@sema-agent/core 7.23.2 → 7.23.4

package/CHANGELOG.md

@@ -1,3 +1,35 @@
+# Changelog
+
+## 7.23.4 — 2026-09-19
+
+### Read boundary — one deny judge for every read face: the `bash_readonly` shell wires the same seat (#937; P1; design/199 v1 exception retired; @server @cli)
+- **Before.** Under `handsReadOnly:true` (the mount that carries `bash_readonly` and no write faces at all) a wired `readDenyPatterns` table judged NOTHING on the shell face. Measured on `563c1e45` with `["**/.env","**/secrets/**"]`: `cat .env`, `cat .en?`, `grep -r <needle> .` and `grep -r <needle> secrets` each cost ZERO cards and each returned the guarded file's bytes — in the headless and the wired-approver deployment alike. The SAME deployment on the full Bash face mandates an ask for every one of them. The cause was one carve-out stated in three places (design/199 v1): this face's roots containment plus its reader allowlist were ruled to BE the deployment's read-safety declaration, so it wired no deny seat — neither on the boundary it classifies with nor on its own execute-time canonical recheck's `ask`.
+- **After — the exception is retired, and it is one rule fewer.** Roots answer WHERE a command may read; the allowlist answers WHICH verb runs; neither answers WHICH FILES are off the table, and a deny row holds INSIDE the roots by definition — so the carve-out did not narrow the table on read-only mounts, it deleted it. The face now holds ONE boundary for BOTH of its judging moments (the pre-execution classify walk and the canonical recheck), assembled once per mount from the SAME compiled matcher `createHandsToolkit` hands Read/Grep/Glob/RepoMap. No read-only-face branch was added: the classify call takes the boundary it always took with its deny half filled in, and the recheck's `ask` is the same `{ deny, containment }` pair the full shell's leg asks. Rules: −1 face exception, −1 seat-wiring spelling (`readDenySeat`, the one adapter from a compiled matcher to the boundary's deny half, now used by `prepare-hands-readface` too), −1 card spelling (`readDenyRefusal`, the one `read_path_denied` mint for both passes).
+- **Every finding lands on the rule this face already had.** It has no approval channel, so a demotion is a refusal: a judge MATCH refuses with the fs boundary's own `read_path_denied` card (target + pattern, whichever pass caught it — minting a deny finding as `readonly_out_of_root` would tell a consumer the read left the roots); a contents-disclosing recursive form under a wired judge (`recursiveReadPaths` — `grep -r/-R`, `diff -r`, and `rg`/`ag`/`ack`/`tar c` where a deployment allowlists them) is the face's UNESTABLISHABLE arm, the same finding as a pattern the expander cannot enumerate, and carries the same `readonly_out_of_root` code with the check's own sentence. Names-only traversals (`ls -R`, `du`, `find`, `tree`) mint no such finding and are unmoved.
+- **Reach.** `TaskSpec.handsReadOnly` mounts + a non-empty deny set (task `readDenyPatterns`, deployment `readDenyPatterns`, or an active built-in tier). With NO deny set wired the judge is not mounted at all and both judging moments are byte-identical — including `grep -r`, whose demotion is minted only under a wired judge. In-root ordinary reads, in-root globs, the containment refusals (#775 / RB-413) and the full Bash face's answers are all unmoved; `test/backlog937-readonly-face-deny-judge.test.ts` pins the contrast column.
+- **Ops.** A deployment that configures a read deny table AND mounts a read-only band (server's autonomy read-only lane; plan-mode research turns; verifier runs) will see its read-only shell REFUSE a read of a deny-listed file where it previously executed silently, and refuse `grep -r`-family commands while that table is in force. The refusals name the matched pattern (match arm) or the traversal roots the check took (traversal arm). No deny table ⇒ no change.
+- **A second leak of the same shape, found by the adversarial round and confirmed by construction.** This face RESCUES a containment refusal when every out-of-root candidate canonicalizes back INSIDE the roots (the aliased-root case, `/tmp` → `/private/tmp`) — and the released operand rode `outOfRootPaths`, which the execute-time leg is handed neither as a literal nor as a pattern. So a proof about WHERE a read lands stood in for the question of WHICH file it is: `cat <outside>/alias/notes.txt`, where `notes.txt` is a symlink to a deny-listed file, ran at zero cards. The full shell's leg may drop what the boundary raised — there a PERSON answered it — and nobody is asked here, so the rescued candidates now go back through the same leg. The rescue itself is unchanged (pinned in both directions). The overflow-spool exemption is deliberately NOT collected: those paths are outside the roots by construction, and the containment half would refuse the engine's own recovery file.
+- **The second grant site, from the adversarial round's round 2.** This face also grants itself a read of its OWN truncated-output file (the result trailer advertises `tail -c … <file>`), and that grant answered containment only. A deployment whose deny table names the engine's recovery spelling had a route out of the boundary: an out-of-root operand with an innocent name whose canonical target is the spool file clears the lexical table, fails the root rescue, and passes the fence. Both grant sites now obey ONE rule — **a grant answers containment, never the deny half** — and the recovery route itself is unchanged wherever no row names it (pinned in both directions). Rules: −1 (the two grant arms had two different downstream obligations; now one).
+- **One accepted over-fire, declared.** Released candidates enter the leg as LITERALS, and an operand carrying a bracket metacharacter is reported by the classifier as both a candidate and a pattern — so a real file literally named `[ab].txt` that links out of the roots is judged although bash would expand the word instead. Fail-CLOSED, and the same family as the over-fires this leg's scope note already declares. Subtracting the pattern spellings instead would drop the QUOTED occurrence of the same word, which is a real read, and fail open; provenance per OCCURRENCE rather than per de-duplicated path is what would answer both, and no consumer carries it today.
+- **Precedence, stated honestly.** Deny outranks containment among the findings ONE pass has in hand; it is not a promise across passes. A command the lexical pass refuses on containment (or on the traversal arm) keeps that sentence even where a later canonical resolution would have found a deny row on some other operand. Every such command is refused either way; only the account differs.
+- **Contract sentences changed:** `TaskSpec.readDenyPatterns` now names `bash_readonly` among the judged faces; `read-deny.ts`'s scope note says every read face rather than the structured ones; `BashReadonlyRootBoundary.denyMatch` / `CompoundReadonlyVerdict.recursiveReadPaths` / the `DENY_REFUSAL_NOTE` single-spelling note all retire their v1-ruling clauses. `CompoundReadonlyVerdict` gains `readDeniedPath` / `readDeniedPattern` (present-iff `readDenied`, the `outOfRootRead`/`outOfRootPaths` idiom) so a consumer names the target without re-parsing prose — additive, breaking 0.
+
+## 7.23.3 — 2026-09-19
+
+### Read boundary — an operand the shell EXPANDS is judged by the deployment's deny judge, at the one moment the expansion exists (#934; P1; execute-time recheck; @cli @server @client-core)
