@sema-agent/core 7.19.0 → 7.20.1

package/dist/index.js

@@ -71,7 +71,7 @@ export { getShellConfig, isWslBashLauncher } from "./engine/execution-env/node-e
 export { isSecretEnvKey, scrubSecretEnv } from "./core/secret-env.js";
 export { MAX_EXEC_OUTPUT_BYTES, RollingTailBuffer, markTruncated } from "./core/exec-output-tail.js";
 export { physicalPathOf, physicalPathOfExisting } from "./core/physical-path.js";
-export { RemoteExecutionError, hasDestroy, isRemoteExecutionEnv, isSuspendable, isIsolated, missingRestoreSurface, isRetryableRemoteErrorCode, RETRYABLE_REMOTE_ERROR_CODES, } from "./core/remote-env.js";
+export { RemoteExecutionError, hasDestroy, isRemoteExecutionEnv, isSuspendable, isIsolated, canonicalPathIsAuthoritative, missingRestoreSurface, isRetryableRemoteErrorCode, RETRYABLE_REMOTE_ERROR_CODES, } from "./core/remote-env.js";
 export { withRetry } from "./core/with-retry.js";
 export { addWorktree, pruneWorktrees, WORKTREE_PARENT } from "./core/git-worktree-env.js";
 export { runExecGate } from "./core/exec-gate.js";
@@ -83,7 +83,7 @@ export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, }
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
 export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY_BUILTIN_TIERS, READ_DENY_DEFAULT_TIERS, resolveReadDenyBuiltins, compileReadDeny, } from "./tools/fs/index.js";
 export { deploymentFaceClampNotice, resolveContainmentFace, } from "./tools/fs/index.js";
-export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, } from "./core/write-protect.js";
+export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, WRITE_PROTECTION_TARGET_VIEWS, } from "./core/write-protect.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, } from "./core/tool-result-store.js";
 export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, realApprovalOrgFact, resolveCheckpointStore, checkpointStoreExecutionUndeclared, } from "./core/checkpoint-store.js";
 export { EXECUTION_OUTCOME_RECORD_WORDS, EXECUTION_RECORD_LEAVES_ROW_UNRECORDED, ExecutionOutcomeConflictError, checkpointExecutionRecorded, executionRecordDisposition, sameExecutionRecord, executionVerdict, } from "./core/checkpoint-execution-record.js";
@@ -103,8 +103,8 @@ export { FileStorageBackend, FileSessionRepo, FileCheckpointStore, FileMemorySto
 export { CacheBreakDetector } from "./core/cache-break-detector.js";
 export { maybeCompact } from "./core/auto-compaction.js";
 export { brainToRuntime } from "./core/runtime.js";
-export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS, RECOMMENDED_SENSITIVE_ASK_PATTERNS } from "./core/sensitive-path-policy.js";
-export { createFsWriteGatePolicy } from "./core/fs-write-gate-policy.js";
+export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./core/sensitive-path-policy.js";
+export { createFsWriteGatePolicy, WRITE_EXEMPT_DIR_COVERS_ROOT_CODE } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, } from "./core/task-notification.js";
@@ -152,6 +152,7 @@ export {} from "./core/hooks.js";
 export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps } from "./core/swappable-deps.js";
 export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, classifierUnavailableDenyMessage, classifierParseFailureDenyMessage, AUTO_MODE_PARSE_FAILURES, isAutoModeParseFailure, AUTO_MODE_CLASSIFIER_FALLBACKS, isAutoModeClassifierFallback, AUTO_MODE_FALLBACK_CAUSES, isAutoModeFallbackCause, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, } from "./core/auto-mode.js";
 export { AUTO_MODE_DENIAL_LIMIT_DEFAULTS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "./core/auto-mode-defaults.js";
+export { classifierSeatModel } from "./core/runner/classifier-ladder.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
 export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoModeArmingRecipe, foldAutoModeArming, } from "./core/auto-mode-arming.js";
@@ -174,7 +175,7 @@ export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootA
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, } from "./stores/file/adoption/adopt.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, normalizePersistedRuleHit, } from "./core/hooks.js";
 export { HOOK_FAMILIES, HOOKS_INVALID_CODE } from "./core/hook-seats.js";
