@sema-agent/core 7.23.1 → 7.23.3

package/dist/orchestration/workflow.js

@@ -23,6 +23,7 @@ import { compileOutputSchema } from "../core/runner/strict-output-schema.js";
 import { WorkflowBudgetExceededError, WorkflowNestingError, WorkflowAgentBlockedError, WorkflowAgentParkedError, WorkflowAgentSchemaError, WorkflowAgentStalledError, WorkflowMaxAgentsError, WORKFLOW_SPAWN_BLOCKED_ERROR_CODE } from "./workflow-types.js";
 import { WorkflowScriptError } from "./workflow-meta.js";
 import { STALL_CONNECT_MS, STALL_FIRST_TOKEN_MS } from "../brain/timeout.js";
+import { asThrownError, thrownText } from "../core/thrown-value.js";
 export * from "./workflow-types.js";
 const MAX_TRANSCRIPT_CHARS = 4000;
 const WORKFLOW_RESULT_MAX = 4000;
@@ -193,7 +194,7 @@ function foldFanOutSettled(settled, lane, errorsOut, emitRunLog) {
         }
         rethrowIfMaxAgents(s.e);
         errorsOut?.push(workflowFanOutSlotError(s.i, s.e));
-        emitRunLog(`${lane}[${s.i}] failed: ${boundedRedactedSummary(s.e instanceof Error ? s.e.message : String(s.e), 300)}`);
+        emitRunLog(`${lane}[${s.i}] failed: ${boundedRedactedSummary(thrownText(s.e), 300)}`);
         return null;
     });
     if (dropped > 0)
@@ -203,7 +204,7 @@ function foldFanOutSettled(settled, lane, errorsOut, emitRunLog) {
 function workflowFanOutSlotError(index, e) {
     const code = e?.code;
     const kind = typeof code === "string" && code.length > 0 ? code : e instanceof Error ? e.name : "Error";
-    return { index, kind, message: boundedRedactedSummary(e instanceof Error ? e.message : String(e), 300) };
+    return { index, kind, message: boundedRedactedSummary(thrownText(e), 300) };
 }
 export class WorkflowResultTooLargeError extends Error {
     size;
@@ -841,7 +842,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
     };
     const parkSeat = opts.checkpointStore;
     const parkedByOrdinal = [];
-    const errText = (err) => (err instanceof Error ? err.message : String(err));
+    const errText = (err) => (thrownText(err));
     const withoutToken = (text, token) => (token === "" ? text : text.split(token).join("<token>"));
     const parkBindingBroken = (ordinal, why) => new WorkflowParkRefusal("workflow.park_binding_broken", `workflow resume: ordinal ${ordinal}'s park cannot be bound to its checkpoint (${why}) — the recorded park is inconsistent. Decide the checkpoint through the deployment's approval channel and start a fresh run.`, { ordinal });
     const readParkTruth = async (seat, key, ordinal) => {
@@ -980,7 +981,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
             }
             catch (err) {
                 if (dbg)
-                    console.error(`[sema:wf-journal] runId=${runId} callKey=${callKey} TOMBSTONE-ERROR ${err instanceof Error ? err.message : String(err)}`);
+                    console.error(`[sema:wf-journal] runId=${runId} callKey=${callKey} TOMBSTONE-ERROR ${thrownText(err)}`);
             }
             return;
         }
@@ -993,7 +994,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
         }
         catch (err) {
             if (dbg)
-                console.error(`[sema:wf-journal] runId=${runId} callKey=${callKey} APPEND-ERROR ${err instanceof Error ? err.message : String(err)}`);
+                console.error(`[sema:wf-journal] runId=${runId} callKey=${callKey} APPEND-ERROR ${thrownText(err)}`);
             throw err;
         }
     };
@@ -1271,7 +1272,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                 inheritedModelSnap = opts.defaultModel?.();
             }
             catch (err) {
-                inheritedModelError = err instanceof Error ? err : new Error(String(err));
+                inheritedModelError = asThrownError(err);
             }
