@sema-agent/core 7.17.6 → 7.17.7

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 7.17.7 — 2026-09-15
+
+### Narrowing — an INTERPRETER whose program is argument text: the argument-as-program family gains its fourth member (#791; @server @cli @test)
+- **Before.** Three shapes were modelled: shell re-entry (`sh -c …` — the argument IS the command line), argv re-entry (`xargs cat` — the operands arrive on a stream) and a verb's script slot (`sed -n '1r <file>'`). The fourth was not. An interpreter's program can arrive as an option's value (`perl -e '…'`, `python3 -c '…'`, `node --eval '…'`), as the first operand (the awk family, whose program is mandatory unless `-f` names a file), or on STANDARD INPUT when the command line names none — and in each case the reads it performs are decided by text nobody parsed. An unparenthesized program is ONE folded token that is not path-shaped, so it fell through the ordinary operand scan and any absolute path inside it was never a candidate. Measured on the real load path under the default doctrine, each at zero asks and EXECUTED: `perl -e '…'`, `perl -pe '…' <file>`, `perl -ne '…' <file>`, `ruby -e '…'`, `php -r '…'`, `node -p '…'`, `node -pe '…'`, `<program> | tclsh`, `awk '{print}' <file>`, `awk 'NR==1' <file>`, `gawk '{print}' <file>`. Spellings carrying `(`/`)`/`$` (`python3 -c 'print(open("x").read())'`, `node -e '…readFileSync…'`) were already refused by the generic punctuation gate, which is why the defect looked narrower than it was.
+- **After (one table, one mint point, the family's existing sentence).** A row per interpreter declares how it receives its program: the options whose value is program TEXT (`-e`, `-c`, `--eval`, `--run`, single-dash `-cmd`), the short letters that introduce it inside a bundle (`-pe`, `-lne`, `-uc`, `-0777e`), the options whose value NAMES the program (a script file, a module), the letters whose value is the rest of the token (so a bundle scan stops there rather than reading an `-e` out of a directory name), the letters that make THAT interpreter print and exit, which OPERAND holds the program and whether it is text or a file, and whether an invocation naming no program reads one from standard input. An invocation carrying program text is refused WHOLE with the family's template (`command "X" runs its argument as an interpreted program, which this walk does not judge — not auto-allowed`); one that names no program at all is refused with the second half of the same answer (`… reads the program it runs from its standard input …`). Twenty-six rows today — perl, ruby, python, node/nodejs, php, lua/luajit, tclsh, wish, expect, awk/gawk/mawk/nawk, jq, bc, dc, sqlite3, psql, osascript, Rscript, julia, ghci, groovy, bun — and a versioned spelling (`python3`, `python3.11`, `perl5.36`, `tclsh8.6`) is the same row.
+- **Every doubt resolves in the REFUSING direction, and each way it can arise is declared.** A letter this file has no row for does NOT end a bundle scan (`perl -fe '…'` carries an `-e`), a DIGIT never ends one either (it is the numeric payload of the letter in front of it — `perl -0777e '…'`, `ruby -0e '…'`), a letter whose value can only be ATTACHED takes nothing from the next token (`perl -C -e '…'` runs the `-e`; reading `-e` as `-C`'s value swallowed it), a letter whose value IS the next token consumes it so it cannot be mistaken for an operand or for `--` (`perl -I -- -e '…'`; `python3 -W ignore` names no program and reads one from stdin), a lone `-` is the stdin marker wherever it stands including past `--` — except on a row whose operand is program text, where it is a DATA stream (`jq -f <filter> -`) — and a program-file option whose VALUE is `-` (`awk -f -`) is stdin rather than a file. An INITIALIZATION file is supplemental and does not name the program (`sqlite3 -init <file> <db> '<sql>'` still carries SQL, and without it still reads SQL from its input), an INTERACTIVE switch outranks both a banner and a named script (`lua -v -i`, `lua -i <script>`), and an interpreter whose operands are MODULES it loads never has one name the program (`ghci <module>` still reads commands from its input, and `ghci <module> -e '…'` still carries the `-e`).
+- **Four rows the intake sweep filled in, each measured as a false refusal first.** A long option whose VALUE the row declares no longer turns the script behind it into a word of unknown arity (`node --import tsx app.ts`, `--loader`, `--experimental-loader`, `--require`, `--env-file`); a MODE that names what runs takes no value and reads no program from its input (`node --test`, and `--check` as a plain switch); a LINT switch leaves the file operand naming the program (`php -l <file>`); and the C shell family joins the shell re-entry spellings, since `csh -c '…'` and `tcsh -c '…'` run their argument exactly as `sh -c` does.