-export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, } from "./core/memory.js";
+export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, MemoryProjectionError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, writableRootOf, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, committedDistilledOf, distilledEquals, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, isInstructionEntry, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, erasureSelectHash, computeMemoryBundleHash, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, } from "./core/shared-memory/contract.js";

package/dist/orchestration/workflow-primitives.js

@@ -1,4 +1,5 @@
 import { assertSupportedAgentIsolation } from "./workflow.js";
+import { childClampSeats } from "../core/child-clamp-seats.js";
 import { WorkflowScriptError } from "./workflow-meta.js";
 import { buildGovernedChildSpec, emitIgnoredAgentOptionsNotice, overlayWorktreeBaseline, MAX_ANNOUNCED_KEYS, SPEC_KEY_ALIASES, WHITELIST_KEYS, } from "./workflow-governance.js";
 const ACCEPTED_AGENT_OPTION_KEYS = ["label", "phase", "schema", "agentType", "isolation"];
@@ -77,27 +78,16 @@ export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentChe
         if (parentCheckpointStore !== undefined && (parentCheckpointStore === "disabled" || childSpec.checkpointStore === undefined)) {
             childSpec.checkpointStore = parentCheckpointStore;
         }
-        if (parentReadFace) {
-            const pf = parentReadFace();
-            if (pf === "roots" && childSpec.readFace !== "roots")
-                childSpec.readFace = "roots";
-        }
-        if (parentWriteFace) {
-            const pw = parentWriteFace();
-            if (pw === "roots" && childSpec.writeFace !== "roots")
-                childSpec.writeFace = "roots";
-        }
-        if (parentReadDenyPatterns) {
-            const pd = parentReadDenyPatterns();
-            if (pd !== undefined && pd.length > 0) {
-                childSpec.readDenyPatterns = childSpec.readDenyPatterns !== undefined ? [...childSpec.readDenyPatterns, ...pd] : [...pd];
-            }
-        }
-        if (parentHandsReadOnly === true) {
-            childSpec.handsReadOnly = true;
-        }
+        const pd = parentReadDenyPatterns?.();
+        const workflowChildClamps = childClampSeats({
+            handsReadOnly: parentHandsReadOnly,
+            interactiveTools: parentInteractiveToolsOff === true ? false : undefined,
+            readFace: parentReadFace?.() === "roots" ? "roots" : childSpec.readFace,
+            writeFace: parentWriteFace?.() === "roots" ? "roots" : childSpec.writeFace,
+            readDenyPatterns: pd !== undefined && pd.length > 0 ? [...(childSpec.readDenyPatterns ?? []), ...pd] : childSpec.readDenyPatterns,
+        });
+        Object.assign(childSpec, workflowChildClamps);
         if (parentInteractiveToolsOff === true) {
-            childSpec.interactiveTools = false;
             if (childSpec.interactionPosture === "interactive")
                 delete childSpec.interactionPosture;
         }

package/dist/stores/file/memory-store.d.ts

@@ -1,7 +1,6 @@
 import { type Embedder, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type StructuredNoteInput } from "../../core/memory.js";
 export declare class FileMemoryStore implements MemoryStore {
     private readonly root;
-    private readonly tmpDir;
     /** Optional injected embedder (design/81 Slice 5). When present, note bodies are embedded (in the background,
      *  after the durable note write) into a rebuildable sidecar index and `searchScored` ranks by cosine distance
      *  (portable / in-process, mirrors PgMemoryStore's jsonb mode). Absent ⇒ lexical, byte-identical to before. */
@@ -59,7 +58,11 @@ export declare class FileMemoryStore implements MemoryStore {
      *  Only when an embedder is injected; a failure/timeout leaves the row lexical (fail-open). The durable note
      *  write has ALREADY happened before this is called, so this never gates durability. */
     private queueEmbed;
-    /** Rewrite the derived `MEMORY.md` projection atomically (CC markdown parity). */
