@sema-agent/core 7.23.3 → 7.23.4

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 7.23.4 — 2026-09-19
+
+### Read boundary — one deny judge for every read face: the `bash_readonly` shell wires the same seat (#937; P1; design/199 v1 exception retired; @server @cli)
+- **Before.** Under `handsReadOnly:true` (the mount that carries `bash_readonly` and no write faces at all) a wired `readDenyPatterns` table judged NOTHING on the shell face. Measured on `563c1e45` with `["**/.env","**/secrets/**"]`: `cat .env`, `cat .en?`, `grep -r <needle> .` and `grep -r <needle> secrets` each cost ZERO cards and each returned the guarded file's bytes — in the headless and the wired-approver deployment alike. The SAME deployment on the full Bash face mandates an ask for every one of them. The cause was one carve-out stated in three places (design/199 v1): this face's roots containment plus its reader allowlist were ruled to BE the deployment's read-safety declaration, so it wired no deny seat — neither on the boundary it classifies with nor on its own execute-time canonical recheck's `ask`.
+- **After — the exception is retired, and it is one rule fewer.** Roots answer WHERE a command may read; the allowlist answers WHICH verb runs; neither answers WHICH FILES are off the table, and a deny row holds INSIDE the roots by definition — so the carve-out did not narrow the table on read-only mounts, it deleted it. The face now holds ONE boundary for BOTH of its judging moments (the pre-execution classify walk and the canonical recheck), assembled once per mount from the SAME compiled matcher `createHandsToolkit` hands Read/Grep/Glob/RepoMap. No read-only-face branch was added: the classify call takes the boundary it always took with its deny half filled in, and the recheck's `ask` is the same `{ deny, containment }` pair the full shell's leg asks. Rules: −1 face exception, −1 seat-wiring spelling (`readDenySeat`, the one adapter from a compiled matcher to the boundary's deny half, now used by `prepare-hands-readface` too), −1 card spelling (`readDenyRefusal`, the one `read_path_denied` mint for both passes).
+- **Every finding lands on the rule this face already had.** It has no approval channel, so a demotion is a refusal: a judge MATCH refuses with the fs boundary's own `read_path_denied` card (target + pattern, whichever pass caught it — minting a deny finding as `readonly_out_of_root` would tell a consumer the read left the roots); a contents-disclosing recursive form under a wired judge (`recursiveReadPaths` — `grep -r/-R`, `diff -r`, and `rg`/`ag`/`ack`/`tar c` where a deployment allowlists them) is the face's UNESTABLISHABLE arm, the same finding as a pattern the expander cannot enumerate, and carries the same `readonly_out_of_root` code with the check's own sentence. Names-only traversals (`ls -R`, `du`, `find`, `tree`) mint no such finding and are unmoved.
+- **Reach.** `TaskSpec.handsReadOnly` mounts + a non-empty deny set (task `readDenyPatterns`, deployment `readDenyPatterns`, or an active built-in tier). With NO deny set wired the judge is not mounted at all and both judging moments are byte-identical — including `grep -r`, whose demotion is minted only under a wired judge. In-root ordinary reads, in-root globs, the containment refusals (#775 / RB-413) and the full Bash face's answers are all unmoved; `test/backlog937-readonly-face-deny-judge.test.ts` pins the contrast column.
+- **Ops.** A deployment that configures a read deny table AND mounts a read-only band (server's autonomy read-only lane; plan-mode research turns; verifier runs) will see its read-only shell REFUSE a read of a deny-listed file where it previously executed silently, and refuse `grep -r`-family commands while that table is in force. The refusals name the matched pattern (match arm) or the traversal roots the check took (traversal arm). No deny table ⇒ no change.
+- **A second leak of the same shape, found by the adversarial round and confirmed by construction.** This face RESCUES a containment refusal when every out-of-root candidate canonicalizes back INSIDE the roots (the aliased-root case, `/tmp` → `/private/tmp`) — and the released operand rode `outOfRootPaths`, which the execute-time leg is handed neither as a literal nor as a pattern. So a proof about WHERE a read lands stood in for the question of WHICH file it is: `cat <outside>/alias/notes.txt`, where `notes.txt` is a symlink to a deny-listed file, ran at zero cards. The full shell's leg may drop what the boundary raised — there a PERSON answered it — and nobody is asked here, so the rescued candidates now go back through the same leg. The rescue itself is unchanged (pinned in both directions). The overflow-spool exemption is deliberately NOT collected: those paths are outside the roots by construction, and the containment half would refuse the engine's own recovery file.
+- **The second grant site, from the adversarial round's round 2.** This face also grants itself a read of its OWN truncated-output file (the result trailer advertises `tail -c … <file>`), and that grant answered containment only. A deployment whose deny table names the engine's recovery spelling had a route out of the boundary: an out-of-root operand with an innocent name whose canonical target is the spool file clears the lexical table, fails the root rescue, and passes the fence. Both grant sites now obey ONE rule — **a grant answers containment, never the deny half** — and the recovery route itself is unchanged wherever no row names it (pinned in both directions). Rules: −1 (the two grant arms had two different downstream obligations; now one).
+- **One accepted over-fire, declared.** Released candidates enter the leg as LITERALS, and an operand carrying a bracket metacharacter is reported by the classifier as both a candidate and a pattern — so a real file literally named `[ab].txt` that links out of the roots is judged although bash would expand the word instead. Fail-CLOSED, and the same family as the over-fires this leg's scope note already declares. Subtracting the pattern spellings instead would drop the QUOTED occurrence of the same word, which is a real read, and fail open; provenance per OCCURRENCE rather than per de-duplicated path is what would answer both, and no consumer carries it today.
+- **Precedence, stated honestly.** Deny outranks containment among the findings ONE pass has in hand; it is not a promise across passes. A command the lexical pass refuses on containment (or on the traversal arm) keeps that sentence even where a later canonical resolution would have found a deny row on some other operand. Every such command is refused either way; only the account differs.
+- **Contract sentences changed:** `TaskSpec.readDenyPatterns` now names `bash_readonly` among the judged faces; `read-deny.ts`'s scope note says every read face rather than the structured ones; `BashReadonlyRootBoundary.denyMatch` / `CompoundReadonlyVerdict.recursiveReadPaths` / the `DENY_REFUSAL_NOTE` single-spelling note all retire their v1-ruling clauses. `CompoundReadonlyVerdict` gains `readDeniedPath` / `readDeniedPattern` (present-iff `readDenied`, the `outOfRootRead`/`outOfRootPaths` idiom) so a consumer names the target without re-parsing prose — additive, breaking 0.
+
 ## 7.23.3 — 2026-09-19
 
