@sema-agent/core 7.23.4 → 7.24.0

package/dist/tools/fs/bash-program-position.d.ts

@@ -9,6 +9,7 @@
  * does (an option skipped, a chain member missed) is how one face used to vouch for a program another refused.
  */
 import type { SegmentTokens } from "./bash-lexer.js";
+import type { AssertAllKeysHandled } from "../../core/ask-origin.js";
 /** The verdict every unresolvable / out-of-root / unbounded finding ends on. The findings differ in what
  *  they found; the consequence is one consequence, and a copy that drifts reads as a second rule. */
 export declare const NOT_AUTO_ALLOWED = "\u2014 not auto-allowed";
@@ -170,6 +171,28 @@ export declare function argvReentryUnjudged(pos: ProgramPosition, acceptedTarget
  */
 export declare const SHELL_SCAN_DECLINES: readonly ["unreadable_program_position", "stream_fed_operands"];
 export type ShellScanDecline = (typeof SHELL_SCAN_DECLINES)[number];
+/** The two SEAT TABLES over that set — ROW PER MEMBER behind a compile-time fence, registered in
+ *  `docs/CLOSED-SETS.md` so `gate:closed-sets` is their runtime twin. The ARGUMENT for the rows is at the
+ *  seats that read them (`fs-bash.ts`), which DERIVE the `Set` shape their readers take. Rows and not two
+ *  sets because a derived set beside an empty literal made a third decline SILENTLY asymmetric, in the
+ *  widening direction; a member with no row now reds `tsc` at both fences with the word spelled out. */
+export declare const BOUNDARY_SEAT_READS_DECLINE: {
+    readonly unreadable_program_position: true;
+    readonly stream_fed_operands: true;
+};
+/** The fence over the read-boundary seat's table: `never` while every decline has a row. */
+export type BoundarySeatTableCoversEveryDecline = AssertAllKeysHandled<Exclude<ShellScanDecline, keyof typeof BOUNDARY_SEAT_READS_DECLINE>>;
+/** The classify doctrine's table — every row `false` BY THE ARGUMENT (stated at the seat), not by omission. */
+export declare const CLASSIFY_SEAT_READS_DECLINE: {
+    readonly unreadable_program_position: false;
+    readonly stream_fed_operands: false;
+};
+/** The fence over the classify seat's table. */
+export type ClassifySeatTableCoversEveryDecline = AssertAllKeysHandled<Exclude<ShellScanDecline, keyof typeof CLASSIFY_SEAT_READS_DECLINE>>;
+/** A seat's table in the shape its readers take — the members it answers YES for. DERIVED, so the ROWS are
+ *  the single source and a set can never say something its table does not. The parameter is TOTAL, not
+ *  `Partial`: that stops a third seat being written `seatDeclineEvidence({})`, one level up from the fences. */
+export declare function seatDeclineEvidence(table: Record<ShellScanDecline, boolean>): ReadonlySet<ShellScanDecline>;
 /** Does a SHELL stand where this segment's program would be — as the program itself (`sh -c`), or as a launcher
  *  ROW handing its operands to one (`watch "…"`)? ONE predicate for the re-entry class, so the two spellings
  *  cannot be answered differently; which names are shells is the caller's declaration. Not a decline. */

package/dist/tools/fs/bash-program-position.js

@@ -159,6 +159,17 @@ export function argvReentryUnjudged(pos, acceptedTargets) {
     return runs === undefined || !acceptedTargets.has(runs);
 }
 export const SHELL_SCAN_DECLINES = ["unreadable_program_position", "stream_fed_operands"];
+export const BOUNDARY_SEAT_READS_DECLINE = {
+    unreadable_program_position: true,
+    stream_fed_operands: true,
+};
+export const CLASSIFY_SEAT_READS_DECLINE = {
+    unreadable_program_position: false,
+    stream_fed_operands: false,
+};
+export function seatDeclineEvidence(table) {
+    return new Set(SHELL_SCAN_DECLINES.filter((decline) => table[decline] === true));
+}
 export function programPositionRunsShell(pos, shellProgram) {
     if (pos.refusal !== undefined)
         return pos.refusal.kind === "control_syntax_at_program_position" && pos.refusal.runsShell === true;

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -76,11 +76,13 @@ export interface LeadingCommandNameOptions {
      * Read a shell operator that sits inside a QUOTED region as ordinary argument TEXT rather than as an
      * operator, so `grep -E "a|b" f.log` parses as the single simple command it is.
