@sema-agent/core 7.21.1 → 7.22.0

package/dist/tools/fs/bash-program-position.js

@@ -12,23 +12,33 @@ export function isBareControlWord(toks, i, words) {
 export const ARGV_REENTRY_PROGRAM_RE = /^xargs$/;
 export const ARGV_REENTRY_DEFAULT_PROGRAM = "echo";
 const NO_DECLARED_OPTIONS = { optionArity: new Map() };
+const launcherRow = (pairs, extra = {}) => ({ optionArity: new Map(pairs), ...extra });
 export const LAUNCHER_TABLE = new Map([
-    ["env", NO_DECLARED_OPTIONS], ["command", NO_DECLARED_OPTIONS], ["builtin", NO_DECLARED_OPTIONS], ["exec", NO_DECLARED_OPTIONS],
+    ["env", launcherRow([["-i", 0], ["-0", 0], ["-v", 0], ["--ignore-environment", 0], ["--null", 0], ["--debug", 0], ["-u", 1], ["--unset", 1]], { assignmentOperands: true })],
+    ["command", launcherRow([["-p", 0]])],
+    ["builtin", NO_DECLARED_OPTIONS], ["exec", NO_DECLARED_OPTIONS],
     ["noglob", NO_DECLARED_OPTIONS], ["xargs", NO_DECLARED_OPTIONS], ["busybox", NO_DECLARED_OPTIONS],
-    ["sudo", NO_DECLARED_OPTIONS], ["doas", NO_DECLARED_OPTIONS], ["pkexec", NO_DECLARED_OPTIONS], ["su", NO_DECLARED_OPTIONS],
-    ["runuser", NO_DECLARED_OPTIONS], ["chroot", NO_DECLARED_OPTIONS], ["setpriv", NO_DECLARED_OPTIONS],
-    ["nohup", NO_DECLARED_OPTIONS], ["nice", NO_DECLARED_OPTIONS], ["ionice", NO_DECLARED_OPTIONS], ["chrt", NO_DECLARED_OPTIONS],
-    ["taskset", NO_DECLARED_OPTIONS], ["stdbuf", NO_DECLARED_OPTIONS], ["timeout", NO_DECLARED_OPTIONS],
+    ["sudo", { optionArity: new Map(), assignmentOperands: true }], ["doas", NO_DECLARED_OPTIONS], ["pkexec", { optionArity: new Map(), whenNoProgram: "shell" }],
+    ["su", { optionArity: new Map(), shellText: true }], ["runuser", { optionArity: new Map(), shellText: true }],
+    ["chroot", { optionArity: new Map(), requiredOperands: 1, whenNoProgram: "shell" }], ["setpriv", NO_DECLARED_OPTIONS],
+    ["nohup", NO_DECLARED_OPTIONS],
+    ["nice", launcherRow([["-n", 1], ["--adjustment", 1]], { negativeIntegerIsOwnArgument: true })],
+    ["ionice", NO_DECLARED_OPTIONS], ["chrt", { optionArity: new Map(), requiredOperands: 1 }], ["taskset", { optionArity: new Map(), requiredOperands: 1 }],
+    ["stdbuf", launcherRow([["-i", 1], ["-o", 1], ["-e", 1], ["--input", 1], ["--output", 1], ["--error", 1]])],
+    ["timeout", launcherRow([
+            ["--foreground", 0], ["--preserve-status", 0], ["--verbose", 0], ["-v", 0],
+            ["-k", 1], ["-s", 1], ["--kill-after", 1], ["--signal", 1],
+        ], { requiredOperands: 1 })],
     ["time", {
             optionArity: new Map([
                 ["-p", 0], ["-a", 0], ["-v", 0], ["-q", 0], ["--portability", 0], ["--append", 0], ["--verbose", 0], ["--quiet", 0], ["--help", 0], ["--version", 0],
                 ["-f", 1], ["-o", 1], ["--format", 1], ["--output", 1],
             ]),
         }],
-    ["watch", NO_DECLARED_OPTIONS], ["setsid", NO_DECLARED_OPTIONS], ["flock", NO_DECLARED_OPTIONS], ["unshare", NO_DECLARED_OPTIONS],
-    ["nsenter", NO_DECLARED_OPTIONS], ["script", NO_DECLARED_OPTIONS], ["numactl", NO_DECLARED_OPTIONS], ["prlimit", NO_DECLARED_OPTIONS],
+    ["watch", { optionArity: new Map(), shellText: true }], ["setsid", NO_DECLARED_OPTIONS], ["flock", { optionArity: new Map(), requiredOperands: 1 }], ["unshare", { optionArity: new Map(), whenNoProgram: "shell" }],
+    ["nsenter", { optionArity: new Map(), whenNoProgram: "shell" }], ["script", { optionArity: new Map(), shellText: true }], ["numactl", NO_DECLARED_OPTIONS], ["prlimit", NO_DECLARED_OPTIONS],
     ["systemd-run", NO_DECLARED_OPTIONS],
-    ["strace", NO_DECLARED_OPTIONS], ["ltrace", NO_DECLARED_OPTIONS], ["valgrind", NO_DECLARED_OPTIONS], ["firejail", NO_DECLARED_OPTIONS],
+    ["strace", NO_DECLARED_OPTIONS], ["ltrace", NO_DECLARED_OPTIONS], ["valgrind", NO_DECLARED_OPTIONS], ["firejail", { optionArity: new Map(), whenNoProgram: "shell" }],
     ["bwrap", NO_DECLARED_OPTIONS],
 ]);
 export const COMMAND_LAUNCHERS = new Set(LAUNCHER_TABLE.keys());
@@ -38,15 +48,33 @@ function pastLauncherOptions(launcher, folded, i) {
         return i;
     for (;;) {
         const tok = folded[i];
-        const arity = tok === undefined ? undefined : row.optionArity.get(tok);
-        if (arity === undefined)
+        if (tok === undefined)
             return i;
-        if (arity === 1 && folded[i + 1] === undefined)
+        if (row.negativeIntegerIsOwnArgument === true && /^-\d+$/.test(tok)) {
+            i += 1;