         }
         const inheritedThinkingSnap = spec.thinking === undefined ? opts.defaultThinking?.() : undefined;
@@ -1781,17 +1782,17 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                     const journaled = journalAppend(callKey, salvaged ?? {
                         taskId: callKey,
                         sessionId: "",
-                        result: boundedRedactedSummary(err instanceof Error ? err.message : String(err), 500),
+                        result: boundedRedactedSummary(thrownText(err), 500),
                         terminal: {
                             kind: "failed",
                             ...(err instanceof WorkflowAgentBlockedError ? { code: WORKFLOW_SPAWN_BLOCKED_ERROR_CODE } : err instanceof WorkflowBudgetExceededError ? { code: err.code } : {}),
-                            message: boundedRedactedSummary(err instanceof Error ? err.message : String(err), 500),
+                            message: boundedRedactedSummary(thrownText(err), 500),
                         },
                         stats: { turns: 0, tokens: 0, costMicroUsd: 0, usageMissing: true },
                     }, label).catch(() => undefined);
                     if (!((err instanceof WorkflowBudgetExceededError || err instanceof WorkflowAgentParkedError) && rec.startedAt === undefined))
                         await journaled;
-                    bceTerminal(callKey, "failed", rec.output ?? (err instanceof Error ? err.message : String(err)), rec.sessionId, rec.stats);
+                    bceTerminal(callKey, "failed", rec.output ?? (thrownText(err)), rec.sessionId, rec.stats);
                 }
                 throw err;
             }
@@ -1969,7 +1970,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                 }
                 recordFailed();
                 releaseLeg();
-                bceTerminal(callKey, "failed", err instanceof Error ? err.message : String(err), undefined, undefined);
+                bceTerminal(callKey, "failed", thrownText(err), undefined, undefined);
                 throw err;
             }
             if (childSessionId !== undefined && !finalized) {
@@ -2012,11 +2013,11 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                     void journalAppend(callKey, {
                         taskId: callKey,
                         sessionId: "",
-                        terminal: { kind: "failed", message: boundedRedactedSummary(err instanceof Error ? err.message : String(err), 500) },
-                        result: boundedRedactedSummary(err instanceof Error ? err.message : String(err), 500),
+                        terminal: { kind: "failed", message: boundedRedactedSummary(thrownText(err), 500) },
+                        result: boundedRedactedSummary(thrownText(err), 500),
                         stats: { turns: partialSpend?.turns ?? 0, tokens: partialSpend?.tokens ?? 0, costMicroUsd: partialSpend?.costMicroUsd ?? 0 },
                     }).catch(() => undefined);
-                    bceTerminal(callKey, "failed", err instanceof Error ? err.message : String(err), undefined, rec.stats);
+                    bceTerminal(callKey, "failed", thrownText(err), undefined, rec.stats);
                     throw err;
                 }
                 rollbackUsageBeat();
@@ -2377,7 +2378,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
             run.endedAt = now();
             if (parkedLeg !== undefined && !(err instanceof WorkflowAgentParkedError))
                 err = parkedError();
-            run.error = err instanceof Error ? err.message : String(err);
+            run.error = thrownText(err);
             closeAbandonedAgents(run.endedAt);
             {
                 let thrownCode;

