@sema-agent/core 7.23.0 → 7.23.2

package/dist/tools/fs/bash-readonly-classifier.js

@@ -1,7 +1,6 @@
 import { hasWin32AliasedComponent, isAbsoluteForFamily, isAbsolutePathForm, isBlockedDevicePath, isShellRootedSpellingUnmapped, joinForFamily, nativeUncSpellingOf, normalizeAbsPathLexically, win32NamespaceScreen, pathFamilyOf, withinAnyRoot } from "./safety.js";
 import { lexShellText, literalTildeSpelling, quoteMask, substitutionsInHeredocBody, SUBSTITUTION_PLACEHOLDER, wordsOf, } from "./bash-lexer.js";
-import { ASSIGNMENT_WORD, COMMAND_LAUNCHERS, NOT_AUTO_ALLOWED, SHELL_BLOCK_WORDS, argvReentryUnjudged, isBareControlWord, programBasename, programPositionRefusalSentence, readProgramPosition, } from "./bash-program-position.js";
-export { NOT_AUTO_ALLOWED } from "./bash-program-position.js";
+import { ASSIGNMENT_WORD, COMMAND_LAUNCHERS, NOT_AUTO_ALLOWED, SHELL_BLOCK_WORDS, argvReentryUnjudged, isBareControlWord, programPositionRunsShell, shellScanDeclineOf, programBasename, programPositionRefusalSentence, readProgramPosition, } from "./bash-program-position.js";
 export const BASH_READONLY_DEFAULT_ALLOW = [
     "ls", "cat", "head", "tail", "wc", "pwd", "echo", "whoami", "uname",
     "grep", "cut", "tr", "basename", "dirname", "stat", "du", "df", "which",
@@ -52,7 +51,8 @@ export function coarseReadonlyCheck(command, allow, options) {
         return `command "${parsed.name}" is not in the read-only allowlist`;
     return undefined;
 }
-const SHELL_SEGMENT_HARD_REJECT = /[<>$()`\n\r\\]/;
+const SHELL_SEGMENT_QUOTE_BLIND_REJECT = /[<>()`\n\r\\]/;
+const SHELL_EXPANSION_CHARS = /[$]/;
 export function carriesShellRedirection(text) {
     return SHELL_REDIRECTION_OPERATORS.test(text);
 }
@@ -78,10 +78,25 @@ function rejectedSansRedirection(source) {
     if (redirectionPrecedesConnector(source)) {
         return "a redirection followed by `|`, `&` or `;` is not allowed — the operator's own characters cannot be told apart from a command boundary";
     }
+    return hardRejectReason(source, true);
+}
+function hardRejectReason(source, tolerateRedirection) {
+    const reason = tolerateRedirection
+        ? "command/variable substitution, subshells, escapes, and line breaks are not allowed"
+        : "redirection, command/variable substitution, subshells, escapes, and line breaks are not allowed";
     for (const ch of source) {
-        if (SHELL_SEGMENT_HARD_REJECT.test(ch) && !SHELL_REDIRECTION_OPERATORS.test(ch)) {
-            return "command/variable substitution, subshells, escapes, and line breaks are not allowed";
-        }
+        if (SHELL_SEGMENT_QUOTE_BLIND_REJECT.test(ch) && !(tolerateRedirection && SHELL_REDIRECTION_OPERATORS.test(ch)))
+            return reason;
+    }
+    if (!SHELL_EXPANSION_CHARS.test(source))
+        return undefined;
+    const mask = quoteMask(source);
+    for (let i = 0; i < source.length; i++) {
+        if (!SHELL_EXPANSION_CHARS.test(source[i]))
+            continue;
+        if (mask.balanced && mask.openedBy[i] === "'")
+            continue;
+        return reason;
     }
     return undefined;
 }
@@ -91,8 +106,10 @@ export function splitShellCompoundSegments(source, options) {
         if (refused !== undefined)
             return { reject: refused };
     }
-    else if (SHELL_SEGMENT_HARD_REJECT.test(source)) {
-        return { reject: "redirection, command/variable substitution, subshells, escapes, and line breaks are not allowed" };
+    else {
+        const refused = hardRejectReason(source, false);
+        if (refused !== undefined)
+            return { reject: refused };
     }
     const scanned = options?.trailingTerminator !== "keep" ? source.replace(/;\s*$/, "") : source;
     const lexed = lexShellText(scanned, { mode: "strict" });
@@ -239,8 +256,10 @@ function tokensMoveBase(toks) {
     return pos.refusal !== undefined || pos.program?.basename === "cd";
 }
 const SHELL_REENTRY_PROGRAM_RE = /^(?:(?:ba|z|da|k|fi|a|mk|ya|pdk|c|tc)?sh|eval|source|\.|parallel)$/;
-export function refusedCommandMayRead(command, allow, boundary) {
-    return !refusedCommandExempt(command, allow, boundary, 0);
+export function refusedCommandMayRead(command, allow, boundary, declinesAreEvidence) {
+    const scan = { declined: false };
+    const exempt = refusedCommandExempt(command, allow, boundary, declinesAreEvidence, scan, 0);
+    return { mayRead: !exempt, declined: scan.declined };
 }
 const STDIN_ONLY_READER_FLAGS = new Map([
     ["cat", /^-[AbeEnstTuv]+$/],
@@ -262,7 +281,7 @@ function whitelistSegment(segment) {
         redirects: tokens.filter((t) => t.kind === "redirect"),
     };
 }
-function refusedCommandExempt(command, allow, boundary, depth, baseMovedOutside = false) {
+function refusedCommandExempt(command, allow, boundary, declinesAreEvidence, scan, depth, baseMovedOutside = false) {
     if (depth > 4)
         return false;
     const lexed = lexShellText(command, { mode: "lenient" });
