@sema-agent/core 7.19.0 → 7.20.0

package/dist/tools/fs/bash-readonly-classifier.js

@@ -8,7 +8,10 @@ export const BASH_READONLY_DEFAULT_ALLOW = [
     "cal", "uptime", "id", "groups", "nproc", "locale", "free", "realpath", "readlink",
     "true", "false", "seq", "expr", "type", "sleep", "diff", "cmp", "comm",
 ];
-export const BASH_CLASSIFY_DEFAULT_ALLOW = [...BASH_READONLY_DEFAULT_ALLOW, "find", "sed", "cd"];
+export const BASH_CLASSIFY_EXTRA_ALLOW = ["find", "sed", "cd"];
+export function bashClassifyDefaultAllow() {
+    return [...BASH_READONLY_DEFAULT_ALLOW, ...BASH_CLASSIFY_EXTRA_ALLOW];
+}
 const SHELL_OPERATORS = /[;&|<>$()`\n\r\\]/;
 function hasBareShellOperator(s, quotedOperatorsAreText) {
     if (!quotedOperatorsAreText)
@@ -446,18 +449,6 @@ function isGrepPatternFlagToken(tok) {
     }
     return /^-[A-Za-z0-9]*[ef]/.test(tok);
 }
-function isGrepPatternPayloadLongOption(tok) {
-    if (!tok.includes("="))
-        return false;
-    const name = longOptionNameOf(tok);
-    return name !== undefined && isLongOptionAbbrevOf(name, "regexp");
-}
-function isCutDelimiterPayloadLongOption(tok) {
-    if (!tok.includes("="))
-        return false;
-    const name = longOptionNameOf(tok);
-    return name !== undefined && (isLongOptionAbbrevOf(name, "delimiter") || isLongOptionAbbrevOf(name, "output-delimiter"));
-}
 function isGrepClusterFileStdin(tok) {
     if (tok.startsWith("--") || !/^-[A-Za-z0-9]/.test(tok))
         return false;
@@ -472,6 +463,283 @@ function isGrepClusterFileStdin(tok) {
     }
     return false;
 }
+function valueNamesAFile(kind) {
+    return kind === "path" || kind === "indirect" || kind === "form" || kind === "header" || kind === "url";
+}
+function widestValueKind(kinds) {
+    if (kinds.has("indirect"))
+        return "indirect";
+    if (kinds.has("path"))
+        return "path";
+    if (kinds.has("form"))
+        return "form";
+    if (kinds.has("header"))
+        return "header";
+    if (kinds.has("url"))
+        return "url";
+    return [...kinds][0];
+}
+const VERB_OPTION_SLOTS = {
+    head: {
+        shortValue: { c: "count", n: "count" },
+        shortPlain: "qvz",
+        longValue: { bytes: "count", lines: "count" },
+        longOptionalValue: {},
+        longPlain: ["help", "quiet", "silent", "verbose", "version", "zero-terminated"],
+    },
+    tail: {
+        shortValue: { b: "count", c: "count", n: "count", s: "count" },
+        shortPlain: "fFqvz",
+        longValue: { bytes: "count", lines: "count", "max-unchanged-stats": "count", pid: "count", "sleep-interval": "count" },
+        longOptionalValue: { follow: "label" },
+        longPlain: ["help", "quiet", "retry", "silent", "verbose", "version", "zero-terminated"],
+    },
+    cut: {
+        shortValue: { b: "count", c: "count", d: "delimiter", f: "count" },
+        shortPlain: "nsz",
+        longValue: { bytes: "count", characters: "count", delimiter: "delimiter", fields: "count", "output-delimiter": "delimiter" },
+        longOptionalValue: {},
+        longPlain: ["complement", "help", "only-delimited", "version", "zero-terminated"],
+    },
+    grep: {
+        shortValue: { A: "count", B: "count", C: "count", D: "label", d: "label", e: "pattern", f: "path", m: "count" },
+        shortPlain: "0123456789abcEFGhHiIlLnoPqrRsUvVwxyzZ",
+        longValue: {
+            "after-context": "count",
+            "before-context": "count",
+            "binary-files": "label",
+            devices: "label",
+            directories: "label",
+            exclude: "name-pattern",
+            "exclude-dir": "name-pattern",
+            "exclude-from": "path",
+            file: "path",
+            "group-separator": "label",
+            include: "name-pattern",
+            label: "label",
+            "max-count": "count",
+            regexp: "pattern",
+        },
+        longOptionalValue: { color: "label", colour: "label", context: "count" },
+        longPlain: [
+            "basic-regexp", "byte-offset", "count", "dereference-recursive", "extended-regexp",