+- **Where the interpreter stops reading its OWN options is declared too, in both directions.** Past the word that NAMES the program every remaining word belongs to that program — `node app.js -p 3000`, `python3 script.py -c config.json` and `python3 -m unittest -c` keep their old verdict — but only while every option behind it was one the row EXPLAINS. After an option of unknown arity the following word may be that option's value rather than the script, so the search for program text runs to the end instead: `ruby --encoding UTF-8 -e '…'` is the mandated ask it should be, while `node --inspect app.js` and `python3 -u script.py -c x` are untouched.
+- **What is judged is PRESENCE, never CONTENT.** A quoted program is one word to this file's lexer and its contents are never parsed, so the only answerable question is "is there a program this walk did not read". `node -e 'console.log(1)'` therefore refuses with the rest: telling it apart from a program that opens a file needs a parser per language, which is the thing a lexical floor must not grow. This is the same doctrine that keeps the sed recognizer on sed's own closed grammar rather than on a character blacklist, and it is pinned in both directions.
+- **Not this member, and pinned as such.** A program named as a FILE operand (`perl x.pl`, `python3 app.py`, `node app.js`, `ruby app.rb`, `tclsh script.tcl`, `awk -f prog.awk <file>`, `php -f page.php`) is a path the ordinary operand walk already judges and is untouched. So is a module (`python3 -m http.server`), an invocation that prints a banner and exits (`node --version`, `node -v`, `ruby -v`, `perl -V`, `python3 --version`, `php -v`, `lua -v`, `--help`), a fused option VALUE that merely contains a text letter (`perl -Ivendor script.pl`, `perl -i.bak script.pl`), and a text letter standing past POSIX end-of-options, where it is a FILE NAME (`perl -- -e`, `python3 -- -c`). A bundle is read left to right and STOPS at the first letter no row explains, because an option this file has no row for may consume the rest of the token.
+- **Behaviour, for consumers, and the headless lane first.** Under BOTH doctrines an interpreter carrying an inline program now asks ONCE, mandated — a stored allow rule naming the whole command line is disclosed as shadowed and does not clear it. **Under the default doctrine these ran with ZERO asks before, so on a headless or auto-mode deployment — no approver wired — the card is a REFUSAL, not a prompt.** Under `"classify"` the same invocations already asked (no interpreter is on any reader table); what changes there is that the plain ask becomes a mandated one. The affected spellings are every one listed above plus the bare interpreter (`perl`, `ruby`, `python3`, `node`, `php`, `lua`, `tclsh`, `wish`, `expect`), an explicit stdin operand (`python3 -`), and an option-only invocation that is not a banner (`python3 -u`, `perl -w`).
+- **Stated over-fire, measured rather than described — the awk family is where it lands.** Over a twenty-line corpus of everyday awk one-liners, SEVEN move from zero asks to one mandated ask: `awk '{print}' <file>`, `awk -F, '{print}' <file>`, `awk 'NR==1' <file>`, `awk 'NF' <file>`, `awk 'END{print NR}' <file>`, `gawk '{print}' <file>`, `mawk '{print}' <file>`. The other thirteen — every spelling whose program text carries `$`, `/` or a pipe, which is the overwhelming majority of real one-liners — were ALREADY mandated on both doctrines and are unchanged by this arm. awk is in the family because its program can read (`getline < "<file>"`), write (`print > "<file>"`) and spawn (`system(…)`), which is the hazard the family names; `awk -f prog.awk <file>` — the same work with the program in a file — is the unchanged spelling. Beyond awk the over-fire is the harmless inline program (`node -e 'console.log(1)'`), one approval each.
+- **A third pass, the same root, and the point where it stops — stated rather than buried.** Three adversarial passes each found more spellings of one question ("where does this interpreter stop reading its own options, and what names its program"), and each was answered by declaring more per-row data: an attached-only value letter, an interactive switch, a supplemental initialization file, a module selector that ends option processing, a banner that owns its payload, a declared plain long option. The third pass answered the structural question directly, and the answer is a boundary rather than a bug: past the word that NAMES the program the remaining words are that program's own and are exempt — and a named module or script can define program-text slots of its own (`python3 -m timeit 0` compiles and runs `0`). No amount of per-interpreter option data reaches that class. Closing it means refusing every unmodelled argument tail, which would refuse `node app.js --port 3000` and `python3 script.py --flag` along with it — an adjudication about everyday interpreter invocations, not a fix, and it is left as one.
+- **A second everyday line leaves the zero-ask floor with the jq row, and it is named rather than implied.** `jq -r .name pkg.json` and `jq . f` are mandated asks now: a jq filter is program text like any other, which is the family's rule read consistently. Measured and stated honestly in the other direction: unlike the rest of the table, jq's filter language has no general file-open and no command-execution builtin, so this row is doctrine consistency rather than a closed hazard. `jq -f <filter file> <data>` is the unchanged spelling.
