveOperandLexically(base: string | undefined, operand: string, homeDir: string | undefined): string | undefined;
+/** One operand's two absolute spellings. `folded` has its `..` collapsed in the TEXT and is the
+ *  containment answer — every root comparison, deny judgment and verdict field here is built from it.
+ *  `spelled` keeps those segments, the walk the KERNEL performs: each prefix resolves (symlinks included)
+ *  BEFORE a parent step applies, so `<root>/link/../x` names `dirname(realpath(link))/x`. Present ONLY
+ *  when the operand traverses `..`; a filesystem-resolving caller judges it BESIDE the folded form. */
+export interface OperandSpellings {
+    /** The `..`-collapsed absolute path — what containment is decided on. */
+    folded: string;
+    /** The uncollapsed absolute path, when the operand traverses `..`. */
+    spelled?: string;
+}
+/** Resolve one operand into {@link OperandSpellings}, or `undefined` on the same unresolvable operands
+ *  {@link resolveOperandLexically} reports (it is this function's folded half). */
+export declare function resolveOperandSpellings(base: string | undefined, operand: string, homeDir: string | undefined): OperandSpellings | undefined;
 /** Whether a command the grammar gate REFUSED WHOLE may READ a file the boundary never judged. The answer is the
  *  complement of a WHITELIST: the command is exempt only when every part of it is a shape the scan fully understands
  *  and none of those shapes reads a file outside the walk's reach — everything else is read evidence, so a token the