+    /** Rewrite the derived `MEMORY.md` projection atomically (CC markdown parity), STAGED IN THE TARGET'S
+     *  OWN DIRECTORY: `rename(2)` is defined only within one filesystem, so staging beside the target makes
+     *  the two share a mount by construction where a fixed scratch dir elsewhere made it deployment luck (a
+     *  memory tree on its own device took `EXDEV` on every note). EVERY caller is POST-DURABLE, so a failure
+     *  here cannot mean the note was lost: it is {@link MemoryProjectionError}, that phase's one name. */
     private writeProjection;
     read(scope: string): string | null;
     append(scope: string, note: string): string | void;

package/dist/stores/file/memory-store.js

@@ -1,6 +1,6 @@
 import { join } from "node:path";
 import { uuidv7 } from "../../internal/harness.js";
-import { firstSentence, lexicalSearchMatch, parseNoteTimestamp, } from "../../core/memory.js";
+import { firstSentence, lexicalSearchMatch, parseNoteTimestamp, MemoryProjectionError, } from "../../core/memory.js";
 import { cosineDistance, jaccardDistance, termSet } from "../../core/memory-vector.js";
 import { canonicalStoreKey, AppendLog, atomicWriteFile, ensureDir, readJsonlRecords, sanitizeScope, } from "./fs-atomic.js";
 import { assertAdoptionBootGate } from "./adoption/marker.js";
@@ -8,7 +8,6 @@ const MAX_OPEN_MEMORY_SCOPES = 64;
 const sharedMemoryDirs = new Map();
 export class FileMemoryStore {
     root;
-    tmpDir;
     embedder;
     embedTimeoutMs;
     pending = new Set();
@@ -31,7 +30,6 @@ export class FileMemoryStore {
             this.sharedScopes = { scopes: new Map(), refs: 1, openLogs: new Set() };
             sharedMemoryDirs.set(this.scopeKey, this.sharedScopes);
         }
-        this.tmpDir = join(root, "tmp");
         this.embedder = opts.embedder;
         this.embedTimeoutMs = Math.max(0, opts.embedTimeoutMs ?? 10_000);
         ensureDir(this.root);
@@ -148,7 +146,13 @@ export class FileMemoryStore {
     }
     writeProjection(state) {
         const body = state.entries.map(renderBullet).join("\n");
-        atomicWriteFile(this.tmpDir, join(state.dir, "MEMORY.md"), body ? `${body}\n` : "");
+        const target = join(state.dir, "MEMORY.md");
+        try {
+            atomicWriteFile(state.dir, target, body ? `${body}\n` : "");
+        }
+        catch (err) {
+            throw new MemoryProjectionError(target, err);
+        }
     }
     read(scope) {
         const { entries } = this.scopeState(scope);

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -35,7 +35,7 @@ export { NOT_AUTO_ALLOWED } from "./bash-program-position.js";
 export type { ShellSegmentConnector } from "./bash-lexer.js";
 export declare const BASH_READONLY_DEFAULT_ALLOW: readonly string[];
 /**
- * The CLASSIFY face's default allow set: the shared list PLUS the verbs that are
+ * The verbs the CLASSIFY face admits ON TOP of the shared list ({@link bashClassifyDefaultAllow}) —
  * admissible only where the compound classifier's per-verb judgment runs, and NOT on the shared list's
  * other consumer faces:
  *  · `find` — read-only only when no CC `aCy` dangerous predicate token is present (guard arm);
@@ -54,7 +54,18 @@ export declare const BASH_READONLY_DEFAULT_ALLOW: readonly string[];
  * poll-loop face inherits the guard arms for free: its body vetting delegates to the same compound
  * classifier.
  */
-export declare const BASH_CLASSIFY_DEFAULT_ALLOW: readonly string[];
+export declare const BASH_CLASSIFY_EXTRA_ALLOW: readonly string[];
+/** A verb only the classify face admits. */
+export type BashClassifyExtraVerb = (typeof BASH_CLASSIFY_EXTRA_ALLOW)[number];
+/**
+ * @contract shell.classify_allow.one_union_point — the classify face's default allow set is the union of
+ * two SPELLED-OUT tables ({@link BASH_READONLY_DEFAULT_ALLOW} ∪ {@link BASH_CLASSIFY_EXTRA_ALLOW}) and
+ * this function is its only assembly point; no call site composes its own. Both halves stay arrays of
+ * string literals so a static reader can enumerate them: a vocabulary derived in place
+ * (`[...TABLE, "extra"]`) is invisible to the release's wire-change manifest, so a verb added to or
+ * dropped from this security-relevant set would move nothing a downstream reader could see.