+- **Scope, honestly.** The table names the interpreters this file has a row for; one it does not — `deno` (its inline program is a SUBCOMMAND, `deno eval`, a shape this option/operand model does not express), `mono`, `dotnet`, `scala`, and anything else — is judged as any other unlisted program, exactly as before. Where a row's option grammar is incomplete the cost is one ask, not a silence, because an unknown option never ends a scan: `sqlite3 -init <file> <db>` counts the option's value as an operand and therefore refuses, and `perl -Mstrict <script>` refuses because perl's module argument can carry code. `psql`'s operands are connection arguments, so it is the one row where no operand ever names the program.
+
+### Narrowing — ONE launcher option grammar, read by every reader that has to find the program word (#792; @server @cli @test)
+- **Before.** `time -p xargs cat <<< <path>` was vouched under the default doctrine while `xargs cat <<< <path>` was mandated. The launcher option grammar — the one table that declares which tokens belong to a control word rather than naming the program behind it — was read by the boundary walk's control-word strip and by the single-command boundary face, but NOT by the refused-command whitelist's own head scan. There `-p` was read as the program word, the segment was exempted as an ordinary unlisted program, and the argv re-entry standing behind it was never asked about. The same silence covered `time -f %e xargs cat <<< <path>` and `time -o <file> xargs cat <<< <path>`.
+- **After (a reuse point, not a second table).** The whitelist's head scan reads the same declared grammar, so all three program-word readers give one answer, and beneath it a floor the walk has always had: an option-shaped word is never read as a program name. A spelling the grammar deliberately does not carry — a FUSED long option (`time --format=%e …`), or an option of a launcher with no row at all (`nice -n 5 …`, `env -u X …`) — therefore leaves which program runs unreadable and is refused, which is the answer the boundary walk already gave for that condition. The readers that resolve a launcher CHAIN (`env time -p …`) deliberately still refuse rather than resolve: resolving there would turn a whole refusal into an ordinary walked segment, which is the widening direction, while every reader that does read the table only ever finds MORE program to judge.
+- **Behaviour, for consumers.** `time -p xargs cat <<< <path>` and its valued spellings are now one mandated ask on both doctrines (a refusal on a headless deployment), as the bare `xargs` spelling already was; `time -p cd <dir>` is recognized as the directory change it is; and `time --format=%e cat <file>` — a spelling the boundary walk already called unreadable — now gets that answer from the whitelist too instead of being quietly exempted. Unchanged and pinned: `time -p ls`, `time -p cat <file>`, `time -f %e cat <file>`, `time -p echo hi`, `time -o <file> ls`.
+### Narrowing — an APPLET DISPATCHER is a launcher, and the shell re-entry member is spelled by the shell (#791, the complement pass; @server @cli @test)
+- **Before.** A multi-call binary runs the applet named in its first argument, and it was on no launcher table — so nobody unwrapped it, and the program text behind it folds into words that all resolve in root. Measured at ZERO asks under the default doctrine: `busybox sh -c "cat /etc/passwd"` and `busybox ash -c "…"`, while the bare `sh -c "cat /etc/passwd"` was mandated; `busybox awk '{print}' <file>` slipped the interpreter table the same way. Separately, three spellings of the shell itself were outside the shell re-entry pattern and vouched on their own: `ash -c "…"`, `mksh -c "…"`, `yash -c "…"`.
+- **After.** The dispatcher joins the launcher table — it is already on the rule lane's own curated interpreter table, which is the list this file's launcher set is drawn from, so the pinned subset relation is unchanged — and the shell re-entry pattern spells the Almquist family and its descendants. `busybox cat <file>`, `busybox ls`, `busybox ls -la` and a bare `busybox` keep the verdict they had, and `busybox cat <outside>` is gated exactly as before. Stated over-fire: `busybox --help` puts an option where the applet name would be, which leaves what runs unreadable and refuses — one ask.
+- Pins: `test/backlog791-interpreter-inline-program.test.ts` (174 cases — the real load path on both doctrines with a planted marker and its reverse control on all four delivery shapes, the mandated-ask lane under an exact covering rule, fifty-five inline-program spellings and twenty-five stdin ones pinned on the arm's OWN sentence, forty-one negative controls plus a twenty-nine-line everyday corpus, reachability at all three faces that judge a program's own words with the redirection words dropped from the argument list, the interpreter behind a control word / a launcher / a path prefix / an applet dispatcher, and the stated over-fire pinned rather than described; SIXTEEN mutation directions measured in the header, no two of which red the same set) and four new cases in `test/backlog766-argv-reentry.test.ts` (the control word's own option against the chain, and the everyday cells the grammar keeps).
