@sema-agent/core 7.22.0 → 7.23.1

package/dist/tools/fs/bash-readonly-classifier.js

@@ -1,7 +1,6 @@
 import { hasWin32AliasedComponent, isAbsoluteForFamily, isAbsolutePathForm, isBlockedDevicePath, isShellRootedSpellingUnmapped, joinForFamily, nativeUncSpellingOf, normalizeAbsPathLexically, win32NamespaceScreen, pathFamilyOf, withinAnyRoot } from "./safety.js";
 import { lexShellText, literalTildeSpelling, quoteMask, substitutionsInHeredocBody, SUBSTITUTION_PLACEHOLDER, wordsOf, } from "./bash-lexer.js";
-import { ASSIGNMENT_WORD, COMMAND_LAUNCHERS, NOT_AUTO_ALLOWED, SHELL_BLOCK_WORDS, argvReentryUnjudged, isBareControlWord, programBasename, programPositionRefusalSentence, readProgramPosition, } from "./bash-program-position.js";
-export { NOT_AUTO_ALLOWED } from "./bash-program-position.js";
+import { ASSIGNMENT_WORD, COMMAND_LAUNCHERS, NOT_AUTO_ALLOWED, SHELL_BLOCK_WORDS, argvReentryUnjudged, isBareControlWord, programPositionRunsShell, shellScanDeclineOf, programBasename, programPositionRefusalSentence, readProgramPosition, } from "./bash-program-position.js";
 export const BASH_READONLY_DEFAULT_ALLOW = [
     "ls", "cat", "head", "tail", "wc", "pwd", "echo", "whoami", "uname",
     "grep", "cut", "tr", "basename", "dirname", "stat", "du", "df", "which",
@@ -52,7 +51,8 @@ export function coarseReadonlyCheck(command, allow, options) {
         return `command "${parsed.name}" is not in the read-only allowlist`;
     return undefined;
 }
-const SHELL_SEGMENT_HARD_REJECT = /[<>$()`\n\r\\]/;
+const SHELL_SEGMENT_QUOTE_BLIND_REJECT = /[<>()`\n\r\\]/;
+const SHELL_EXPANSION_CHARS = /[$]/;
 export function carriesShellRedirection(text) {
     return SHELL_REDIRECTION_OPERATORS.test(text);
 }
@@ -78,10 +78,25 @@ function rejectedSansRedirection(source) {
     if (redirectionPrecedesConnector(source)) {
         return "a redirection followed by `|`, `&` or `;` is not allowed — the operator's own characters cannot be told apart from a command boundary";
     }
+    return hardRejectReason(source, true);
+}
+function hardRejectReason(source, tolerateRedirection) {
+    const reason = tolerateRedirection
+        ? "command/variable substitution, subshells, escapes, and line breaks are not allowed"
+        : "redirection, command/variable substitution, subshells, escapes, and line breaks are not allowed";
     for (const ch of source) {
-        if (SHELL_SEGMENT_HARD_REJECT.test(ch) && !SHELL_REDIRECTION_OPERATORS.test(ch)) {
-            return "command/variable substitution, subshells, escapes, and line breaks are not allowed";
-        }
+        if (SHELL_SEGMENT_QUOTE_BLIND_REJECT.test(ch) && !(tolerateRedirection && SHELL_REDIRECTION_OPERATORS.test(ch)))
+            return reason;
+    }
+    if (!SHELL_EXPANSION_CHARS.test(source))
+        return undefined;
+    const mask = quoteMask(source);
+    for (let i = 0; i < source.length; i++) {
+        if (!SHELL_EXPANSION_CHARS.test(source[i]))
+            continue;
+        if (mask.balanced && mask.openedBy[i] === "'")
+            continue;
+        return reason;
     }
     return undefined;
 }
@@ -91,8 +106,10 @@ export function splitShellCompoundSegments(source, options) {
         if (refused !== undefined)
             return { reject: refused };
     }
-    else if (SHELL_SEGMENT_HARD_REJECT.test(source)) {
-        return { reject: "redirection, command/variable substitution, subshells, escapes, and line breaks are not allowed" };
+    else {
+        const refused = hardRejectReason(source, false);
+        if (refused !== undefined)
+            return { reject: refused };
     }
     const scanned = options?.trailingTerminator !== "keep" ? source.replace(/;\s*$/, "") : source;
     const lexed = lexShellText(scanned, { mode: "strict" });
@@ -239,8 +256,8 @@ function tokensMoveBase(toks) {
     return pos.refusal !== undefined || pos.program?.basename === "cd";
 }
 const SHELL_REENTRY_PROGRAM_RE = /^(?:(?:ba|z|da|k|fi|a|mk|ya|pdk|c|tc)?sh|eval|source|\.|parallel)$/;
-export function refusedCommandMayRead(command, allow, boundary) {
-    return !refusedCommandExempt(command, allow, boundary, 0);
+export function refusedCommandMayRead(command, allow, boundary, declinesAreEvidence) {
+    return !refusedCommandExempt(command, allow, boundary, declinesAreEvidence, 0);
 }
 const STDIN_ONLY_READER_FLAGS = new Map([
     ["cat", /^-[AbeEnstTuv]+$/],
@@ -262,7 +279,7 @@ function whitelistSegment(segment) {
         redirects: tokens.filter((t) => t.kind === "redirect"),
     };
 }
-function refusedCommandExempt(command, allow, boundary, depth, baseMovedOutside = false) {
+function refusedCommandExempt(command, allow, boundary, declinesAreEvidence, depth, baseMovedOutside = false) {
     if (depth > 4)
         return false;
     const lexed = lexShellText(command, { mode: "lenient" });
@@ -282,12 +299,21 @@ function refusedCommandExempt(command, allow, boundary, depth, baseMovedOutside