@@ -282,12 +301,23 @@ function refusedCommandExempt(command, allow, boundary, depth, baseMovedOutside
         }
         segments.push(whitelistSegment(segment));
     }
+    let declined;
+    for (const { words } of segments) {
+        const pos = readProgramPosition(words);
+        if (programPositionRunsShell(pos, SHELL_REENTRY_PROGRAM_RE))
+            return false;
+        const decline = shellScanDeclineOf(pos, XARGS_TARGETS_ACCEPTED_UNJUDGED);
+        if (decline !== undefined)
+            scan.declined = true;
+        if (decline !== undefined && declinesAreEvidence.has(decline))
+            return false;
+        declined ??= decline;
+    }
+    if (declined !== undefined)
+        return true;
     const baseMoved = baseMovedOutside ||
         segments.some(({ words }) => {
-            const pos = readProgramPosition(words);
-            if (pos.refusal !== undefined)
-                return true;
-            const runs = pos.program?.basename;
+            const runs = readProgramPosition(words).program?.basename;
             return runs === "cd" || (runs !== undefined && UNMODELLED_BASE_MOVERS.has(runs));
         });
     for (const body of bodies) {
@@ -296,7 +326,7 @@ function refusedCommandExempt(command, allow, boundary, depth, baseMovedOutside
             (walked.undecidedPaths?.length ?? 0) === 0 && (walked.unresolvedOperands?.length ?? 0) === 0 && (walked.recursiveReadPaths?.length ?? 0) === 0;
         if (fullyGreen)
             continue;
-        if (!refusedCommandExempt(body, allow, boundary, depth + 1, baseMoved))
+        if (!refusedCommandExempt(body, allow, boundary, declinesAreEvidence, scan, depth + 1, baseMoved))
             return false;
     }
     const stdinFileJudgedInside = (word) => {
@@ -353,8 +383,6 @@ function refusedCommandExempt(command, allow, boundary, depth, baseMovedOutside
             if (r.op === "<" && !stdinFileJudgedInside(r.target?.folded))
                 return false;
         const pos = readProgramPosition(words);
-        if (pos.refusal !== undefined)
-            return false;
         for (const k of words.folded.keys()) {
             const word = words.folded[k];
             if (ASSIGNMENT_WORD.test(word) && /\$\(|`/.test(word) && (pos.assignments.includes(k) || pos.launchers.some((l) => l.index < k)))
@@ -365,24 +393,16 @@ function refusedCommandExempt(command, allow, boundary, depth, baseMovedOutside
         if (program === undefined) {
             if (pos.launchers.length === 0)
                 continue;
-            if (argvReentryUnjudged(pos, XARGS_TARGETS_ACCEPTED_UNJUDGED))
-                return false;
             if (!unlistedSegmentJudgedInside(words, pos.launchers[0].index, pos.assignments))
                 return false;
             continue;
         }
         if (program.name.includes(SUBSTITUTION_PLACEHOLDER) || /[$`]/.test(program.name))
             return false;
-        if (SHELL_REENTRY_PROGRAM_RE.test(program.basename))
-            return false;
-        if (pos.launchers.length > 0) {
-            if (argvReentryUnjudged(pos, XARGS_TARGETS_ACCEPTED_UNJUDGED))
+        if (pos.launchers.length > 0 && !listed(program.basename)) {
+            if (!unlistedSegmentJudgedInside(words, pos.launchers[0].index, pos.assignments))
                 return false;
-            if (!listed(program.basename)) {
-                if (!unlistedSegmentJudgedInside(words, pos.launchers[0].index, pos.assignments))
-                    return false;
-                continue;
-            }
+            continue;
         }
         const head = program.basename;
         if (head === "cd" || UNMODELLED_BASE_MOVERS.has(head))
@@ -455,12 +475,12 @@ function longOptionNameOf(tok) {
 function isLongOptionAbbrevOf(name, full) {
     return full.startsWith(name);
 }
-function isGrepPatternFlagToken(tok) {
+function suppliesFirstOperandSlot(slot, tok) {
     if (tok.startsWith("--")) {
         const long = longOptionNameOf(tok);
-        return long !== undefined && (isLongOptionAbbrevOf(long, "regexp") || isLongOptionAbbrevOf(long, "file"));
+        return long !== undefined && slot.suppliedByLongNames.some((full) => isLongOptionAbbrevOf(long, full));
     }
-    return /^-[A-Za-z0-9]*[ef]/.test(tok);
+    return new RegExp(`^-[A-Za-z0-9]*[${slot.suppliedByLetters}]`).test(tok);
 }
 function isGrepClusterFileStdin(tok) {
     if (tok.startsWith("--") || !/^-[A-Za-z0-9]/.test(tok))
@@ -534,6 +554,7 @@ const VERB_OPTION_SLOTS = {
             regexp: "pattern",
         },
         longOptionalValue: { color: "label", colour: "label", context: "count" },
+        firstOperand: { kind: "pattern", suppliedByLetters: "ef", suppliedByLongNames: ["regexp", "file"] },
         longPlain: [
             "basic-regexp", "byte-offset", "count", "dereference-recursive", "extended-regexp",
             "files-with-matches", "files-without-match", "fixed-strings", "help", "ignore-case", "initial-tab",
@@ -579,6 +600,7 @@ const VERB_OPTION_SLOTS = {