 ### Read boundary — an operand the shell EXPANDS is judged by the deployment's deny judge, at the one moment the expansion exists (#934; P1; execute-time recheck; @cli @server @client-core)

package/dist/core/runner/prepare-hands-readface.js

@@ -3,7 +3,7 @@ import { StubExecutionEnv } from "../stub-env.js";
 import { hasBackgroundShell } from "../background-shell.js";
 import { boundaryIsTheSandbox } from "../remote-env.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { bashReadBoundaryProbe, bashReversibilityProbe, activeReadDenyBuiltinTiers, compileReadDeny, createHandsToolkit, deploymentFaceClampNotice, pdfModelCapabilitiesOf, inheritSessionReadFileState, resolveContainmentFace, seedReadFileStateFromContext, seedReadFileStateFromTranscript, } from "../../tools/fs/index.js";
+import { bashReadBoundaryProbe, bashReversibilityProbe, activeReadDenyBuiltinTiers, compileReadDeny, readDenySeat, createHandsToolkit, deploymentFaceClampNotice, pdfModelCapabilitiesOf, inheritSessionReadFileState, resolveContainmentFace, seedReadFileStateFromContext, seedReadFileStateFromTranscript, } from "../../tools/fs/index.js";
 import { resolveKey, sha256 } from "../../tools/fs/safety.js";
 import { normalizeFileText } from "../../tools/fs/encoding.js";
 import { wholeFileRecordsFromTranscript } from "./session-file-state-replay.js";
@@ -327,16 +327,12 @@ export async function prepareHandsMount(input) {
                         sessionSeats.reanchor(sessionId, readFileState, ownCommittedTailEntryId);
                 }
                 : undefined;
-        const compiledDeny = readDenyMatcher;
-        const denySeatJudge = compiledDeny !== undefined && compiledDeny.entries.length > 0
-            ? (p) => compiledDeny.matchPath(p)?.pattern ?? null
-            : undefined;
+        const denySeat = readDenySeat(readDenyMatcher);
         const shellReadBoundary = () => ({
             roots: [rootCanonical, ...additionalRootsCanonical, ...additionalReadRootsCanonical],
             ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}),
             ...(executionEnv.homeDir !== undefined ? { homeDir: executionEnv.homeDir } : {}),
-            ...(denySeatJudge !== undefined ? { denyMatch: denySeatJudge } : {}),
-            denyEntries: (compiledDeny?.entries ?? []).map((e) => e.pattern),
+            ...denySeat,
             ...(resolvedReadFace !== undefined ? { face: resolvedReadFace } : {}),
         });
         const band = createHandsToolkit(executionEnv, readFileState, rootCanonical, {