package/dist/server/http.js

@@ -1,4 +1,5 @@
 import http from "node:http";
+import { thrownText } from "../core/thrown-value.js";
 const DEFAULT_MAX_BODY = 5 * 1024 * 1024;
 class HttpError extends Error {
     status;
@@ -25,7 +26,7 @@ async function readJson(req, maxBytes) {
         return JSON.parse(Buffer.concat(chunks).toString("utf8"));
     }
     catch (e) {
-        throw new HttpError(400, `invalid JSON request body: ${e instanceof Error ? e.message : String(e)}`);
+        throw new HttpError(400, `invalid JSON request body: ${thrownText(e)}`);
     }
 }
 function setCors(res, origin) {
@@ -47,7 +48,7 @@ export function createTaskServer(opts) {
         void handle(req, res).catch((err) => {
             if (!res.headersSent) {
                 const status = err instanceof HttpError ? err.status : 500;
-                sendJson(res, status, { error: err instanceof Error ? err.message : String(err) });
+                sendJson(res, status, { error: thrownText(err) });
             }
             else {
                 res.end();

package/dist/stores/file/adoption/adopt.js

@@ -3,6 +3,7 @@ import { existsSync, readdirSync, readFileSync, unlinkSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { adoptFilePermissionRuleStore } from "../permission-rule-adopt.js";
 import { BootLock, atomicWriteFile, ensureDir, sanitizeScope } from "../fs-atomic.js";
+import { thrownText } from "../../../core/thrown-value.js";
 import { AdoptionError, NOT_MIGRATED_BY_DESIGN, readRootAdoptionFile, writeRootAdoptionFile, } from "./marker.js";
 const CONFIG_ACCOUNT_FILE = "adoption-configs.json";
 function baselineConfigs(toPrincipal) {
@@ -491,7 +492,7 @@ export async function adoptLocalDataRoot(opts) {
                 catch (err) {
                     if (err instanceof AdoptionError)
                         throw err;
-                    throw new AdoptionError("adoption_rule_leg_refused", `the permission-rule leg refused: ${err instanceof Error ? err.message : String(err)}`);
+                    throw new AdoptionError("adoption_rule_leg_refused", `the permission-rule leg refused: ${thrownText(err)}`);
                 }
                 if (nested.status === "stalled") {
                     return {
@@ -533,7 +534,7 @@ export async function adoptLocalDataRoot(opts) {
                     return {
                         status: "stalled",
                         phase: 4,
-                        error: `the "${leg.store}" carriage leg failed: ${err instanceof Error ? err.message : String(err)} — resume when it is healthy`,
+                        error: `the "${leg.store}" carriage leg failed: ${thrownText(err)} — resume when it is healthy`,
                     };
                 }
                 if (rows !== undefined && (!Number.isSafeInteger(rows) || rows < 0)) {

package/dist/stores/file/fs-atomic.js

@@ -5,6 +5,7 @@ import { basename, dirname, join, resolve as resolvePath } from "node:path";
 import { createHash, randomBytes } from "node:crypto";
 import { execFileSync } from "node:child_process";
 import { physicalPathOf, physicalPathOfExisting } from "../../core/physical-path.js";
+import { thrownText } from "../../core/thrown-value.js";
 const SAFE_COMPONENT = /^[A-Za-z0-9_.-]+$/;
 export function sanitizePathComponent(raw) {
     if (raw === "" || raw === "." || raw === ".." || !SAFE_COMPONENT.test(raw)) {
@@ -411,7 +412,7 @@ export class BootLock {
         }
         catch (err) {
             throw new FileStoreLockError("store.lock_unreadable", `file store: this process still owns the lock file at ${this.lockPath} from an earlier release that ` +
-                `could not remove it, and removing it now failed too (${String(err.message)}); ` +
+                `could not remove it, and removing it now failed too (${thrownText(err)}); ` +
                 `remove it manually`, this.lockPath, process.pid);
         }
         abandonedLocks.delete(this.abandonKey);

package/dist/stores/file/permission-rule-adopt.js

@@ -3,6 +3,7 @@ import { join } from "node:path";
 import { writerOf } from "../../core/permission-rule-store.js";
 import { createPermissionRuleStoreProvider } from "../../core/permission-rule-provider.js";
 import { syncPermissionRules } from "../../core/permission-rule-sync.js";
+import { thrownText } from "../../core/thrown-value.js";
 import { FileDurableRulePartitionProvider, LOCAL_OWNER_FILE, principalRuleFileName, readRuleAdoptionFile, writeRuleAdoptionFile, } from "./permission-rule-store.js";
 export async function adoptFilePermissionRuleStore(opts) {
     if (typeof opts.toPrincipal !== "string" || opts.toPrincipal === "") {
@@ -63,7 +64,7 @@ export async function adoptFilePermissionRuleStore(opts) {
                 });
             }
             catch (err) {
-                return { status: "stalled", phase: 4, error: `the first sync round failed: ${err instanceof Error ? err.message : String(err)}` };
+                return { status: "stalled", phase: 4, error: `the first sync round failed: ${thrownText(err)}` };
             }
             if (!syncResult.ok) {
                 return {