         shortPlain: "nrEszu",
         longValue: { expression: "script", file: "path", "line-length": "count" },
         longOptionalValue: { "in-place": "label" },
+        firstOperand: { kind: "script", suppliedByLetters: "ef", suppliedByLongNames: ["expression", "file"] },
         longPlain: [
             "debug", "follow-symlinks", "help", "null-data", "posix", "quiet", "regexp-extended", "sandbox",
             "separate", "silent", "unbuffered", "version", "zero-terminated",
@@ -1670,7 +1692,8 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
     }
     else {
         const eoo = args.indexOf("--");
-        const patternSuppliedByFlag = name === "grep" && (eoo === -1 ? args : args.slice(0, eoo)).some(isGrepPatternFlagToken);
+        const firstOperandSlot = VERB_OPTION_SLOTS[name]?.firstOperand;
+        const firstOperandSuppliedByFlag = firstOperandSlot !== undefined && (eoo === -1 ? args : args.slice(0, eoo)).some((t) => suppliesFirstOperandSlot(firstOperandSlot, t));
         let sawOperand = false;
         let sawArgvOperand = false;
         let endOfOptions = false;
@@ -1718,12 +1741,12 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
                     continue;
                 }
             }
-            const isGrepPatternSlot = name === "grep" && !patternSuppliedByFlag && !sawOperand;
+            const inFirstOperandSlot = firstOperandSlot !== undefined && !firstOperandSuppliedByFlag && !sawOperand;
             sawOperand = true;
             if (k >= argvOperandsStartAt)
                 sawArgvOperand = true;
             if (t === "-") {
-                if (isGrepPatternSlot)
+                if (inFirstOperandSlot)
                     continue;
                 const m = RECURSIVE_READ_FORMS[slotVerb];
                 if (m === undefined || m.dashIsStdin === true) {
@@ -1734,8 +1757,14 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
                     positionalOperands.push(t);
                 continue;
             }
-            if (isGrepPatternSlot)
+            if (inFirstOperandSlot) {
+                const named = slotValueCandidates(t, firstOperandSlot.kind);
+                for (const c of named)
+                    judgeOperand(c, argGlobs(k));
+                if (named.length > 0 && k >= argvOperandsStartAt)
+                    positionalOperands.push(t);
                 continue;
+            }
             if (k >= argvOperandsStartAt)
                 positionalOperands.push(t);
             judgeOperand(t, argGlobs(k));
@@ -1987,7 +2016,8 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
         if (!(pipeFed[si] ?? false)) {
             const floor = STDIN_FILE_FLOOR[name];
             const restArgs = toks.slice(1);
-            const grepPatternSuppliedByFlag = name === "grep" && restArgs.some(isGrepPatternFlagToken);
+            const floorFirstOperandSlot = VERB_OPTION_SLOTS[name]?.firstOperand;
+            const floorSlotSuppliedByFlag = floorFirstOperandSlot !== undefined && restArgs.some((t) => suppliesFirstOperandSlot(floorFirstOperandSlot, t));
             let sawNonFlagOperand = false;
             let hasStdinDash = false;
             let operandCount = 0;
@@ -2013,10 +2043,10 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
                         if (t.startsWith("-") && t !== "-")
                             continue;
                     }
-                    const isGrepPatternPosition = name === "grep" && !grepPatternSuppliedByFlag && !sawNonFlagOperand;
+                    const inFirstOperandSlot = floorFirstOperandSlot !== undefined && !floorSlotSuppliedByFlag && !sawNonFlagOperand;
                     sawNonFlagOperand = true;
                     operandCount++;
-                    if (isGrepPatternPosition)
+                    if (inFirstOperandSlot)
                         continue;
                     if (t === "-") {
                         hasStdinDash = true;
@@ -2329,10 +2359,13 @@ export function classifyOutOfRootReadGate(command, allow, boundary) {
         if (baseMoved)
             return { gated: true, paths: [] };
         const verdict = evaluateReadBoundary(readers, containmentOnly, false, readerReach);
-        return verdict.outOfRootRead === true ? { gated: true, paths: verdict.outOfRootPaths ?? [] } : NOT_GATED;
+        const denied = boundary.denyMatch === undefined ? false : evaluateReadBoundary(readers, boundary, false, readerReach).readDenied === true;
+        if (verdict.outOfRootRead === true)
+            return { gated: true, paths: verdict.outOfRootPaths ?? [], ...(denied ? { denied: true } : {}) };
+        return denied ? { gated: false, paths: [], denied: true } : NOT_GATED;
     };
     const direct = judge(command);
-    if (direct.gated)
+    if (direct.gated || direct.denied === true)
         return direct;
     const shape = POLL_LOOP_SHAPE.exec(command.trim());
     return shape !== null ? judge(shape[3]) : NOT_GATED;