package/dist/core/task-spec.d.ts

@@ -784,7 +784,8 @@ export interface TaskSpec {
      * design/199 件B — TASK-layer ADDITIONS to the built-in sensitive-path READ deny set
      * ({@link import("../tools/fs/read-deny.js").READ_FACE_DEFAULT_DENY_ENTRIES}). Judged by the
      * structured read faces (Read/Grep/Glob/RepoMap, their traversals, the classify shell gate's
-     * auto-allow probe and the compaction attachment reader) in BOTH containment modes. Add-only at
+     * auto-allow probe, the compaction attachment reader and the `bash_readonly` shell mounted by
+     * {@link handsReadOnly} — one deny judge for every read face) in BOTH containment modes. Add-only at
      * the task layer: entries here UNION with the active built-ins and the deployment's
      * {@link RunnerDeps.readDenyPatterns}; `[]` ≡ absent (union identity); NOTHING at the task layer
      * can remove a built-in — the one removal channel is the DEPLOYMENT's built-in configuration

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -272,28 +272,24 @@ export interface BashReadonlyRootBoundary {
      *  and demotes (with no out-of-root signal — the classifier does not know where it points, which is a
      *  different verdict from knowing it points outside). */
     homeDir?: string;
-    /** The sensitive-path read deny judge over LEXICALLY RESOLVED operands: a hit
-     *  demotes the command (ask, never auto-allow), independently of the roots — in-root operands are
-     *  judged too. Returns the matched pattern, or null. TWO named residuals, both inherited from this
-     *  classifier's declared purity (synchronous, zero I/O — the same scope stated for the
-     *  containment half): ① operand TARGET matching only — no ancestor intersection: the judge sees
-     *  the operand's own resolved spelling, never its subtree. The RECURSIVE-reach half of that
-     *  residual has since been narrowed: a listed recursive/expanding verb's path
-     *  operand under this wired seat rides {@link CompoundReadonlyVerdict.recursiveReadPaths}
-     *  (⊂ undecidedPaths), so `grep -r x ~/` no longer auto-allows — it demotes to ask through the
-     *  undecided contract. What REMAINS of ① is the form table's stated open set (see the KNOWN OPEN
-     *  SET note at {@link RECURSIVE_READ_FORMS}: a traversal verb absent there that a deployment
-     *  allowlists classifies by its ordinary form and can auto-run a traversal unjudged);
-     *  ② LEXICAL only HERE — an in-root symlink whose target is a
-     *  guarded path reads as its innocent spelling at this seat, exactly as it does for the containment half,
-     *  because the classify auto-allow lane has no I/O seat by contract. The CANONICAL view is judged by the
-     *  full shell's execute-time recheck, which asks THIS judge (the same function object, forwarded) where
-     *  each candidate really lands — a `checkedPaths` literal and a `undecidedPaths` pattern's expansions
-     *  alike. The `bash_readonly` face wires no deny seat at all, so its own recheck carries nothing. The structured read faces judge BOTH
-     *  views (canonical + lexical); what this seat is and is not is stated once, at
-     *  `shell.read_boundary.friction_floor`. The `bash_readonly` face deliberately does NOT wire this seat (its
-     *  roots containment + command allowlist double gate is the deployment's own read-safety
-     *  declaration — v1 ruling). */
+    /** The sensitive-path read deny judge over LEXICALLY RESOLVED operands: a hit demotes the command (ask,
+     *  never auto-allow), independently of the roots — in-root operands are judged too. Returns the matched
+     *  pattern, or null. TWO named residuals, both inherited from this classifier's declared purity
+     *  (synchronous, zero I/O — the same scope stated for the containment half): ① operand TARGET matching
+     *  only, no ancestor intersection: the judge sees the operand's own resolved spelling, never its subtree.
+     *  The RECURSIVE-reach half of ① is narrowed — a listed recursive verb's path operand under this wired
+     *  seat rides {@link CompoundReadonlyVerdict.recursiveReadPaths} (⊂ undecidedPaths), so `grep -r x ~/` no
+     *  longer auto-allows; what REMAINS is the form table's stated open set (the KNOWN OPEN SET note at
+     *  {@link RECURSIVE_READ_FORMS}: a traversal verb absent there that a deployment allowlists classifies by
+     *  its ordinary form and can auto-run a traversal unjudged). ② LEXICAL only HERE — an in-root symlink
+     *  whose target is guarded reads as its innocent spelling at this seat, as it does for the containment
+     *  half, because the classify auto-allow lane has no I/O seat by contract; the CANONICAL view is judged by
+     *  an execute-time recheck that asks THIS judge (the same function object, forwarded) where each candidate
+     *  really lands, on a `checkedPaths` literal and a pattern's expansions alike.