+
 ## 7.17.6 — 2026-09-14
 
 ### Narrowing — a verb whose ARGUMENT IS A PROGRAM: the sed script slot is read for the files it names and the commands it runs (#769; @server @cli @test)

package/dist/tools/fs/bash-readonly-classifier.js

@@ -253,13 +253,19 @@ function isBareControlWord(toks, i, words) {
 }
 function tokensMoveBase(toks, allow) {
     let from = 0;
-    while (from < toks.folded.length && isBareControlWord(toks, from, SHELL_CONTROL_PREFIXES))
+    while (from < toks.folded.length && isBareControlWord(toks, from, SHELL_CONTROL_PREFIXES)) {
+        const controlWord = programBasename(toks.folded[from] ?? "");
         from++;
+        for (let span = launcherOptionSpan(controlWord, toks.folded, from); span > 0; span = launcherOptionSpan(controlWord, toks.folded, from))
+            from += span;
+    }
     const head = toks.folded[from];
     if (head === undefined)
         return false;
     if (toks.raw[from] !== head)
         return true;
+    if (head.startsWith("-") && head !== "-")
+        return true;
     if (head === "cd")
         return true;
     if (!COMMAND_LAUNCHERS.has(head))
@@ -267,7 +273,7 @@ function tokensMoveBase(toks, allow) {
     const unwrapped = unwrapLauncher(toks.folded.slice(from), allow);
     return unwrapped.kind === "refused" || (unwrapped.kind === "reader" && unwrapped.head === "cd");
 }
-const SHELL_REENTRY_PROGRAM_RE = /^(?:(?:ba|z|da|k|fi)?sh|eval|source|\.|parallel)$/;
+const SHELL_REENTRY_PROGRAM_RE = /^(?:(?:ba|z|da|k|fi|a|mk|ya|pdk|c|tc)?sh|eval|source|\.|parallel)$/;
 const ARGV_REENTRY_PROGRAM_RE = /^xargs$/;
 export function refusedCommandMayRead(command, allow, boundary) {
     return !refusedCommandExempt(command, allow, boundary, 0);
@@ -474,11 +480,15 @@ function refusedCommandExempt(command, allow, boundary, depth, baseMovedOutside
             .filter((t) => t !== "");
     });
     const headIndex = (toks) => {
+        const folded = toks.map(fold);
         let i = 0;
         while (i < toks.length) {
-            const w = fold(toks[i]);
+            const w = folded[i];
             if (ASSIGNMENT_WORD.test(w) || SHELL_CONTROL_PREFIXES.has(w) || SHELL_BLOCK_WORDS.has(w) || /^[{}]$/.test(w)) {
                 i++;
+                const controlWord = programBasename(w);
+                for (let span = launcherOptionSpan(controlWord, folded, i); span > 0; span = launcherOptionSpan(controlWord, folded, i))
+                    i += span;
                 continue;
             }
             if (/^(?:<<<|<<|<|>>?|&>>?)$/.test(w)) {
@@ -580,14 +590,21 @@ function refusedCommandExempt(command, allow, boundary, depth, baseMovedOutside
         const headWord = fold(toks[i]);
         if (headWord.includes(SUBSTITUTION_PLACEHOLDER) || /[$`]/.test(headWord))
             return false;
+        if (headWord.startsWith("-") && headWord !== "-")
+            return false;
         let head = programOf(headWord);
-        if (COMMAND_LAUNCHERS.has(head)) {
+        const launcherUnwrap = COMMAND_LAUNCHERS.has(head) ? unwrapLauncher(toks.slice(i).map(fold), allow) : undefined;
+        if (launcherUnwrap?.kind === "refused")
+            return false;
+        const runs = launcherUnwrap === undefined ? { head, index: 0 } : { head: launcherUnwrap.head, index: launcherUnwrap.index };
+        if (runs.head !== undefined && runs.index !== undefined &&
+            argumentAsProgramRefusal(runs.head, runs.head, toks.slice(i + runs.index + 1).map(fold)) !== undefined)
+            return false;
+        if (launcherUnwrap !== undefined) {
             const wrapped = runProgramOf(toks, i);
             if (wrapped === undefined || /[$`]/.test(wrapped) || SHELL_REENTRY_PROGRAM_RE.test(wrapped))
                 return false;
-            const unwrapped = unwrapLauncher(toks.slice(i).map(fold), allow);
-            if (unwrapped.kind === "refused")
-                return false;
+            const unwrapped = launcherUnwrap;
             if (argvReentryUnjudged(unwrapped))
                 return false;
             if (unwrapped.kind === "unlisted") {
@@ -1159,14 +1176,273 @@ const SCRIPT_SLOT_VERBS = new Map([
             return readings.every((reading) => reading === "unparsed");
         }],