+            continue;
+        }
+        const step = launcherOptionStep(row, tok);
+        if (step === undefined)
+            return i;
+        if (step === 2 && folded[i + 1] === undefined)
             return i;
-        i += arity + 1;
+        i += step;
     }
 }
-const LAUNCHER_BARE_NUMBER = /^\d+[smhd]?$/;
+function launcherOptionStep(row, tok) {
+    const exact = row.optionArity.get(tok);
+    if (exact !== undefined)
+        return exact === 1 ? 2 : 1;
+    const eq = tok.startsWith("--") ? tok.indexOf("=") : -1;
+    if (eq > 2 && row.optionArity.get(tok.slice(0, eq)) === 1)
+        return 1;
+    if (/^-[A-Za-z]./.test(tok) && row.optionArity.get(tok.slice(0, 2)) === 1)
+        return 1;
+    if (/^-[A-Za-z]+$/.test(tok) && [...tok.slice(1)].every((ch) => row.optionArity.get(`-${ch}`) === 0))
+        return 1;
+    return undefined;
+}
 export const PROGRAM_POSITION_REFUSAL_KINDS = ["option_at_program_position", "control_syntax_at_program_position"];
 export function readProgramPosition(toks) {
     const { folded } = toks;
@@ -79,21 +107,38 @@ export function readProgramPosition(toks) {
     }
     const launchers = [{ index: i, name: basename }];
     const owner = head;
+    const shellRefusal = () => ({ kind: "control_syntax_at_program_position", owner, word: "sh" });
+    let owedOperands = LAUNCHER_TABLE.get(basename)?.requiredOperands ?? 0;
+    let lastRow = LAUNCHER_TABLE.get(basename);
+    const chain0 = (program, refusal) => ({ controlWords, written, assignments, launchers, argvFromStdin: false, runsDefaultProgram: false, program, refusal });
+    if (lastRow?.shellText === true)
+        return chain0(undefined, shellRefusal());
     let argvFromStdin = ARGV_REENTRY_PROGRAM_RE.test(basename);
     let lastReentry = argvFromStdin ? i : -1;
     const chain = (program, refusal) => ({ controlWords, written, assignments, launchers, argvFromStdin, runsDefaultProgram: lastReentry === folded.length - 1, program, refusal });
     for (let j = pastLauncherOptions(basename, folded, i + 1); j < folded.length; j++) {
         const t = folded[j];
-        if (ASSIGNMENT_WORD.test(t) || LAUNCHER_BARE_NUMBER.test(t))
+        if (owedOperands > 0 && !t.startsWith("-")) {
+            owedOperands -= 1;
+            continue;
+        }
+        if (lastRow?.assignmentOperands === true && !t.startsWith("-") && t.includes("="))
             continue;
         const wordBasename = programBasename(t);
         if (ARGV_REENTRY_PROGRAM_RE.test(wordBasename)) {
             argvFromStdin = true;
             lastReentry = j;
+            lastRow = undefined;
+            owedOperands = 0;
             continue;
         }
         if (COMMAND_LAUNCHERS.has(wordBasename)) {
             launchers.push({ index: j, name: wordBasename });
+            lastRow = LAUNCHER_TABLE.get(wordBasename);
+            if (lastRow?.shellText === true)
+                return chain(undefined, shellRefusal());
+            owedOperands = lastRow?.requiredOperands ?? 0;
+            j = pastLauncherOptions(wordBasename, folded, j + 1) - 1;
             continue;
         }
         if (t.startsWith("-"))
@@ -103,13 +148,15 @@ export function readProgramPosition(toks) {
         }
         return chain({ index: j, name: t, basename: wordBasename });
     }
+    if (lastRow?.whenNoProgram === "shell")
+        return chain(undefined, shellRefusal());
     return chain(undefined);
 }
-export function argvReentryUnjudged(pos, noPathPrograms) {
+export function argvReentryUnjudged(pos, acceptedTargets) {
     if (!pos.argvFromStdin)
         return false;
     const runs = pos.program?.basename ?? (pos.runsDefaultProgram ? ARGV_REENTRY_DEFAULT_PROGRAM : undefined);
-    return runs === undefined || !noPathPrograms.has(runs);
+    return runs === undefined || !acceptedTargets.has(runs);
 }
 export function programPositionRefusalSentence(refusal) {
     switch (refusal.kind) {

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -293,6 +293,15 @@ export interface BashReadonlyRootBoundary {
      *  roots containment + command allowlist double gate is the deployment's own read-safety
      *  declaration — v1 ruling). */
     denyMatch?: (resolvedPath: string) => string | null;
+    /** What the wired {@link denyMatch} judge would apply — the ACTIVE deny patterns. Read for ONE question:
+     *  is there anything for a traversal to defeat? EMPTY ⇒ the judge refuses nothing, so a walk under it