+- **Before.** Under `shellGate:"classify"` + `readFace:"roots"` with a deny table wired, `cat .en?` cost ZERO cards and returned `.env`'s bytes; so did `cat secrets*/app.txt` and `grep . secret?/app.txt`, in the headless and the wired-approver deployment alike. Three passes each declined, and each was right to: the classify walk judges an unexpanded glob on its UNEXPANDED spelling (`<root>/.en?` is on no deny table) and parks it as `undecidedPaths`; the read-only command tables then cleared that ordinary card (`cat` is a listed reader; the table knows nothing about paths); and the execute-time canonical recheck (#775) — the one pass that HOLDS a filesystem and does expand the pattern — asked only "does this land outside the roots?". **A deny-listed expansion is in-root by definition**, so the containment question can never be the one that catches it. Not a 7.23.1 regression: the same reading since 7.22.x.
+- **After — one rule: an EXPANSION IS AN OPERAND.** The recheck leg hands every path it establishes to `BashReadonlyRootBoundary.denyMatch` — the SAME function object the approval-time walk holds, forwarded, never a second matcher — and asks it BEFORE containment, the order the walk itself applies (deny outranks; no root grant clears a deny row). Rules: ±0 judges, −1 drop. The expander's property-6 shortcut used to DELETE an in-root non-symlink match outright; what that shortcut buys is the `realpath` call, so the match is now handed over WITH the canonical location the enumeration already established, and the judge answers both questions on it at the same cost. The deny question is asked of the FOLDED view, because that is the form the walk decides on — `cat secrets/../sub/a.txt` reads `sub/a.txt` and is not refused.
+- **Two views per path, and which is NEW is the whole of the change.** The operand's own spelling — already judged for a literal candidate, NEVER judged for an expansion the shell produces after the verdict — and the canonical TARGET, which no lexical pass can reach on either list. The second closes the deny seat's stated residual ② (an in-root symlink whose target is guarded: `cat notes.txt` → `<root>/.env` also disclosed at zero asks), which that seat's own contract already named this leg as the closer of. Judging the spelling of expansions ALONE would have been a second rule.
+- **The same leak had a second site, and the face was the reason.** With `readFace:"open"` the leg exited before doing anything — a CONTAINMENT-shaped exit applied to the whole pass — so `cat .en?` and `cat notes.txt` disclosed the file at zero asks there too, on a face whose deny seat's own contract reads "the deny half above keeps judging in both faces" (the LITERAL `cat .env` was mandated there all along, which is what proves the floor is real). Which half still has a question is now one value the face decides member by member: containment OFF under open (an out-of-roots operand rides `checkedPaths` there as an ACCEPTED candidate; re-judging it would make the open face stricter than the closed one), deny ON in both. With neither question the leg does not run, so an open face with no deny table is answered exactly as before. Rules: −1 face special case. Both directions pinned — the deny cells AND the containment controls (an out-of-root read, plain and globbed, still runs under open with a deny table wired).
+- **A third site, found by the adversarial round and confirmed by construction.** The expander had one more containment shortcut: when a glob's LAST directory canonicalized OUTSIDE the roots, it pushed that DIRECTORY and discarded the matches. Containment reached the right verdict through the directory, which is why the shortcut survived — and the deny half never can, because a deny row is about the FILE. Measured on the parent: under the open face, `cat vendor/.en?` (an in-root directory symlink pointing out) and `cat <outside>/.en?` both disclosed the file at zero asks. The expander now hands over the matches themselves with whatever canonical facts it already holds; containment may use those as shortcuts, it may not replace the operands. Consequence, disclosed: the closed face's `readonly_out_of_root` refusal for such a glob now names the FILES (`<outside>/secret`, `<outside>/second`) instead of the directory — strictly more precise, and `test/backlog775-glob-canonical-recheck.test.ts` A1-a is re-pinned to it. A consumer counting `details.paths` entries for this refusal sees one row per escaping match rather than one per escaping directory.
+- **Precedence, made one rule.** An expansion the leg cannot establish used to RETURN immediately, which ranked it above a deny row a later operand would have produced — the one order this leg is not free to choose. It is now recorded like every other objection and the three are ranked once, at the end: deny > unestablished > containment. Every such command was refused before and is refused now; only which sentence it carries can change.
+- **Not the other repair.** Widening the classify seat's weak rung to `boundaryUnread` would turn every in-root glob into an ordinary card — a narrowing for every deployment, deny table or not. RB-474b's ordinary card, the classify seat's card shape and the off/bypass seats are untouched.
+- **Reach.** Only a deployment with a deny judge wired (`readDenyPatterns`, or a selected built-in tier — default OFF) sees anything: without one the boundary carries no `denyMatch` and this leg's answer is byte-identical, on both read faces. `bash_readonly` is unaffected — that face wires no deny judge at all (v1 ruling). No second adjudication: a deny row the walk RAISED returns a verdict carrying no candidates, so an approver's yes still runs the command. An execute-time deny refusal is NOT clearable by a stored allow rule or by the auto classifier — it is past the approval step, which is what makes it stronger than the accepted reach #891 states for a retired ordinary card.
+- **Stated reach on the open face.** The leg's fail-closed arm travels with the deny half: under `readFace:"open"` WITH a deny table, a candidate this leg cannot ESTABLISH — a glob nobody can expand (an uncompilable range, an unenumerable directory, an expansion past the enumeration caps), or a literal whose chain the resolver could neither answer nor rule absent — is now refused rather than run, because a location that cannot be established cannot be deny-judged either. The closed face always answered that way; an open face with no deny table does not run the leg at all and is unchanged. Measured in both directions.
+- **Still open, stated rather than assumed gone.** A DECLARED isolated sandbox keeps the lexical-only leg (property 3): its `canonicalPath` is an RPC into a namespace this process cannot resolve, so no expansion can be established there and the deny half stays at the approval walk's unexpanded-spelling reading. The sandbox is that deployment's declared floor. A RECURSIVE verb's directory operand (`grep -r . <dir>`) is judged on the operand, never on its subtree — measured at one mandated ask with no disclosure, so it is asked rather than leaked, but what a yes then opens is the execution environment's floor.
+- **headless.** Restrictive direction: a deny-listed read that reached a headless run through a glob, or through an in-root symlink, is now refused instead of executed. The refusal is the fs boundary's own card (`read_path_denied`, with `target` and the matched `pattern`), the same one `Read`/`Grep`/`Glob` mint — one rule, learned once.
+- Pins: `test/backlog934-glob-expansion-deny-judge.test.ts` (3 shapes × 2 approver arms, judge-identity via a case-folded pattern, the symlink view, the wire card, and five controls: RB-474b unchanged, no deny table, #775 unflipped, two `..`-over-fire shapes, and the approved deny row).
+
 ## 7.23.2 — 2026-09-19
 