      *
-     * OPT-IN, and used by ONE caller: the compound classify face ({@link classifyCompoundReadonlyDetailed}),
-     * which has already rejected the whole command for backslashes / `$` / backticks / subshells / line
-     * breaks and so is inside {@link quoteMask}'s exactness envelope. The declaration and rule faces do
-     * NOT set it — their contract is "a single simple command with no operator characters at all", which
-     * is a spelling rule about what a person can read at a glance, not a claim about bash's grammar.
+     * OPT-IN, and the two callers that set it share one premise: the whole command has ALREADY been refused
+     * for backslashes / an expanding `$` / backticks / subshells / line breaks, so they are inside
+     * {@link quoteMask}'s exactness envelope — the compound classify face
+     * ({@link classifyCompoundReadonlyDetailed}) and the persisted permission-RULE lane (`RULE_LANE_FLOOR`),
+     * whose segments come out of that same gate ({@link splitShellCompoundSegments}). The `bash_readonly`
+     * DECLARATION face does NOT set it: its contract is "a single simple command with no operator characters
+     * at all", and it runs on raw tool input with no whole-string gate in front of it.
      *
      * Fail-closed on unbalanced quoting: with a region left open, the mask is not trusted and every
      * operator character counts, exactly as without this option.
@@ -617,8 +619,29 @@ export interface OutOfRootReadGateVerdict {
     readonly paths: readonly string[];
     /** Did the deployment's DENY judge speak about an operand this command names? The other half of the same
      *  question, over the very same readers, in a second pass WITH the deny judge — which is what lets the
-     *  containment answer above stay deny-free and keep its `paths` contract. Absent ⇔ it said nothing. */
-    readonly denied?: true;
+     *  containment answer above stay deny-free and keep its `paths` contract. Absent ⇔ it said nothing.
+     *
+     *  It carries the FINDING, not a boolean: this is the arm a command the grammar gate refused WHOLE
+     *  (`cat .env > out.txt`, a subshell, a substitution) reaches, and there the compound verdict carries no
+     *  deny fields at all — so a caller disclosing the hit has nowhere else to read the path and the pattern
+     *  from, and said nothing. The second pass already computed both; throwing them away was the whole bug. */
+    readonly denied?: {
+        readonly path: string;
+        readonly pattern: string;
+    };
+    /** The reader operands this pass RESOLVED and placed inside the roots, plus the expansions it parsed but
+     *  cannot enumerate — the candidates an execute-time recheck must canonicalize.
+     *
+     *  Published because this pass reads SHAPES the compound walk hands nothing out for: a launcher whose
+     *  program it cannot name (`env -- cat f`, `sudo -u root cat f`), a stream-fed one (`… | xargs cat f`).
+     *  There the compound verdict carries no candidates at all, so the recheck had nothing to resolve and an
+     *  in-root symlink to a deny-listed target RAN after an approval — while the same read spelled without
+     *  the launcher was refused. Same operands, same judge, one more pass allowed to hand them over.