 ]);
+const INLINE_PROGRAM_TEXT = "runs its argument as an interpreted program";
+const INLINE_PROGRAM_STDIN = "reads the program it runs from its standard input";
+const INTERPRETER_BANNER_OPTIONS = new Set(["--version", "--help", "--usage", "-version", "-help"]);
+const BLANK_INLINE = {
+    longText: new Set(), longFile: new Set(), longNamesProgram: new Set(), longSupplemental: new Set(),
+    longValue: new Set(), longPlain: new Set(), fileOptionEndsOptions: false,
+    textLetters: "", fileLetters: "", separatedValueLetters: "", attachedValueLetters: "",
+    plainLetters: "", bannerLetters: "", interactiveLetters: "",
+    programOperand: { at: 0, isText: false },
+};
+const PERL_INLINE = {
+    ...BLANK_INLINE, textLetters: "eEmM", separatedValueLetters: "I", attachedValueLetters: "iCFxDV",
+    plainLetters: "nplawcsStTUWX", bannerLetters: "vVh", stdinWhenUnnamed: true,
+};
+const RUBY_INLINE = {
+    ...BLANK_INLINE, textLetters: "e", separatedValueLetters: "IrECFKT", plainLetters: "nplawcsSU",
+    bannerLetters: "vh", stdinWhenUnnamed: true,
+};
+const PYTHON_INLINE = {
+    ...BLANK_INLINE, textLetters: "c", fileLetters: "m", separatedValueLetters: "WXQ",
+    plainLetters: "uBEIsSqbdvxOtR", bannerLetters: "Vh?", interactiveLetters: "i",
+    fileOptionEndsOptions: true, stdinWhenUnnamed: true,
+};
+const NODE_INLINE = {
+    ...BLANK_INLINE, longText: new Set(["--eval", "--print"]), textLetters: "ep",
+    longValue: new Set(["--import", "--loader", "--experimental-loader", "--require", "--env-file", "--conditions", "--max-old-space-size"]),
+    longNamesProgram: new Set(["--test"]),
+    longPlain: new Set(["--inspect", "--inspect-brk", "--no-warnings", "--trace-warnings", "--watch", "--enable-source-maps", "--experimental-modules", "--no-deprecation", "--check"]),
+    separatedValueLetters: "r", plainLetters: "c", bannerLetters: "vh", interactiveLetters: "i",
+    stdinWhenUnnamed: true,
+};
+const PHP_INLINE = {
+    ...BLANK_INLINE, longText: new Set(["--run", "--process-begin", "--process-code", "--process-end"]),
+    textLetters: "rRBE", fileLetters: "fF", separatedValueLetters: "dcz", plainLetters: "nqswl",
+    bannerLetters: "vhi", interactiveLetters: "a", stdinWhenUnnamed: true,
+};
+const LUA_INLINE = {
+    ...BLANK_INLINE, textLetters: "e", separatedValueLetters: "l", bannerLetters: "vh",
+    interactiveLetters: "i", stdinWhenUnnamed: true,
+};
+const TCL_INLINE = { ...BLANK_INLINE, stdinWhenUnnamed: true };
+const EXPECT_INLINE = {
+    ...BLANK_INLINE, textLetters: "c", separatedValueLetters: "Db", plainLetters: "dN",
+    bannerLetters: "vh", interactiveLetters: "i", stdinWhenUnnamed: true,
+};
+const AWK_INLINE = {
+    ...BLANK_INLINE, longText: new Set(["--source"]), textLetters: "e",
+    longFile: new Set(["--file", "--exec"]), fileLetters: "fE", separatedValueLetters: "vF",
+    bannerLetters: "V", programOperand: { at: 0, isText: true }, stdinWhenUnnamed: false,
+};
+const JQ_INLINE = {
+    ...BLANK_INLINE, longFile: new Set(["--from-file"]), fileLetters: "f", separatedValueLetters: "L",
+    plainLetters: "nrjcsSaCMRe", bannerLetters: "h", programOperand: { at: 0, isText: true },
+    stdinWhenUnnamed: false,
+};
+const BC_INLINE = {
+    ...BLANK_INLINE, longText: new Set(["--expression"]), textLetters: "e", plainLetters: "lqsw",
+    bannerLetters: "vh", interactiveLetters: "i", programOperand: undefined, stdinWhenUnnamed: true,
+};
+const DC_INLINE = {
+    ...BLANK_INLINE, longText: new Set(["--expression"]), textLetters: "e",
+    longFile: new Set(["--file"]), fileLetters: "f", bannerLetters: "hV",
+    programOperand: undefined, stdinWhenUnnamed: true,
+};
+const SQLITE_INLINE = {
+    ...BLANK_INLINE, longText: new Set(["-cmd"]), longSupplemental: new Set(["-init"]),
+    programOperand: { at: 1, isText: true }, stdinWhenUnnamed: true,
+};
+const PSQL_INLINE = {
+    ...BLANK_INLINE, longText: new Set(["--command"]), textLetters: "c",
+    longFile: new Set(["--file"]), fileLetters: "f", separatedValueLetters: "hpUdoF",
+    plainLetters: "aeEqtxXwW", bannerLetters: "lV?", programOperand: undefined, stdinWhenUnnamed: true,
+};
+const OSASCRIPT_INLINE = {