+            "files-with-matches", "files-without-match", "fixed-strings", "help", "ignore-case", "initial-tab",
+            "invert-match", "line-buffered", "line-number", "line-regexp", "no-filename", "no-group-separator",
+            "no-messages", "null", "null-data", "only-matching", "perl-regexp", "quiet", "recursive", "silent",
+            "text", "version", "with-filename", "word-regexp",
+        ],
+    },
+    diff: {
+        shortValue: { C: "count", D: "label", F: "pattern", I: "pattern", L: "label", S: "path", U: "count", W: "count", X: "path", x: "name-pattern" },
+        shortPlain: "abBcdeEHilnNpqrstTuvwyZ",
+        longValue: {
+            exclude: "name-pattern",
+            "exclude-from": "path",
+            "from-file": "path",
+            "horizon-lines": "count",
+            ifdef: "label",
+            "ignore-matching-lines": "pattern",
+            label: "label",
+            "show-function-line": "pattern",
+            "starting-file": "path",
+            tabsize: "count",
+            "to-file": "path",
+            width: "count",
+        },
+        longOptionalValue: { color: "label", context: "count", unified: "count" },
+        longPlain: [
+            "brief", "ed", "expand-tabs", "help", "ignore-all-space", "ignore-blank-lines", "ignore-case",
+            "ignore-space-change", "ignore-tab-expansion", "ignore-trailing-space", "initial-tab", "minimal",
+            "new-file", "normal", "paginate", "recursive", "report-identical-files", "rcs", "show-c-function",
+            "side-by-side", "speed-large-files", "suppress-blank-empty", "text", "version",
+        ],
+    },
+    cmp: {
+        shortValue: { i: "count", n: "count" },
+        shortPlain: "blsv",
+        longValue: { bytes: "count", "ignore-initial": "count" },
+        longOptionalValue: {},
+        longPlain: ["help", "print-bytes", "quiet", "silent", "verbose", "version"],
+    },
+    sed: {
+        shortValue: { e: "script", f: "path" },
+        shortPlain: "nrEszu",
+        longValue: { expression: "script", file: "path", "line-length": "count" },
+        longOptionalValue: { "in-place": "label" },
+        longPlain: [
+            "debug", "follow-symlinks", "help", "null-data", "posix", "quiet", "regexp-extended", "sandbox",
+            "separate", "silent", "unbuffered", "version", "zero-terminated",
+        ],
+    },
+    date: {
+        shortValue: { d: "count", f: "path", r: "path", s: "count" },
+        shortPlain: "uR",
+        longValue: { date: "count", file: "path", reference: "path", "rfc-3339": "count", set: "count" },
+        longOptionalValue: { "iso-8601": "label" },
+        longPlain: ["debug", "help", "rfc-822", "rfc-email", "universal", "utc", "version"],
+    },
+    tar: {
+        shortValue: { b: "count", C: "path", f: "path", T: "path", X: "path" },
+        shortPlain: "acdhjJkmOpPrStuvwWxzZ",
+        longValue: {
+            "blocking-factor": "count",
+            directory: "path",
+            exclude: "name-pattern",
+            "exclude-from": "path",
+            file: "path",
+            "files-from": "path",
+            "strip-components": "count",
+        },
+        longOptionalValue: {},
+        longPlain: [
+            "absolute-names", "append", "create", "dereference", "extract", "get", "help", "interactive",
+            "keep-old-files", "list", "preserve-permissions", "sparse", "to-stdout", "touch", "update",
+            "verbose", "verify", "version",
+        ],
+    },
+    curl: {
+        shortValue: {
+            A: "label", b: "indirect", C: "count", c: "path", D: "path", d: "indirect", E: "path", e: "label",
+            F: "form", H: "header", K: "path", m: "count", o: "path", P: "label", Q: "label", r: "count",
+            T: "path", t: "label", U: "label", u: "label", w: "indirect", X: "label", x: "label", Y: "count",
+            y: "count", z: "path",
+        },
+        shortPlain: "#0123456aBfgGhiIjJklLMnNOpqRsSvVZ",
+        longValue: {
+            cacert: "path",