+ */
+export declare function bashClassifyDefaultAllow(): readonly string[];
 /**
  * G2 — options for {@link parseLeadingCommandName}. Omitting them keeps the parser byte-identical to
  * what every existing caller (the `bash_readonly` declaration face, the coarse command-name policy, the

package/dist/tools/fs/bash-readonly-classifier.js

@@ -8,7 +8,10 @@ export const BASH_READONLY_DEFAULT_ALLOW = [
     "cal", "uptime", "id", "groups", "nproc", "locale", "free", "realpath", "readlink",
     "true", "false", "seq", "expr", "type", "sleep", "diff", "cmp", "comm",
 ];
-export const BASH_CLASSIFY_DEFAULT_ALLOW = [...BASH_READONLY_DEFAULT_ALLOW, "find", "sed", "cd"];
+export const BASH_CLASSIFY_EXTRA_ALLOW = ["find", "sed", "cd"];
+export function bashClassifyDefaultAllow() {
+    return [...BASH_READONLY_DEFAULT_ALLOW, ...BASH_CLASSIFY_EXTRA_ALLOW];
+}
 const SHELL_OPERATORS = /[;&|<>$()`\n\r\\]/;
 function hasBareShellOperator(s, quotedOperatorsAreText) {
     if (!quotedOperatorsAreText)
@@ -304,7 +307,7 @@ function refusedCommandExempt(command, allow, boundary, depth, baseMovedOutside
         const resolved = resolveOperandLexically(boundary.cwd ?? boundary.roots[0], word, boundary.homeDir);
         if (resolved === undefined || boundary.denyMatch?.(resolved) != null)
             return false;
-        return withinAnyRoot(boundary.roots, resolved);
+        return boundary.face === "open" || withinAnyRoot(boundary.roots, resolved);
     };
     const unlistedSegmentJudgedInside = (words, from) => {
         if (boundary === undefined)
@@ -446,18 +449,6 @@ function isGrepPatternFlagToken(tok) {
     }
     return /^-[A-Za-z0-9]*[ef]/.test(tok);
 }
-function isGrepPatternPayloadLongOption(tok) {
-    if (!tok.includes("="))
-        return false;
-    const name = longOptionNameOf(tok);
-    return name !== undefined && isLongOptionAbbrevOf(name, "regexp");
-}
-function isCutDelimiterPayloadLongOption(tok) {
-    if (!tok.includes("="))
-        return false;
-    const name = longOptionNameOf(tok);
-    return name !== undefined && (isLongOptionAbbrevOf(name, "delimiter") || isLongOptionAbbrevOf(name, "output-delimiter"));
-}
 function isGrepClusterFileStdin(tok) {
     if (tok.startsWith("--") || !/^-[A-Za-z0-9]/.test(tok))
         return false;
@@ -472,6 +463,283 @@ function isGrepClusterFileStdin(tok) {
     }
     return false;
 }
+function valueNamesAFile(kind) {
+    return kind === "path" || kind === "indirect" || kind === "form" || kind === "header" || kind === "url";
+}
+function widestValueKind(kinds) {
+    if (kinds.has("indirect"))
+        return "indirect";
+    if (kinds.has("path"))
+        return "path";
+    if (kinds.has("form"))
+        return "form";
+    if (kinds.has("header"))
+        return "header";
+    if (kinds.has("url"))
+        return "url";
+    return [...kinds][0];
+}
+const VERB_OPTION_SLOTS = {
+    head: {
+        shortValue: { c: "count", n: "count" },
+        shortPlain: "qvz",
+        longValue: { bytes: "count", lines: "count" },
+        longOptionalValue: {},
+        longPlain: ["help", "quiet", "silent", "verbose", "version", "zero-terminated"],
+    },
+    tail: {
+        shortValue: { b: "count", c: "count", n: "count", s: "count" },
+        shortPlain: "fFqvz",
+        longValue: { bytes: "count", lines: "count", "max-unchanged-stats": "count", pid: "count", "sleep-interval": "count" },
+        longOptionalValue: { follow: "label" },
+        longPlain: ["help", "quiet", "retry", "silent", "verbose", "version", "zero-terminated"],
+    },
+    cut: {
+        shortValue: { b: "count", c: "count", d: "delimiter", f: "count" },
+        shortPlain: "nsz",
+        longValue: { bytes: "count", characters: "count", delimiter: "delimiter", fields: "count", "output-delimiter": "delimiter" },
+        longOptionalValue: {},
+        longPlain: ["complement", "help", "only-delimited", "version", "zero-terminated"],
+    },
+    grep: {
+        shortValue: { A: "count", B: "count", C: "count", D: "label", d: "label", e: "pattern", f: "path", m: "count" },
+        shortPlain: "0123456789abcEFGhHiIlLnoPqrRsUvVwxyzZ",
+        longValue: {
+            "after-context": "count",
+            "before-context": "count",
+            "binary-files": "label",