+    ...BLANK_INLINE, textLetters: "e", separatedValueLetters: "ls", plainLetters: "i", bannerLetters: "h",
+    stdinWhenUnnamed: true,
+};
+const RSCRIPT_INLINE = {
+    ...BLANK_INLINE, textLetters: "e", bannerLetters: "h", stdinWhenUnnamed: false,
+};
+const JULIA_INLINE = {
+    ...BLANK_INLINE, longText: new Set(["--eval", "--print"]), textLetters: "eE",
+    separatedValueLetters: "JLp", plainLetters: "q", bannerLetters: "vh", interactiveLetters: "i",
+    stdinWhenUnnamed: true,
+};
+const GHCI_INLINE = {
+    ...BLANK_INLINE, textLetters: "e", separatedValueLetters: "io", programOperand: undefined,
+    stdinWhenUnnamed: true,
+};
+const GROOVY_INLINE = {
+    ...BLANK_INLINE, textLetters: "e", separatedValueLetters: "Dcl", plainLetters: "n",
+    bannerLetters: "vh", interactiveLetters: "i", stdinWhenUnnamed: false,
+};
+const BUN_INLINE = {
+    ...BLANK_INLINE, longText: new Set(["--eval", "--print"]), textLetters: "ep",
+    separatedValueLetters: "r", bannerLetters: "vh", stdinWhenUnnamed: false,
+};
+const INTERPRETER_INLINE_PROGRAMS = new Map([
+    ["perl", PERL_INLINE],
+    ["ruby", RUBY_INLINE],
+    ["python", PYTHON_INLINE],
+    ["node", NODE_INLINE],
+    ["nodejs", NODE_INLINE],
+    ["php", PHP_INLINE],
+    ["lua", LUA_INLINE],
+    ["luajit", LUA_INLINE],
+    ["tclsh", TCL_INLINE],
+    ["wish", TCL_INLINE],
+    ["expect", EXPECT_INLINE],
+    ["awk", AWK_INLINE],
+    ["gawk", AWK_INLINE],
+    ["mawk", AWK_INLINE],
+    ["nawk", AWK_INLINE],
+    ["jq", JQ_INLINE],
+    ["bc", BC_INLINE],
+    ["dc", DC_INLINE],
+    ["sqlite", SQLITE_INLINE],
+    ["psql", PSQL_INLINE],
+    ["osascript", OSASCRIPT_INLINE],
+    ["Rscript", RSCRIPT_INLINE],
+    ["julia", JULIA_INLINE],
+    ["ghci", GHCI_INLINE],
+    ["groovy", GROOVY_INLINE],
+    ["bun", BUN_INLINE],
+]);
+function interpreterKey(name) {
+    return name.replace(/\d+(?:\.\d+)*$/, "");
+}
+function withoutRedirectionWords(args) {
+    const out = [];
+    for (let i = 0; i < args.length; i++) {
+        const t = args[i];
+        if (/^(?:<<<|<<|<|>>?|&>>?)$/.test(t)) {
+            i++;
+            continue;
+        }
+        if (/^(?:>>?|<)&\d*$/.test(t))
+            continue;
+        out.push(t);
+    }
+    return out;
+}
+function inlineProgramClause(model, args) {
+    let endOfOptions = false;
+    let banner = false;
+    let interactive = false;
+    let named = false;
+    let stdin = false;
+    let explained = true;
+    let operands = 0;
+    scan: for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (!endOfOptions && arg === "--") {
+            endOfOptions = true;
+            continue;
+        }
+        if (arg === "-") {
+            if (model.programOperand?.isText !== true)
+                stdin = true;
+            continue;
+        }
+        if (!endOfOptions && arg.startsWith("-")) {
+            const eq = arg.indexOf("=");
+            const whole = eq < 0 ? arg : arg.slice(0, eq);
+            const valueOf = () => (eq < 0 ? args[++i] : arg.slice(eq + 1));
+            if (model.longText.has(whole))
+                return INLINE_PROGRAM_TEXT;
+            if (model.longFile.has(whole)) {
+                if (valueOf() === "-") {
+                    stdin = true;
+                    continue;
+                }
+                named = true;
+                if (explained && model.fileOptionEndsOptions)
+                    break scan;
+                continue;
+            }
+            if (model.longNamesProgram.has(whole)) {
+                named = true;
+                continue;
+            }
+            if (model.longSupplemental.has(whole)) {
+                valueOf();
+                continue;
+            }
+            if (INTERPRETER_BANNER_OPTIONS.has(whole)) {
+                banner = true;
+                continue;
+            }
+            if (model.longValue.has(whole)) {
+                valueOf();
+                continue;
+            }
+            if (model.longPlain.has(whole))
+                continue;
+            if (arg.startsWith("--")) {
+                if (eq < 0)
+                    explained = false;
+                continue;
+            }
+            for (let k = 1; k < arg.length; k++) {
+                const ch = arg[k];