+     *  EVERY read face wires this one seat, the `bash_readonly` shell included, at BOTH of its judging
+     *  moments — roots answer WHERE a command may read and the allowlist WHICH verb runs, neither answers
+     *  WHICH FILES are off the table. What this seat is and is not is stated once, at
+     *  `shell.read_boundary.friction_floor`. */
     denyMatch?: (resolvedPath: string) => string | null;
     /** What the wired {@link denyMatch} judge would apply — the ACTIVE deny patterns. Read for ONE question:
      *  is there anything for a traversal to defeat? EMPTY ⇒ the judge refuses nothing, so a walk under it
@@ -333,6 +329,10 @@ export interface CompoundReadonlyVerdict {
      *  reads it to mint `mandated` — a stored allow rule or the read-only shell arm may retire a classify-
      *  tier question, never one the read face itself asked. Structural sibling of `outOfRootRead`. */
     readDenied?: true;
+    /** The matched operand (resolved spelling) and the pattern — present iff {@link readDenied} (the
+     *  `outOfRootRead`/`outOfRootPaths` idiom), so a refusal CARD names the target without parsing prose. */
+    readDeniedPath?: string;
+    readDeniedPattern?: string;
     /**
      * The paths this scan resolved INSIDE the roots (de-duplicated, first-seen order), i.e. the
      * candidates a caller holding a filesystem should re-check with symlinks resolved. Absent when there
@@ -419,20 +419,19 @@ export interface CompoundReadonlyVerdict {
     /**
      * Operands of a RECURSIVE/EXPANDING read form (`grep -r`, `ls -R`, `du`, … — see
      * {@link RECURSIVE_READ_FORMS}) judged with a {@link BashReadonlyRootBoundary.denyMatch} seat wired.
-     * The deny judge sees only the operand's own resolved spelling, but a recursive verb reads the
-     * operand's whole SUBTREE — `grep -r x /home/user` touches `/home/user/.ssh/*` while the judged
-     * spelling `/home/user` matches no deny pattern. The traversal's reach set is therefore not covered
-     * by the lexical check at all, and with zero I/O "provably not a directory" does not exist — so
-     * every such operand is UNDECIDED (no directory guessing, no bounded pre-check: both would be a
-     * false "resolved, inside" of exactly the kind {@link undecidedPaths} exists to prevent).
+     * The judge sees only the operand's own resolved spelling, but a recursive verb reads the operand's whole
+     * SUBTREE — `grep -r x /home/user` touches `/home/user/.ssh/*` while the judged spelling matches nothing.
+     * The traversal's reach set is therefore not covered by the lexical check at all, and with zero I/O
+     * "provably not a directory" does not exist — so every such operand is UNDECIDED (no directory guessing,
+     * no bounded pre-check: both would be a false "resolved, inside" of exactly the kind
+     * {@link undecidedPaths} exists to prevent).
      *
-     * Subset of {@link undecidedPaths} (same consumer contract: ask, never auto-allow); carried
-     * separately so a consumer minting prose can name the recursive-reach cause rather than the glob
-     * one. Minted ONLY when `denyMatch` is wired: without a deny judge there is nothing the traversal
-     * bypasses — the containment half already judges the operand itself, and its lexical residuals are
-     * recorded on {@link checkedPaths}. The `bash_readonly` face never wires `denyMatch` (v1 ruling,
-     * see that seat's note), so this field never appears there and its expand-and-verify execution
-     * path is unchanged.
+     * Subset of {@link undecidedPaths} (same consumer contract: ask, never auto-allow); carried separately so
+     * a consumer minting prose can name the recursive-reach cause rather than the glob one. Minted ONLY when
+     * `denyMatch` is wired: without a judge there is nothing the traversal bypasses. EVERY face wiring the
+     * seat sees this field, the `bash_readonly` shell included, and answers it by its OWN rule for a demotion
+     * — that face has no approval channel, so what it cannot establish it REFUSES (an unbounded traversal is
+     * the same "the read set is not in the text" finding as a pattern the expander cannot enumerate).
      */
     recursiveReadPaths?: readonly string[];
     /**

package/dist/tools/fs/bash-readonly-classifier.js

@@ -2171,6 +2171,8 @@ function evaluateReadBoundary(foldedSegments, boundary, mintGrantCandidate, reac
                     return {
                         reason: `a command operand resolves to "${finding.path}", which matches the sensitive-path read deny list (pattern "${denied}") ${NOT_AUTO_ALLOWED}`,
                         readDenied: true,
+                        readDeniedPath: finding.path,
+                        readDeniedPattern: denied,
                     };
                 }
                 if (finding.kind === "inside") {