+            devices: "label",
+            directories: "label",
+            exclude: "name-pattern",
+            "exclude-dir": "name-pattern",
+            "exclude-from": "path",
+            file: "path",
+            "group-separator": "label",
+            include: "name-pattern",
+            label: "label",
+            "max-count": "count",
+            regexp: "pattern",
+        },
+        longOptionalValue: { color: "label", colour: "label", context: "count" },
+        longPlain: [
+            "basic-regexp", "byte-offset", "count", "dereference-recursive", "extended-regexp",
+            "files-with-matches", "files-without-match", "fixed-strings", "help", "ignore-case", "initial-tab",
+            "invert-match", "line-buffered", "line-number", "line-regexp", "no-filename", "no-group-separator",
+            "no-messages", "null", "null-data", "only-matching", "perl-regexp", "quiet", "recursive", "silent",
+            "text", "version", "with-filename", "word-regexp",
+        ],
+    },
+    diff: {
+        shortValue: { C: "count", D: "label", F: "pattern", I: "pattern", L: "label", S: "path", U: "count", W: "count", X: "path", x: "name-pattern" },
+        shortPlain: "abBcdeEHilnNpqrstTuvwyZ",
+        longValue: {
+            exclude: "name-pattern",
+            "exclude-from": "path",
+            "from-file": "path",
+            "horizon-lines": "count",
+            ifdef: "label",
+            "ignore-matching-lines": "pattern",
+            label: "label",
+            "show-function-line": "pattern",
+            "starting-file": "path",
+            tabsize: "count",
+            "to-file": "path",
+            width: "count",
+        },
+        longOptionalValue: { color: "label", context: "count", unified: "count" },
+        longPlain: [
+            "brief", "ed", "expand-tabs", "help", "ignore-all-space", "ignore-blank-lines", "ignore-case",
+            "ignore-space-change", "ignore-tab-expansion", "ignore-trailing-space", "initial-tab", "minimal",
+            "new-file", "normal", "paginate", "recursive", "report-identical-files", "rcs", "show-c-function",
+            "side-by-side", "speed-large-files", "suppress-blank-empty", "text", "version",
+        ],
+    },
+    cmp: {
+        shortValue: { i: "count", n: "count" },
+        shortPlain: "blsv",
+        longValue: { bytes: "count", "ignore-initial": "count" },
+        longOptionalValue: {},
+        longPlain: ["help", "print-bytes", "quiet", "silent", "verbose", "version"],
+    },
+    sed: {
+        shortValue: { e: "script", f: "path" },
+        shortPlain: "nrEszu",
+        longValue: { expression: "script", file: "path", "line-length": "count" },
+        longOptionalValue: { "in-place": "label" },
+        longPlain: [
+            "debug", "follow-symlinks", "help", "null-data", "posix", "quiet", "regexp-extended", "sandbox",
+            "separate", "silent", "unbuffered", "version", "zero-terminated",
+        ],
+    },
+    date: {
+        shortValue: { d: "count", f: "path", r: "path", s: "count" },
+        shortPlain: "uR",
+        longValue: { date: "count", file: "path", reference: "path", "rfc-3339": "count", set: "count" },
+        longOptionalValue: { "iso-8601": "label" },
+        longPlain: ["debug", "help", "rfc-822", "rfc-email", "universal", "utc", "version"],
+    },
+    tar: {
+        shortValue: { b: "count", C: "path", f: "path", T: "path", X: "path" },
+        shortPlain: "acdhjJkmOpPrStuvwWxzZ",
+        longValue: {
+            "blocking-factor": "count",
+            directory: "path",
+            exclude: "name-pattern",
+            "exclude-from": "path",
+            file: "path",
+            "files-from": "path",
+            "strip-components": "count",
+        },
+        longOptionalValue: {},
+        longPlain: [
+            "absolute-names", "append", "create", "dereference", "extract", "get", "help", "interactive",
+            "keep-old-files", "list", "preserve-permissions", "sparse", "to-stdout", "touch", "update",
+            "verbose", "verify", "version",
+        ],
+    },
+    curl: {
+        shortValue: {
+            A: "label", b: "indirect", C: "count", c: "path", D: "path", d: "indirect", E: "path", e: "label",