         }
         segments.push(whitelistSegment(segment));
     }
+    let declined;
+    for (const { words } of segments) {
+        const pos = readProgramPosition(words);
+        if (programPositionRunsShell(pos, SHELL_REENTRY_PROGRAM_RE))
+            return false;
+        const decline = shellScanDeclineOf(pos, XARGS_TARGETS_ACCEPTED_UNJUDGED);
+        if (decline !== undefined && declinesAreEvidence.has(decline))
+            return false;
+        declined ??= decline;
+    }
+    if (declined !== undefined)
+        return true;
     const baseMoved = baseMovedOutside ||
         segments.some(({ words }) => {
-            const pos = readProgramPosition(words);
-            if (pos.refusal !== undefined)
-                return true;
-            const runs = pos.program?.basename;
+            const runs = readProgramPosition(words).program?.basename;
             return runs === "cd" || (runs !== undefined && UNMODELLED_BASE_MOVERS.has(runs));
         });
     for (const body of bodies) {
@@ -296,7 +322,7 @@ function refusedCommandExempt(command, allow, boundary, depth, baseMovedOutside
             (walked.undecidedPaths?.length ?? 0) === 0 && (walked.unresolvedOperands?.length ?? 0) === 0 && (walked.recursiveReadPaths?.length ?? 0) === 0;
         if (fullyGreen)
             continue;
-        if (!refusedCommandExempt(body, allow, boundary, depth + 1, baseMoved))
+        if (!refusedCommandExempt(body, allow, boundary, declinesAreEvidence, depth + 1, baseMoved))
             return false;
     }
     const stdinFileJudgedInside = (word) => {
@@ -353,8 +379,6 @@ function refusedCommandExempt(command, allow, boundary, depth, baseMovedOutside
             if (r.op === "<" && !stdinFileJudgedInside(r.target?.folded))
                 return false;
         const pos = readProgramPosition(words);
-        if (pos.refusal !== undefined)
-            return false;
         for (const k of words.folded.keys()) {
             const word = words.folded[k];
             if (ASSIGNMENT_WORD.test(word) && /\$\(|`/.test(word) && (pos.assignments.includes(k) || pos.launchers.some((l) => l.index < k)))
@@ -365,24 +389,16 @@ function refusedCommandExempt(command, allow, boundary, depth, baseMovedOutside
         if (program === undefined) {
             if (pos.launchers.length === 0)
                 continue;
-            if (argvReentryUnjudged(pos, XARGS_TARGETS_ACCEPTED_UNJUDGED))
-                return false;
             if (!unlistedSegmentJudgedInside(words, pos.launchers[0].index, pos.assignments))
                 return false;
             continue;
         }
         if (program.name.includes(SUBSTITUTION_PLACEHOLDER) || /[$`]/.test(program.name))
             return false;
-        if (SHELL_REENTRY_PROGRAM_RE.test(program.basename))
-            return false;
-        if (pos.launchers.length > 0) {
-            if (argvReentryUnjudged(pos, XARGS_TARGETS_ACCEPTED_UNJUDGED))
+        if (pos.launchers.length > 0 && !listed(program.basename)) {
+            if (!unlistedSegmentJudgedInside(words, pos.launchers[0].index, pos.assignments))
                 return false;
-            if (!listed(program.basename)) {
-                if (!unlistedSegmentJudgedInside(words, pos.launchers[0].index, pos.assignments))
-                    return false;
-                continue;
-            }
+            continue;
         }
         const head = program.basename;
         if (head === "cd" || UNMODELLED_BASE_MOVERS.has(head))
@@ -455,12 +471,12 @@ function longOptionNameOf(tok) {
 function isLongOptionAbbrevOf(name, full) {
     return full.startsWith(name);
 }
-function isGrepPatternFlagToken(tok) {
+function suppliesFirstOperandSlot(slot, tok) {
     if (tok.startsWith("--")) {
         const long = longOptionNameOf(tok);
-        return long !== undefined && (isLongOptionAbbrevOf(long, "regexp") || isLongOptionAbbrevOf(long, "file"));
+        return long !== undefined && slot.suppliedByLongNames.some((full) => isLongOptionAbbrevOf(long, full));
     }
-    return /^-[A-Za-z0-9]*[ef]/.test(tok);
+    return new RegExp(`^-[A-Za-z0-9]*[${slot.suppliedByLetters}]`).test(tok);
 }
 function isGrepClusterFileStdin(tok) {
     if (tok.startsWith("--") || !/^-[A-Za-z0-9]/.test(tok))
@@ -534,6 +550,7 @@ const VERB_OPTION_SLOTS = {
             regexp: "pattern",
         },
         longOptionalValue: { color: "label", colour: "label", context: "count" },
+        firstOperand: { kind: "pattern", suppliedByLetters: "ef", suppliedByLongNames: ["regexp", "file"] },
         longPlain: [
             "basic-regexp", "byte-offset", "count", "dereference-recursive", "extended-regexp",
             "files-with-matches", "files-without-match", "fixed-strings", "help", "ignore-case", "initial-tab",
@@ -579,6 +596,7 @@ const VERB_OPTION_SLOTS = {
         shortPlain: "nrEszu",