+     *
+     *  NOT the out-of-root ones: those ride {@link paths}, they are what the boundary RAISED, and a leg that
+     *  re-refused them would be a second adjudicator of a decision already made. */
+    readonly checked: readonly string[];
+    readonly undecided: readonly string[];
 }
 /** Test seam for the lockstep pin that the launcher table (the ONE launcher truth, in the program-position
  *  reader's module) stays a SUBSET of the rule lane's curated `BARE_INTERPRETER_NAMES`. Exported for that one

package/dist/tools/fs/bash-readonly-classifier.js

@@ -1,3 +1,4 @@
+import { sensitivePathDenyList } from "./read-deny.js";
 import { hasWin32AliasedComponent, isAbsoluteForFamily, isAbsolutePathForm, isBlockedDevicePath, isShellRootedSpellingUnmapped, joinForFamily, nativeUncSpellingOf, normalizeAbsPathLexically, win32NamespaceScreen, pathFamilyOf, withinAnyRoot } from "./safety.js";
 import { lexShellText, literalTildeSpelling, quoteMask, substitutionsInHeredocBody, SUBSTITUTION_PLACEHOLDER, wordsOf, } from "./bash-lexer.js";
 import { ASSIGNMENT_WORD, COMMAND_LAUNCHERS, NOT_AUTO_ALLOWED, SHELL_BLOCK_WORDS, argvReentryUnjudged, isBareControlWord, programPositionRunsShell, shellScanDeclineOf, programBasename, programPositionRefusalSentence, readProgramPosition, } from "./bash-program-position.js";
@@ -19,11 +20,16 @@ function hasBareShellOperator(s, quotedOperatorsAreText) {
     if (!mask.balanced)
         return SHELL_OPERATORS.test(s);
     for (let i = 0; i < s.length; i++) {
-        if (!mask.quoted[i] && SHELL_OPERATORS.test(s[i]))
+        const ch = s[i];
+        if (!SHELL_OPERATORS.test(ch))
+            continue;
+        const literal = SHELL_EXPANDS_IN_DOUBLE_QUOTES.test(ch) ? mask.openedBy[i] === "'" : mask.quoted[i];
+        if (!literal)
             return true;
     }
     return false;
 }
+const SHELL_EXPANDS_IN_DOUBLE_QUOTES = /[$`]/;
 export function parseLeadingCommandName(command, options) {
     const trimmed = command.trim();
     if (!trimmed)
@@ -2169,7 +2175,7 @@ function evaluateReadBoundary(foldedSegments, boundary, mintGrantCandidate, reac
                 const denied = boundary.denyMatch?.(finding.path);
                 if (denied != null) {
                     return {
-                        reason: `a command operand resolves to "${finding.path}", which matches the sensitive-path read deny list (pattern "${denied}") ${NOT_AUTO_ALLOWED}`,
+                        reason: `a command operand resolves to "${finding.path}", which matches ${sensitivePathDenyList(denied)} ${NOT_AUTO_ALLOWED}`,
                         readDenied: true,
                         readDeniedPath: finding.path,
                         readDeniedPattern: denied,
@@ -2301,7 +2307,7 @@ export function classifySimpleCommandReadBoundary(command, boundary) {
     }
     return evaluateReadBoundary([toks], boundary, true);
 }
-const NOT_GATED = { gated: false, paths: [] };
+const NOT_GATED = { gated: false, paths: [], checked: [], undecided: [] };
 const UNREADABLE_WHITELIST_WORD = /[$`()*?[\]{}]/;
 const UNMODELLED_BASE_MOVERS = new Set(["pushd", "popd"]);
 export const COMMAND_LAUNCHERS_FOR_TEST = COMMAND_LAUNCHERS;
@@ -2359,18 +2365,33 @@ export function classifyOutOfRootReadGate(command, allow, boundary) {
         if (readers.length === 0)
             return NOT_GATED;
         if (baseMoved)
-            return { gated: true, paths: [] };
+            return { gated: true, paths: [], checked: [], undecided: [] };