package/dist/tools/fs/fs-bash.d.ts

@@ -4,6 +4,7 @@ import { type CwdRef } from "./fs-shared.js";
 import type { ReversibilityVerdict } from "../../core/types.js";
 import { type BashReadonlyRootBoundary } from "./bash-readonly-classifier.js";
 import { type ShellScanDecline } from "./bash-program-position.js";
+import { type ReadDenyMatcher } from "./read-deny.js";
 /**
  * A parsed-command classifier for the `bash` tool, exposed as a
  * `ToolSpec.reversibilityProbe`. A full shell is treated as egress+irreversible by DEFAULT; this probe is the
@@ -306,12 +307,17 @@ export declare function createBashTool(env: ExecutionEnv, rootCanonical: string,
  * read-only band), so an out-of-root read here is not something to escalate, it is outside what the tool
  * is. It is refused, fail-closed, before anything executes — including the conservative direction, where
  * the operand cannot be resolved statically (there is nothing to degrade to).
+ *
+ * The boundary has TWO halves and this face wires both: roots answer WHERE a command may read and the
+ * allowlist WHICH verb runs, neither answers WHICH FILES are off the table (a deny row holds INSIDE the
+ * roots). The judge is the structured read faces' own, asked at both judging moments; every finding lands
+ * on the standing rule above — a demotion here is a refusal.
  */
 export declare function createBashReadonlyTool(env: ExecutionEnv, rootCanonical: string, allow: ReadonlySet<string>, opts?: {
     /** Same timeout-cap overrides the full `bash` leg takes — see
      *  {@link import("./index.js").HandsToolkitOptions.bashDefaultTimeoutMs} /
-     *  {@link import("./index.js").HandsToolkitOptions.bashMaxTimeoutMs} (类修完整域: both foreground
-     *  legs share runShell's clamp, so both must share the configurable resolution). */
+     *  {@link import("./index.js").HandsToolkitOptions.bashMaxTimeoutMs} — both foreground legs share
+     *  runShell's clamp, so both must share the configurable resolution. */
     bashDefaultTimeoutMs?: number;
     bashMaxTimeoutMs?: number;
     /** Structured sink for the timeout-cap discard announcements — same seat the full `bash` leg
@@ -321,6 +327,9 @@ export declare function createBashReadonlyTool(env: ExecutionEnv, rootCanonical:
      *  canonical). A read this deployment already sanctions for Read/Grep/Glob is equally sanctioned
      *  here — the two faces must not disagree about which directories exist for this session. */
     additionalRoots?: readonly string[];
+    /** The deployment's compiled read deny set — the SAME matcher object the structured read faces of this
+     *  mount hold (one compile, one table). Absent ⇒ no deny judge, and both judging moments are unchanged. */
+    readDeny?: ReadDenyMatcher;
     /** The run's tool-progress sink — the SAME seat the full shell leg takes, for the same reason its
      *  two neighbours above are shared: both foreground legs run through `runShell`, so a long command
      *  must breathe on both or a person watching one of them is told nothing. This face has no detach