         longValue: { expression: "script", file: "path", "line-length": "count" },
         longOptionalValue: { "in-place": "label" },
+        firstOperand: { kind: "script", suppliedByLetters: "ef", suppliedByLongNames: ["expression", "file"] },
         longPlain: [
             "debug", "follow-symlinks", "help", "null-data", "posix", "quiet", "regexp-extended", "sandbox",
             "separate", "silent", "unbuffered", "version", "zero-terminated",
@@ -1670,7 +1688,8 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
     }
     else {
         const eoo = args.indexOf("--");
-        const patternSuppliedByFlag = name === "grep" && (eoo === -1 ? args : args.slice(0, eoo)).some(isGrepPatternFlagToken);
+        const firstOperandSlot = VERB_OPTION_SLOTS[name]?.firstOperand;
+        const firstOperandSuppliedByFlag = firstOperandSlot !== undefined && (eoo === -1 ? args : args.slice(0, eoo)).some((t) => suppliesFirstOperandSlot(firstOperandSlot, t));
         let sawOperand = false;
         let sawArgvOperand = false;
         let endOfOptions = false;
@@ -1718,12 +1737,12 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
                     continue;
                 }
             }
-            const isGrepPatternSlot = name === "grep" && !patternSuppliedByFlag && !sawOperand;
+            const inFirstOperandSlot = firstOperandSlot !== undefined && !firstOperandSuppliedByFlag && !sawOperand;
             sawOperand = true;
             if (k >= argvOperandsStartAt)
                 sawArgvOperand = true;
             if (t === "-") {
-                if (isGrepPatternSlot)
+                if (inFirstOperandSlot)
                     continue;
                 const m = RECURSIVE_READ_FORMS[slotVerb];
                 if (m === undefined || m.dashIsStdin === true) {
@@ -1734,8 +1753,14 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
                     positionalOperands.push(t);
                 continue;
             }
-            if (isGrepPatternSlot)
+            if (inFirstOperandSlot) {
+                const named = slotValueCandidates(t, firstOperandSlot.kind);
+                for (const c of named)
+                    judgeOperand(c, argGlobs(k));
+                if (named.length > 0 && k >= argvOperandsStartAt)
+                    positionalOperands.push(t);
                 continue;
+            }
             if (k >= argvOperandsStartAt)
                 positionalOperands.push(t);
             judgeOperand(t, argGlobs(k));
@@ -1987,7 +2012,8 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
         if (!(pipeFed[si] ?? false)) {
             const floor = STDIN_FILE_FLOOR[name];
             const restArgs = toks.slice(1);
-            const grepPatternSuppliedByFlag = name === "grep" && restArgs.some(isGrepPatternFlagToken);
+            const floorFirstOperandSlot = VERB_OPTION_SLOTS[name]?.firstOperand;
+            const floorSlotSuppliedByFlag = floorFirstOperandSlot !== undefined && restArgs.some((t) => suppliesFirstOperandSlot(floorFirstOperandSlot, t));
             let sawNonFlagOperand = false;
             let hasStdinDash = false;
             let operandCount = 0;
@@ -2013,10 +2039,10 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
                         if (t.startsWith("-") && t !== "-")
                             continue;
                     }
-                    const isGrepPatternPosition = name === "grep" && !grepPatternSuppliedByFlag && !sawNonFlagOperand;
+                    const inFirstOperandSlot = floorFirstOperandSlot !== undefined && !floorSlotSuppliedByFlag && !sawNonFlagOperand;
                     sawNonFlagOperand = true;
                     operandCount++;
-                    if (isGrepPatternPosition)
+                    if (inFirstOperandSlot)
                         continue;
                     if (t === "-") {
                         hasStdinDash = true;
@@ -2329,10 +2355,13 @@ export function classifyOutOfRootReadGate(command, allow, boundary) {
         if (baseMoved)
             return { gated: true, paths: [] };
         const verdict = evaluateReadBoundary(readers, containmentOnly, false, readerReach);
-        return verdict.outOfRootRead === true ? { gated: true, paths: verdict.outOfRootPaths ?? [] } : NOT_GATED;
+        const denied = boundary.denyMatch === undefined ? false : evaluateReadBoundary(readers, boundary, false, readerReach).readDenied === true;
+        if (verdict.outOfRootRead === true)
+            return { gated: true, paths: verdict.outOfRootPaths ?? [], ...(denied ? { denied: true } : {}) };
+        return denied ? { gated: false, paths: [], denied: true } : NOT_GATED;
     };
     const direct = judge(command);
-    if (direct.gated)
+    if (direct.gated || direct.denied === true)
         return direct;
     const shape = POLL_LOOP_SHAPE.exec(command.trim());
     return shape !== null ? judge(shape[3]) : NOT_GATED;