+            F: "form", H: "header", K: "path", m: "count", o: "path", P: "label", Q: "label", r: "count",
+            T: "path", t: "label", U: "label", u: "label", w: "indirect", X: "label", x: "label", Y: "count",
+            y: "count", z: "path",
+        },
+        shortPlain: "#0123456aBfgGhiIjJklLMnNOpqRsSvVZ",
+        longValue: {
+            cacert: "path",
+            capath: "path",
+            cert: "path",
+            config: "path",
+            "connect-timeout": "count",
+            cookie: "indirect",
+            "cookie-jar": "path",
+            data: "indirect",
+            "data-ascii": "indirect",
+            "data-binary": "indirect",
+            "data-raw": "label",
+            "data-urlencode": "form",
+            "dump-header": "path",
+            form: "form",
+            "form-string": "label",
+            header: "header",
+            key: "path",
+            "max-time": "count",
+            "netrc-file": "path",
+            output: "path",
+            proxy: "label",
+            range: "count",
+            referer: "label",
+            request: "label",
+            resolve: "label",
+            trace: "path",
+            "time-cond": "path",
+            "trace-ascii": "path",
+            "upload-file": "path",
+            url: "url",
+            user: "label",
+            "user-agent": "label",
+            "write-out": "indirect",
+        },
+        longOptionalValue: {},
+        longPlain: [
+            "append", "compressed", "disable", "fail", "get", "globoff", "head", "help", "include", "insecure",
+            "junk-session-cookies", "list-only", "location", "manual", "netrc", "next", "no-buffer", "parallel",
+            "proxytunnel", "remote-header-name", "remote-name", "remote-time", "show-error", "silent",
+            "use-ascii", "verbose", "version",
+        ],
+    },
+};
+function readVerbOptionSlot(name, tok) {
+    const row = VERB_OPTION_SLOTS[name];
+    if (row === undefined)
+        return undefined;
+    if (!tok.startsWith("-") || tok === "-" || tok === "--")
+        return { form: "unexplained" };
+    if (tok.startsWith("--")) {
+        const long = longOptionNameOf(tok);
+        if (long === undefined)
+            return { form: "unexplained" };
+        const eq = tok.indexOf("=");
+        const attached = eq >= 0 ? tok.slice(eq + 1) : undefined;
+        const withValue = (kind) => attached !== undefined ? { form: "attached", value: attached, kind } : { form: "separated", kind };
+        const exact = row.longValue[long];
+        if (exact !== undefined)
+            return withValue(exact);
+        const exactOptional = row.longOptionalValue[long];
+        if (exactOptional !== undefined)
+            return attached !== undefined ? { form: "attached", value: attached, kind: exactOptional } : { form: "no-value" };
+        if (row.longPlain.includes(long))
+            return attached === undefined ? { form: "no-value" } : { form: "unexplained" };
+        const valueNames = [
+            ...Object.keys(row.longValue),
+            ...(attached !== undefined ? Object.keys(row.longOptionalValue) : []),
+        ].filter((full) => isLongOptionAbbrevOf(long, full));
+        const plainNames = [
+            ...row.longPlain,
+            ...(attached === undefined ? Object.keys(row.longOptionalValue) : []),
+        ].filter((full) => isLongOptionAbbrevOf(long, full));
+        if (valueNames.length === 0)
+            return plainNames.length > 0 && attached === undefined ? { form: "no-value" } : { form: "unexplained" };
+        const kinds = new Set(valueNames.map((full) => (row.longValue[full] ?? row.longOptionalValue[full])));
+        if (attached !== undefined)
+            return { form: "attached", value: attached, kind: widestValueKind(kinds) };
+        if (plainNames.length > 0 || kinds.size !== 1)
+            return { form: "unexplained" };
+        return withValue([...kinds][0]);
+    }
+    for (let i = 1; i < tok.length; i++) {
+        const ch = tok[i];
+        const kind = row.shortValue[ch];
+        if (kind !== undefined) {
+            const rest = tok.slice(i + 1);
+            return rest !== "" ? { form: "attached", value: rest, kind } : { form: "separated", kind };
+        }
+        if (!row.shortPlain.includes(ch))