package/dist/tools/fs/fs-bash.d.ts

@@ -3,6 +3,7 @@ import { type TaskRegistry } from "../../core/task-registry.js";
 import { type CwdRef } from "./fs-shared.js";
 import type { ReversibilityVerdict } from "../../core/types.js";
 import { type BashReadonlyRootBoundary } from "./bash-readonly-classifier.js";
+import { type ShellScanDecline } from "./bash-program-position.js";
 /**
  * A parsed-command classifier for the `bash` tool, exposed as a
  * `ToolSpec.reversibilityProbe`. A full shell is treated as egress+irreversible by DEFAULT; this probe is the
@@ -60,6 +61,33 @@ import { type BashReadonlyRootBoundary } from "./bash-readonly-classifier.js";
  * shape classifier here changes what happens to the residual shell risk, never that reading.
  */
 export declare function bashReversibilityProbe(allow?: readonly string[], boundary?: BashReadonlyRootBoundary | (() => BashReadonlyRootBoundary | undefined)): (args: unknown) => ReversibilityVerdict;
+/**
+ * ONE rule, TWO TABLES: which {@link ShellScanDecline} a SEAT reads as read evidence. A decline names no word,
+ * so it is never the boundary DECLARING anything about a path.
+ *
+ * The READ-BOUNDARY seat is what the default/off doctrine and a bypass mode mount ALONE: there "not mandated"
+ * is VOUCHED, so a decline must count as evidence or a read nobody judged runs silently (`<out-of-root> |
+ * xargs cat` at zero asks — a closed P0). It keeps both. The CLASSIFY seat composes the same boundary with the
+ * SHAPE classifier, which refuses every one of these shapes: what survives is a CARD, and the only question
+ * this table answers is who may retire it. It keeps NEITHER — an ANSWERER may (a person, the auto-mode
+ * classifier, a person's stored allow rule) — empty by the argument, not by omission.
+ *
+ * WHAT AN EMPTY TABLE DOES NOT BUY, corrected where it was once claimed: "the shape classifier refuses these
+ * shapes anyway, so the only question left is the stored answer" was true of the PROBE and false of the OUTCOME
+ * — the allow layer's other members are not that classifier, and both cleared exactly these cards at ZERO asks. An
+ * empty table says only "no MANDATE HERE"; that the boundary DECLINED is a separate fact, carried on every ask this
+ * seat raises ({@link BoundaryAnswer}'s weaker rung), standing every ANSWERLESS arm down while every answerer's lane stays open.
+ * THE COST, stated rather than mitigated: once that ask is retired BY AN ANSWERER, an out-of-root or deny-listed
+ * read HIDDEN inside such a command is not asked again. A command's words are not the argv its programs receive (a
+ * stream is re-split by its consumer, an unread option may move the working directory first, stdin text is a
+ * command line nobody parsed), so a scan of them cannot be the guarantee it was claimed to be. "A read the boundary
+ * objects to is never retired by a stored rule" does NOT hold on the classify seat for this class, and holds
+ * unchanged elsewhere. One word-level check survives on both seats and is not part of the trade: a token the scan
+ * DID read naming a path outside the roots still gates the call ({@link classifyOutOfRootReadGate}).
+ */
+export declare const BOUNDARY_SEAT_DECLINE_EVIDENCE: ReadonlySet<ShellScanDecline>;
+/** The classify doctrine's table — see above; empty by the argument. */
+export declare const CLASSIFY_SEAT_DECLINE_EVIDENCE: ReadonlySet<ShellScanDecline>;
 /**
  * The READ-BOUNDARY seat of the full shell: a `ToolSpec.reversibilityProbe` that answers exactly ONE
  * question — does the deployment's read boundary object to where this command reads? — and nothing about