package/dist/tools/fs/fs-bash.d.ts

@@ -3,6 +3,7 @@ import { type TaskRegistry } from "../../core/task-registry.js";
 import { type CwdRef } from "./fs-shared.js";
 import type { ReversibilityVerdict } from "../../core/types.js";
 import { type BashReadonlyRootBoundary } from "./bash-readonly-classifier.js";
+import { type ShellScanDecline } from "./bash-program-position.js";
 /**
  * A parsed-command classifier for the `bash` tool, exposed as a
  * `ToolSpec.reversibilityProbe`. A full shell is treated as egress+irreversible by DEFAULT; this probe is the
@@ -60,6 +61,27 @@ import { type BashReadonlyRootBoundary } from "./bash-readonly-classifier.js";
  * shape classifier here changes what happens to the residual shell risk, never that reading.
  */
 export declare function bashReversibilityProbe(allow?: readonly string[], boundary?: BashReadonlyRootBoundary | (() => BashReadonlyRootBoundary | undefined)): (args: unknown) => ReversibilityVerdict;
+/**
+ * ONE rule, TWO TABLES: which {@link ShellScanDecline} a SEAT reads as read evidence. A decline names no word,
+ * so it is never the boundary DECLARING anything about a path.
+ *
+ * The READ-BOUNDARY seat is what the default/off doctrine and a bypass mode mount ALONE: there "not mandated"
+ * is VOUCHED, so a decline must count as evidence or a read nobody judged runs silently (`<out-of-root> |
+ * xargs cat` at zero asks — a closed P0). It keeps both. The CLASSIFY seat composes the same boundary with the
+ * SHAPE classifier, which refuses all these shapes anyway: the only question left is whether a stored answer
+ * may retire the ask. It keeps NEITHER — empty by the argument, not by omission.
+ * THE COST, stated rather than mitigated: once that ask is retired, an out-of-root or deny-listed read HIDDEN
+ * inside such a command is not asked again. A command's words are not the argv its programs receive (a stream
+ * is re-split by its consumer, an unread option may move the working directory first, stdin text is a command
+ * line nobody parsed), so a scan of them cannot be the guarantee it was claimed to be — three independently
+ * exploitable shapes measured that. "A read the boundary objects to is never retired by a stored rule" does
+ * NOT hold on the classify seat for this class, and holds unchanged elsewhere; below it is the execution
+ * environment's sandbox. One word-level check survives on both seats and is not part of the trade: a token the
+ * scan DID read naming a path outside the roots still gates the call ({@link classifyOutOfRootReadGate}).
+ */
+export declare const BOUNDARY_SEAT_DECLINE_EVIDENCE: ReadonlySet<ShellScanDecline>;
+/** The classify doctrine's table — see above; empty by the argument. */
+export declare const CLASSIFY_SEAT_DECLINE_EVIDENCE: ReadonlySet<ShellScanDecline>;
 /**
  * The READ-BOUNDARY seat of the full shell: a `ToolSpec.reversibilityProbe` that answers exactly ONE
  * question — does the deployment's read boundary object to where this command reads? — and nothing about