+            return { form: "unexplained" };
+    }
+    return { form: "no-value" };
+}
+function localFileUrlPath(value) {
+    const m = /^file:(?:\/\/[^/?#]*)?(\/[^?#]*)/i.exec(value.trim());
+    if (m === null)
+        return undefined;
+    const raw = m[1];
+    try {
+        return decodeURIComponent(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+function formSpecFileNames(value) {
+    const out = [];
+    const after = (s) => {
+        const at = s.search(/[@<]/);
+        if (at !== -1 && at < s.length - 1)
+            out.push(s.slice(at + 1));
+    };
+    after(value);
+    for (const part of value.split(/[;,]/))
+        after(part);
+    return [...new Set(out)];
+}
+function slotValueCandidates(value, kind) {
+    if (!valueNamesAFile(kind))
+        return [];
+    if (kind === "url") {
+        const local = localFileUrlPath(value);
+        return local !== undefined ? [local] : [];
+    }
+    if (kind === "form")
+        return formSpecFileNames(value).map(literalTildeSpelling);
+    const named = value.startsWith("@") && value.length > 1 ? literalTildeSpelling(value.slice(1)) : undefined;
+    if (kind === "header")
+        return named !== undefined ? [value, named] : [];
+    const out = [value];
+    if (kind === "indirect" && named !== undefined)
+        out.push(named);
+    return out;
+}
 const SEPARATED_VALUE_OPTIONS = {
     head: { short: "cn", long: ["bytes", "lines"] },
     tail: { short: "cns", long: ["bytes", "lines", "sleep-interval", "pid", "max-unchanged-stats"] },
@@ -1248,17 +1516,6 @@ function isGrepFileStdinLongOption(tok) {
     return name !== undefined && isLongOptionAbbrevOf(name, "file");
 }
 const CLUSTER_OPTION_CHAR = /[A-Za-z0-9]/;
-function grepClusterValueOwner(tok) {
-    if (!tok.startsWith("-") || tok.startsWith("--") || !CLUSTER_OPTION_CHAR.test(tok[1] ?? ""))
-        return undefined;
-    for (const ch of tok.slice(1)) {
-        if (ch === "e" || ch === "f")
-            return ch;
-        if (!CLUSTER_OPTION_CHAR.test(ch))
-            return undefined;
-    }
-    return undefined;
-}
 function attachedOptionPayloads(tok) {
     const literal = literalTildeSpelling;
     const out = [];
@@ -1282,6 +1539,7 @@ function attachedOptionPayloads(tok) {
 }
 function collectSegmentBoundaryFindings(tokens, boundary) {
     const name = tokens.folded[0];
+    const slotVerb = tokens.slotVerb ?? name;
     if (NO_PATH_OPERAND_COMMANDS.has(name))
         return [];
     const args = tokens.folded.slice(1);
@@ -1328,6 +1586,8 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
         const eoo = args.indexOf("--");
         const patternSuppliedByFlag = name === "grep" && (eoo === -1 ? args : args.slice(0, eoo)).some(isGrepPatternFlagToken);
         let sawOperand = false;
+        const argvOperandsStartAt = tokens.slotVerb !== undefined ? 1 : 0;
+        let sawArgvOperand = false;
         let endOfOptions = false;
         for (let k = 0; k < args.length; k++) {
             const t = args[k];
@@ -1338,15 +1598,35 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
                     endOfOptions = true;
                     continue;
                 }
-                if (name === "cut" && (t === "-d" || t === "--delimiter" || t === "--output-delimiter")) {
-                    k++;
-                    continue;
-                }
-                if (name === "cut" && (/^-d./.test(t) || isCutDelimiterPayloadLongOption(t)))
-                    continue;
-                if (name === "grep" && (grepClusterValueOwner(t) === "e" || isGrepPatternPayloadLongOption(t)))
-                    continue;
                 if (t.startsWith("-") && t !== "-") {
+                    const slot = readVerbOptionSlot(slotVerb, t);
+                    if (sawArgvOperand) {
+                        judgeOperand(t, argGlobs(k));
+                        if (slot !== undefined && slot.form === "separated") {
+                            const ahead = args[k + 1];
+                            if (ahead !== undefined && !expandingArgs.has(k + 1)) {
+                                for (const c of slotValueCandidates(ahead, slot.kind))
+                                    judgeOperand(c, argGlobs(k + 1));
+                            }
+                        }