 ### Rendering a thrown value is one total rule — a hook could kill the engine with its choice of rejection value (#926; P1, failure face; @cli @server @client-core: text only, no wire key)
@@ -19,7 +51,7 @@
 - **Difference from 7.23.0.** 7.23.0 refused these shapes with a MANDATE (no classifier, no stored rule, confirm-or-refuse). This version is strictly looser than that and strictly tighter than 7.23.1: an ordinary card an answerer may settle.
 - **Reach.** Any deployment that wires a read boundary (`readFace` + roots, with or without `readDenyPatterns`) under `shellGate:"classify"`: a shell command whose operands the walk could not read — a stream-fed operand list, an unreadable program position — now reaches the person/classifier instead of being auto-allowed by the read-only tables. In-root spellings of the same shapes (`echo sub/x.txt | xargs grep .`) are in that set too: the boundary declined for them as well, and "in root" is a fact nobody established. Commands with no decline are untouched — `git status`, `ls -la` and every other read-only shape the tables clear keep costing zero questions.
 - **headless.** Restrictive direction, and the reason this is a P1: a headless classify-tier run that executed these stream-fed reads with no approver now refuses them (an ask with no approver is a refusal). A deployment relying on that auto-allow should widen its roots, store an allow rule for the command, or wire an approver/classifier.
-- **NOT FIXED here, and visible rather than assumed gone (measured on this tree AND on 7.23.1's).** The other half of "the boundary could not read where this command reads" — an UNEXPANDED GLOB (`undecidedPaths`) — is a plain card by ruling (RB-474b) and is still cleared by the read-only tables. Its containment half is caught at execute time by the canonical recheck (#775); its DENY half is not, because that recheck judges roots only. `cat .en?` under `readDenyPatterns:["**/.env"]` discloses `.env` at zero asks on 7.23.1 and on this version alike. Tracked separately; this version neither widens nor narrows it.
+- **The other half, measured here and FIXED in this same version by #934 below.** "The boundary could not read where this command reads" has a second family — an UNEXPANDED GLOB (`undecidedPaths`), a plain card by ruling (RB-474b) and still cleared by the read-only tables. Its containment half was already caught at execute time by the canonical recheck (#775); its DENY half was not, because that recheck judged roots only, so `cat .en?` under `readDenyPatterns:["**/.env"]` disclosed `.env` at zero asks on 7.23.1 and on this tree alike. This version does not change the CARD (RB-474b stands); it gives the execute-time recheck the boundary's own deny judge — see the #934 section.
 - Pins: `test/backlog930-decline-not-read-only-clearable.test.ts` (14 shapes × 2 arms, + the C-R67 (B) surface, the sandbox arm with its own three-way control, the off seat's mandate, the read-only arm still alive, and the `xargs cat` / in-root controls).
 
 ## 7.23.1 — 2026-09-18

package/dist/core/runner/prepare-hands-readface.js

@@ -3,7 +3,7 @@ import { StubExecutionEnv } from "../stub-env.js";
 import { hasBackgroundShell } from "../background-shell.js";
 import { boundaryIsTheSandbox } from "../remote-env.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { bashReadBoundaryProbe, bashReversibilityProbe, activeReadDenyBuiltinTiers, compileReadDeny, createHandsToolkit, deploymentFaceClampNotice, pdfModelCapabilitiesOf, inheritSessionReadFileState, resolveContainmentFace, seedReadFileStateFromContext, seedReadFileStateFromTranscript, } from "../../tools/fs/index.js";
+import { bashReadBoundaryProbe, bashReversibilityProbe, activeReadDenyBuiltinTiers, compileReadDeny, readDenySeat, createHandsToolkit, deploymentFaceClampNotice, pdfModelCapabilitiesOf, inheritSessionReadFileState, resolveContainmentFace, seedReadFileStateFromContext, seedReadFileStateFromTranscript, } from "../../tools/fs/index.js";
 import { resolveKey, sha256 } from "../../tools/fs/safety.js";
 import { normalizeFileText } from "../../tools/fs/encoding.js";
 import { wholeFileRecordsFromTranscript } from "./session-file-state-replay.js";
@@ -327,16 +327,12 @@ export async function prepareHandsMount(input) {
                         sessionSeats.reanchor(sessionId, readFileState, ownCommittedTailEntryId);
                 }
                 : undefined;
-        const compiledDeny = readDenyMatcher;
-        const denySeatJudge = compiledDeny !== undefined && compiledDeny.entries.length > 0
-            ? (p) => compiledDeny.matchPath(p)?.pattern ?? null
-            : undefined;
+        const denySeat = readDenySeat(readDenyMatcher);
         const shellReadBoundary = () => ({
             roots: [rootCanonical, ...additionalRootsCanonical, ...additionalReadRootsCanonical],
             ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}),
             ...(executionEnv.homeDir !== undefined ? { homeDir: executionEnv.homeDir } : {}),
-            ...(denySeatJudge !== undefined ? { denyMatch: denySeatJudge } : {}),
-            denyEntries: (compiledDeny?.entries ?? []).map((e) => e.pattern),
+            ...denySeat,
             ...(resolvedReadFace !== undefined ? { face: resolvedReadFace } : {}),
         });
         const band = createHandsToolkit(executionEnv, readFileState, rootCanonical, {

package/dist/core/task-spec.d.ts

@@ -784,7 +784,8 @@ export interface TaskSpec {
      * design/199 件B — TASK-layer ADDITIONS to the built-in sensitive-path READ deny set
      * ({@link import("../tools/fs/read-deny.js").READ_FACE_DEFAULT_DENY_ENTRIES}). Judged by the
      * structured read faces (Read/Grep/Glob/RepoMap, their traversals, the classify shell gate's
-     * auto-allow probe and the compaction attachment reader) in BOTH containment modes. Add-only at
+     * auto-allow probe, the compaction attachment reader and the `bash_readonly` shell mounted by
+     * {@link handsReadOnly} — one deny judge for every read face) in BOTH containment modes. Add-only at
      * the task layer: entries here UNION with the active built-ins and the deployment's
      * {@link RunnerDeps.readDenyPatterns}; `[]` ≡ absent (union identity); NOTHING at the task layer
      * can remove a built-in — the one removal channel is the DEPLOYMENT's built-in configuration