+                if (ch >= "0" && ch <= "9")
+                    continue;
+                if (model.textLetters.includes(ch))
+                    return INLINE_PROGRAM_TEXT;
+                if (model.fileLetters.includes(ch)) {
+                    const value = k + 1 < arg.length ? arg.slice(k + 1) : args[++i];
+                    if (value === "-") {
+                        stdin = true;
+                        break;
+                    }
+                    named = true;
+                    if (explained && model.fileOptionEndsOptions)
+                        break scan;
+                    break;
+                }
+                if (model.attachedValueLetters.includes(ch)) {
+                    if (model.bannerLetters.includes(ch))
+                        banner = true;
+                    break;
+                }
+                if (model.bannerLetters.includes(ch)) {
+                    banner = true;
+                    continue;
+                }
+                if (model.interactiveLetters.includes(ch)) {
+                    interactive = true;
+                    continue;
+                }
+                if (model.separatedValueLetters.includes(ch)) {
+                    if (k + 1 >= arg.length)
+                        i++;
+                    break;
+                }
+                if (!model.plainLetters.includes(ch))
+                    explained = false;
+            }
+            continue;
+        }
+        operands++;
+        if (!named && explained && model.programOperand !== undefined && operands === model.programOperand.at + 1) {
+            if (model.programOperand.isText)
+                return INLINE_PROGRAM_TEXT;
+            named = true;
+            break;
+        }
+    }
+    if (stdin || interactive)
+        return INLINE_PROGRAM_STDIN;
+    if (named || banner)
+        return undefined;
+    return model.stdinWhenUnnamed ? INLINE_PROGRAM_STDIN : undefined;
+}
 function unjudgedProgramTextRefusal(written, clause) {
     return `command "${written}" ${clause}, which this walk does not judge ${NOT_AUTO_ALLOWED}`;
 }
-function scriptSlotRefusal(written, name, args) {
-    const recognizer = SCRIPT_SLOT_VERBS.get(name);
-    if (recognizer === undefined || !recognizer(args))
+function argumentAsProgramRefusal(written, name, args) {
+    const slot = SCRIPT_SLOT_VERBS.get(name);
+    if (slot !== undefined && slot(args)) {
+        return unjudgedProgramTextRefusal(written, "names files or runs commands inside its script text");
+    }
+    const interpreter = INTERPRETER_INLINE_PROGRAMS.get(interpreterKey(name));
+    if (interpreter === undefined)
         return undefined;
-    return unjudgedProgramTextRefusal(written, "names files or runs commands inside its script text");
+    const clause = inlineProgramClause(interpreter, withoutRedirectionWords(args));
+    return clause === undefined ? undefined : unjudgedProgramTextRefusal(written, clause);
 }
 function guardedVerbFormReason(name, toks, raw) {
     if (name === "find") {
@@ -1590,9 +1866,9 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
             return { reason: launcherUnwrap.reason, refusedWhole: true };
         const runs = launcherUnwrap === undefined ? { head: name, index: 0 } : { head: launcherUnwrap.head, index: launcherUnwrap.index };
         if (runs?.head !== undefined && runs.index !== undefined) {
-            const slotRefusal = scriptSlotRefusal(runs.head, runs.head, folded.slice(from + runs.index + 1));
-            if (slotRefusal !== undefined)
-                return { reason: slotRefusal, refusedWhole: true };
+            const familyRefusal = argumentAsProgramRefusal(runs.head, runs.head, folded.slice(from + runs.index + 1));
+            if (familyRefusal !== undefined)
+                return { reason: familyRefusal, refusedWhole: true };
         }
         if (allow.has(name)) {
             if (pathPrefixed || from > 0)
@@ -1958,9 +2234,9 @@ export function classifySimpleCommandReadBoundary(command, boundary) {
     if (runs.kind === "refused")
         return { reason: runs.reason, refusedWhole: true };
     if (runs.head !== undefined && runs.index !== undefined) {