+            capath: "path",
+            cert: "path",
+            config: "path",
+            "connect-timeout": "count",
+            cookie: "indirect",
+            "cookie-jar": "path",
+            data: "indirect",
+            "data-ascii": "indirect",
+            "data-binary": "indirect",
+            "data-raw": "label",
+            "data-urlencode": "form",
+            "dump-header": "path",
+            form: "form",
+            "form-string": "label",
+            header: "header",
+            key: "path",
+            "max-time": "count",
+            "netrc-file": "path",
+            output: "path",
+            proxy: "label",
+            range: "count",
+            referer: "label",
+            request: "label",
+            resolve: "label",
+            trace: "path",
+            "time-cond": "path",
+            "trace-ascii": "path",
+            "upload-file": "path",
+            url: "url",
+            user: "label",
+            "user-agent": "label",
+            "write-out": "indirect",
+        },
+        longOptionalValue: {},
+        longPlain: [
+            "append", "compressed", "disable", "fail", "get", "globoff", "head", "help", "include", "insecure",
+            "junk-session-cookies", "list-only", "location", "manual", "netrc", "next", "no-buffer", "parallel",
+            "proxytunnel", "remote-header-name", "remote-name", "remote-time", "show-error", "silent",
+            "use-ascii", "verbose", "version",
+        ],
+    },
+};
+function readVerbOptionSlot(name, tok) {
+    const row = VERB_OPTION_SLOTS[name];
+    if (row === undefined)
+        return undefined;
+    if (!tok.startsWith("-") || tok === "-" || tok === "--")
+        return { form: "unexplained" };
+    if (tok.startsWith("--")) {
+        const long = longOptionNameOf(tok);
+        if (long === undefined)
+            return { form: "unexplained" };
+        const eq = tok.indexOf("=");
+        const attached = eq >= 0 ? tok.slice(eq + 1) : undefined;
+        const withValue = (kind) => attached !== undefined ? { form: "attached", value: attached, kind } : { form: "separated", kind };
+        const exact = row.longValue[long];
+        if (exact !== undefined)
+            return withValue(exact);
+        const exactOptional = row.longOptionalValue[long];
+        if (exactOptional !== undefined)
+            return attached !== undefined ? { form: "attached", value: attached, kind: exactOptional } : { form: "no-value" };
+        if (row.longPlain.includes(long))
+            return attached === undefined ? { form: "no-value" } : { form: "unexplained" };
+        const valueNames = [
+            ...Object.keys(row.longValue),
+            ...(attached !== undefined ? Object.keys(row.longOptionalValue) : []),
+        ].filter((full) => isLongOptionAbbrevOf(long, full));
+        const plainNames = [
+            ...row.longPlain,
+            ...(attached === undefined ? Object.keys(row.longOptionalValue) : []),
+        ].filter((full) => isLongOptionAbbrevOf(long, full));
+        if (valueNames.length === 0)
+            return plainNames.length > 0 && attached === undefined ? { form: "no-value" } : { form: "unexplained" };
+        const kinds = new Set(valueNames.map((full) => (row.longValue[full] ?? row.longOptionalValue[full])));
+        if (attached !== undefined)
+            return { form: "attached", value: attached, kind: widestValueKind(kinds) };
+        if (plainNames.length > 0 || kinds.size !== 1)
+            return { form: "unexplained" };
+        return withValue([...kinds][0]);
+    }
+    for (let i = 1; i < tok.length; i++) {
+        const ch = tok[i];
+        const kind = row.shortValue[ch];
+        if (kind !== undefined) {
+            const rest = tok.slice(i + 1);
+            return rest !== "" ? { form: "attached", value: rest, kind } : { form: "separated", kind };
+        }
+        if (!row.shortPlain.includes(ch))
+            return { form: "unexplained" };
+    }
+    return { form: "no-value" };
+}
+function localFileUrlPath(value) {