+     *  bypasses nothing and {@link CompoundReadonlyVerdict.recursiveReadPaths} is not minted. ABSENT ⇒ the
+     *  caller did not say, which is not "none": the walk is reported, the reading every caller had before
+     *  this seat existed. It is deliberately NOT the reference implementation's question at the same place —
+     *  its deny rules are ROOTED, so "is the guarded place inside this traversal?" is lexically answerable
+     *  there; these patterns match a segment run ANYWHERE in a path ({@link
+     *  import("./read-deny.js").ReadDenyEntry}), so only emptiness is. */
+    denyEntries?: readonly string[];
     /** The resolved read-face containment state. Under "open" the CONTAINMENT half of
      *  this boundary is structurally satisfied (an out-of-roots operand is not a demotion; it reports
      *  as a checked candidate instead), while the deny half above keeps judging in both faces.
@@ -425,20 +434,25 @@ export interface CompoundReadonlyVerdict {
      */
     recursiveReadPaths?: readonly string[];
     /**
-     * The ONE directory whose addition to the declared roots would make every objection this walk raised go
-     * away. It rides the SAME arm as the containment sentence and is dropped wherever that sentence is (a
-     * SHAPE refusal takes both — `tail -f <out-of-root>` stays refused after any grant), and on that arm the
-     * claim is MEASURED, not argued: the walk runs again with the proposed root in place and the directory is
-     * offered only if that walk has no objection left. `..`-traversing spellings are excluded on their own
-     * account ({@link outOfRootSpellings}): that is a disagreement between the folded text and the kernel,
-     * which no replay of the text can settle. VALUE: the deepest directory PROPERLY
-     * containing every {@link outOfRootPaths} entry, folded lexically — zero I/O, so a path that is itself a
-     * directory contributes its PARENT (`ls /etc/ssl` ⇒ `/etc`) where the reference implementation narrows
-     * with a stat; refused rather than widened when the result would be a family root or would contain the
-     * declared home or a declared {@link BashReadonlyRootBoundary.roots} entry. Meaning and spelling
-     * contract: {@link import("../../core/tool-spec.js").ReadRootGrantCandidate}.
+     * The ONE path whose addition to the declared roots would make every objection THIS WALK raised go away,
+     * MEASURED not argued: the walk runs again with the proposed root in place and the value is offered only
+     * if that walk has no objection left (`..` spellings are excluded on their own account — a folded-vs-kernel
+     * disagreement no replay of the text settles). It rides the containment sentence, and a per-segment NAME
+     * refusal ({@link segmentNameRefusal}), which is not a refusal of the READ; a SHAPE refusal takes it with
+     * it. VALUE: the deepest directory PROPERLY containing every {@link outOfRootPaths} entry, folded (zero
+     * I/O, so a directory contributes its PARENT); where that would contain the declared home or a root, the
+     * single path read is offered VERBATIM instead ({@link outOfRootGrantCoversExactPath}) — `cat
+     * ~/.gitconfig` is one file and the alternative is a card with no way out. Contract:
+     * {@link import("../../core/tool-spec.js").ReadRootGrantCandidate}.
      */
     outOfRootGrantCandidate?: string;
+    /** {@link outOfRootGrantCandidate} is the path the command NAMED, offered verbatim, rather than a
+     *  directory containing it — minted where that directory would have handed out the home or the workspace.
+     *  A consumer adds the string ITSELF; expanding it into a directory pattern is what this prevents. */
+    outOfRootGrantCoversExactPath?: true;
+    /** The verdict's {@link reason} is a per-segment NAME refusal (an unlisted program, a path-prefixed name,
+     *  a control word before a reader) rather than the walk's own sentence or a refused SHAPE. */
+    segmentNameRefusal?: true;
 }
 /**
  * The single minting point for the out-of-root-read approval option text, so a gate rendering
@@ -745,11 +759,7 @@ export declare const POLL_LOOP_MAX_SLEEP_SECONDS = 600;
  *    run. (The substitution is a flagged, high-severity shape kept per the ruling that names
  *    `$(seq <int> <int>)` as the one exemption — recorded for a
  *    tightening decision, since the brace form is a drop-in equivalent.)