         const verdict = evaluateReadBoundary(readers, containmentOnly, false, readerReach);
-        const denied = boundary.denyMatch === undefined ? false : evaluateReadBoundary(readers, boundary, false, readerReach).readDenied === true;
-        if (verdict.outOfRootRead === true)
-            return { gated: true, paths: verdict.outOfRootPaths ?? [], ...(denied ? { denied: true } : {}) };
-        return denied ? { gated: false, paths: [], denied: true } : NOT_GATED;
+        const denyPass = boundary.denyMatch === undefined ? undefined : evaluateReadBoundary(readers, boundary, false, readerReach);
+        const denied = denyPass?.readDenied === true && denyPass.readDeniedPath !== undefined && denyPass.readDeniedPattern !== undefined
+            ? { path: denyPass.readDeniedPath, pattern: denyPass.readDeniedPattern }
+            : undefined;
+        const resolvedOperands = {
+            checked: [...(verdict.checkedPaths ?? []), ...(verdict.checkedSpellings ?? [])],
+            undecided: [...(verdict.undecidedPaths ?? []), ...(verdict.undecidedSpellings ?? [])],
+        };
+        if (verdict.outOfRootRead === true) {
+            return { gated: true, paths: verdict.outOfRootPaths ?? [], ...resolvedOperands, ...(denied !== undefined ? { denied } : {}) };
+        }
+        if (denied !== undefined)
+            return { gated: false, paths: [], ...resolvedOperands, denied };
+        return resolvedOperands.checked.length === 0 && resolvedOperands.undecided.length === 0 ? NOT_GATED : { gated: false, paths: [], ...resolvedOperands };
     };
     const direct = judge(command);
-    if (direct.gated || direct.denied === true)
+    if (direct.gated || direct.denied !== undefined)
         return direct;
     const shape = POLL_LOOP_SHAPE.exec(command.trim());
-    return shape !== null ? judge(shape[3]) : NOT_GATED;
+    if (shape === null)
+        return direct;
+    const loop = judge(shape[3]);
+    return loop.gated || loop.denied !== undefined
+        ? loop
+        : { ...loop, checked: [...direct.checked, ...loop.checked], undecided: [...direct.undecided, ...loop.undecided] };
 }
 export function classifyCompoundReadonly(command, allow, boundary) {
     return classifyCompoundReadonlyDetailed(command, allow, boundary).reason;

package/dist/tools/fs/fs-bash.d.ts

@@ -66,6 +66,10 @@ export declare function bashReversibilityProbe(allow?: readonly string[], bounda
  * ONE rule, TWO TABLES: which {@link ShellScanDecline} a SEAT reads as read evidence. A decline names no word,
  * so it is never the boundary DECLARING anything about a path.
  *
+ * BOTH tables are ROW-PER-MEMBER objects behind a compile-time fence ({@link BOUNDARY_SEAT_READS_DECLINE} /
+ * {@link CLASSIFY_SEAT_READS_DECLINE}); the sets below are DERIVED from those rows and the ARGUMENT for the
+ * rows is this block. "Empty by the argument" is a row saying `false`, not a literal nobody can judge.
+ *
  * The READ-BOUNDARY seat is what the default/off doctrine and a bypass mode mount ALONE: there "not mandated"
  * is VOUCHED, so a decline must count as evidence or a read nobody judged runs silently (`<out-of-root> |
  * xargs cat` at zero asks — a closed P0). It keeps both. The CLASSIFY seat composes the same boundary with the
@@ -87,8 +91,13 @@ export declare function bashReversibilityProbe(allow?: readonly string[], bounda
  * DID read naming a path outside the roots still gates the call ({@link classifyOutOfRootReadGate}).