+    const m = /^file:(?:\/\/[^/?#]*)?(\/[^?#]*)/i.exec(value.trim());
+    if (m === null)
+        return undefined;
+    const raw = m[1];
+    try {
+        return decodeURIComponent(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+function formSpecFileNames(value) {
+    const out = [];
+    const after = (s) => {
+        const at = s.search(/[@<]/);
+        if (at !== -1 && at < s.length - 1)
+            out.push(s.slice(at + 1));
+    };
+    after(value);
+    for (const part of value.split(/[;,]/))
+        after(part);
+    return [...new Set(out)];
+}
+function slotValueCandidates(value, kind) {
+    if (!valueNamesAFile(kind))
+        return [];
+    if (kind === "url") {
+        const local = localFileUrlPath(value);
+        return local !== undefined ? [local] : [];
+    }
+    if (kind === "form")
+        return formSpecFileNames(value).map(literalTildeSpelling);
+    const named = value.startsWith("@") && value.length > 1 ? literalTildeSpelling(value.slice(1)) : undefined;
+    if (kind === "header")
+        return named !== undefined ? [value, named] : [];
+    const out = [value];
+    if (kind === "indirect" && named !== undefined)
+        out.push(named);
+    return out;
+}
 const SEPARATED_VALUE_OPTIONS = {
     head: { short: "cn", long: ["bytes", "lines"] },
     tail: { short: "cns", long: ["bytes", "lines", "sleep-interval", "pid", "max-unchanged-stats"] },
@@ -1248,17 +1516,6 @@ function isGrepFileStdinLongOption(tok) {
     return name !== undefined && isLongOptionAbbrevOf(name, "file");
 }
 const CLUSTER_OPTION_CHAR = /[A-Za-z0-9]/;
-function grepClusterValueOwner(tok) {
-    if (!tok.startsWith("-") || tok.startsWith("--") || !CLUSTER_OPTION_CHAR.test(tok[1] ?? ""))
-        return undefined;
-    for (const ch of tok.slice(1)) {
-        if (ch === "e" || ch === "f")
-            return ch;
-        if (!CLUSTER_OPTION_CHAR.test(ch))
-            return undefined;
-    }
-    return undefined;
-}
 function attachedOptionPayloads(tok) {
     const literal = literalTildeSpelling;
     const out = [];
@@ -1282,6 +1539,7 @@ function attachedOptionPayloads(tok) {
 }
 function collectSegmentBoundaryFindings(tokens, boundary) {
     const name = tokens.folded[0];
+    const slotVerb = tokens.slotVerb ?? name;
     if (NO_PATH_OPERAND_COMMANDS.has(name))
         return [];
     const args = tokens.folded.slice(1);
@@ -1328,6 +1586,8 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
         const eoo = args.indexOf("--");
         const patternSuppliedByFlag = name === "grep" && (eoo === -1 ? args : args.slice(0, eoo)).some(isGrepPatternFlagToken);
         let sawOperand = false;
+        const argvOperandsStartAt = tokens.slotVerb !== undefined ? 1 : 0;
+        let sawArgvOperand = false;
         let endOfOptions = false;
         for (let k = 0; k < args.length; k++) {
             const t = args[k];
@@ -1338,15 +1598,35 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
                     endOfOptions = true;
                     continue;
                 }
-                if (name === "cut" && (t === "-d" || t === "--delimiter" || t === "--output-delimiter")) {
-                    k++;
-                    continue;
-                }
-                if (name === "cut" && (/^-d./.test(t) || isCutDelimiterPayloadLongOption(t)))
-                    continue;
-                if (name === "grep" && (grepClusterValueOwner(t) === "e" || isGrepPatternPayloadLongOption(t)))
-                    continue;
                 if (t.startsWith("-") && t !== "-") {
+                    const slot = readVerbOptionSlot(slotVerb, t);
+                    if (sawArgvOperand) {
+                        judgeOperand(t, argGlobs(k));
+                        if (slot !== undefined && slot.form === "separated") {
+                            const ahead = args[k + 1];
+                            if (ahead !== undefined && !expandingArgs.has(k + 1)) {
+                                for (const c of slotValueCandidates(ahead, slot.kind))