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -272,26 +272,24 @@ export interface BashReadonlyRootBoundary {
      *  and demotes (with no out-of-root signal — the classifier does not know where it points, which is a
      *  different verdict from knowing it points outside). */
     homeDir?: string;
-    /** The sensitive-path read deny judge over LEXICALLY RESOLVED operands: a hit
-     *  demotes the command (ask, never auto-allow), independently of the roots — in-root operands are
-     *  judged too. Returns the matched pattern, or null. TWO named residuals, both inherited from this
-     *  classifier's declared purity (synchronous, zero I/O — the same scope stated for the
-     *  containment half): ① operand TARGET matching only — no ancestor intersection: the judge sees
-     *  the operand's own resolved spelling, never its subtree. The RECURSIVE-reach half of that
-     *  residual has since been narrowed: a listed recursive/expanding verb's path
-     *  operand under this wired seat rides {@link CompoundReadonlyVerdict.recursiveReadPaths}
-     *  (⊂ undecidedPaths), so `grep -r x ~/` no longer auto-allows — it demotes to ask through the
-     *  undecided contract. What REMAINS of ① is the form table's stated open set (see the KNOWN OPEN
-     *  SET note at {@link RECURSIVE_READ_FORMS}: a traversal verb absent there that a deployment
-     *  allowlists classifies by its ordinary form and can auto-run a traversal unjudged);
-     *  ② LEXICAL only — an in-root symlink whose target is a
-     *  guarded path reads as its innocent spelling here, exactly as it does for the containment half
-     *  (the enforcing/canonicalizing recheck is both shell faces' execute leg, via checkedPaths; the
-     *  classify auto-allow lane has no I/O seat by contract). The structured read faces judge BOTH
-     *  views (canonical + lexical); what this seat is and is not is stated once, at
-     *  `shell.read_boundary.friction_floor`. The `bash_readonly` face deliberately does NOT wire this seat (its
-     *  roots containment + command allowlist double gate is the deployment's own read-safety
-     *  declaration — v1 ruling). */
+    /** The sensitive-path read deny judge over LEXICALLY RESOLVED operands: a hit demotes the command (ask,
+     *  never auto-allow), independently of the roots — in-root operands are judged too. Returns the matched
+     *  pattern, or null. TWO named residuals, both inherited from this classifier's declared purity
+     *  (synchronous, zero I/O — the same scope stated for the containment half): ① operand TARGET matching
+     *  only, no ancestor intersection: the judge sees the operand's own resolved spelling, never its subtree.
+     *  The RECURSIVE-reach half of ① is narrowed — a listed recursive verb's path operand under this wired
+     *  seat rides {@link CompoundReadonlyVerdict.recursiveReadPaths} (⊂ undecidedPaths), so `grep -r x ~/` no
+     *  longer auto-allows; what REMAINS is the form table's stated open set (the KNOWN OPEN SET note at
+     *  {@link RECURSIVE_READ_FORMS}: a traversal verb absent there that a deployment allowlists classifies by
+     *  its ordinary form and can auto-run a traversal unjudged). ② LEXICAL only HERE — an in-root symlink
+     *  whose target is guarded reads as its innocent spelling at this seat, as it does for the containment
+     *  half, because the classify auto-allow lane has no I/O seat by contract; the CANONICAL view is judged by
+     *  an execute-time recheck that asks THIS judge (the same function object, forwarded) where each candidate
+     *  really lands, on a `checkedPaths` literal and a pattern's expansions alike.
+     *  EVERY read face wires this one seat, the `bash_readonly` shell included, at BOTH of its judging
+     *  moments — roots answer WHERE a command may read and the allowlist WHICH verb runs, neither answers
+     *  WHICH FILES are off the table. What this seat is and is not is stated once, at
+     *  `shell.read_boundary.friction_floor`. */
     denyMatch?: (resolvedPath: string) => string | null;
     /** What the wired {@link denyMatch} judge would apply — the ACTIVE deny patterns. Read for ONE question:
      *  is there anything for a traversal to defeat? EMPTY ⇒ the judge refuses nothing, so a walk under it
@@ -331,6 +329,10 @@ export interface CompoundReadonlyVerdict {
      *  reads it to mint `mandated` — a stored allow rule or the read-only shell arm may retire a classify-
      *  tier question, never one the read face itself asked. Structural sibling of `outOfRootRead`. */
     readDenied?: true;
+    /** The matched operand (resolved spelling) and the pattern — present iff {@link readDenied} (the
+     *  `outOfRootRead`/`outOfRootPaths` idiom), so a refusal CARD names the target without parsing prose. */
+    readDeniedPath?: string;
+    readDeniedPattern?: string;
     /**
      * The paths this scan resolved INSIDE the roots (de-duplicated, first-seen order), i.e. the
      * candidates a caller holding a filesystem should re-check with symlinks resolved. Absent when there
@@ -417,20 +419,19 @@ export interface CompoundReadonlyVerdict {
     /**
      * Operands of a RECURSIVE/EXPANDING read form (`grep -r`, `ls -R`, `du`, … — see
      * {@link RECURSIVE_READ_FORMS}) judged with a {@link BashReadonlyRootBoundary.denyMatch} seat wired.
-     * The deny judge sees only the operand's own resolved spelling, but a recursive verb reads the
-     * operand's whole SUBTREE — `grep -r x /home/user` touches `/home/user/.ssh/*` while the judged
-     * spelling `/home/user` matches no deny pattern. The traversal's reach set is therefore not covered
-     * by the lexical check at all, and with zero I/O "provably not a directory" does not exist — so
-     * every such operand is UNDECIDED (no directory guessing, no bounded pre-check: both would be a
-     * false "resolved, inside" of exactly the kind {@link undecidedPaths} exists to prevent).
+     * The judge sees only the operand's own resolved spelling, but a recursive verb reads the operand's whole
+     * SUBTREE — `grep -r x /home/user` touches `/home/user/.ssh/*` while the judged spelling matches nothing.
+     * The traversal's reach set is therefore not covered by the lexical check at all, and with zero I/O
+     * "provably not a directory" does not exist — so every such operand is UNDECIDED (no directory guessing,
+     * no bounded pre-check: both would be a false "resolved, inside" of exactly the kind
+     * {@link undecidedPaths} exists to prevent).
      *
-     * Subset of {@link undecidedPaths} (same consumer contract: ask, never auto-allow); carried
-     * separately so a consumer minting prose can name the recursive-reach cause rather than the glob
-     * one. Minted ONLY when `denyMatch` is wired: without a deny judge there is nothing the traversal
-     * bypasses — the containment half already judges the operand itself, and its lexical residuals are
-     * recorded on {@link checkedPaths}. The `bash_readonly` face never wires `denyMatch` (v1 ruling,
-     * see that seat's note), so this field never appears there and its expand-and-verify execution
-     * path is unchanged.
+     * Subset of {@link undecidedPaths} (same consumer contract: ask, never auto-allow); carried separately so
+     * a consumer minting prose can name the recursive-reach cause rather than the glob one. Minted ONLY when
+     * `denyMatch` is wired: without a judge there is nothing the traversal bypasses. EVERY face wiring the
+     * seat sees this field, the `bash_readonly` shell included, and answers it by its OWN rule for a demotion
+     * — that face has no approval channel, so what it cannot establish it REFUSES (an unbounded traversal is
+     * the same "the read set is not in the text" finding as a pattern the expander cannot enumerate).
      */
     recursiveReadPaths?: readonly string[];
     /**