+                    }
+                    if (slot !== undefined && slot.form !== "unexplained" && !(slot.form === "separated" && sawArgvOperand)) {
+                        if (slot.form === "attached") {
+                            for (const c of slotValueCandidates(literalTildeSpelling(slot.value), slot.kind))
+                                judgeOperand(c, argGlobs(k));
+                        }
+                        else if (slot.form === "separated") {
+                            const value = args[++k];
+                            if (value !== undefined && !expandingArgs.has(k)) {
+                                const named = slotValueCandidates(value, slot.kind);
+                                for (const c of named)
+                                    judgeOperand(c, argGlobs(k));
+                                if (named.length > 0)
+                                    positionalOperands.push(value);
+                            }
+                        }
+                        continue;
+                    }
                     for (const payload of attachedOptionPayloads(t))
                         judgeOperand(payload, argGlobs(k));
                     continue;
@@ -1354,6 +1634,8 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
             }
             const isGrepPatternSlot = name === "grep" && !patternSuppliedByFlag && !sawOperand;
             sawOperand = true;
+            if (k >= argvOperandsStartAt)
+                sawArgvOperand = true;
             if (t === "-") {
                 if (isGrepPatternSlot)
                     continue;
@@ -1584,7 +1866,7 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
             const unlisted = tokenizeSegment(segments[si]);
             if (unlisted.folded.length === 0)
                 continue;
-            foldedSegments.push({ folded: [LAUNCHER_SCAN_HEAD, ...unlisted.folded], raw: [LAUNCHER_SCAN_HEAD, ...unlisted.raw] });
+            foldedSegments.push({ folded: [LAUNCHER_SCAN_HEAD, ...unlisted.folded], raw: [LAUNCHER_SCAN_HEAD, ...unlisted.raw], slotVerb: programBasename(unlisted.folded[0]) });
             pushReach();
             continue;
         }
@@ -1734,7 +2016,7 @@ function evaluateReadBoundary(foldedSegments, boundary, mintGrantCandidate, reac
         if (si > 0 && reach?.[si]?.andJoined !== true)
             andRunStart = reach?.[si]?.orBroken === true ? si + 1 : si;
         const reachable = candidates.filter((c) => c.skippedCd < andRunStart);
-        const row = findingsRowFor(JSON.stringify([toks.folded, toks.raw]));
+        const row = findingsRowFor(JSON.stringify([toks.folded, toks.raw, toks.slotVerb]));
         for (const { base: currentBase } of reachable) {
             for (const finding of findingsFor(row, toks, currentBase)) {
                 if (finding.kind === "unresolvable") {
@@ -1929,7 +2211,7 @@ export function classifyOutOfRootReadGate(command, allow, boundary) {
             if (UNMODELLED_BASE_MOVERS.has(name))
                 baseMoved = true;
             if (!allow.has(name) && name !== "cd") {
-                pushReader({ folded: [LAUNCHER_SCAN_HEAD, ...toks.folded.slice(i)], raw: [LAUNCHER_SCAN_HEAD, ...toks.raw.slice(i)] });
+                pushReader({ folded: [LAUNCHER_SCAN_HEAD, ...toks.folded.slice(i)], raw: [LAUNCHER_SCAN_HEAD, ...toks.raw.slice(i)], slotVerb: name });
                 continue;
             }
             pushReader(i === 0 && name === written ? toks : { folded: [name, ...toks.folded.slice(i + 1)], raw: [toks.raw[i] ?? name, ...toks.raw.slice(i + 1)] });

package/dist/tools/fs/fs-bash.d.ts

@@ -100,7 +100,7 @@ export declare function bashReversibilityProbe(allow?: readonly string[], bounda
  * add a mandate to an ask, never originate one). The poll-loop face's structured verdict
  * ({@link classifyBoundedReadonlyPollLoopDetailed}) is read the same three ways as the compound face's.
  *
- * The reader set is the engine's classify set ({@link BASH_CLASSIFY_DEFAULT_ALLOW}) — here it is NOT an
+ * The reader set is the engine's classify set ({@link bashClassifyDefaultAllow}) — here it is NOT an
  * auto-allow list but the set of programs whose operands the faces read; a wider set means more reads are
  * judged, never that more runs are vouched.
  *