+                                    judgeOperand(c, argGlobs(k + 1));
+                            }
+                        }
+                    }
+                    if (slot !== undefined && slot.form !== "unexplained" && !(slot.form === "separated" && sawArgvOperand)) {
+                        if (slot.form === "attached") {
+                            for (const c of slotValueCandidates(literalTildeSpelling(slot.value), slot.kind))
+                                judgeOperand(c, argGlobs(k));
+                        }
+                        else if (slot.form === "separated") {
+                            const value = args[++k];
+                            if (value !== undefined && !expandingArgs.has(k)) {
+                                const named = slotValueCandidates(value, slot.kind);
+                                for (const c of named)
+                                    judgeOperand(c, argGlobs(k));
+                                if (named.length > 0)
+                                    positionalOperands.push(value);
+                            }
+                        }
+                        continue;
+                    }
                     for (const payload of attachedOptionPayloads(t))
                         judgeOperand(payload, argGlobs(k));
                     continue;
@@ -1354,6 +1634,8 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
             }
             const isGrepPatternSlot = name === "grep" && !patternSuppliedByFlag && !sawOperand;
             sawOperand = true;
+            if (k >= argvOperandsStartAt)
+                sawArgvOperand = true;
             if (t === "-") {
                 if (isGrepPatternSlot)
                     continue;
@@ -1584,7 +1866,7 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
             const unlisted = tokenizeSegment(segments[si]);
             if (unlisted.folded.length === 0)
                 continue;
-            foldedSegments.push({ folded: [LAUNCHER_SCAN_HEAD, ...unlisted.folded], raw: [LAUNCHER_SCAN_HEAD, ...unlisted.raw] });
+            foldedSegments.push({ folded: [LAUNCHER_SCAN_HEAD, ...unlisted.folded], raw: [LAUNCHER_SCAN_HEAD, ...unlisted.raw], slotVerb: programBasename(unlisted.folded[0]) });
             pushReach();
             continue;
         }
@@ -1734,7 +2016,7 @@ function evaluateReadBoundary(foldedSegments, boundary, mintGrantCandidate, reac
         if (si > 0 && reach?.[si]?.andJoined !== true)
             andRunStart = reach?.[si]?.orBroken === true ? si + 1 : si;
         const reachable = candidates.filter((c) => c.skippedCd < andRunStart);
-        const row = findingsRowFor(JSON.stringify([toks.folded, toks.raw]));
+        const row = findingsRowFor(JSON.stringify([toks.folded, toks.raw, toks.slotVerb]));
         for (const { base: currentBase } of reachable) {
             for (const finding of findingsFor(row, toks, currentBase)) {
                 if (finding.kind === "unresolvable") {
@@ -1929,7 +2211,7 @@ export function classifyOutOfRootReadGate(command, allow, boundary) {
             if (UNMODELLED_BASE_MOVERS.has(name))
                 baseMoved = true;
             if (!allow.has(name) && name !== "cd") {
-                pushReader({ folded: [LAUNCHER_SCAN_HEAD, ...toks.folded.slice(i)], raw: [LAUNCHER_SCAN_HEAD, ...toks.raw.slice(i)] });
+                pushReader({ folded: [LAUNCHER_SCAN_HEAD, ...toks.folded.slice(i)], raw: [LAUNCHER_SCAN_HEAD, ...toks.raw.slice(i)], slotVerb: name });
                 continue;
             }
             pushReader(i === 0 && name === written ? toks : { folded: [name, ...toks.folded.slice(i + 1)], raw: [toks.raw[i] ?? name, ...toks.raw.slice(i + 1)] });

package/dist/tools/fs/fs-bash.d.ts

@@ -100,7 +100,7 @@ export declare function bashReversibilityProbe(allow?: readonly string[], bounda
  * add a mandate to an ask, never originate one). The poll-loop face's structured verdict
  * ({@link classifyBoundedReadonlyPollLoopDetailed}) is read the same three ways as the compound face's.