package/dist/tools/fs/bash-readonly-classifier.js

@@ -2171,6 +2171,8 @@ function evaluateReadBoundary(foldedSegments, boundary, mintGrantCandidate, reac
                     return {
                         reason: `a command operand resolves to "${finding.path}", which matches the sensitive-path read deny list (pattern "${denied}") ${NOT_AUTO_ALLOWED}`,
                         readDenied: true,
+                        readDeniedPath: finding.path,
+                        readDeniedPattern: denied,
                     };
                 }
                 if (finding.kind === "inside") {

package/dist/tools/fs/fs-bash.d.ts

@@ -4,6 +4,7 @@ import { type CwdRef } from "./fs-shared.js";
 import type { ReversibilityVerdict } from "../../core/types.js";
 import { type BashReadonlyRootBoundary } from "./bash-readonly-classifier.js";
 import { type ShellScanDecline } from "./bash-program-position.js";
+import { type ReadDenyMatcher } from "./read-deny.js";
 /**
  * A parsed-command classifier for the `bash` tool, exposed as a
  * `ToolSpec.reversibilityProbe`. A full shell is treated as egress+irreversible by DEFAULT; this probe is the
@@ -306,12 +307,17 @@ export declare function createBashTool(env: ExecutionEnv, rootCanonical: string,
  * read-only band), so an out-of-root read here is not something to escalate, it is outside what the tool
  * is. It is refused, fail-closed, before anything executes — including the conservative direction, where
  * the operand cannot be resolved statically (there is nothing to degrade to).
+ *
+ * The boundary has TWO halves and this face wires both: roots answer WHERE a command may read and the
+ * allowlist WHICH verb runs, neither answers WHICH FILES are off the table (a deny row holds INSIDE the
+ * roots). The judge is the structured read faces' own, asked at both judging moments; every finding lands
+ * on the standing rule above — a demotion here is a refusal.
  */
 export declare function createBashReadonlyTool(env: ExecutionEnv, rootCanonical: string, allow: ReadonlySet<string>, opts?: {
     /** Same timeout-cap overrides the full `bash` leg takes — see
      *  {@link import("./index.js").HandsToolkitOptions.bashDefaultTimeoutMs} /
-     *  {@link import("./index.js").HandsToolkitOptions.bashMaxTimeoutMs} (类修完整域: both foreground
-     *  legs share runShell's clamp, so both must share the configurable resolution). */
+     *  {@link import("./index.js").HandsToolkitOptions.bashMaxTimeoutMs} — both foreground legs share
+     *  runShell's clamp, so both must share the configurable resolution. */
     bashDefaultTimeoutMs?: number;
     bashMaxTimeoutMs?: number;
     /** Structured sink for the timeout-cap discard announcements — same seat the full `bash` leg
@@ -321,6 +327,9 @@ export declare function createBashReadonlyTool(env: ExecutionEnv, rootCanonical:
      *  canonical). A read this deployment already sanctions for Read/Grep/Glob is equally sanctioned
      *  here — the two faces must not disagree about which directories exist for this session. */
     additionalRoots?: readonly string[];
+    /** The deployment's compiled read deny set — the SAME matcher object the structured read faces of this
+     *  mount hold (one compile, one table). Absent ⇒ no deny judge, and both judging moments are unchanged. */
+    readDeny?: ReadDenyMatcher;
     /** The run's tool-progress sink — the SAME seat the full shell leg takes, for the same reason its
      *  two neighbours above are shared: both foreground legs run through `runShell`, so a long command
      *  must breathe on both or a person watching one of them is told nothing. This face has no detach