  */
 export declare const BOUNDARY_SEAT_DECLINE_EVIDENCE: ReadonlySet<ShellScanDecline>;
-/** The classify doctrine's table — see above; empty by the argument. */
+/** The classify doctrine's table in the shape its readers take — see above; empty because every row says `false`. */
 export declare const CLASSIFY_SEAT_DECLINE_EVIDENCE: ReadonlySet<ShellScanDecline>;
+export declare function fitMiddle(s: string, budget: number): string;
+/** `s` shortened to `budget` by removing its MIDDLE, marked — cut through the repo's surrogate-safe
+ *  primitive, never a raw `slice` (a raw cut leaves half an astral code point on a card and in a durable
+ *  row). Under a dozen characters the HEAD is taken. */
+export declare function elideMiddle(s: string, budget: number): string;
 /**
  * The READ-BOUNDARY seat of the full shell: a `ToolSpec.reversibilityProbe` that answers exactly ONE
  * question — does the deployment's read boundary object to where this command reads? — and nothing about
@@ -292,6 +301,26 @@ export declare function createBashTool(env: ExecutionEnv, rootCanonical: string,
      *  Absent ⇒ historic bare tag. */
     reminderMark?: string;
 }): AgentTool;
+type ShellCanonicalRefusal = {
+    content: string;
+    isError: true;
+    details?: unknown;
+};
+/** What a face contributes to the shared refusal cards: the TOOL refusing, and the three prose slots. */
+export interface ShellFaceProse {
+    readonly tool: string;
+    readonly subject: string;
+    readonly verdictPhrase: string;
+    readonly note: string;
+}
+export type ShellCanonicalRecheck = (command: string, signal?: AbortSignal) => Promise<ShellCanonicalRefusal | undefined>;
+/**
+ * THE execute-time canonical recheck, mounted by every face that spawns a shell command — the full `Bash`
+ * tool and `Monitor`, whose approval-time seats judge the WRITTEN spelling while this re-judges where the
+ * kernel takes those words. The SAME leg, not a second one; the contract below is the leg's own. */
+export declare function createShellCanonicalRecheck(env: ExecutionEnv, readBoundary: BashReadonlyRootBoundary | (() => BashReadonlyRootBoundary | undefined) | undefined, face?: ShellFaceProse): ShellCanonicalRecheck;
+/** The `Monitor` face's prose — the full shell's with its own tool name: one leg, one finding, two tools. */
+export declare const MONITOR_ESCAPE_PROSE: ShellFaceProse;
 /**
  * `bash_readonly` (effect:read) — a restricted shell for the verifier read-only boundary: a single
  * allowlisted, bare command with no shell operators. effect:read lets it survive the verifier's

package/dist/tools/fs/fs-bash.js

@@ -7,15 +7,16 @@ import { RollingTailBuffer } from "../../core/exec-output-tail.js";
 import { TASK_OUTPUT_TOOL_NAME, TASK_STOP_TOOL_NAME, TASK_OUTPUT_MISSING_ID_MESSAGE, TASK_STOP_MISSING_ID_MESSAGE, TASK_STOP_PARAMS, resolveTaskIdArg, ENV_DIRECT_TASK_TOOL_CAPS, composeTaskOutputDescription, composeTaskOutputParams, composeTaskStopDescription, } from "../../core/task-tool-shape.js";
 import { hasBackgroundShell } from "../../core/background-shell.js";
 import { delimitUntrusted } from "../../core/untrusted-text.js";
+import { sliceHeadSafe, sliceTailSafe } from "../../core/surrogate-safe-slice.js";
 import { MCP_IMAGE_MAX_BASE64 } from "../../core/mcp.js";
 import { imageMagicMatches, normalizeAbsPathLexically, violationDetails, withinAnyRoot } from "./safety.js";
 import { boundaryIsTheSandbox, canonicalPathIsAuthoritative, hasDestroy, isIsolated } from "../../core/remote-env.js";
 import { ghRateLimitHint } from "./gh-rate-limit.js";
 import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, createShellOverflowSpoolFence, shellRecoveryHint, CWD_SENTINEL, stripCwdSentinel, BASH_READONLY_CONFINEMENT_NOTE, } from "./fs-shared.js";
-import { PROBE_CAUSE_PATH_MAX, inlineUntrusted } from "../../core/untrusted-text.js";
+import { PROBE_CAUSE_PATH_MAX, PROBE_REASON_MAX, inlineUntrusted } from "../../core/untrusted-text.js";