  *
- * The reader set is the engine's classify set ({@link BASH_CLASSIFY_DEFAULT_ALLOW}) — here it is NOT an
+ * The reader set is the engine's classify set ({@link bashClassifyDefaultAllow}) — here it is NOT an
  * auto-allow list but the set of programs whose operands the faces read; a wider set means more reads are
  * judged, never that more runs are vouched.
  *

package/dist/tools/fs/fs-bash.js

@@ -9,11 +9,11 @@ import { hasBackgroundShell } from "../../core/background-shell.js";
 import { delimitUntrusted } from "../../core/untrusted-text.js";
 import { MCP_IMAGE_MAX_BASE64 } from "../../core/mcp.js";
 import { imageMagicMatches, normalizeAbsPathLexically, withinAnyRoot } from "./safety.js";
-import { boundaryIsTheSandbox, hasDestroy, isIsolated } from "../../core/remote-env.js";
+import { boundaryIsTheSandbox, canonicalPathIsAuthoritative, hasDestroy, isIsolated } from "../../core/remote-env.js";
 import { ghRateLimitHint } from "./gh-rate-limit.js";
-import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, createShellOverflowSpoolFence, shellRecoveryHint, CWD_SENTINEL, BASH_READONLY_CONFINEMENT_NOTE, } from "./fs-shared.js";
+import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, createShellOverflowSpoolFence, shellRecoveryHint, CWD_SENTINEL, stripCwdSentinel, BASH_READONLY_CONFINEMENT_NOTE, } from "./fs-shared.js";
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted } from "../../core/untrusted-text.js";
-import { BASH_CLASSIFY_DEFAULT_ALLOW, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed, classifyOutOfRootReadGate, refusedCommandMayRead, classifySimpleCommandReadBoundary, NOT_AUTO_ALLOWED, } from "./bash-readonly-classifier.js";
+import { bashClassifyDefaultAllow, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed, classifyOutOfRootReadGate, refusedCommandMayRead, classifySimpleCommandReadBoundary, NOT_AUTO_ALLOWED, } from "./bash-readonly-classifier.js";
 import { toolFace } from "../../core/tool-catalog-entries.js";
 const RECURSIVE_CAUSE_MAX_PATHS = 3;
 const RECURSIVE_READ_CAUSE_CODE = "shell.recursive_read_unbounded";
@@ -25,7 +25,7 @@ function operandFamily(paths) {
     };
 }
 export function bashReversibilityProbe(allow, boundary) {
-    const allowSet = new Set(allow ?? BASH_CLASSIFY_DEFAULT_ALLOW);
+    const allowSet = new Set(allow ?? bashClassifyDefaultAllow());
     return (args) => {
         const command = shellCommandOf(args);
         if (command === undefined)
@@ -109,7 +109,7 @@ function recursiveReadCause(detailed) {
     };
 }
 export function bashReadBoundaryProbe(boundary) {
-    const allowSet = new Set(BASH_CLASSIFY_DEFAULT_ALLOW);
+    const allowSet = new Set(bashClassifyDefaultAllow());
     return (args) => {
         const command = shellCommandOf(args);
         if (command === undefined)
@@ -402,23 +402,6 @@ function createEpilogueFilter(marker) {
         return out + buf;
     };
 }
-function readCwdEpilogue(stderr, marker) {
-    let out = "";
-    let rest = stderr;
-    let cwd;
-    for (;;) {
-        const open = rest.indexOf(marker);
-        if (open === -1)
-            break;
-        const close = rest.indexOf(marker, open + marker.length);
-        if (close === -1)
-            break;
-        out += rest.slice(0, open);
-        cwd = rest.slice(open + marker.length, close);
-        rest = rest.slice(close + marker.length);
-    }
-    return { stderr: out + rest, cwd };
-}
 function describeSafely(sink, body) {
     if (sink === undefined)
         return;
@@ -582,7 +565,7 @@ async function runShell(env, cwd, toolName, command, timeoutSec, caps, signal, c