package/dist/stores/file/permission-rule-store.js

@@ -6,6 +6,7 @@ import { PERMISSION_RULE_WRITER, applySyncJoin, applyTombstones, assertDeleteDel
 import { canonicalize } from "../../core/canonical-json.js";
 import { BootLock } from "./fs-atomic.js";
 import { assertAdoptionBootGate } from "./adoption/marker.js";
+import { thrownText } from "../../core/thrown-value.js";
 function isRuleFile(v) {
     const p = v;
     return typeof p === "object" && p !== null && p.schemaVersion === 4 && Array.isArray(p.rules) && Array.isArray(p.tombstones) && typeof p.rev === "number" && (p.quarantined === undefined || Array.isArray(p.quarantined));
@@ -139,7 +140,7 @@ class FileDurableRulePartition {
             const e = err;
             if (e?.code === "ENOENT")
                 return { absent: true };
-            const why = `could not read ${this.file}: ${e?.message ?? String(err)}; loading zero rules`;
+            const why = `could not read ${this.file}: ${thrownText(err)}; loading zero rules`;
             this.disclose(why);
             return { unreadable: why };
         }

package/dist/stores/file/session-store.js

@@ -3,6 +3,7 @@ import { join } from "node:path";
 import { BaseSessionStorage, StoredSession, SessionError, getEntriesToFork, uuidv7, validateEntriesForImport, } from "../../internal/harness.js";
 import { canonicalStoreKey, AppendLog, atomicWriteFile, ensureDir, readJsonlRecords, sanitizePathComponent } from "./fs-atomic.js";
 import { assertAdoptionBootGate } from "./adoption/marker.js";
+import { thrownText } from "../../core/thrown-value.js";
 function containSinkThenable(r) {
     if (typeof r?.then === "function") {
         r.then(undefined, () => {
@@ -171,7 +172,7 @@ export class FileSessionRepo {
             }
             catch (err) {
                 if (!(err instanceof SessionError && err.code === "not_found")) {
-                    this.disclose(this.pathFor(id), `session log unreadable (${err instanceof Error ? err.message : String(err)}) — skipped from the listing`);
+                    this.disclose(this.pathFor(id), `session log unreadable (${thrownText(err)}) — skipped from the listing`);
                 }
             }
         }
@@ -200,7 +201,7 @@ export class FileSessionRepo {
             }
             catch (err) {
                 if (!(err instanceof SessionError && err.code === "not_found")) {
-                    this.disclose(this.pathFor(id), `session log unreadable (${err instanceof Error ? err.message : String(err)}) — skipped from the placed listing`);
+                    this.disclose(this.pathFor(id), `session log unreadable (${thrownText(err)}) — skipped from the placed listing`);
                 }
                 continue;
             }
@@ -238,7 +239,7 @@ export class FileSessionRepo {
             rmSync(this.pathFor(metadata.id), { force: true });
         }
         catch (err) {
-            throw new SessionError("storage", `session ${metadata.id} could not be deleted: ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err : undefined);
+            throw new SessionError("storage", `session ${metadata.id} could not be deleted: ${thrownText(err)}`, err instanceof Error ? err : undefined);
         }
     }
     async fork(sourceMetadata, options = {}) {