- *  · STDIN-BLOCKING BODY (an availability residual, not a safety one). CLOSED for the shape this note
- *    used to record: a quoted multiword operand like `grep "x y"` read, to the then whitespace-blind
- *    tokenizer, as two operands meeting grep's file floor, while bash passes ONE pattern and no file and
- *    grep blocks on stdin. the lexer now counts the operand bash actually passes, so
- *    that command demotes on both this arm and the plain face. What REMAINS residual is the general
+ *  · STDIN-BLOCKING BODY (an availability residual, not a safety one). What REMAINS residual is the general
  *    statement: this arm inherits whatever the shared availability arms can see, they are best-effort
  *    (an operand that only turns out to be unreadable at run time is not in the text), and a hang is
  *    bounded by the tool timeout — outside the irreversibility / egress envelope this arm governs. The

package/dist/tools/fs/bash-readonly-classifier.js

@@ -173,18 +173,18 @@ function outOfRootGrantCandidateOf(paths, boundary) {
     }
     if (candidate === undefined)
         return undefined;
-    if (parentDirLexically(candidate) === candidate)
-        return undefined;
-    if (boundary.homeDir !== undefined && withinAnyRoot([candidate], boundary.homeDir))
-        return undefined;
-    if (boundary.roots.some((root) => withinAnyRoot([candidate], root)))
-        return undefined;
-    return candidate;
+    const tooWide = parentDirLexically(candidate) === candidate ||
+        (boundary.homeDir !== undefined && withinAnyRoot([candidate], boundary.homeDir)) ||
+        boundary.roots.some((root) => withinAnyRoot([candidate], root));
+    if (tooWide)
+        return paths.length === 1 ? { path: paths[0], exact: true } : undefined;
+    return { path: candidate };
 }
 const NO_PATH_OPERAND_COMMANDS = new Set([
-    "pwd", "echo", "whoami", "uname", "which", "tr", "basename", "dirname",
+    "pwd", "echo", "printf", "whoami", "uname", "which", "tr", "basename", "dirname",
     "cal", "uptime", "id", "groups", "nproc", "locale", "free", "true", "false", "seq", "expr", "type", "sleep",
 ]);
+const XARGS_TARGETS_ACCEPTED_UNJUDGED = NO_PATH_OPERAND_COMMANDS;
 function isPathShapedToken(tok) {
     return tok.includes("/") || tok.startsWith("~") || tok === "." || tok === "..";
 }
@@ -322,6 +322,9 @@ function refusedCommandExempt(command, allow, boundary, depth, baseMovedOutside
             if (!assignmentJudgedInside(words.folded[k]))
                 return false;
         }
+        const argv = argvProgramOf(words);
+        const argvStart = argv?.from ?? words.folded.length;
+        const declaredNotPaths = ASSIGNMENT_VALUE_NOT_PATHS.has(argv?.program ?? "");
         let endOfOptions = false;
         for (let j = from; j < words.folded.length; j++) {
             const word = words.folded[j];
@@ -340,7 +343,7 @@ function refusedCommandExempt(command, allow, boundary, depth, baseMovedOutside
                 if (!stdinFileJudgedInside(candidate))
                     return false;
             }
-            if (!optionShaped && !assignmentJudgedInside(word))
+            if (!optionShaped && (j < argvStart || !declaredNotPaths) && !assignmentJudgedInside(word))
                 return false;
         }
         return true;
@@ -362,7 +365,7 @@ function refusedCommandExempt(command, allow, boundary, depth, baseMovedOutside
         if (program === undefined) {
             if (pos.launchers.length === 0)
                 continue;
-            if (argvReentryUnjudged(pos, NO_PATH_OPERAND_COMMANDS))
+            if (argvReentryUnjudged(pos, XARGS_TARGETS_ACCEPTED_UNJUDGED))
                 return false;
             if (!unlistedSegmentJudgedInside(words, pos.launchers[0].index, pos.assignments))
                 return false;
@@ -370,12 +373,10 @@ function refusedCommandExempt(command, allow, boundary, depth, baseMovedOutside
         }
         if (program.name.includes(SUBSTITUTION_PLACEHOLDER) || /[$`]/.test(program.name))
             return false;
-        if (argumentAsProgramRefusal(program.basename, program.basename, words.folded.slice(program.index + 1)) !== undefined)
-            return false;
         if (SHELL_REENTRY_PROGRAM_RE.test(program.basename))
             return false;
         if (pos.launchers.length > 0) {
-            if (argvReentryUnjudged(pos, NO_PATH_OPERAND_COMMANDS))
+            if (argvReentryUnjudged(pos, XARGS_TARGETS_ACCEPTED_UNJUDGED))
                 return false;
             if (!listed(program.basename)) {
                 if (!unlistedSegmentJudgedInside(words, pos.launchers[0].index, pos.assignments))
@@ -609,6 +610,32 @@ const VERB_OPTION_SLOTS = {