package/dist/tools/fs/fs-bash.js

@@ -13,7 +13,8 @@ import { boundaryIsTheSandbox, canonicalPathIsAuthoritative, hasDestroy, isIsola
 import { ghRateLimitHint } from "./gh-rate-limit.js";
 import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, createShellOverflowSpoolFence, shellRecoveryHint, CWD_SENTINEL, stripCwdSentinel, BASH_READONLY_CONFINEMENT_NOTE, } from "./fs-shared.js";
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted } from "../../core/untrusted-text.js";
-import { bashClassifyDefaultAllow, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed, classifyOutOfRootReadGate, refusedCommandMayRead, classifySimpleCommandReadBoundary, NOT_AUTO_ALLOWED, } from "./bash-readonly-classifier.js";
+import { bashClassifyDefaultAllow, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed, classifyOutOfRootReadGate, refusedCommandMayRead, classifySimpleCommandReadBoundary, } from "./bash-readonly-classifier.js";
+import { NOT_AUTO_ALLOWED, SHELL_SCAN_DECLINES } from "./bash-program-position.js";
 import { toolFace } from "../../core/tool-catalog-entries.js";
 const RECURSIVE_CAUSE_MAX_PATHS = 3;
 const RECURSIVE_READ_CAUSE_CODE = "shell.recursive_read_unbounded";
@@ -27,8 +28,8 @@ function operandFamily(paths) {
 export function bashReversibilityProbe(allow, boundary) {
     const allowSet = new Set(allow ?? bashClassifyDefaultAllow());
     const judge = (args, command, resolved, offers) => {
-        const boundaryGate = (verdict) => readBoundaryMandate(command, allowSet, resolved, verdict);
-        const outOfRootGate = () => readBoundaryMandate(command, allowSet, resolved, {});
+        const boundaryGate = (verdict) => readBoundaryMandate(command, allowSet, resolved, verdict, CLASSIFY_SEAT_DECLINE_EVIDENCE);
+        const outOfRootGate = () => readBoundaryMandate(command, allowSet, resolved, {}, CLASSIFY_SEAT_DECLINE_EVIDENCE);
         const backgrounded = isBackgroundShellCall(args);
         const detailed = classifyCompoundReadonlyDetailed(command, allowSet, resolved);
         if (backgrounded)
@@ -46,7 +47,7 @@ export function bashReversibilityProbe(allow, boundary) {
         if (loop.reason === undefined)
             return { reversible: true };
         const seatOffer = (verdict) => (offers ? readRootCandidateOf(verdict) : {});
-        if (boundaryDeclared(loop) || unjudgedRead(command, allowSet, resolved, loop))
+        if (boundaryDeclared(loop) || unjudgedRead(command, allowSet, resolved, loop, CLASSIFY_SEAT_DECLINE_EVIDENCE))
             return { reversible: false, mandated: true, ...seatOffer(loop) };
         const refusedCause = recursiveReadCause(detailed);
         return { reversible: false, ...boundaryGate(detailed), ...seatOffer(detailed), ...(refusedCause !== undefined ? { cause: refusedCause } : {}) };
@@ -86,24 +87,30 @@ function shellCommandOf(args) {
 function isBackgroundShellCall(args) {
     return args?.run_in_background === true;
 }
-function readBoundaryMandate(command, allowSet, resolved, verdict) {
+export const BOUNDARY_SEAT_DECLINE_EVIDENCE = new Set(SHELL_SCAN_DECLINES);
+export const CLASSIFY_SEAT_DECLINE_EVIDENCE = new Set();
+function readBoundaryMandate(command, allowSet, resolved, verdict, declineEvidence) {
     if (resolved === undefined)
         return {};
-    if (denyJudgeSpoke(verdict) || unjudgedRead(command, allowSet, resolved, verdict))
+    if (denyJudgeSpoke(verdict) || unjudgedRead(command, allowSet, resolved, verdict, declineEvidence))
         return { mandated: true };
-    return classifyOutOfRootReadGate(command, allowSet, resolved).gated ? { mandated: true } : {};
+    const named = classifyOutOfRootReadGate(command, allowSet, resolved);
+    return named.gated || named.denied === true ? { mandated: true } : {};
 }
 function boundaryUnjudged(verdict) {
     return verdict.refusedWhole === true || (verdict.unresolvedOperands !== undefined && verdict.unresolvedOperands.length > 0);
 }
-function unjudgedRead(command, allowSet, resolved, verdict) {
+function unjudgedRead(command, allowSet, resolved, verdict, declineEvidence) {
     if (verdict.unresolvedOperands !== undefined && verdict.unresolvedOperands.length > 0)
         return true;
     if (verdict.refusedWhole !== true)
         return false;
-    if (refusedCommandMayRead(command, allowSet, resolved))
+    if (refusedCommandMayRead(command, allowSet, resolved, declineEvidence))
         return true;
-    return resolved !== undefined && classifyOutOfRootReadGate(command, allowSet, resolved).gated;
+    if (resolved === undefined)
+        return false;
+    const named = classifyOutOfRootReadGate(command, allowSet, resolved);
+    return named.gated || named.denied === true;
 }
 function recursiveReadCause(detailed) {
     const recursive = detailed.recursiveReadPaths;
@@ -121,7 +128,7 @@ export function bashReadBoundaryProbe(boundary) {
     const allowSet = new Set(bashClassifyDefaultAllow());
     const judge = (command, resolved, offers) => {
         const seatVerdict = (verdict) => {
-            if (boundaryDeclared(verdict) || unjudgedRead(command, allowSet, resolved, verdict)) {
+            if (boundaryDeclared(verdict) || unjudgedRead(command, allowSet, resolved, verdict, BOUNDARY_SEAT_DECLINE_EVIDENCE)) {
                 const cause = recursiveReadCause(verdict);
                 return { reversible: false, mandated: true, ...(cause !== undefined ? { cause } : {}) };
             }
@@ -145,7 +152,7 @@ export function bashReadBoundaryProbe(boundary) {
         const offerFrom = (verdict) => (offers ? readRootCandidateOf(verdict) : {});
         if (mandated !== undefined)
             return { ...mandated, ...offerFrom(detailed), ...offerFrom(loop) };
-        if (readBoundaryMandate(command, allowSet, resolved, detailed).mandated === true)
+        if (readBoundaryMandate(command, allowSet, resolved, detailed, BOUNDARY_SEAT_DECLINE_EVIDENCE).mandated === true)
             return { reversible: false, mandated: true };
         return compoundVerdict ?? loopVerdict ?? { reversible: true };
     };