package/dist/stores/file/strategy-store.js

@@ -3,6 +3,7 @@ import { join } from "node:path";
 import { createHash } from "node:crypto";
 import { atomicWriteFile } from "./fs-atomic.js";
 import { createSafeNotifier, observeThenableRejection } from "../../core/safe-notify.js";
+import { thrownText } from "../../core/thrown-value.js";
 import { MAX_STRATEGY_INJECTION_TOTAL_BYTES, MAX_STRATEGY_TEXT_BYTES, compileStrategyQuery, resolveCapacityCap, resolveFindLimit, scoreStoredStrategy, storedStrategyShapeIssue, strategyDedupKey, validateStrategyForWrite, } from "../../core/strategy-store.js";
 function configRefusal(message, code) {
     const e = new Error(message);
@@ -32,14 +33,14 @@ export class FileStrategyStore {
             mkdirSync(root, { recursive: true, mode: 0o700 });
         }
         catch (err) {
-            throw configRefusal(`FileStrategyStore: cannot create root ${root}: ${String(err.message ?? err)}`, "config.strategy_root_invalid");
+            throw configRefusal(`FileStrategyStore: cannot create root ${root}: ${thrownText(err)}`, "config.strategy_root_invalid");
         }
         let st;
         try {
             st = statSync(root);
         }
         catch (err) {
-            throw configRefusal(`FileStrategyStore: cannot stat root ${root}: ${String(err.message ?? err)}`, "config.strategy_root_invalid");
+            throw configRefusal(`FileStrategyStore: cannot stat root ${root}: ${thrownText(err)}`, "config.strategy_root_invalid");
         }
         if (!st.isDirectory()) {
             throw configRefusal(`FileStrategyStore: root ${root} exists and is not a directory`, "config.strategy_root_invalid");
@@ -145,7 +146,7 @@ export class FileStrategyStore {
             catch (err) {
                 if (err.code === "ENOENT")
                     continue;
-                this.incident({ op: "find", error: `unstat-able entry skipped: ${String(err.message ?? err)}`, path: p });
+                this.incident({ op: "find", error: `unstat-able entry skipped: ${thrownText(err)}`, path: p });
                 continue;
             }
             if (!fst.isFile()) {
@@ -163,7 +164,7 @@ export class FileStrategyStore {
             catch (err) {
                 if (err.code === "ENOENT")
                     continue;
-                this.incident({ op: "find", error: `unreadable entry skipped: ${String(err.message ?? err)}`, path: p });
+                this.incident({ op: "find", error: `unreadable entry skipped: ${thrownText(err)}`, path: p });
                 continue;
             }
             let parsed;
@@ -217,7 +218,7 @@ export class FileStrategyStore {
             this.incident({ op: "parse", error: `corrupt entry quarantined (${reason})`, path: p });
         }
         catch (err) {
-            this.incident({ op: "parse", error: `corrupt entry skipped (${reason}); quarantine rename failed: ${String(err.message ?? err)}`, path: p });
+            this.incident({ op: "parse", error: `corrupt entry skipped (${reason}); quarantine rename failed: ${thrownText(err)}`, path: p });
         }
     }
     writeEntry(dir, path, entry) {
@@ -286,7 +287,7 @@ export class FileStrategyStore {
             catch (err) {
                 if (err.code === "ENOENT")
                     continue;
-                this.incident({ op: "evict", error: String(err.message ?? err), id: le.entry.id, path: le.path });
+                this.incident({ op: "evict", error: thrownText(err), id: le.entry.id, path: le.path });
             }
         }
     }

package/dist/tools/artifact/artifact-tool.js

@@ -7,6 +7,7 @@ import { errorResult } from "../../core/tools.js";
 import { inlineUntrusted } from "../../core/untrusted-text.js";
 import { actionDescription, artifactDescription, PARAM_TEXT, urlDescription } from "./artifact-text.js";
 import { ARTIFACT_REJECT_BREAKER_THRESHOLD, artifactRejectBannerFor, artifactRejectKeyOf, createArtifactRejectBreaker } from "./reject-breaker.js";
+import { thrownText } from "../../core/thrown-value.js";
 export const MAX_FILES_PER_PUBLISH = 255;
 const LIST_LIMIT_DEFAULT = 25;
 const LIST_LIMIT_MAX = 100;
@@ -93,10 +94,10 @@ function callHost(action, fn, signal) {
         }
         catch (err) {
             signal?.removeEventListener("abort", onAbort);
-            resolve({ ok: false, kind: "threw", message: err instanceof Error ? err.message : String(err) });
+            resolve({ ok: false, kind: "threw", message: thrownText(err) });
             return;
         }
-        p.then((value) => resolve(OUTCOME_SHAPE[action](value) ? { ok: true, value } : { ok: false, kind: "malformed", message: `the ${action} answer was outside the host contract` }), (err) => resolve({ ok: false, kind: "threw", message: err instanceof Error ? err.message : String(err) })).finally(() => signal?.removeEventListener("abort", onAbort));
+        p.then((value) => resolve(OUTCOME_SHAPE[action](value) ? { ok: true, value } : { ok: false, kind: "malformed", message: `the ${action} answer was outside the host contract` }), (err) => resolve({ ok: false, kind: "threw", message: thrownText(err) })).finally(() => signal?.removeEventListener("abort", onAbort));
     });
 }
 function buildSchema(caps) {