package/dist/tools/fs/fs-bash.js

@@ -13,8 +13,10 @@ import { boundaryIsTheSandbox, canonicalPathIsAuthoritative, hasDestroy, isIsola
 import { ghRateLimitHint } from "./gh-rate-limit.js";
 import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, createShellOverflowSpoolFence, shellRecoveryHint, CWD_SENTINEL, stripCwdSentinel, BASH_READONLY_CONFINEMENT_NOTE, } from "./fs-shared.js";
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted } from "../../core/untrusted-text.js";
-import { bashClassifyDefaultAllow, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed, classifyOutOfRootReadGate, refusedCommandMayRead, classifySimpleCommandReadBoundary, NOT_AUTO_ALLOWED, } from "./bash-readonly-classifier.js";
+import { bashClassifyDefaultAllow, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed, classifyOutOfRootReadGate, refusedCommandMayRead, classifySimpleCommandReadBoundary, } from "./bash-readonly-classifier.js";
+import { NOT_AUTO_ALLOWED, SHELL_SCAN_DECLINES } from "./bash-program-position.js";
 import { toolFace } from "../../core/tool-catalog-entries.js";
+import { thrownText } from "../../core/thrown-value.js";
 const RECURSIVE_CAUSE_MAX_PATHS = 3;
 const RECURSIVE_READ_CAUSE_CODE = "shell.recursive_read_unbounded";
 function operandFamily(paths) {
@@ -27,8 +29,8 @@ function operandFamily(paths) {
 export function bashReversibilityProbe(allow, boundary) {
     const allowSet = new Set(allow ?? bashClassifyDefaultAllow());
     const judge = (args, command, resolved, offers) => {
-        const boundaryGate = (verdict) => readBoundaryMandate(command, allowSet, resolved, verdict);
-        const outOfRootGate = () => readBoundaryMandate(command, allowSet, resolved, {});
+        const boundaryGate = (verdict) => readBoundaryMandate(command, allowSet, resolved, verdict, CLASSIFY_SEAT_DECLINE_EVIDENCE);
+        const outOfRootGate = () => readBoundaryMandate(command, allowSet, resolved, {}, CLASSIFY_SEAT_DECLINE_EVIDENCE);
         const backgrounded = isBackgroundShellCall(args);
         const detailed = classifyCompoundReadonlyDetailed(command, allowSet, resolved);
         if (backgrounded)
@@ -46,7 +48,8 @@ export function bashReversibilityProbe(allow, boundary) {
         if (loop.reason === undefined)
             return { reversible: true };
         const seatOffer = (verdict) => (offers ? readRootCandidateOf(verdict) : {});
-        if (boundaryDeclared(loop) || unjudgedRead(command, allowSet, resolved, loop))
+        const loopScan = refusedCommandScan(command, allowSet, resolved, loop, CLASSIFY_SEAT_DECLINE_EVIDENCE);
+        if (boundaryDeclared(loop) || unjudgedRead(command, allowSet, resolved, loop, loopScan))
             return { reversible: false, mandated: true, ...seatOffer(loop) };
         const refusedCause = recursiveReadCause(detailed);
         return { reversible: false, ...boundaryGate(detailed), ...seatOffer(detailed), ...(refusedCause !== undefined ? { cause: refusedCause } : {}) };
@@ -86,24 +89,39 @@ function shellCommandOf(args) {
 function isBackgroundShellCall(args) {
     return args?.run_in_background === true;
 }
-function readBoundaryMandate(command, allowSet, resolved, verdict) {
+export const BOUNDARY_SEAT_DECLINE_EVIDENCE = new Set(SHELL_SCAN_DECLINES);
+export const CLASSIFY_SEAT_DECLINE_EVIDENCE = new Set();
+function readBoundaryMandate(command, allowSet, resolved, verdict, declineEvidence) {
     if (resolved === undefined)
         return {};
-    if (denyJudgeSpoke(verdict) || unjudgedRead(command, allowSet, resolved, verdict))
+    const scan = refusedCommandScan(command, allowSet, resolved, verdict, declineEvidence);
+    if (denyJudgeSpoke(verdict) || unjudgedRead(command, allowSet, resolved, verdict, scan))
         return { mandated: true };
-    return classifyOutOfRootReadGate(command, allowSet, resolved).gated ? { mandated: true } : {};
+    const named = classifyOutOfRootReadGate(command, allowSet, resolved);
+    if (named.gated || named.denied === true)
+        return { mandated: true };
+    return declinedRung(scan);
+}
+function declinedRung(scan) {
+    return scan.declined ? { boundaryDeclined: true } : {};
+}
+function refusedCommandScan(command, allowSet, resolved, verdict, declineEvidence) {
+    return verdict.refusedWhole === true ? refusedCommandMayRead(command, allowSet, resolved, declineEvidence) : { mayRead: false, declined: false };
 }
 function boundaryUnjudged(verdict) {
     return verdict.refusedWhole === true || (verdict.unresolvedOperands !== undefined && verdict.unresolvedOperands.length > 0);
 }
-function unjudgedRead(command, allowSet, resolved, verdict) {
+function unjudgedRead(command, allowSet, resolved, verdict, scan) {
     if (verdict.unresolvedOperands !== undefined && verdict.unresolvedOperands.length > 0)
         return true;
     if (verdict.refusedWhole !== true)
         return false;
-    if (refusedCommandMayRead(command, allowSet, resolved))
+    if (scan.mayRead)
         return true;
-    return resolved !== undefined && classifyOutOfRootReadGate(command, allowSet, resolved).gated;
+    if (resolved === undefined)
+        return false;
+    const named = classifyOutOfRootReadGate(command, allowSet, resolved);
+    return named.gated || named.denied === true;
 }
 function recursiveReadCause(detailed) {
     const recursive = detailed.recursiveReadPaths;
@@ -121,7 +139,7 @@ export function bashReadBoundaryProbe(boundary) {
     const allowSet = new Set(bashClassifyDefaultAllow());
     const judge = (command, resolved, offers) => {
         const seatVerdict = (verdict) => {
-            if (boundaryDeclared(verdict) || unjudgedRead(command, allowSet, resolved, verdict)) {
+            if (boundaryDeclared(verdict) || unjudgedRead(command, allowSet, resolved, verdict, refusedCommandScan(command, allowSet, resolved, verdict, BOUNDARY_SEAT_DECLINE_EVIDENCE))) {
                 const cause = recursiveReadCause(verdict);
                 return { reversible: false, mandated: true, ...(cause !== undefined ? { cause } : {}) };
             }
@@ -145,7 +163,7 @@ export function bashReadBoundaryProbe(boundary) {
         const offerFrom = (verdict) => (offers ? readRootCandidateOf(verdict) : {});
         if (mandated !== undefined)
             return { ...mandated, ...offerFrom(detailed), ...offerFrom(loop) };
-        if (readBoundaryMandate(command, allowSet, resolved, detailed).mandated === true)
+        if (readBoundaryMandate(command, allowSet, resolved, detailed, BOUNDARY_SEAT_DECLINE_EVIDENCE).mandated === true)
             return { reversible: false, mandated: true };
         return compoundVerdict ?? loopVerdict ?? { reversible: true };
     };
@@ -719,7 +737,7 @@ async function adoptBackgroundShell(req) {
         return { ok: true, taskId, outputFile };
     }
     catch (e) {
-        const reason = e instanceof Error ? e.message : String(e);
+        const reason = thrownText(e);
         let kill;
         try {
             kill = await env.killBackground(shellId);