             "verbose", "verify", "version",
         ],
     },
+    find: {
+        shortValue: { D: "label", O: "count", f: "path" },
+        shortPlain: "HLPdsx",
+        longValue: {},
+        longOptionalValue: {},
+        longPlain: ["help", "version"],
+        dashWordValue: {
+            amin: "count", anewer: "path", atime: "count", cmin: "count", cnewer: "path", context: "label",
+            ctime: "count", fstype: "label", gid: "count", group: "label", ilname: "path", iname: "name-pattern",
+            inum: "count", ipath: "path", iregex: "name-pattern", iwholename: "path", links: "count",
+            lname: "path", maxdepth: "count", mindepth: "count", mmin: "count", mtime: "count", name: "name-pattern",
+            newer: "path", newerat: "path", neweraa: "path", neweram: "path", newerac: "path",
+            newerct: "path", newerca: "path", newercm: "path", newercc: "path",
+            newermt: "path", newerma: "path", newermm: "path", newermc: "path",
+            newerbt: "path", newerba: "path", newerbm: "path", newerbc: "path",
+            path: "path", perm: "label", printf: "label", regex: "name-pattern", regextype: "label",
+            samefile: "path", size: "count", type: "label", uid: "count", used: "count", user: "label",
+            wholename: "path", xtype: "label",
+        },
+        dashWordPlain: [
+            "and", "daystart", "depth", "empty", "executable", "false", "follow", "help", "ignore_readdir_race",
+            "mount", "noignore_readdir_race", "noleaf", "not", "nogroup", "nouser", "or", "print",
+            "print0", "prune", "quit", "readable", "true", "version", "writable", "xdev",
+        ],
+        optionsArePositionIndependent: true,
+    },
     curl: {
         shortValue: {
             A: "label", b: "indirect", C: "count", c: "path", D: "path", d: "indirect", E: "path", e: "label",
@@ -699,6 +726,17 @@ function readVerbOptionSlot(name, tok) {
             return { form: "unexplained" };
         return withValue([...kinds][0]);
     }
+    const word = row.dashWordValue !== undefined || row.dashWordPlain !== undefined ? /^-([A-Za-z_][\w-]+)$/.exec(tok)?.[1] : undefined;
+    if (word !== undefined) {
+        if (row.shortValue[word[0]] !== undefined)
+            return { form: "unexplained" };
+        const kind = row.dashWordValue?.[word];
+        if (kind !== undefined)
+            return { form: "separated", kind };
+        if (row.dashWordPlain?.includes(word) === true)
+            return { form: "no-value" };
+        return { form: "unexplained" };
+    }
     for (let i = 1; i < tok.length; i++) {
         const ch = tok[i];
         const kind = row.shortValue[ch];
@@ -711,6 +749,9 @@ function readVerbOptionSlot(name, tok) {
     }
     return { form: "no-value" };
 }
+function verbOptionsArePositionIndependent(name) {
+    return VERB_OPTION_SLOTS[name]?.optionsArePositionIndependent === true;
+}
 function localFileUrlPath(value) {
     const m = /^file:(?:\/\/[^/?#]*)?(\/[^?#]*)/i.exec(value.trim());
     if (m === null)
@@ -800,23 +841,27 @@ function takesSeparatedValue(name, tok) {
     }
     return false;
 }
+const GREP_RECURSIVE_READ_FORM = {
+    discloses: "contents",
+    shortLetters: "rR",
+    valueOwners: "efmABCD",
+    longNames: ["recursive", "dereference-recursive"],
+    enumOptions: [{ shortLetter: "d", longName: "directories", recursiveValue: "recurse" }],
+    dashIsStdin: true,
+};
 const RECURSIVE_READ_FORMS = {
-    grep: {
-        shortLetters: "rR",
-        valueOwners: "efmABCD",
-        longNames: ["recursive", "dereference-recursive"],
-        enumOptions: [{ shortLetter: "d", longName: "directories", recursiveValue: "recurse" }],
-        dashIsStdin: true,
-    },
-    ls: { shortLetters: "R", longNames: ["recursive"] },
-    du: { always: true },
-    find: { always: true },
-    rg: { always: true, dashIsStdin: true },
-    tree: { always: true },
-    ag: { always: true, dashIsStdin: true },
-    ack: { always: true, dashIsStdin: true },
-    tar: { shortLetters: "cru", valueOwners: "fCTXbg", longNames: ["create", "append", "update"], bundledModeLetters: "cru", dashIsStdin: true },
-    diff: { shortLetters: "r", valueOwners: "UCWISFXx", longNames: ["recursive"], dashIsStdin: true },
+    grep: GREP_RECURSIVE_READ_FORM,
+    egrep: GREP_RECURSIVE_READ_FORM,
+    fgrep: GREP_RECURSIVE_READ_FORM,
+    ls: { discloses: "names", shortLetters: "R", longNames: ["recursive"] },
+    du: { discloses: "names", always: true },
+    find: { discloses: "names", always: true },
+    rg: { discloses: "contents", always: true, dashIsStdin: true },
+    tree: { discloses: "names", always: true },