package/dist/tools/artifact/conformance.js

@@ -1,4 +1,5 @@
 import { randomUUID } from "node:crypto";
+import { thrownText } from "../../core/thrown-value.js";
 import { readArtifactHostCapabilities, } from "../../core/artifact-host.js";
 class Violation extends Error {
 }
@@ -25,7 +26,7 @@ async function publish(h, r, attemptId) {
         return await h.host.publish(r, ctxOf(h, attemptId));
     }
     catch (err) {
-        return fail(`publish threw: ${err instanceof Error ? err.message : String(err)}`);
+        return fail(`publish threw: ${thrownText(err)}`);
     }
 }
 async function publishOk(h, r, what, attemptId) {
@@ -282,7 +283,7 @@ define({ id: "read.unknown_url_typed", describe: "`read` of a url this host neve
         out = await h.host.read({ url: FOREIGN_URL }, ctxOf(h));
     }
     catch (err) {
-        return fail(`read threw: ${err instanceof Error ? err.message : String(err)}`);
+        return fail(`read threw: ${thrownText(err)}`);
     }
     check(!out.ok && (out.code === "not_found" || out.code === "forbidden"), `an unknown url answered ${out.ok ? "ok" : out.code}`);
     return out.ok ? "" : out.code;
@@ -340,7 +341,7 @@ export async function runArtifactConformance(host, opts = {}) {
             row = { id: v.id, status: "pass", detail: await v.run(h) };
         }
         catch (err) {
-            row = { id: v.id, status: "fail", detail: err instanceof Violation ? err.message : `threw: ${err instanceof Error ? err.message : String(err)}` };
+            row = { id: v.id, status: "fail", detail: err instanceof Violation ? err.message : `threw: ${thrownText(err)}` };
         }
         results.push(row);
     }