     let { stderr } = res.value;
     const { stdout, exitCode } = res.value;
     if (cwdRef) {
-        const epilogue = readCwdEpilogue(stderr, cwdMarker);
+        const epilogue = stripCwdSentinel(stderr, cwdMarker);
         stderr = epilogue.stderr;
         if (epilogue.cwd !== undefined) {
             const captured = epilogue.cwd.trim();
@@ -736,7 +719,7 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
     const bgRetained = hasBackgroundShell(env) && env.backgroundCapabilities.retainBackgroundProcesses === true;
     const bgSessionScoped = taskOpts.sessionId !== undefined && taskOpts.taskRegistry !== undefined;
     const bgEnvIsolatedOwned = hasDestroy(env) && isIsolated(env);
-    const recheckReaders = new Set(BASH_CLASSIFY_DEFAULT_ALLOW);
+    const recheckReaders = new Set(bashClassifyDefaultAllow());
     let canonicalForRoots;
     const canonicalBoundaryFor = (roots) => {
         const key = roots.join("\u0000");
@@ -1070,6 +1053,7 @@ function pathSegmentsFrom(p, from) {
 }
 function createCanonicalReadBoundary(env, readRoots) {
     const lexicalOnly = boundaryIsTheSandbox(env);
+    const resolverIsAuthoritative = canonicalPathIsAuthoritative(env);
     let rootsOnce;
     const canonicalRoots = async (signal) => {
         rootsOnce ??= (async () => {
@@ -1229,8 +1213,11 @@ function createCanonicalReadBoundary(env, readRoots) {
             let unresolvable;
             const judge = async (p) => {
                 const real = await resolve(p, signal);
-                if (real === undefined)
+                if (real === undefined) {
+                    if (resolverIsAuthoritative)
+                        unresolvable ??= `"${p}" cannot be resolved to verify where it reads`;
                     return;
+                }
                 if (!real.exact && real.missing !== true) {
                     unresolvable ??= `"${p}" cannot be resolved to verify where it reads`;
                     return;

package/dist/tools/fs/fs-shared.d.ts

@@ -361,6 +361,28 @@ export declare function shellRecoveryHint(path: string, readOnly: boolean | unde
  *  (NOT NotebookEdit — CC ships it without the trailer). */
 export declare const FILE_STATE_TRAILER = " (file state is current in your context \u2014 no need to Read it back)";
 export declare const CWD_SENTINEL = "__cc_cwd_9f2c1b__";
+/**
+ * Take the engine's own cwd epilogue out of a finished stderr, and report the working directory the
+ * command left behind (the payload of the LAST span).
+ *
+ * EVERY span, and the LAST one — not the first, and not just one. A command that turns on shell tracing
+ * produces more than one (the shell echoes the epilogue's own source, marker and all, before running
+ * it), and under a one-pair rule the FIRST pair was that echo, whose payload is the unexpanded
+ * `' "$(pwd)" '`; a `cd` that plainly worked was then dropped while the real record stayed in the stderr
+ * a person reads. An opener with no close is NOT ours to eat — the command's own text is left exactly
+ * as it arrived.
+ *
+ * TWO CALLERS, ONE RULE, which is why the marker is optional. The foreground result path KNOWS the
+ * marker it minted and passes it (exact, unambiguous). A backgrounded command's spool is assembled by a
+ * different lane entirely — the shell row outlives the run that launched it and never had the marker —
+ * so it passes none and the marker is recovered per span from the sentinel plus its hex suffix. Before
+ * this was shared, only the foreground path stripped, and the completion notification handed a person
+ * the raw internal marker with the directory inside it.