package/dist/tools/fs/fs-bash.js

@@ -8,13 +8,14 @@ import { TASK_OUTPUT_TOOL_NAME, TASK_STOP_TOOL_NAME, TASK_OUTPUT_MISSING_ID_MESS
 import { hasBackgroundShell } from "../../core/background-shell.js";
 import { delimitUntrusted } from "../../core/untrusted-text.js";
 import { MCP_IMAGE_MAX_BASE64 } from "../../core/mcp.js";
-import { imageMagicMatches, normalizeAbsPathLexically, withinAnyRoot } from "./safety.js";
+import { imageMagicMatches, normalizeAbsPathLexically, violationDetails, withinAnyRoot } from "./safety.js";
 import { boundaryIsTheSandbox, canonicalPathIsAuthoritative, hasDestroy, isIsolated } from "../../core/remote-env.js";
 import { ghRateLimitHint } from "./gh-rate-limit.js";
 import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, createShellOverflowSpoolFence, shellRecoveryHint, CWD_SENTINEL, stripCwdSentinel, BASH_READONLY_CONFINEMENT_NOTE, } from "./fs-shared.js";
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted } from "../../core/untrusted-text.js";
 import { bashClassifyDefaultAllow, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed, classifyOutOfRootReadGate, refusedCommandMayRead, classifySimpleCommandReadBoundary, } from "./bash-readonly-classifier.js";
 import { NOT_AUTO_ALLOWED, SHELL_SCAN_DECLINES } from "./bash-program-position.js";
+import { readDenySeat } from "./read-deny.js";
 import { toolFace } from "../../core/tool-catalog-entries.js";
 import { thrownText } from "../../core/thrown-value.js";
 const RECURSIVE_CAUSE_MAX_PATHS = 3;
@@ -772,7 +773,10 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
     };
     const canonicalEscape = async (command, signal) => {
         const resolvedBoundary = typeof taskOpts.readBoundary === "function" ? taskOpts.readBoundary() : taskOpts.readBoundary;
-        if (resolvedBoundary === undefined || resolvedBoundary.face === "open")
+        if (resolvedBoundary === undefined)
+            return undefined;
+        const ask = { deny: resolvedBoundary.denyMatch, containment: resolvedBoundary.face !== "open" };
+        if (ask.deny === undefined && !ask.containment)
             return undefined;
         const faces = [
             classifyCompoundReadonlyDetailed(command, recheckReaders, resolvedBoundary),
@@ -781,7 +785,7 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
         const literal = [...new Set(faces.flatMap((v) => [...(v.checkedPaths ?? []), ...(v.checkedSpellings ?? [])]))];
         const asked = new Set(faces.flatMap((v) => v.outOfRootPaths ?? []));
         const patterns = [...new Set(faces.flatMap((v) => [...(v.undecidedPaths ?? []), ...(v.undecidedSpellings ?? [])]))].filter((p) => !asked.has(normalizeAbsPathLexically(p)));
-        return await canonicalEscapeRefusal(canonicalBoundaryFor(resolvedBoundary.roots), { literal, patterns }, resolvedBoundary.roots, FULL_SHELL_FACE_ESCAPE_PROSE, signal);
+        return await canonicalEscapeRefusal(canonicalBoundaryFor(resolvedBoundary.roots), { literal, patterns }, resolvedBoundary.roots, FULL_SHELL_FACE_ESCAPE_PROSE, ask, signal);
     };
     return defineTool({
         name: "Bash",
@@ -1189,6 +1193,7 @@ function createCanonicalReadBoundary(env, readRoots) {
         let frontier = [p.slice(0, segs[first].start).replace(/[\\/]+$/, "") || "/"];
         let dirsUsed = 0;
         let matches = 0;
+        const canonicalOfMatch = new Map();
         for (let j = first; j < segs.length; j++) {
             const seg = segs[j].text;
             if (!GLOB_METACHAR_RE.test(seg)) {
@@ -1222,40 +1227,48 @@ function createCanonicalReadBoundary(env, readRoots) {
                         if (re.test(dot))
                             next.push(joinCandidate(dir, dot));
                 }
-                let dirInside = false;
-                if (isLast) {
-                    if (canonDir !== undefined && !withinAnyRoot(roots, canonDir.value)) {
-                        next.push(canonDir.value);
-                        continue;
-                    }
-                    dirInside = canonDir !== undefined;
-                }
+                const canonDirHere = isLast ? canonDir?.value : undefined;
                 for (const entry of listed.value) {
                     if (!globSegmentMatches(re, seg, entry.name))
                         continue;
                     if (++matches > MAX_GLOB_MATCHES) {
                         return { unverifiable: `"${p}" expands to more than ${MAX_GLOB_MATCHES} names, too many to enumerate to verify` };
                     }
-                    if (isLast && dirInside && entry.kind !== "symlink")
-                        continue;
-                    next.push(joinCandidate(dir, entry.name));
+                    const candidate = joinCandidate(dir, entry.name);
+                    if (canonDirHere !== undefined && entry.kind !== "symlink")
+                        canonicalOfMatch.set(candidate, joinCandidate(canonDirHere, entry.name));
+                    next.push(candidate);
                 }
             }
             frontier = next;
             if (frontier.length === 0)
-                return { paths: [] };
+                return { paths: [], canonical: canonicalOfMatch };
         }
-        return { paths: frontier };
+        return { paths: frontier, canonical: canonicalOfMatch };
     };
     return {
-        escapesAfterResolution: async (paths, signal) => {
+        escapesAfterResolution: async (paths, ask, signal) => {
+            const deny = ask.deny;
             if (lexicalOnly || (paths.literal.length === 0 && paths.patterns.length === 0))
                 return { escaping: [] };
             const roots = await canonicalRoots(signal);
             const escaping = [];
             let unresolvable;
-            const judge = async (p) => {
-                const real = await resolve(p, signal);
+            let denied;
+            const denyHit = (p) => {
+                if (deny === undefined || denied !== undefined)
+                    return false;
+                const folded = normalizeAbsPathLexically(p);
+                const pattern = deny(folded);
+                if (pattern === null)
+                    return false;
+                denied = { path: folded, pattern };
+                return true;
+            };
+            const judge = async (p, canonicalKnown) => {
+                if (denyHit(p))
+                    return;
+                const real = canonicalKnown !== undefined ? { value: canonicalKnown, exact: true } : await resolve(p, signal);
                 if (real === undefined) {
                     if (resolverIsAuthoritative)
                         unresolvable ??= `"${p}" cannot be resolved to verify where it reads`;
@@ -1265,18 +1278,36 @@ function createCanonicalReadBoundary(env, readRoots) {
                     unresolvable ??= `"${p}" cannot be resolved to verify where it reads`;
                     return;
                 }
-                if (!withinAnyRoot(roots, real.value) && !escaping.includes(real.value))
+                if (denyHit(real.value))
+                    return;
+                if (ask.containment && !withinAnyRoot(roots, real.value) && !escaping.includes(real.value))
                     escaping.push(real.value);
             };
-            for (const p of paths.literal)
+            for (const p of paths.literal) {
+                if (denied !== undefined)
+                    break;
                 await judge(p);
+            }
             for (const p of paths.patterns) {
+                if (denied !== undefined)
+                    break;
                 const expanded = await expandGlobCandidate(p, roots, signal);
-                if (expanded !== undefined && "unverifiable" in expanded)
-                    return { escaping, unverifiable: expanded.unverifiable };
-                for (const t of expanded !== undefined && expanded.paths.length > 0 ? expanded.paths : [p])
-                    await judge(t);
+                if (expanded !== undefined && "unverifiable" in expanded) {