package/dist/tools/fs/fs-bash.js

@@ -15,6 +15,7 @@ import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bash
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted } from "../../core/untrusted-text.js";
 import { bashClassifyDefaultAllow, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed, classifyOutOfRootReadGate, refusedCommandMayRead, classifySimpleCommandReadBoundary, } from "./bash-readonly-classifier.js";
 import { NOT_AUTO_ALLOWED, SHELL_SCAN_DECLINES } from "./bash-program-position.js";
+import { readDenySeat } from "./read-deny.js";
 import { toolFace } from "../../core/tool-catalog-entries.js";
 import { thrownText } from "../../core/thrown-value.js";
 const RECURSIVE_CAUSE_MAX_PATHS = 3;
@@ -1333,24 +1334,30 @@ function createCanonicalReadBoundary(env, readRoots) {
 async function canonicalEscapeRefusal(canonical, candidates, readRoots, face, ask, signal) {
     const resolved = await canonical.escapesAfterResolution(candidates, ask, signal);
     if (resolved.denied !== undefined) {
-        const content = `Error (Bash): reading "${resolved.denied.path}" is refused: the target matches the sensitive-path ` +
-            `read deny list (pattern "${resolved.denied.pattern}"). This list guards credential-class paths and ` +
-            `applies regardless of the containment roots. ${DENY_REFUSAL_NOTE}`;
-        return errorResult(content, violationDetails({ code: "read_path_denied", message: content, target: resolved.denied.path, pattern: resolved.denied.pattern }));
+        return readDenyRefusal(resolved.denied.path, resolved.denied.pattern);
     }
     if (resolved.unverifiable !== undefined) {
-        return errorResult(`Error (Bash): ${resolved.unverifiable}, so this command cannot be confirmed to read only inside the allowed directories for this session: ${readRoots.join(", ")}. ` +
-            face.note, { type: "readonly_out_of_root", code: "readonly_out_of_root", paths: [] });
+        return readContainmentRefusal(`Error (Bash): ${resolved.unverifiable}, so this command cannot be confirmed to read only inside the allowed directories for this session: ${readRoots.join(", ")}. ` +
+            face.note);
     }
     if (resolved.escaping.length > 0) {
         const quoted = resolved.escaping.map((p) => `"${p}"`).join(", ");
-        return errorResult(`Error (Bash): ${face.subject} resolves through a symlink to ${quoted}, outside the allowed directories for this session: ${readRoots.join(", ")}${face.verdictPhrase}. ` +
-            face.note, { type: "readonly_out_of_root", code: "readonly_out_of_root", paths: resolved.escaping });
+        return readContainmentRefusal(`Error (Bash): ${face.subject} resolves through a symlink to ${quoted}, outside the allowed directories for this session: ${readRoots.join(", ")}${face.verdictPhrase}. ` +
+            face.note, resolved.escaping);
     }
     return undefined;
 }
-const DENY_REFUSAL_NOTE = "The read boundary judged this command's written spelling before the call was approved; what the shell " +
-    "would actually read was established only at execution, and a deny-listed read is refused here rather than escalated.";
+const DENY_REFUSAL_NOTE = "The read boundary judges this command's written spelling and, where a filesystem can be consulted, the " +
+    "paths it would actually read; a deny-listed read is refused here rather than escalated.";
+function readContainmentRefusal(content, paths = []) {
+    return errorResult(content, { type: "readonly_out_of_root", code: "readonly_out_of_root", paths });
+}
+function readDenyRefusal(target, pattern) {
+    const content = `Error (Bash): reading "${target}" is refused: the target matches the sensitive-path ` +
+        `read deny list (pattern "${pattern}"). This list guards credential-class paths and ` +
+        `applies regardless of the containment roots. ${DENY_REFUSAL_NOTE}`;
+    return errorResult(content, violationDetails({ code: "read_path_denied", message: content, target, pattern }));
+}
 const READONLY_FACE_ESCAPE_PROSE = {
     subject: "a path this command reads",
     verdictPhrase: ` ${NOT_AUTO_ALLOWED}`,
@@ -1366,6 +1373,8 @@ export function createBashReadonlyTool(env, rootCanonical, allow, opts) {
     const timeoutCapsSecView = bashTimeoutCapsSec(timeoutCaps);
     const sample = [...allow].slice(0, 6).join(", ");
     const readRoots = [rootCanonical, ...(opts?.additionalRoots ?? [])];
+    const denySeat = readDenySeat(opts?.readDeny);
+    const readBoundary = { roots: readRoots, cwd: rootCanonical, ...denySeat };
     const overflowSpoolFence = createShellOverflowSpoolFence(env);
     const readsOnlyEngineOverflowSpool = async (verdict) => {
         if (verdict.outOfRootRead !== true)
@@ -1377,6 +1386,9 @@ export function createBashReadonlyTool(env, rootCanonical, allow, opts) {
             return false;
         for (const p of [...paths, ...(verdict.outOfRootSpellings ?? [])]) {
             const real = await canonicalBoundary.canonicalOf(p);
+            for (const view of [real, p])
+                if (view !== undefined && denySeat.denyMatch?.(normalizeAbsPathLexically(view)) != null)
+                    return false;
             if (!(await overflowSpoolFence(real ?? p)))
                 return false;
         }
@@ -1404,17 +1416,30 @@ export function createBashReadonlyTool(env, rootCanonical, allow, opts) {
             const reason = coarseReadonlyCheck(command, allow);
             if (reason)
                 return errorResult(`Error (Bash): ${reason}`);
-            const boundary = classifySimpleCommandReadBoundary(command, { roots: readRoots, cwd: rootCanonical });
+            const boundary = classifySimpleCommandReadBoundary(command, readBoundary);
+            let releasedByGrant = [];
+            if (boundary.readDeniedPath !== undefined && boundary.readDeniedPattern !== undefined)
+                return readDenyRefusal(boundary.readDeniedPath, boundary.readDeniedPattern);
+            const traversal = boundary.recursiveReadPaths ?? [];
+            if (traversal.length > 0) {
+                const shown = traversal.slice(0, RECURSIVE_CAUSE_MAX_PATHS);
+                return readContainmentRefusal(`Error (Bash): this lexical check cannot bound what a recursive read form in this command traverses, and a deny list is in force — ` +
+                    `${traversal.length} path(s) taken as traversal roots: ${shown.join(", ")}${traversal.length > shown.length ? `, and ${traversal.length - shown.length} more` : ""}. ` +
+                    `Use the Grep tool to search a directory tree — it applies the same deny list to every file it reads. ` +
+                    `${BASH_READONLY_CONFINEMENT_NOTE}`);
+            }
             if (boundary.reason !== undefined) {
                 const rescueCandidates = [...(boundary.outOfRootPaths ?? []), ...(boundary.outOfRootSpellings ?? [])];
                 const rescued = boundary.outOfRootRead === true &&
                     (boundary.unresolvedOperands ?? []).length === 0 &&
                     (await canonicalBoundary.allResolveInside(rescueCandidates, ctx.signal));
+                if (rescued)
+                    releasedByGrant = rescueCandidates;
                 if (!rescued && !(await readsOnlyEngineOverflowSpool(boundary))) {
-                    return errorResult(`Error (Bash): ${boundary.reason}. ${BASH_READONLY_CONFINEMENT_NOTE}`, { type: "readonly_out_of_root", code: "readonly_out_of_root", paths: boundary.outOfRootPaths ?? [] });
+                    return readContainmentRefusal(`Error (Bash): ${boundary.reason}. ${BASH_READONLY_CONFINEMENT_NOTE}`, boundary.outOfRootPaths ?? []);
                 }
             }
-            const escape = await canonicalEscapeRefusal(canonicalBoundary, { literal: [...(boundary.checkedPaths ?? []), ...(boundary.checkedSpellings ?? [])], patterns: [...(boundary.undecidedPaths ?? []), ...(boundary.undecidedSpellings ?? [])] }, readRoots, READONLY_FACE_ESCAPE_PROSE, { deny: undefined, containment: true }, ctx.signal);
+            const escape = await canonicalEscapeRefusal(canonicalBoundary, { literal: [...(boundary.checkedPaths ?? []), ...(boundary.checkedSpellings ?? []), ...releasedByGrant], patterns: [...(boundary.undecidedPaths ?? []), ...(boundary.undecidedSpellings ?? [])] }, readRoots, READONLY_FACE_ESCAPE_PROSE, { deny: denySeat.denyMatch, containment: true }, ctx.signal);
             if (escape !== undefined)
                 return escape;
             const readOnlyTick = opts?.onToolProgress === undefined ? undefined : (t) => describeSafely(opts.onToolProgress, { toolCallId: ctx.toolCallId, toolName: "Bash", ...t });