 import { bashClassifyDefaultAllow, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed, classifyOutOfRootReadGate, refusedCommandMayRead, classifySimpleCommandReadBoundary, } from "./bash-readonly-classifier.js";
-import { NOT_AUTO_ALLOWED, SHELL_SCAN_DECLINES } from "./bash-program-position.js";
-import { readDenySeat } from "./read-deny.js";
+import { BOUNDARY_SEAT_READS_DECLINE, CLASSIFY_SEAT_READS_DECLINE, NOT_AUTO_ALLOWED, seatDeclineEvidence, } from "./bash-program-position.js";
+import { readDenySeat, sensitivePathDenyList, SENSITIVE_PATH_DENY_SCOPE } from "./read-deny.js";
 import { toolFace } from "../../core/tool-catalog-entries.js";
 import { thrownText } from "../../core/thrown-value.js";
 const RECURSIVE_CAUSE_MAX_PATHS = 3;
@@ -35,13 +36,13 @@ export function bashReversibilityProbe(allow, boundary) {
         const backgrounded = isBackgroundShellCall(args);
         const detailed = classifyCompoundReadonlyDetailed(command, allowSet, resolved);
         if (backgrounded)
-            return { reversible: false, ...boundaryGate(detailed) };
+            return { reversible: false, ...boundaryGate(detailed), ...probeAccountOf(command, allowSet, resolved, detailed) };
         if (detailed.reason === undefined) {
             if (boundaryUnread(detailed)) {
-                const cause = recursiveReadCause(detailed);
-                if (cause !== undefined)
-                    return { reversible: false, ...boundaryGate(detailed), cause };
-                return { reversible: false, ...outOfRootGate() };
+                const account = probeAccountOf(command, allowSet, resolved, detailed);
+                if (account.cause !== undefined)
+                    return { reversible: false, ...boundaryGate(detailed), ...account };
+                return { reversible: false, ...outOfRootGate(), ...account };
             }
             return { reversible: true };
         }
@@ -51,9 +52,8 @@ export function bashReversibilityProbe(allow, boundary) {
         const seatOffer = (verdict) => (offers ? readRootCandidateOf(verdict) : {});
         const loopScan = refusedCommandScan(command, allowSet, resolved, loop, CLASSIFY_SEAT_DECLINE_EVIDENCE);
         if (boundaryDeclared(loop) || unjudgedRead(command, allowSet, resolved, loop, loopScan))
-            return { reversible: false, mandated: true, ...seatOffer(loop) };
-        const refusedCause = recursiveReadCause(detailed);
-        return { reversible: false, ...boundaryGate(detailed), ...seatOffer(detailed), ...(refusedCause !== undefined ? { cause: refusedCause } : {}) };
+            return { reversible: false, mandated: true, ...probeAccountOf(command, allowSet, resolved, loop), ...seatOffer(loop) };
+        return { reversible: false, ...boundaryGate(detailed), ...seatOffer(detailed), ...probeAccountOf(command, allowSet, resolved, detailed) };
     };
     return (args) => {
         const command = shellCommandOf(args);
@@ -90,8 +90,8 @@ function shellCommandOf(args) {
 function isBackgroundShellCall(args) {
     return args?.run_in_background === true;
 }
-export const BOUNDARY_SEAT_DECLINE_EVIDENCE = new Set(SHELL_SCAN_DECLINES);
-export const CLASSIFY_SEAT_DECLINE_EVIDENCE = new Set();
+export const BOUNDARY_SEAT_DECLINE_EVIDENCE = seatDeclineEvidence(BOUNDARY_SEAT_READS_DECLINE);
+export const CLASSIFY_SEAT_DECLINE_EVIDENCE = seatDeclineEvidence(CLASSIFY_SEAT_READS_DECLINE);
 function readBoundaryMandate(command, allowSet, resolved, verdict, declineEvidence) {
     if (resolved === undefined)
         return {};
@@ -99,7 +99,7 @@ function readBoundaryMandate(command, allowSet, resolved, verdict, declineEviden
     if (denyJudgeSpoke(verdict) || unjudgedRead(command, allowSet, resolved, verdict, scan))
         return { mandated: true };
     const named = classifyOutOfRootReadGate(command, allowSet, resolved);
-    if (named.gated || named.denied === true)