+                    unresolvable ??= expanded.unverifiable;
+                    continue;
+                }
+                if (expanded !== undefined && expanded.paths.length > 0) {
+                    for (const t of expanded.paths) {
+                        if (denied !== undefined)
+                            break;
+                        await judge(t, expanded.canonical.get(t));
+                    }
+                }
+                else
+                    await judge(p);
             }
+            if (denied !== undefined)
+                return { escaping, denied };
             return unresolvable === undefined ? { escaping } : { escaping, unverifiable: unresolvable };
         },
         canonicalOf: async (path, signal) => {
@@ -1300,19 +1331,33 @@ function createCanonicalReadBoundary(env, readRoots) {
         },
     };
 }
-async function canonicalEscapeRefusal(canonical, candidates, readRoots, face, signal) {
-    const resolved = await canonical.escapesAfterResolution(candidates, signal);
+async function canonicalEscapeRefusal(canonical, candidates, readRoots, face, ask, signal) {
+    const resolved = await canonical.escapesAfterResolution(candidates, ask, signal);
+    if (resolved.denied !== undefined) {
+        return readDenyRefusal(resolved.denied.path, resolved.denied.pattern);
+    }
     if (resolved.unverifiable !== undefined) {
-        return errorResult(`Error (Bash): ${resolved.unverifiable}, so this command cannot be confirmed to read only inside the allowed directories for this session: ${readRoots.join(", ")}. ` +
-            face.note, { type: "readonly_out_of_root", code: "readonly_out_of_root", paths: [] });
+        return readContainmentRefusal(`Error (Bash): ${resolved.unverifiable}, so this command cannot be confirmed to read only inside the allowed directories for this session: ${readRoots.join(", ")}. ` +
+            face.note);
     }
     if (resolved.escaping.length > 0) {
         const quoted = resolved.escaping.map((p) => `"${p}"`).join(", ");
-        return errorResult(`Error (Bash): ${face.subject} resolves through a symlink to ${quoted}, outside the allowed directories for this session: ${readRoots.join(", ")}${face.verdictPhrase}. ` +
-            face.note, { type: "readonly_out_of_root", code: "readonly_out_of_root", paths: resolved.escaping });
+        return readContainmentRefusal(`Error (Bash): ${face.subject} resolves through a symlink to ${quoted}, outside the allowed directories for this session: ${readRoots.join(", ")}${face.verdictPhrase}. ` +
+            face.note, resolved.escaping);
     }
     return undefined;
 }
+const DENY_REFUSAL_NOTE = "The read boundary judges this command's written spelling and, where a filesystem can be consulted, the " +
+    "paths it would actually read; a deny-listed read is refused here rather than escalated.";
+function readContainmentRefusal(content, paths = []) {
+    return errorResult(content, { type: "readonly_out_of_root", code: "readonly_out_of_root", paths });
+}
+function readDenyRefusal(target, pattern) {
+    const content = `Error (Bash): reading "${target}" is refused: the target matches the sensitive-path ` +
+        `read deny list (pattern "${pattern}"). This list guards credential-class paths and ` +
+        `applies regardless of the containment roots. ${DENY_REFUSAL_NOTE}`;
+    return errorResult(content, violationDetails({ code: "read_path_denied", message: content, target, pattern }));
+}
 const READONLY_FACE_ESCAPE_PROSE = {
     subject: "a path this command reads",
     verdictPhrase: ` ${NOT_AUTO_ALLOWED}`,
@@ -1328,6 +1373,8 @@ export function createBashReadonlyTool(env, rootCanonical, allow, opts) {
     const timeoutCapsSecView = bashTimeoutCapsSec(timeoutCaps);
     const sample = [...allow].slice(0, 6).join(", ");
     const readRoots = [rootCanonical, ...(opts?.additionalRoots ?? [])];
+    const denySeat = readDenySeat(opts?.readDeny);
+    const readBoundary = { roots: readRoots, cwd: rootCanonical, ...denySeat };
     const overflowSpoolFence = createShellOverflowSpoolFence(env);
     const readsOnlyEngineOverflowSpool = async (verdict) => {
         if (verdict.outOfRootRead !== true)
@@ -1339,6 +1386,9 @@ export function createBashReadonlyTool(env, rootCanonical, allow, opts) {
             return false;
         for (const p of [...paths, ...(verdict.outOfRootSpellings ?? [])]) {
             const real = await canonicalBoundary.canonicalOf(p);
+            for (const view of [real, p])
+                if (view !== undefined && denySeat.denyMatch?.(normalizeAbsPathLexically(view)) != null)
+                    return false;
             if (!(await overflowSpoolFence(real ?? p)))
                 return false;
         }
@@ -1366,17 +1416,30 @@ export function createBashReadonlyTool(env, rootCanonical, allow, opts) {
             const reason = coarseReadonlyCheck(command, allow);
             if (reason)
                 return errorResult(`Error (Bash): ${reason}`);
-            const boundary = classifySimpleCommandReadBoundary(command, { roots: readRoots, cwd: rootCanonical });
+            const boundary = classifySimpleCommandReadBoundary(command, readBoundary);
+            let releasedByGrant = [];
+            if (boundary.readDeniedPath !== undefined && boundary.readDeniedPattern !== undefined)
+                return readDenyRefusal(boundary.readDeniedPath, boundary.readDeniedPattern);
+            const traversal = boundary.recursiveReadPaths ?? [];
+            if (traversal.length > 0) {
+                const shown = traversal.slice(0, RECURSIVE_CAUSE_MAX_PATHS);
+                return readContainmentRefusal(`Error (Bash): this lexical check cannot bound what a recursive read form in this command traverses, and a deny list is in force — ` +
+                    `${traversal.length} path(s) taken as traversal roots: ${shown.join(", ")}${traversal.length > shown.length ? `, and ${traversal.length - shown.length} more` : ""}. ` +
+                    `Use the Grep tool to search a directory tree — it applies the same deny list to every file it reads. ` +
+                    `${BASH_READONLY_CONFINEMENT_NOTE}`);
+            }
             if (boundary.reason !== undefined) {
                 const rescueCandidates = [...(boundary.outOfRootPaths ?? []), ...(boundary.outOfRootSpellings ?? [])];
                 const rescued = boundary.outOfRootRead === true &&
                     (boundary.unresolvedOperands ?? []).length === 0 &&
                     (await canonicalBoundary.allResolveInside(rescueCandidates, ctx.signal));
+                if (rescued)
+                    releasedByGrant = rescueCandidates;
                 if (!rescued && !(await readsOnlyEngineOverflowSpool(boundary))) {
-                    return errorResult(`Error (Bash): ${boundary.reason}. ${BASH_READONLY_CONFINEMENT_NOTE}`, { type: "readonly_out_of_root", code: "readonly_out_of_root", paths: boundary.outOfRootPaths ?? [] });
+                    return readContainmentRefusal(`Error (Bash): ${boundary.reason}. ${BASH_READONLY_CONFINEMENT_NOTE}`, boundary.outOfRootPaths ?? []);
                 }
             }
-            const escape = await canonicalEscapeRefusal(canonicalBoundary, { literal: [...(boundary.checkedPaths ?? []), ...(boundary.checkedSpellings ?? [])], patterns: [...(boundary.undecidedPaths ?? []), ...(boundary.undecidedSpellings ?? [])] }, readRoots, READONLY_FACE_ESCAPE_PROSE, ctx.signal);
+            const escape = await canonicalEscapeRefusal(canonicalBoundary, { literal: [...(boundary.checkedPaths ?? []), ...(boundary.checkedSpellings ?? []), ...releasedByGrant], patterns: [...(boundary.undecidedPaths ?? []), ...(boundary.undecidedSpellings ?? [])] }, readRoots, READONLY_FACE_ESCAPE_PROSE, { deny: denySeat.denyMatch, containment: true }, ctx.signal);
             if (escape !== undefined)
                 return escape;
             const readOnlyTick = opts?.onToolProgress === undefined ? undefined : (t) => describeSafely(opts.onToolProgress, { toolCallId: ctx.toolCallId, toolName: "Bash", ...t });