package/dist/tools/fs/fs-read.js

@@ -231,7 +231,7 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
                     if (prevNb && !prevNb.isPartialView && prevNb.hash === hash && prevNb.view && prevNb.view.start === 1 && prevNb.view.end === total) {
                         return fileUnchangedResult(`[${path}: unchanged since you last read it (lines 1-${total} of ${total}); content omitted to save context]`, "unchanged-since-last-read", 1, total, total);
                     }
-                    state.set(r.key, { hash, totalLines: countLines(content), truncated: false, view: { start: 1, end: total }, lastReadAt: Date.now() });
+                    state.set(r.key, { hash, totalLines: countLines(content), truncated: false, view: { start: 1, end: total }, lastReadAt: Date.now(), transmittedByToolCallId: ctx.toolCallId });
                     const bodyBlocks = rendered.blocks.length > 0 ? rendered.blocks : [{ type: "text", text: "[notebook has 0 cells]" }];
                     const nbDisclosure = discloseReminderShaped({
                         segments: rendered.blocks.filter((b) => b.type === "text").map((b) => b.text),
@@ -307,6 +307,7 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
                 ...(pageMarker !== undefined ? { isPartialView: true } : {}),
                 view: { start, end },
                 lastReadAt: Date.now(),
+                transmittedByToolCallId: ctx.toolCallId,
             });
             if (total === 0)
                 return `${openSystemReminder(reminderMark)}Warning: the file exists but the contents are empty.</system-reminder>`;

package/dist/tools/fs/fs-shared.d.ts

@@ -375,9 +375,7 @@ export declare const CWD_SENTINEL = "__cc_cwd_9f2c1b__";
  * TWO CALLERS, ONE RULE, which is why the marker is optional. The foreground result path KNOWS the
  * marker it minted and passes it (exact, unambiguous). A backgrounded command's spool is assembled by a
  * different lane entirely — the shell row outlives the run that launched it and never had the marker —
- * so it passes none and the marker is recovered per span from the sentinel plus its hex suffix. Before
- * this was shared, only the foreground path stripped, and the completion notification handed a person
- * the raw internal marker with the directory inside it.
+ * so it passes none and the marker is recovered per span from the sentinel plus its hex suffix.
  */
 export declare function stripCwdSentinel(stderr: string, marker?: string): {
     stderr: string;
@@ -504,10 +502,38 @@ export declare function inheritSessionReadFileState(target: ReadFileState, inher
  * coordinate (canonicalized the same way the Read/Edit/Write tools populate it), so a plain lookup
  * suffices; no re-hash/re-register needed since the entry's content genuinely has not changed.
  */
-export declare function applyCompactionToReadFileState(state: ReadFileState, attachedComplete: ReadonlyArray<{
-    path: string;
-    content: string;
-}>, preserveKeys?: ReadonlyArray<string>): void;
+/**
+ * The SECOND way a transmission leaves the model's view, and why this function is named for context
+ * SHRINK rather than compaction: the request-layer stale-result pass replaces an old tool result's
+ * content with a cleared marker — no summary, no re-attachment, nothing changed in the session — and
+ * for a Read result the effect on the entry is identical: the body its dedup stub points at is no
+ * longer anywhere the model can see, so the entry must retire with it.
+ *
+ * Selection is by the TRANSMISSION, not by path — an entry a LATER Read re-transmitted carries that
+ * later call's id and so survives a clear of the earlier one, which a path-keyed retirement could not
+ * tell apart. KNOWN IMPRECISION: a call id is not unique over a run (the clear ledger keys occurrences
+ * by id + message timestamp + ordinal for that reason) and the finer key is not reachable at the Read
+ * mint, which does not know the timestamp of the message its result will land in. A reused id can
+ * therefore retire one entry too many, costing a re-transmission and a tightened read-before-edit gate
+ * — the same tightening the summarized arm accepts wholesale. The converse is not reachable: an entry
+ * carries the id of the last Read that transmitted it, so if that result was cleared its id is in the list.
+ */
+export type ReadFileStateShrink = 
+/** A landed compaction: `attachedComplete` re-entered the context whole; `preserveKeys` stayed visible in the kept tail. */
+{
+    kind: "summarized";
+    attachedComplete: ReadonlyArray<{
+        path: string;
+        content: string;
+    }>;
+    preserveKeys?: ReadonlyArray<string>;
+}
+/** A request-layer stale-result clear: these tool calls' results are markers now. Nothing re-entered. */
+ | {
+    kind: "tool-results-cleared";
+    clearedToolCallIds: ReadonlyArray<string>;
+};
+export declare function applyContextShrinkToReadFileState(state: ReadFileState, shrink: ReadFileStateShrink): void;
 /** CC 2.1.198 verbatim skeleton: the ENOENT error body for a
  *  missing Read/Edit target — `File does not exist. Note: your current working directory is <cwd>.`
  *  plus a `Did you mean <sibling>?` correction when the parent directory holds a near-name (case