+ */
+export declare function stripCwdSentinel(stderr: string, marker?: string): {
+    stderr: string;
+    cwd: string | undefined;
+};
 /** Convert a model-supplied millisecond timeout to our internal seconds, clamped. Exported for the
  *  cc-parity unit (model sees ms, internal stays seconds — no ×1000 error).
  *  ⚠️ This returns the EFFECTIVE budget, not the request — capping at a call site destroys the

package/dist/tools/fs/fs-shared.js

@@ -247,6 +247,36 @@ export function shellRecoveryHint(path, readOnly) {
 }
 export const FILE_STATE_TRAILER = " (file state is current in your context — no need to Read it back)";
 export const CWD_SENTINEL = "__cc_cwd_9f2c1b__";
+const CWD_SENTINEL_SUFFIX_CHARS = 16;
+function cwdMarkerAt(text, open) {
+    const after = open + CWD_SENTINEL.length;
+    const suffix = /^[0-9a-f]{16}/.exec(text.slice(after, after + CWD_SENTINEL_SUFFIX_CHARS));
+    return suffix === null ? undefined : CWD_SENTINEL + suffix[0];
+}
+export function stripCwdSentinel(stderr, marker) {
+    let out = "";
+    let rest = stderr;
+    let cwd;
+    let from = 0;
+    for (;;) {
+        const open = rest.indexOf(marker ?? CWD_SENTINEL, from);
+        if (open === -1)
+            break;
+        const span = marker ?? cwdMarkerAt(rest, open);
+        if (span === undefined) {
+            from = open + CWD_SENTINEL.length;
+            continue;
+        }
+        const close = rest.indexOf(span, open + span.length);
+        if (close === -1)
+            break;
+        out += rest.slice(0, open);
+        cwd = rest.slice(open + span.length, close);
+        rest = rest.slice(close + span.length);
+        from = 0;
+    }
+    return { stderr: out + rest, cwd };
+}
 export function msTimeoutToSec(timeoutMs, caps = resolveBashTimeoutCaps()) {
     const { defaultSec, maxSec } = bashTimeoutCapsSec(caps);
     if (timeoutMs === undefined || !Number.isFinite(timeoutMs))

package/dist/tools/fs/index.d.ts

@@ -12,7 +12,7 @@ export * from "./bash-readonly-classifier.js";
 export * from "./fs-bash.js";
 export * from "./read-deny.js";
 import { type BashReadonlyRootBoundary } from "./bash-readonly-classifier.js";
-export { BASH_CLASSIFY_DEFAULT_ALLOW } from "./bash-readonly-classifier.js";
+export { BASH_CLASSIFY_EXTRA_ALLOW, bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
 import { type ReadDenyEntry } from "./read-deny.js";
 import { type ContainmentFace } from "./containment-face.js";
 export * from "./containment-face.js";

package/dist/tools/fs/index.js

@@ -12,7 +12,7 @@ export * from "./bash-readonly-classifier.js";
 export * from "./fs-bash.js";
 export * from "./read-deny.js";
 import { BASH_READONLY_DEFAULT_ALLOW, } from "./bash-readonly-classifier.js";
-export { BASH_CLASSIFY_DEFAULT_ALLOW } from "./bash-readonly-classifier.js";
+export { BASH_CLASSIFY_EXTRA_ALLOW, bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
 import { compileReadDeny } from "./read-deny.js";
 import { deploymentFaceClampNotice, resolveContainmentFace } from "./containment-face.js";
 export * from "./containment-face.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.19.0",
+  "version": "7.20.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",
@@ -84,6 +84,7 @@
     "gate:tool-names": "node scripts/verify-tool-name-tables.mjs",
     "gate:tool-docs": "node scripts/gen-tool-spec-fields.mjs --check",
     "gate:backlog-ledger": "node scripts/verify-backlog-ledger.mjs",
+    "gate:child-clamp-seats": "node scripts/verify-child-clamp-seats.mjs",
     "gate:docs-tool-names": "node scripts/verify-docs-tool-names.mjs",
     "gate:comment-ratio": "vitest run test/comment-ratio-ratchet.test.ts",
     "gate:negative-controls": "vitest run test/gate-negative-controls.test.ts",