+    ag: { discloses: "contents", always: true, dashIsStdin: true },
+    ack: { discloses: "contents", always: true, dashIsStdin: true },
+    tar: { discloses: "contents", shortLetters: "cru", valueOwners: "fCTXbg", longNames: ["create", "append", "update"], bundledModeLetters: "cru", dashIsStdin: true },
+    diff: { discloses: "contents", shortLetters: "r", valueOwners: "UCWISFXx", longNames: ["recursive"], dashIsStdin: true },
 };
 const FIND_DANGEROUS_PREDICATES = new Set([
     "-delete", "-exec", "-execdir", "-ok", "-okdir", "-fprint", "-fprint0", "-fls", "-fprintf", "-files0-from",
@@ -1458,6 +1503,8 @@ function segmentSelectsRecursiveRead(name, args) {
     const model = RECURSIVE_READ_FORMS[name];
     if (model === undefined)
         return false;
+    if (model.discloses !== "contents")
+        return false;
     if (model.always === true)
         return true;
     if (model.bundledModeLetters !== undefined) {
@@ -1540,6 +1587,17 @@ function assignmentWordPayload(word) {
         return { kind: "unresolved", reason: `"${word}" carries a tilde whose expansion the text does not settle` };
     return value === "" ? undefined : { kind: "value", value };
 }
+const ASSIGNMENT_VALUE_NOT_PATHS = new Set(["make", "gmake", "bmake", "cmake", "ninja", "meson", "docker", "podman"]);
+function argvProgramOf(tokens) {
+    let lead = 0;
+    while (lead < tokens.folded.length && ASSIGNMENT_OR_APPEND_WORD.test(tokens.folded[lead]))
+        lead++;
+    const pos = readProgramPosition({ folded: tokens.folded.slice(lead), raw: tokens.raw.slice(lead) });
+    if (pos.program === undefined)
+        return undefined;
+    const at = lead + pos.program.index;
+    return ASSIGNMENT_OR_APPEND_WORD.test(tokens.folded[at] ?? "") ? undefined : { program: pos.program.basename, from: at };
+}
 function attachedOptionPayloads(tok) {
     const literal = literalTildeSpelling;
     const out = [];
@@ -1564,9 +1622,12 @@ function attachedOptionPayloads(tok) {
 function collectSegmentBoundaryFindings(tokens, boundary) {
     const name = tokens.folded[0];
     const slotVerb = tokens.slotVerb ?? name;
+    const declaredNotPaths = ASSIGNMENT_VALUE_NOT_PATHS.has(tokens.argvProgram ?? slotVerb);
+    const argvFrom = tokens.argvFrom ?? (tokens.slotVerb === undefined ? 1 : Number.MAX_SAFE_INTEGER);
     if (NO_PATH_OPERAND_COMMANDS.has(name))
         return [];
-    const args = tokens.folded.slice(1);
+    const declaresNoPathOperands = tokens.slotVerb !== undefined && NO_PATH_OPERAND_COMMANDS.has(tokens.slotVerb) && tokens.argvFrom !== undefined;
+    const args = declaresNoPathOperands ? tokens.folded.slice(1, tokens.argvFrom + 1) : tokens.folded.slice(1);
     const findings = [];
     const candidates = [];
     const bareWordOperands = [];
@@ -1574,6 +1635,7 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
         (isPathShapedToken(text) || isAbsolutePathForm(text) ? candidates : bareWordOperands).push({ text, globbed });
     };
     const positionalOperands = [];
+    const argvOperandsStartAt = tokens.slotVerb !== undefined ? 1 : 0;
     let stdinOperand = false;
     const argGlobs = (k) => {
         const raw = tokens.raw[k + 1];
@@ -1610,7 +1672,6 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
         const eoo = args.indexOf("--");
         const patternSuppliedByFlag = name === "grep" && (eoo === -1 ? args : args.slice(0, eoo)).some(isGrepPatternFlagToken);
         let sawOperand = false;
-        const argvOperandsStartAt = tokens.slotVerb !== undefined ? 1 : 0;
         let sawArgvOperand = false;
         let endOfOptions = false;
         for (let k = 0; k < args.length; k++) {
@@ -1624,7 +1685,8 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
                 }
                 if (t.startsWith("-") && t !== "-") {
                     const slot = readVerbOptionSlot(slotVerb, t);
-                    if (sawArgvOperand) {
+                    const permutes = !verbOptionsArePositionIndependent(slotVerb);
+                    if (sawArgvOperand && permutes) {
                         judgeOperand(t, argGlobs(k));
                         if (slot !== undefined && slot.form === "separated") {
                             const ahead = args[k + 1];
@@ -1634,7 +1696,7 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
                             }
                         }
                     }
-                    if (slot !== undefined && slot.form !== "unexplained" && !(slot.form === "separated" && sawArgvOperand)) {
+                    if (slot !== undefined && slot.form !== "unexplained" && !(slot.form === "separated" && sawArgvOperand && permutes)) {
                         if (slot.form === "attached") {