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -284,10 +284,12 @@ export interface BashReadonlyRootBoundary {
      *  undecided contract. What REMAINS of ① is the form table's stated open set (see the KNOWN OPEN
      *  SET note at {@link RECURSIVE_READ_FORMS}: a traversal verb absent there that a deployment
      *  allowlists classifies by its ordinary form and can auto-run a traversal unjudged);
-     *  ② LEXICAL only — an in-root symlink whose target is a
-     *  guarded path reads as its innocent spelling here, exactly as it does for the containment half
-     *  (the enforcing/canonicalizing recheck is both shell faces' execute leg, via checkedPaths; the
-     *  classify auto-allow lane has no I/O seat by contract). The structured read faces judge BOTH
+     *  ② LEXICAL only HERE — an in-root symlink whose target is a
+     *  guarded path reads as its innocent spelling at this seat, exactly as it does for the containment half,
+     *  because the classify auto-allow lane has no I/O seat by contract. The CANONICAL view is judged by the
+     *  full shell's execute-time recheck, which asks THIS judge (the same function object, forwarded) where
+     *  each candidate really lands — a `checkedPaths` literal and a `undecidedPaths` pattern's expansions
+     *  alike. The `bash_readonly` face wires no deny seat at all, so its own recheck carries nothing. The structured read faces judge BOTH
      *  views (canonical + lexical); what this seat is and is not is stated once, at
      *  `shell.read_boundary.friction_floor`. The `bash_readonly` face deliberately does NOT wire this seat (its
      *  roots containment + command allowlist double gate is the deployment's own read-safety
@@ -527,7 +529,16 @@ export declare function resolveOperandSpellings(base: string | undefined, operan
 export declare function refusedCommandMayRead(command: string, allow: ReadonlySet<string>, boundary: BashReadonlyRootBoundary | undefined, 
 /** The {@link ShellScanDecline} members THIS SEAT reads as evidence (tables and argument: `fs-bash.ts`); one
  *  the table omits ends the scan with "exempt". */
-declinesAreEvidence: ReadonlySet<ShellScanDecline>): boolean;
+declinesAreEvidence: ReadonlySet<ShellScanDecline>): RefusedCommandScan;
+/** What ONE scan of a refused command found — TWO facts, because a seat's table answers only the first. `mayRead`
+ *  is the whitelist's verdict ("may read a file the boundary never judged"), which a seat turns into a MANDATE.
+ *  `declined` is the scan's own report that it could not judge where a segment reads AT ALL
+ *  ({@link SHELL_SCAN_DECLINES}), recorded BEFORE the seat's table and so the SAME on every seat: a seat omitting
+ *  that decline has ruled only that an ANSWERER may retire the ask, never that nothing happened. */
+export interface RefusedCommandScan {
+    readonly mayRead: boolean;
+    readonly declined: boolean;
+}
 /**
  * The home directory's VARIABLE spellings, SUBSTITUTED with the declared value before a read face segments the
  * command: `$HOME` / `${HOME}` at the START of a word (an empty quote pair before it included), unquoted or
@@ -645,10 +656,10 @@ export declare const COMMAND_LAUNCHERS_FOR_TEST: ReadonlySet<string>;
  *    base across segments) and dropping it would place every later relative operand against a base bash
  *    has already left. A move the walk cannot model (`pushd`/`popd`) is not silently tolerated either —
  *    see the `paths`-less gated answer below.
- *  · The CONTAINMENT half only: {@link BashReadonlyRootBoundary.denyMatch} is deliberately NOT passed
- *    on. The deny judge outranks containment inside the walk and returns early, which would let a
- *    deny-listed operand HIDE the fact that it also sits outside the roots — the deny demotion is
- *    unchanged on the full face, and this one keeps answering its own question underneath it.
+ *  · BOTH halves from ONE extraction, in TWO passes: the CONTAINMENT pass alone is deny-free, because
+ *    {@link BashReadonlyRootBoundary.denyMatch} outranks containment inside the walk and returns early,
+ *    which would let a deny-listed operand HIDE the fact that it also sits outside the roots. A SECOND
+ *    pass over the SAME readers does carry that judge, and is what answers `denied` (see below).
  *  · `face: "open"` is honoured: under the open read face containment is structurally satisfied, an
  *    out-of-roots operand is not a finding, and this gate is silent — a full-read deployment sees no
  *    gate here, by the same one mechanism the face already defines.

package/dist/tools/fs/bash-readonly-classifier.js

@@ -257,7 +257,9 @@ function tokensMoveBase(toks) {
 }
 const SHELL_REENTRY_PROGRAM_RE = /^(?:(?:ba|z|da|k|fi|a|mk|ya|pdk|c|tc)?sh|eval|source|\.|parallel)$/;
 export function refusedCommandMayRead(command, allow, boundary, declinesAreEvidence) {
-    return !refusedCommandExempt(command, allow, boundary, declinesAreEvidence, 0);
+    const scan = { declined: false };
+    const exempt = refusedCommandExempt(command, allow, boundary, declinesAreEvidence, scan, 0);
+    return { mayRead: !exempt, declined: scan.declined };
 }
 const STDIN_ONLY_READER_FLAGS = new Map([
     ["cat", /^-[AbeEnstTuv]+$/],
@@ -279,7 +281,7 @@ function whitelistSegment(segment) {
         redirects: tokens.filter((t) => t.kind === "redirect"),
     };
 }
-function refusedCommandExempt(command, allow, boundary, declinesAreEvidence, depth, baseMovedOutside = false) {
+function refusedCommandExempt(command, allow, boundary, declinesAreEvidence, scan, depth, baseMovedOutside = false) {
     if (depth > 4)
         return false;
     const lexed = lexShellText(command, { mode: "lenient" });
@@ -305,6 +307,8 @@ function refusedCommandExempt(command, allow, boundary, declinesAreEvidence, dep
         if (programPositionRunsShell(pos, SHELL_REENTRY_PROGRAM_RE))
             return false;
         const decline = shellScanDeclineOf(pos, XARGS_TARGETS_ACCEPTED_UNJUDGED);
+        if (decline !== undefined)
+            scan.declined = true;
         if (decline !== undefined && declinesAreEvidence.has(decline))
             return false;
         declined ??= decline;
@@ -322,7 +326,7 @@ function refusedCommandExempt(command, allow, boundary, declinesAreEvidence, dep
             (walked.undecidedPaths?.length ?? 0) === 0 && (walked.unresolvedOperands?.length ?? 0) === 0 && (walked.recursiveReadPaths?.length ?? 0) === 0;
         if (fullyGreen)
             continue;
-        if (!refusedCommandExempt(body, allow, boundary, declinesAreEvidence, depth + 1, baseMoved))
+        if (!refusedCommandExempt(body, allow, boundary, declinesAreEvidence, scan, depth + 1, baseMoved))
             return false;
     }
     const stdinFileJudgedInside = (word) => {