package/dist/tools/fs/index.d.ts

@@ -46,7 +46,8 @@ export interface HandsToolkitOptions {
      *  (see `createBashTool`'s `readBoundary`). The caller passes the SAME seat it gives the gate's shell
      *  probes, so the boundary that judges a command's written spelling before approval and the leg that
      *  re-judges its symlink-resolved targets before execution are one declaration. Ignored in `readOnly`
-     *  mode — `bash_readonly` builds its own from the roots it is confined to.
+     *  mode — `bash_readonly` builds its own: containment from the roots it is confined to, DENY from the same
+     *  compiled table this band hands the structured read faces.
      *
      *  ABSENT ⇒ the leg does not run and costs no I/O: with no boundary declared there is no "outside" for
      *  a read to be outside of, which is the same reading the probe seats take of an absent boundary. It

package/dist/tools/fs/index.js

@@ -72,6 +72,7 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
                 ...(opts.bashMaxTimeoutMs !== undefined ? { bashMaxTimeoutMs: opts.bashMaxTimeoutMs } : {}),
                 ...(opts.onNotice !== undefined ? { onNotice: opts.onNotice } : {}),
                 ...(readFaceRoots !== undefined ? { additionalRoots: readFaceRoots } : {}),
+                readDeny,
                 ...(opts.onToolProgress !== undefined ? { onToolProgress: opts.onToolProgress } : {}),
             })
             : createBashTool(env, rootCanonical, commitCoAuthor, cwdRef, {

package/dist/tools/fs/read-deny.d.ts

@@ -61,6 +61,20 @@ export interface ReadDenyMatcher {
      *  matching the deny list exist under the scope and were excluded). */
     readonly rgProbeGlobs: readonly ReadDenyRgGlob[];
 }
+/** The DENY HALF of a shell read boundary, in the shape `BashReadonlyRootBoundary` declares it (structural:
+ *  this module is the leaf every face depends on). `denyMatch` judges one LEXICALLY RESOLVED operand,
+ *  returning the matched pattern or null; PRESENT-IFF there is something to judge. */
+export interface ReadDenySeat {
+    denyMatch?: (resolvedPath: string) => string | null;
+    denyEntries: readonly string[];
+}
+/** The ONE adapter from a compiled matcher to that seat, so every face mounts it the SAME way and the "wire
+ *  the judge only when it has something to judge" rule is spelled once. That rule is load-bearing: the
+ *  seat's PRESENCE is itself read as a fact (the recursive-read demotion mints on "a deny judge is wired" =
+ *  the check a traversal would outflank is in place), so a judge over an EMPTY set must not be wired. Call
+ *  ONCE per mount and reuse the result — the returned closure is then the function OBJECT every face mounted
+ *  from that matcher shares, which makes "the same judge" checkable rather than argued. */
+export declare function readDenySeat(matcher: ReadDenyMatcher | undefined): ReadDenySeat;
 /**
  * The closed set of built-in tiers. A tier is the deployment's selection unit
  * ({@link ReadDenyBuiltinConfig.tiers}); every {@link READ_FACE_BUILTIN_DENY_TABLE} row belongs to

package/dist/tools/fs/read-deny.js

@@ -1,3 +1,9 @@
+export function readDenySeat(matcher) {
+    const entries = (matcher?.entries ?? []).map((e) => e.pattern);
+    if (matcher === undefined || entries.length === 0)
+        return { denyEntries: entries };
+    return { denyMatch: (p) => matcher.matchPath(p)?.pattern ?? null, denyEntries: entries };
+}
 export const READ_DENY_BUILTIN_TIERS = ["credentials", "shell-history", "browser", "wallet", "agent-config"];
 export const READ_FACE_BUILTIN_DENY_TABLE = [
     { pattern: ".ssh", tier: "credentials" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.23.2",
+  "version": "7.23.4",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.23.3.json

@@ -0,0 +1,25 @@
+{
+  "repo": "core",
+  "version": "7.23.3",
+  "from": "b48d37a658cfaa46695e76339021dc1226a9ba57",
+  "to": "v7.23.3",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@bef85633 server@1da4e102 sdk@0a6aeb7 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "912d7792e95edd36fb9b6bb68866661ac36f7f6a"
+}

package/wire-changes/core@7.23.4.json

@@ -0,0 +1,58 @@
+{
+  "repo": "core",
+  "version": "7.23.4",
+  "from": "141b1687631b53cf2998a56c7541bb4aab5ca9af",
+  "to": "v7.23.4",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING, the `bash_readonly` read-only shell face (`handsReadOnly`), deployments with a deny judge wired (#937 = sema-internal #67, P1; stock since design/199 — measured identical on 7.22.0 and 7.23.3): ONE deny judge for every read face. The v1 exception that kept `denyMatch` off the read-only shell face is retired: `readDenySeat()` (`src/tools/fs/read-deny.ts`) is the single adapter from the compiled deny set to a boundary's deny half, mounted by the structured read faces and now by `bash_readonly` at both of its judging moments — the lexical verdict and the execute-time recheck (`src/tools/fs/fs-bash.ts`, `{ deny: denySeat.denyMatch, containment: true }`). One mint for the deny refusal (`readDenyRefusal`) and one for the containment refusal (`readContainmentRefusal`). A containment GRANT (root rescue, overflow-spool recovery) answers containment only, never deny (codex r1/r2). Rules −4. WHO NEEDS IT: a deployment that mounts the read-only shell (server autonomy read-only tier) AND configures `readDenyPatterns` / `READ_DENY_BUILTIN_TIERS` — until now `cat .env` ran there at zero cards with the bytes returned. WHO IS AFFECTED: (a) on that face, a deny-listed read is REFUSED (`read_path_denied`, naming the pattern) — named spelling, glob, symlink target, and a recursive walk that would enter a deny row; (b) a recursive verb (`grep -r <needle> .`) on such a deployment is refused as a whole with the Grep tool named as the way out (KL-937b); (c) a bracket-named glob spelling may over-fire fail-closed (KL-937a). Deployments with no deny judge: byte-identical on this face; the full Bash face: unchanged (contrast column pinned)."
+    }
+  ],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [
+    {
+      "type": "CompoundReadonlyVerdict",
+      "at": [
+        "src/tools/fs/bash-readonly-classifier.ts:644"
+      ],
+      "added": [
+        "readDeniedPath",
+        "readDeniedPattern"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.isError",
+      "assertions": [
+        "G1.a",
+        "G1.b"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [
+      "CompoundReadonlyVerdict"
+    ],
+    "server": [
+      "CompoundReadonlyVerdict"
+    ],
+    "sdk": [],
+    "note": "scanned cli@4e3b6980 server@866e273b sdk@0a6aeb7 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "2a5d3b7f6c6d633510d8866e95d66e7b2b85446a"
+}