                             for (const c of slotValueCandidates(literalTildeSpelling(slot.value), slot.kind))
                                 judgeOperand(c, argGlobs(k));
@@ -1663,23 +1725,27 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
             if (t === "-") {
                 if (isGrepPatternSlot)
                     continue;
-                const m = RECURSIVE_READ_FORMS[name];
+                const m = RECURSIVE_READ_FORMS[slotVerb];
                 if (m === undefined || m.dashIsStdin === true) {
                     stdinOperand = true;
                     continue;
                 }
-                positionalOperands.push(t);
+                if (k >= argvOperandsStartAt)
+                    positionalOperands.push(t);
                 continue;
             }
             if (isGrepPatternSlot)
                 continue;
-            positionalOperands.push(t);
+            if (k >= argvOperandsStartAt)
+                positionalOperands.push(t);
             judgeOperand(t, argGlobs(k));
             const payload = assignmentWordPayload(t);
-            if (payload?.kind === "value")
-                judgeOperand(payload.value, argGlobs(k));
-            else if (payload?.kind === "unresolved")
-                findings.push({ kind: "unresolvable", operand: t, reason: `"${name}": ${payload.reason} ${NOT_AUTO_ALLOWED}` });
+            if (payload !== undefined && (k + 1 < argvFrom || !declaredNotPaths)) {
+                if (payload.kind === "value")
+                    judgeOperand(payload.value, argGlobs(k));
+                else
+                    findings.push({ kind: "unresolvable", operand: t, reason: `"${name}": ${payload.reason} ${NOT_AUTO_ALLOWED}` });
+            }
         }
     }
     for (let k = 0; k < args.length; k++) {
@@ -1713,7 +1779,7 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
         if (!globbed && withinAnyRoot(boundary.roots, spellings.folded))
             findings.push({ kind: "inside", path: spellings.folded, ...(spellings.spelled !== undefined ? { spelled: spellings.spelled } : {}) });
     }
-    if (boundary.denyMatch !== undefined && segmentSelectsRecursiveRead(name, args)) {
+    if (boundary.denyMatch !== undefined && (boundary.denyEntries?.length ?? 1) > 0 && segmentSelectsRecursiveRead(slotVerb, args.slice(argvOperandsStartAt))) {
         const roots = positionalOperands.length > 0 ? positionalOperands : stdinOperand ? [] : ["."];
         for (const operand of roots) {
             const resolved = resolveOperandLexically(boundary.cwd ?? boundary.roots[0], operand, boundary.homeDir);
@@ -1803,6 +1869,12 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
             nameRefusal ??= `command "${written}" is not in the read-only allowlist`;
             continue;
         }
+        const program = pos.program;
+        if (program !== undefined) {
+            const familyRefusal = argumentAsProgramRefusal(program.basename, program.basename, folded.slice(program.index + 1));
+            if (familyRefusal !== undefined)
+                nameRefusal ??= familyRefusal;
+        }
         const parsed = parseLeadingCommandName(toks.raw.slice(from).join(" "), { quotedOperatorsAreText: true, pathPrefixedNameIsText: true });
         if ("reject" in parsed)
             return { reason: parsed.reject, refusedWhole: true };
@@ -1812,12 +1884,6 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
             nameRefusal ??= "the command must be a bare name resolved via PATH (no path prefix)";
         if (pos.refusal !== undefined)
             return { reason: programPositionRefusalSentence(pos.refusal), refusedWhole: true };
-        const program = pos.program;
-        if (program !== undefined) {
-            const familyRefusal = argumentAsProgramRefusal(program.basename, program.basename, folded.slice(program.index + 1));
-            if (familyRefusal !== undefined)
-                return { reason: familyRefusal, refusedWhole: true };
-        }
         if (allow.has(name)) {
             if (pathPrefixed || from > 0)
                 reheaded.set(si, { from, head: name });
@@ -1833,7 +1899,7 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
             if (program !== undefined && !listed && SHELL_REENTRY_PROGRAM_RE.test(program.basename)) {
                 return { reason: `"${written}" runs "${program.basename}", which runs its argument as shell text this walk does not judge ${NOT_AUTO_ALLOWED}`, refusedWhole: true };
             }
-            if (argvReentryUnjudged(pos, NO_PATH_OPERAND_COMMANDS)) {
+            if (argvReentryUnjudged(pos, XARGS_TARGETS_ACCEPTED_UNJUDGED)) {