-        const slotRefusal = scriptSlotRefusal(runs.head, runs.head, toks.folded.slice(runs.index + past + 1));
-        if (slotRefusal !== undefined)
-            return { reason: slotRefusal, refusedWhole: true };
+        const familyRefusal = argumentAsProgramRefusal(runs.head, runs.head, toks.folded.slice(runs.index + past + 1));
+        if (familyRefusal !== undefined)
+            return { reason: familyRefusal, refusedWhole: true };
     }
     return evaluateReadBoundary([toks], boundary);
 }
@@ -1976,7 +2252,7 @@ function whitelistReadsTheSameWords(command, outsideHeredocBodies) {
 }
 const UNMODELLED_BASE_MOVERS = new Set(["pushd", "popd"]);
 const COMMAND_LAUNCHERS = new Set([
-    "env", "command", "builtin", "exec", "noglob", "xargs",
+    "env", "command", "builtin", "exec", "noglob", "xargs", "busybox",
     "sudo", "doas", "pkexec", "su", "runuser", "chroot", "setpriv",
     "nohup", "nice", "ionice", "chrt", "taskset", "stdbuf", "timeout", "time", "watch",
     "setsid", "flock", "unshare", "nsenter", "script", "numactl", "prlimit", "systemd-run",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.17.6",
+  "version": "7.17.7",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.17.6.json

@@ -0,0 +1,81 @@
+{
+  "repo": "core",
+  "version": "7.17.6",
+  "from": "3dfd4ff66bfd1c6ea217fa251d2f28df79052f87",
+  "to": "adb5afdddf8b01be7b9b8a8394251eea7fe2ee19",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "Narrowing — the execute-time canonical recheck now answers for a GLOB's expansion (#775; B-109; test [7201]): the full Bash face hands the boundary's `undecidedPaths` (the operands the shell will expand) to the same expander the `bash_readonly` face already used, so a pattern that expands to a target outside the roots is refused before spawn; an expansion that cannot be established (uncompilable segment, >256 directories, >8192 names, an unreadable directory) is refused too."
+    },
+    {
+      "id": "F2",
+      "source": "behaviorFlips.summary",
+      "text": "Narrowing — a `..` taken AFTER a symlink is judged where the kernel takes it (#770; B-110; test [7203]): the lexical walk folds `..` for its containment verdict as before, but the recheck now receives the operand's UNFOLDED spelling and resolves it segment by segment (realpath the prefix, THEN take the parent), so `<link>/../x` is refused when the link's target parent is outside every read root."
+    },
+    {
+      "id": "F3",
+      "source": "behaviorFlips.summary",
+      "text": "Narrowing — `sed`'s SCRIPT SLOT is judged as an argument-as-program (#769; test [7180] candidate 7): a sed script that names a file or runs a command (`r`/`R`/`w`/`W`/`e` commands, `s///w FILE`, `s///e`) or a script the walk cannot see (`-f FILE`/`--file=`) refuses the command whole (mandated), under the same rule as shell re-entry and argv re-entry."
+    },
+    {
+      "id": "F5",
+      "source": "behaviorFlips.summary",
+      "text": "Narrowing — the execute-time read boundary asks what an environment DECLARES, not what interface it implements (#782; B-115; test [7214]): the canonical recheck is skipped only when the environment declares `capabilities.isolation: true` (the sandbox is the boundary, C-R37 γ); a lane that implements the remote interface but declares no isolation (server `REMOTE_EXEC=host`, SSH hosts) now runs the recheck like an in-process env."
+    }
+  ],
+  "closedSetMembers": [],
+  "typeKeys": [
+    {
+      "type": "CompoundReadonlyVerdict",
+      "at": [
+        "src/tools/fs/bash-readonly-classifier.ts:644"
+      ],
+      "added": [
+        "checkedSpellings",
+        "outOfRootSpellings",
+        "undecidedSpellings"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.ruleOffersAbsence",
+      "assertions": [
+        "G1.a",
+        "G2.a",
+        "G3.a",
+        "G5.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "HarvestReport.rejections",
+      "assertions": [
+        "G4.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [
+      "CompoundReadonlyVerdict"
+    ],
+    "server": [
+      "CompoundReadonlyVerdict"
+    ],
+    "sdk": [],
+    "note": "scanned cli@60ea7972 server@940568c6 sdk@6910789 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}