package/dist/tools/fs/fs-shared.js

@@ -318,7 +318,18 @@ export async function inheritSessionReadFileState(target, inherited, judgeKey) {
             target.set(judged, entry);
     }
 }
-export function applyCompactionToReadFileState(state, attachedComplete, preserveKeys = []) {
+export function applyContextShrinkToReadFileState(state, shrink) {
+    if (shrink.kind === "tool-results-cleared") {
+        if (shrink.clearedToolCallIds.length === 0)
+            return;
+        const cleared = new Set(shrink.clearedToolCallIds);
+        for (const [k, v] of [...state]) {
+            if (v.transmittedByToolCallId !== undefined && cleared.has(v.transmittedByToolCallId))
+                state.delete(k);
+        }
+        return;
+    }
+    const { attachedComplete, preserveKeys = [] } = shrink;
     const preserve = new Set(preserveKeys);
     for (const [k, v] of [...state]) {
         if (v.seededFromContext !== true && !preserve.has(k))

package/dist/tools/fs/safety.d.ts

@@ -77,6 +77,13 @@ export interface ReadEntry {
      *  disk (hash mismatch) always serves real content and the dedup disarms permanently.
      *  Optional/additive: absent = normal entry. */
     seededFromContext?: boolean;
+    /** The id of the tool call whose RESULT carried the body this entry dedups against: when the
+     *  request-layer stale-result pass clears THAT transmission, the entry retires with it
+     *  (`applyContextShrinkToReadFileState`, `tool-results-cleared` arm). Recorded only by the Read
+     *  lanes that TRANSMIT a body — a write-back's content is the model's own arguments and a
+     *  seeded/re-attached entry never rode a tool result, so neither carries this and neither is
+     *  retired by a clear. Optional/additive: absent (an older checkpoint) never matches a cleared id. */
+    transmittedByToolCallId?: string;
 }
 /** Per-task record of which files have been read, keyed by canonical path: owned by prepare-task,
  *  closure-captured by the tools, and serialized into the durable checkpoint. */
@@ -385,6 +392,36 @@ export declare function isShellRootedSpellingUnmapped(family: PathFamily | undef
  *  ⇒ `\\\\host\\share\\x`), for a lexical normalizer that recognises the backslash form only; every other spelling is
  *  returned as is. */
 export declare function nativeUncSpellingOf(family: PathFamily | undefined, spelled: string): string;
+/**
+ * Fold a TRAILING separator run off a spelling that is about to become a KEY: `<dir>/adir`, `<dir>/adir/`
+ * and `<dir>/adir//` name one directory and must mint one key. The existing-path arm folds them already,
+ * as a side effect of asking `realpath`; the arm that mints a key for a path that does NOT exist yet
+ * rejoined the model's own tail verbatim, so the same not-yet-created directory arrived under two and
+ * three keys — and a byte-wise reader (the per-file read state, the write gate's per-key ledger) treats
+ * two keys as two files.
+ *
+ * Called on the ANSWER, at the canonicalizer's single exit, and never on a spelling about to be probed.
+ * Two things break if it moves earlier. A trailing separator is an ASSERTION that the target is a
+ * directory and the platform enforces it (`<existing regular file>/` answers `not_directory`, reported
+ * here as a refusal), so folding before the probe spends that refusal and the slash-suffixed spelling of
+ * a file resolves to the file. And the ancestor walk chooses which ancestor to canonicalize by SPLITTING
+ * the spelling it was handed: a leaf stripped of its separator first is skipped as though it had been
+ * resolved, so `<root>/link/` — a link to a directory outside the root — comes back as the in-root
+ * spelling instead of the destination. Folding the answer costs neither.
+ *
+ * A spelling whose remainder is the bare ANCHOR keeps the separator the platform writes on a root — `/`,
+ * `C:\`, `\\host\share\`. That run IS the root's own spelling rather than a tail nobody wrote, and
+ * stripping it renames the spelling to nothing, to a DRIVE-RELATIVE location, or to a share root written
+ * unlike every other root. The question is asked in the module's own vocabulary ({@link pathIdentityOf} +
+ * {@link isIdentityDir}: is anything left BELOW the anchor?), so the three families need no arm each.
+ * Interior runs are NOT touched here: the ancestor walk folds them by probing, and a run in the middle of
+ * a name is the platform's to read.
+ *
+ * Scanned backwards rather than matched: `/[\\/]+$/` against a model-supplied spelling is quadratic when a
+ * long separator run precedes a non-separator (measured: ~5s for 32k leading slashes, on the caller's
+ * thread), and a path spelling is unbounded input.
+ */
+export declare function foldTrailingSeparators(spelled: string, family: PathFamily): string;
 /**
  * Join a RELATIVE-OR-ROOTED spelling to a base under the family, without folding (`..` across a symlinked
  * parent is the env's to resolve). win = `path.win32` semantics: `/x`/`\x` lands on the base's drive or