                 return { reason: `"${written}" takes the operands of the program it runs from its standard input, which this walk does not judge ${NOT_AUTO_ALLOWED}`, refusedWhole: true };
             }
             if (!listed || program === undefined)
@@ -1895,7 +1961,13 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
             const unlisted = tokenizeSegment(segments[si]);
             if (unlisted.folded.length === 0)
                 continue;
-            foldedSegments.push({ folded: [LAUNCHER_SCAN_HEAD, ...unlisted.folded], raw: [LAUNCHER_SCAN_HEAD, ...unlisted.raw], slotVerb: programBasename(unlisted.folded[0]) });
+            const unlistedArgv = argvProgramOf(unlisted);
+            foldedSegments.push({
+                folded: [LAUNCHER_SCAN_HEAD, ...unlisted.folded],
+                raw: [LAUNCHER_SCAN_HEAD, ...unlisted.raw],
+                slotVerb: programBasename(unlisted.folded[0]),
+                ...(unlistedArgv !== undefined ? { argvProgram: unlistedArgv.program, argvFrom: unlistedArgv.from + 1 } : {}),
+            });
             pushReach();
             continue;
         }
@@ -1989,8 +2061,14 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
         const walk = evaluateReadBoundary(foldedSegments, boundary, true, foldedReach);
         if (shapeRefusal === undefined)
             return walk;
-        const { reason: _walkSentence, outOfRootGrantCandidate: _walkGrantCandidate, ...structure } = walk;
-        return { ...structure, reason: shapeRefusal };
+        const { reason: _walkSentence, outOfRootGrantCandidate: walkGrantCandidate, outOfRootGrantCoversExactPath: walkGrantExact, ...structure } = walk;
+        const nameOnly = shapeRefusal === nameRefusal;
+        return {
+            ...structure,
+            reason: shapeRefusal,
+            ...(nameOnly && walkGrantCandidate !== undefined ? { outOfRootGrantCandidate: walkGrantCandidate, ...(walkGrantExact === true ? { outOfRootGrantCoversExactPath: true } : {}) } : {}),
+            ...(nameOnly ? { segmentNameRefusal: true } : {}),
+        };
     }
     if (shapeRefusal !== undefined)
         return { reason: shapeRefusal };
@@ -2164,14 +2242,14 @@ function evaluateReadBoundary(foldedSegments, boundary, mintGrantCandidate, reac
         const proposed = outOfRootGrantCandidateOf(outside.map((o) => o.path), boundary);
         if (proposed === undefined)
             return undefined;
-        const replay = evaluateReadBoundary(foldedSegments, { ...boundary, roots: [...boundary.roots, proposed] }, false, reach);
+        const replay = evaluateReadBoundary(foldedSegments, { ...boundary, roots: [...boundary.roots, proposed.path] }, false, reach);
         return replay.reason === undefined && (replay.undecidedPaths ?? []).length === 0 ? proposed : undefined;
     })();
     return {
         reason: `"${outside[0].command}" reads ${paths}, outside the allowed directories for this session: ${allowed} ${NOT_AUTO_ALLOWED}`,
         outOfRootRead: true,
         outOfRootPaths: outside.map((o) => o.path),
-        ...(grantCandidate !== undefined ? { outOfRootGrantCandidate: grantCandidate } : {}),
+        ...(grantCandidate !== undefined ? { outOfRootGrantCandidate: grantCandidate.path, ...(grantCandidate.exact === true ? { outOfRootGrantCoversExactPath: true } : {}) } : {}),
         ...outsideField,
         ...checkedField,
         ...undecidedField,
@@ -2187,7 +2265,7 @@ export function classifySimpleCommandReadBoundary(command, boundary) {
     if (pos.program !== undefined) {
         const familyRefusal = argumentAsProgramRefusal(pos.program.basename, pos.program.basename, toks.folded.slice(pos.program.index + 1));
         if (familyRefusal !== undefined)
-            return { reason: familyRefusal, refusedWhole: true };
+            return { reason: familyRefusal };
     }
     return evaluateReadBoundary([toks], boundary, true);
 }
@@ -2240,7 +2318,8 @@ export function classifyOutOfRootReadGate(command, allow, boundary) {
             if (UNMODELLED_BASE_MOVERS.has(name))
                 baseMoved = true;
             if (!allow.has(name) && name !== "cd") {
-                pushReader({ folded: [LAUNCHER_SCAN_HEAD, ...toks.folded], raw: [LAUNCHER_SCAN_HEAD, ...toks.raw], slotVerb: name });
+                const argv = argvProgramOf(toks);
+                pushReader({ folded: [LAUNCHER_SCAN_HEAD, ...toks.folded], raw: [LAUNCHER_SCAN_HEAD, ...toks.raw], slotVerb: name, ...(argv !== undefined ? { argvProgram: argv.program, argvFrom: argv.from + 1 } : {}) });
                 continue;
             }
             pushReader(i === 0 && name === written ? toks : { folded: [name, ...toks.folded.slice(i + 1)], raw: [toks.raw[i] ?? name, ...toks.raw.slice(i + 1)] });