package/dist/tools/fs/fs-write.js

@@ -5,6 +5,7 @@ import { sha256, resolveKey, violationText, violationDetails, requireRead, check
 import { decodeTextBytes, encodeTextForFile, normalizeEditText, normalizeFileText } from "./encoding.js";
 import { MAX_EDIT_BYTES, decodeEditBytes, tooLargeToEditMessage, truncatedUtf16BodyMessage, persistedTextOf, notReadRefusalText, enoentMessage, FILE_STATE_TRAILER, FILE_PATH_PARAMS, ipynbRedirect, countLines, applyRecordedEdit, } from "./fs-shared.js";
 import { toolFace } from "../../core/tool-catalog-entries.js";
+import { thrownText } from "../../core/thrown-value.js";
 async function envFinalWrite(env, key, content, signal, opts) {
     const fireEdited = () => {
         if (opts?.edited?.hook === undefined)
@@ -66,7 +67,7 @@ async function trackToolEdit(hook, tool, path, key, signal) {
         res = await hook({ tool, path, key, ...(signal !== undefined ? { signal } : {}) });
     }
     catch (err) {
-        return { refusal: `Error (${tool}): the file-history first-touch backup failed (${clipHookText(err instanceof Error ? err.message : String(err))}) — nothing was written.` };
+        return { refusal: `Error (${tool}): the file-history first-touch backup failed (${clipHookText(thrownText(err))}) — nothing was written.` };
     }
     if (res.ok === false)
         return { refusal: clipHookText(res.refusal) };
@@ -80,7 +81,7 @@ async function gateToolWrite(hook, tool, path, key, content) {
         res = await hook({ tool, path, key, content });
     }
     catch (err) {
-        return `Error (${tool}): the write gate failed (${clipHookText(err instanceof Error ? err.message : String(err))}) — nothing was written.`;
+        return `Error (${tool}): the write gate failed (${clipHookText(thrownText(err))}) — nothing was written.`;
     }
     if (res !== undefined && res.ok === false)
         return `Error (${tool}): write rejected by the write gate (${res.code}): ${clipHookText(res.reason)}`;