package/dist/tools/fs/index.d.ts

@@ -46,7 +46,8 @@ export interface HandsToolkitOptions {
      *  (see `createBashTool`'s `readBoundary`). The caller passes the SAME seat it gives the gate's shell
      *  probes, so the boundary that judges a command's written spelling before approval and the leg that
      *  re-judges its symlink-resolved targets before execution are one declaration. Ignored in `readOnly`
-     *  mode — `bash_readonly` builds its own from the roots it is confined to.
+     *  mode — `bash_readonly` builds its own: containment from the roots it is confined to, DENY from the same
+     *  compiled table this band hands the structured read faces.
      *
      *  ABSENT ⇒ the leg does not run and costs no I/O: with no boundary declared there is no "outside" for
      *  a read to be outside of, which is the same reading the probe seats take of an absent boundary. It

package/dist/tools/fs/index.js

@@ -72,6 +72,7 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
                 ...(opts.bashMaxTimeoutMs !== undefined ? { bashMaxTimeoutMs: opts.bashMaxTimeoutMs } : {}),
                 ...(opts.onNotice !== undefined ? { onNotice: opts.onNotice } : {}),
                 ...(readFaceRoots !== undefined ? { additionalRoots: readFaceRoots } : {}),
+                readDeny,
                 ...(opts.onToolProgress !== undefined ? { onToolProgress: opts.onToolProgress } : {}),
             })
             : createBashTool(env, rootCanonical, commitCoAuthor, cwdRef, {