package/dist/tools/fs/safety.js

@@ -371,11 +371,17 @@ function mintIdentity(anchor, segments, stripTail) {
                 out.pop();
             continue;
         }
-        const stripped = stripTail ? seg.replace(/[. ]+$/, "") : seg;
+        const stripped = stripTail ? seg.slice(0, trailingDotSpaceStart(seg)) : seg;
         out.push(stripped.length > 0 ? stripped : seg);
     }
     return (out.length === 0 ? anchor || "/" : `${anchor}/${out.join("/")}`);
 }
+function trailingDotSpaceStart(seg) {
+    let end = seg.length;
+    while (end > 0 && (seg[end - 1] === "." || seg[end - 1] === " "))
+        end -= 1;
+    return end;
+}
 function identityAnchorOf(identity) {
     return identity.startsWith("//") ? identity.split("/").slice(0, 4).join("/") : identity.slice(0, 2);
 }
@@ -403,6 +409,18 @@ export function isShellRootedSpellingUnmapped(family, spelled) {
 export function nativeUncSpellingOf(family, spelled) {
     return family === "win" && isUncSpelling(spelled) ? `\\\\${spelled.slice(2).replace(/\//g, "\\")}` : spelled;
 }
+export function foldTrailingSeparators(spelled, family) {
+    let end = spelled.length;
+    while (end > 0 && (spelled[end - 1] === "/" || (family === "win" && spelled[end - 1] === "\\")))
+        end -= 1;
+    if (end === spelled.length)
+        return spelled;
+    const stripped = spelled.slice(0, end);
+    const identity = pathIdentityOf(stripped, family);
+    if (!identity.ok || !isIdentityDir(identity.identity, family))
+        return spelled;
+    return stripped;
+}
 export function joinForFamily(family, base, rel) {
     if (family === "posix")
         return `${base.replace(/\/+$/, "")}/${rel}`;
@@ -500,7 +518,8 @@ export async function canonicalizeTarget(env, path, signal, family, baseCwd) {
         throw e;
     });
     try {
-        return await withGateTimeout(probe, DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "pathCanonicalization");
+        const answer = await withGateTimeout(probe, DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "pathCanonicalization");
+        return answer.ok ? { ...answer, key: foldTrailingSeparators(answer.key, family) } : answer;
     }
     catch (err) {
         if (seenThrow && err === thrownByProbe)
@@ -546,7 +565,16 @@ async function probeRealTarget(env, path, target, family, signal) {
         if (!link.ok) {
             return { ok: false, message: `cannot read symlink "${path}": ${link.error.message}`, unresolvedSymlink: true };
         }
-        const linkTarget = isAbsoluteForFamily(family, link.value) ? link.value : joinForFamily(family, parentDir(abs), link.value);
+        const screenedTarget = win32NamespaceScreen(link.value, family);
+        if (!screenedTarget.ok) {
+            return {
+                ok: false,
+                message: `cannot resolve symlink "${path}": its target "${clipSpelling(link.value)}" ${WIN32_NAMESPACE_REFUSAL_TEXT[screenedTarget.refuse]}; refused (${screenedTarget.refuse}).`,
+                refused: screenedTarget.refuse,
+            };
+        }
+        const hopSpelling = family === "win" ? screenedTarget.spelled : link.value;
+        const linkTarget = isAbsoluteForFamily(family, hopSpelling) ? hopSpelling : joinForFamily(family, parentDir(abs), hopSpelling);
         const reabs = await env.absolutePath(linkTarget, signal);
         if (!reabs.ok) {
             return { ok: false, message: `cannot resolve symlink target "${linkTarget}" for "${path}": ${reabs.error.message}`, unresolvedSymlink: true };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.22.0",
+  "version": "7.23.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",
@@ -48,7 +48,7 @@
   },
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.build.json && tsc -p tsconfig.build.json --emitDeclarationOnly --removeComments false",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --noEmit && echo \"typecheck OK (tsc --noEmit clean)\"",
     "pretest": "npm run gate:debts",
     "test": "vitest run --exclude \"**/*.local.test.ts\"",
     "test:watch": "vitest",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2394,
+  "count": 2395,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -1615,6 +1615,7 @@
     "WriteProtectionMount": "interface",
     "WriteProtectionTargetView": "type",
     "WriteProtectionVerdict": "type",
+    "WriteProtectionViewAbsence": "interface",
     "WriteReceipt": "interface",
     "XARGS_READ_ONLY_TARGETS": "variable",
     "ackAdoptionConfig": "function",
@@ -4011,6 +4012,7 @@
     "WriteProtectionMount": "advanced",
     "WriteProtectionTargetView": "advanced",
     "WriteProtectionVerdict": "advanced",
+    "WriteProtectionViewAbsence": "advanced",
     "WriteReceipt": "internal",
     "XARGS_READ_ONLY_TARGETS": "advanced",
     "ackAdoptionConfig": "advanced",