package/dist/tools/fs/safety.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { sliceHeadSafe } from "../../core/surrogate-safe-slice.js";
 import { pathTargetValue, protectivePathTargetOf } from "../../core/tool-registry.js";
 import { withGateTimeout, DEFAULT_GATE_AWAIT_TIMEOUT_MS } from "../../core/gate-bounded-await.js";
+import { thrownText } from "../../core/thrown-value.js";
 export function fileArgPath(args) {
     const a = args;
     const fp = a?.file_path;
@@ -524,7 +525,7 @@ export async function canonicalizeTarget(env, path, signal, family, baseCwd) {
     catch (err) {
         if (seenThrow && err === thrownByProbe)
             throw err;
-        return { ok: false, message: `cannot resolve path "${path}": ${err instanceof Error ? err.message : String(err)}` };
+        return { ok: false, message: `cannot resolve path "${path}": ${thrownText(err)}` };
     }
 }
 async function probeRealTarget(env, path, target, family, signal) {

package/dist/tools/fs/search.js

@@ -1,6 +1,7 @@
 import { delimitUntrusted } from "../../core/untrusted-text.js";
 import { MAX_EXEC_OUTPUT_BYTES } from "../../core/exec-output-tail.js";
 import { hasBinaryExtension, isAbsoluteForFamily, isWinFormPath, joinForFamily, pathFamilyOf } from "./safety.js";
+import { thrownText } from "../../core/thrown-value.js";
 const WALK_MAX_FILES = 5000;
 const WALK_MAX_DEPTH = 32;
 const GREP_DEFAULT_CAP = 250;
@@ -772,7 +773,7 @@ export async function jsGrepDetailed(env, root, p, signal, guards, deny, denyOut
         test = compilePattern(p);
     }
     catch (e) {
-        return { text: `Error (grep): invalid regex: ${e instanceof Error ? e.message : String(e)}` };
+        return { text: `Error (grep): invalid regex: ${thrownText(e)}` };
     }
     const ignore = await buildIgnore(env, root, signal);
     const rootPrefix = root.replace(/[\\/]+$/, "") + (root.includes("\\") ? "\\" : "/");
@@ -912,7 +913,7 @@ export async function jsGrepDetailed(env, root, p, signal, guards, deny, denyOut
             catch (e) {
                 if (e instanceof GrepBudgetExceeded)
                     return { text: budgetError(shownPath, monotonicNow() - fileMatchStart) };
-                return { text: `Error (grep): invalid regex: ${e instanceof Error ? e.message : String(e)}` };
+                return { text: `Error (grep): invalid regex: ${thrownText(e)}` };
             }
             fileCount = spans.length;
             if (mode === "content") {

package/dist/tools/monitor.js

@@ -3,6 +3,7 @@ import { defineTool, errorResult } from "../core/tools.js";
 import { hasBackgroundShell } from "../core/background-shell.js";
 import { MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, } from "../core/task-registry.js";
 import { toolFace } from "../core/tool-catalog-entries.js";
+import { thrownText } from "../core/thrown-value.js";
 const MONITOR_DESCRIPTION = "Run a shell command in the background and watch its stdout as a stream of events.\n" +
     "\n" +
     "- Each line the command writes to stdout becomes a notification event delivered to you between turns; " +
@@ -98,7 +99,7 @@ export function createMonitorTool(env, opts) {
                 });
             }
             catch (e) {
-                const why = e instanceof Error ? e.message : String(e);
+                const why = thrownText(e);
                 let killDetail;
                 try {
                     const kill = await env.killBackground(spawn.value.shellId);
@@ -106,7 +107,7 @@ export function createMonitorTool(env, opts) {
                         killDetail = `${kill.error.code}: ${kill.error.message}`;
                 }
                 catch (killErr) {
-                    killDetail = killErr instanceof Error ? killErr.message : String(killErr);
+                    killDetail = thrownText(killErr);
                 }
                 return errorResult(killDetail === undefined
                     ? `Error (Monitor): the watch process was started but could not be registered (${why}); it has been terminated.`

package/dist/tools/sql.js

@@ -1,4 +1,5 @@
 import { Type } from "typebox";
+import { thrownText } from "../core/thrown-value.js";
 const FORBIDDEN = /\b(insert|update|delete|drop|alter|create|truncate|grant|revoke|merge|replace|attach|detach|pragma|vacuum|exec|execute|call|copy|lock|reindex)\b/i;
 class SqlValidationError extends Error {
 }
@@ -82,7 +83,7 @@ export function createSqlTool(opts) {
                 validateReadOnlySql(sql, opts.allowTables);
             }
             catch (e) {
-                const msg = e instanceof Error ? e.message : String(e);
+                const msg = thrownText(e);
                 return { content: `SQL rejected: ${msg}`, details: { error: msg }, terminate: false };
             }
             const rows = await opts.query(stripTrailingSemicolon(sql.trim()));