package/dist/tools/fs/read-deny.d.ts

@@ -61,6 +61,20 @@ export interface ReadDenyMatcher {
      *  matching the deny list exist under the scope and were excluded). */
     readonly rgProbeGlobs: readonly ReadDenyRgGlob[];
 }
+/** The DENY HALF of a shell read boundary, in the shape `BashReadonlyRootBoundary` declares it (structural:
+ *  this module is the leaf every face depends on). `denyMatch` judges one LEXICALLY RESOLVED operand,
+ *  returning the matched pattern or null; PRESENT-IFF there is something to judge. */
+export interface ReadDenySeat {
+    denyMatch?: (resolvedPath: string) => string | null;
+    denyEntries: readonly string[];
+}
+/** The ONE adapter from a compiled matcher to that seat, so every face mounts it the SAME way and the "wire
+ *  the judge only when it has something to judge" rule is spelled once. That rule is load-bearing: the
+ *  seat's PRESENCE is itself read as a fact (the recursive-read demotion mints on "a deny judge is wired" =
+ *  the check a traversal would outflank is in place), so a judge over an EMPTY set must not be wired. Call
+ *  ONCE per mount and reuse the result — the returned closure is then the function OBJECT every face mounted
+ *  from that matcher shares, which makes "the same judge" checkable rather than argued. */
+export declare function readDenySeat(matcher: ReadDenyMatcher | undefined): ReadDenySeat;
 /**
  * The closed set of built-in tiers. A tier is the deployment's selection unit
  * ({@link ReadDenyBuiltinConfig.tiers}); every {@link READ_FACE_BUILTIN_DENY_TABLE} row belongs to

package/dist/tools/fs/read-deny.js

@@ -1,3 +1,9 @@
+export function readDenySeat(matcher) {
+    const entries = (matcher?.entries ?? []).map((e) => e.pattern);
+    if (matcher === undefined || entries.length === 0)
+        return { denyEntries: entries };
+    return { denyMatch: (p) => matcher.matchPath(p)?.pattern ?? null, denyEntries: entries };
+}
 export const READ_DENY_BUILTIN_TIERS = ["credentials", "shell-history", "browser", "wallet", "agent-config"];
 export const READ_FACE_BUILTIN_DENY_TABLE = [
     { pattern: ".ssh", tier: "credentials" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.23.3",
+  "version": "7.23.4",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.23.4.json

@@ -0,0 +1,58 @@
+{
+  "repo": "core",
+  "version": "7.23.4",
+  "from": "141b1687631b53cf2998a56c7541bb4aab5ca9af",
+  "to": "v7.23.4",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING, the `bash_readonly` read-only shell face (`handsReadOnly`), deployments with a deny judge wired (#937 = sema-internal #67, P1; stock since design/199 — measured identical on 7.22.0 and 7.23.3): ONE deny judge for every read face. The v1 exception that kept `denyMatch` off the read-only shell face is retired: `readDenySeat()` (`src/tools/fs/read-deny.ts`) is the single adapter from the compiled deny set to a boundary's deny half, mounted by the structured read faces and now by `bash_readonly` at both of its judging moments — the lexical verdict and the execute-time recheck (`src/tools/fs/fs-bash.ts`, `{ deny: denySeat.denyMatch, containment: true }`). One mint for the deny refusal (`readDenyRefusal`) and one for the containment refusal (`readContainmentRefusal`). A containment GRANT (root rescue, overflow-spool recovery) answers containment only, never deny (codex r1/r2). Rules −4. WHO NEEDS IT: a deployment that mounts the read-only shell (server autonomy read-only tier) AND configures `readDenyPatterns` / `READ_DENY_BUILTIN_TIERS` — until now `cat .env` ran there at zero cards with the bytes returned. WHO IS AFFECTED: (a) on that face, a deny-listed read is REFUSED (`read_path_denied`, naming the pattern) — named spelling, glob, symlink target, and a recursive walk that would enter a deny row; (b) a recursive verb (`grep -r <needle> .`) on such a deployment is refused as a whole with the Grep tool named as the way out (KL-937b); (c) a bracket-named glob spelling may over-fire fail-closed (KL-937a). Deployments with no deny judge: byte-identical on this face; the full Bash face: unchanged (contrast column pinned)."
+    }
+  ],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [
+    {
+      "type": "CompoundReadonlyVerdict",
+      "at": [
+        "src/tools/fs/bash-readonly-classifier.ts:644"
+      ],
+      "added": [
+        "readDeniedPath",
+        "readDeniedPattern"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.isError",
+      "assertions": [
+        "G1.a",
+        "G1.b"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [
+      "CompoundReadonlyVerdict"
+    ],
+    "server": [
+      "CompoundReadonlyVerdict"
+    ],
+    "sdk": [],
+    "note": "scanned cli@4e3b6980 server@866e273b sdk@0a6aeb7 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "2a5d3b7f6c6d633510d8866e95d66e7b2b85446a"
+}