package/dist/tools/fs/fs-bash.d.ts

@@ -68,16 +68,22 @@ export declare function bashReversibilityProbe(allow?: readonly string[], bounda
  * The READ-BOUNDARY seat is what the default/off doctrine and a bypass mode mount ALONE: there "not mandated"
  * is VOUCHED, so a decline must count as evidence or a read nobody judged runs silently (`<out-of-root> |
  * xargs cat` at zero asks — a closed P0). It keeps both. The CLASSIFY seat composes the same boundary with the
- * SHAPE classifier, which refuses all these shapes anyway: the only question left is whether a stored answer
- * may retire the ask. It keeps NEITHER — empty by the argument, not by omission.
- * THE COST, stated rather than mitigated: once that ask is retired, an out-of-root or deny-listed read HIDDEN
- * inside such a command is not asked again. A command's words are not the argv its programs receive (a stream
- * is re-split by its consumer, an unread option may move the working directory first, stdin text is a command
- * line nobody parsed), so a scan of them cannot be the guarantee it was claimed to be — three independently
- * exploitable shapes measured that. "A read the boundary objects to is never retired by a stored rule" does
- * NOT hold on the classify seat for this class, and holds unchanged elsewhere; below it is the execution
- * environment's sandbox. One word-level check survives on both seats and is not part of the trade: a token the
- * scan DID read naming a path outside the roots still gates the call ({@link classifyOutOfRootReadGate}).
+ * SHAPE classifier, which refuses every one of these shapes: what survives is a CARD, and the only question
+ * this table answers is who may retire it. It keeps NEITHER — an ANSWERER may (a person, the auto-mode
+ * classifier, a person's stored allow rule) — empty by the argument, not by omission.
+ *
+ * WHAT AN EMPTY TABLE DOES NOT BUY, corrected where it was once claimed: "the shape classifier refuses these
+ * shapes anyway, so the only question left is the stored answer" was true of the PROBE and false of the OUTCOME
+ * — the allow layer's other members are not that classifier, and both cleared exactly these cards at ZERO asks. An
+ * empty table says only "no MANDATE HERE"; that the boundary DECLINED is a separate fact, carried on every ask this
+ * seat raises ({@link BoundaryAnswer}'s weaker rung), standing every ANSWERLESS arm down while every answerer's lane stays open.
+ * THE COST, stated rather than mitigated: once that ask is retired BY AN ANSWERER, an out-of-root or deny-listed
+ * read HIDDEN inside such a command is not asked again. A command's words are not the argv its programs receive (a
+ * stream is re-split by its consumer, an unread option may move the working directory first, stdin text is a
+ * command line nobody parsed), so a scan of them cannot be the guarantee it was claimed to be. "A read the boundary
+ * objects to is never retired by a stored rule" does NOT hold on the classify seat for this class, and holds
+ * unchanged elsewhere. One word-level check survives on both seats and is not part of the trade: a token the scan
+ * DID read naming a path outside the roots still gates the call ({@link classifyOutOfRootReadGate}).
  */
 export declare const BOUNDARY_SEAT_DECLINE_EVIDENCE: ReadonlySet<ShellScanDecline>;
 /** The classify doctrine's table — see above; empty by the argument. */