package/dist/tools/web.js

@@ -8,6 +8,7 @@ import { DEFAULT_CHARS_PER_TOKEN } from "../internal/harness.js";
 import { binaryMagicFormat } from "./fs/safety.js";
 import { pdfMagicMatches } from "./fs/pdf.js";
 import { toolFace } from "../core/tool-catalog-entries.js";
+import { thrownText } from "../core/thrown-value.js";
 const MAX_REDIRECTS = 10;
 const MAX_URL_LENGTH = 2048;
 const WEBFETCH_ACCEPT = "text/markdown, text/html, */*";
@@ -447,7 +448,7 @@ export function webFetchToolSpec(config = {}) {
                     };
                 }
                 return {
-                    content: `Error (WebFetch): request failed: ${e instanceof Error ? e.message : String(e)}`,
+                    content: `Error (WebFetch): request failed: ${thrownText(e)}`,
                     details: errDetails,
                     isError: true,
                 };
@@ -594,7 +595,7 @@ export function webFetchToolSpec(config = {}) {
                 catch (e) {
                     out = text;
                     note =
-                        `[note: summarization failed (${inlineUntrusted(e instanceof Error ? e.message : String(e), 160)}) — ` +
+                        `[note: summarization failed (${inlineUntrusted(thrownText(e), 160)}) — ` +
                             `raw page content follows; the requested analysis ("${inlineUntrusted(prompt, 120)}") was NOT applied]`;
                 }
             }
@@ -910,7 +911,7 @@ export function createWebSearchTool(config) {
                     return abortedFrame();
                 if (ac.signal.aborted)
                     return timedOutFrame();
-                const msg = redactSecrets(e instanceof Error ? e.message : String(e)).trim();
+                const msg = redactSecrets(thrownText(e)).trim();
                 const headline = "Error (WebSearch): the search backend failed.";
                 const verdict = classifySearchFailure(msg);
                 const composed = (msg ? `${headline} The backend's error text follows:\n\n${delimitUntrusted("WebSearch backend error", msg, SEARCH_ERROR_EXCERPT_CHARS)}` : headline) + `\n\n${verdict.hint}`;
@@ -1029,18 +1030,7 @@ export async function probeSearchBackend(search, options) {
         return { ok: true, results: results.length };
     }
     catch (e) {
-        let text;
-        if (e instanceof Error)
-            text = e.message;
-        else {
-            try {
-                text = String(e);
-            }
-            catch {
-                text = Object.prototype.toString.call(e);
-            }
-        }
-        return { ok: false, error: text };
+        return { ok: false, error: thrownText(e) };
     }
     finally {
         clearTimeout(timer);

package/dist/tools/worktree.js

@@ -3,6 +3,7 @@ import { Type } from "typebox";
 import { defineTool, errorResult } from "../core/tools.js";
 import { addWorktree, pruneWorktrees, WORKTREE_PARENT } from "../core/git-worktree-env.js";
 import { toolFace } from "../core/tool-catalog-entries.js";
+import { thrownText } from "../core/thrown-value.js";
 const ENTER_DESCRIPTION = "Use this tool ONLY when explicitly instructed to work in a worktree — either by the user directly, or by " +
     "project instructions. This tool creates an isolated git worktree and switches the current session into it.\n" +
     "\n" +
@@ -67,14 +68,16 @@ const EXIT_DESCRIPTION = "Exit a worktree session created by EnterWorktree and r
     "- Once exited, EnterWorktree can be called again to create a fresh worktree.";
 const shq = (s) => `'${s.replace(/'/g, "'\\''")}'`;
 function reasonOf(e) {
-    if (e instanceof Error)
-        return e.message;
-    if (typeof e === "object" && e !== null) {
-        const m = e.message;
-        if (typeof m === "string" && m !== "")
-            return m;
+    try {
+        if (typeof e === "object" && e !== null && !(e instanceof Error)) {
+            const m = e.message;
+            if (typeof m === "string" && m !== "")
+                return m;
+        }
+    }
+    catch {
     }
-    return String(e);
+    return thrownText(e);
 }
 async function resolveBaseCommit(env, repoRoot, baseRef) {
     const rev = async (ref) => {
@@ -147,7 +150,7 @@ export function createWorktreeTools(env, opts) {
             try {
                 const probe = await env.exec("git rev-parse --is-inside-work-tree", { cwd: repoRoot });
                 if (!probe.ok || probe.value.exitCode !== 0) {
-                    const detail = probe.ok ? (probe.value.stderr || probe.value.stdout).trim().split("\n")[0] : String(probe.error);
+                    const detail = probe.ok ? (probe.value.stderr || probe.value.stdout).trim().split("\n")[0] : thrownText(probe.error);
                     return errorResult(`Error (EnterWorktree): the working directory ${repoRoot} is not a git repository` +
                         `${detail ? ` (${detail})` : ""}. This deployment has no VCS-agnostic worktree extension point, ` +
                         "so worktree isolation is unavailable here.");
@@ -214,7 +217,7 @@ export function createWorktreeTools(env, opts) {
                     createdDir = worktreeDir;
                 }
                 catch (e) {
-                    return errorResult(`Error (EnterWorktree): ${e instanceof Error ? e.message : String(e)}`);
+                    return errorResult(`Error (EnterWorktree): ${thrownText(e)}`);
                 }
                 session.current = {
                     worktreeDir: createdDir,