+    if (named.gated || named.denied !== undefined)
         return { mandated: true };
     return declinedRung(scan);
 }
@@ -122,7 +122,7 @@ function unjudgedRead(command, allowSet, resolved, verdict, scan) {
     if (resolved === undefined)
         return false;
     const named = classifyOutOfRootReadGate(command, allowSet, resolved);
-    return named.gated || named.denied === true;
+    return named.gated || named.denied !== undefined;
 }
 function recursiveReadCause(detailed) {
     const recursive = detailed.recursiveReadPaths;
@@ -136,17 +136,65 @@ function recursiveReadCause(detailed) {
         ...(others.length > 0 ? { further: operandFamily(others) } : {}),
     };
 }
+function denyHitReason(finding) {
+    if (finding === undefined)
+        return {};
+    const { path, pattern } = finding;
+    const composed = (target, pat) => `reading "${target}" matches ${sensitivePathDenyList(pat)}.`;
+    const room = PROBE_REASON_MAX - composed("", "").length;
+    const patternRoom = Math.min(pattern.length, Math.max(Math.floor(room / 2), room - path.length));
+    return { reason: composed(fitMiddle(path, room - patternRoom), fitMiddle(pattern, patternRoom)) };
+}
+export function fitMiddle(s, budget) {
+    return s.length <= budget ? s : elideMiddle(s, budget);
+}
+export function elideMiddle(s, budget) {
+    if (budget < 12)
+        return sliceHeadSafe(s, Math.max(0, budget));
+    const keep = budget - 1;
+    const head = Math.ceil(keep / 2);
+    return `${sliceHeadSafe(s, head)}\u2026${sliceTailSafe(s, keep - head)}`;
+}
+function denyFindingOf(command, allowSet, resolved, verdict) {
+    if (verdict.readDenied === true && verdict.readDeniedPath !== undefined && verdict.readDeniedPattern !== undefined) {
+        return { path: verdict.readDeniedPath, pattern: verdict.readDeniedPattern };
+    }
+    return resolved === undefined ? undefined : classifyOutOfRootReadGate(command, allowSet, resolved).denied;
+}
+function recursiveDenyReason(resolved, verdict) {
+    const roots = verdict.recursiveReadPaths;
+    const entries = resolved?.denyEntries;
+    if (roots === undefined || roots.length === 0 || entries === undefined || entries.length === 0)
+        return {};
+    const composed = (root, rows) => `a recursive read form traverses "${root}", which this walk does not enumerate, past ${sensitivePathDenyList(rows)}.`;
+    const root = roots[0] ?? "";
+    const label = (rows) => rows.length < entries.length ? [...rows, `+${entries.length - rows.length} more`] : rows;
+    let rows = entries.slice(0, MAX_DENY_ROWS_NAMED);
+    while (rows.length > 1 && PROBE_REASON_MAX - composed("", label(rows)).length < MIN_TRAVERSAL_ROOT_ROOM)
+        rows = rows.slice(0, -1);
+    let shown = label(rows);
+    if (PROBE_REASON_MAX - composed("", shown).length < MIN_TRAVERSAL_ROOT_ROOM) {
+        const over = MIN_TRAVERSAL_ROOT_ROOM - (PROBE_REASON_MAX - composed("", shown).length);
+        shown = label([fitMiddle(rows[0] ?? "", Math.max((rows[0] ?? "").length - over, 8))]);
+    }
+    return { reason: composed(fitMiddle(root, Math.max(PROBE_REASON_MAX - composed("", shown).length, 0)), shown) };
+}
+const MAX_DENY_ROWS_NAMED = 3;
+const MIN_TRAVERSAL_ROOT_ROOM = 24;
+function probeAccountOf(command, allowSet, resolved, verdict) {
+    const cause = recursiveReadCause(verdict);
+    const hit = denyHitReason(denyFindingOf(command, allowSet, resolved, verdict));
+    return { ...(hit.reason !== undefined ? hit : recursiveDenyReason(resolved, verdict)), ...(cause !== undefined ? { cause } : {}) };
+}
 export function bashReadBoundaryProbe(boundary) {
     const allowSet = new Set(bashClassifyDefaultAllow());
     const judge = (command, resolved, offers) => {
         const seatVerdict = (verdict) => {
             if (boundaryDeclared(verdict) || unjudgedRead(command, allowSet, resolved, verdict, refusedCommandScan(command, allowSet, resolved, verdict, BOUNDARY_SEAT_DECLINE_EVIDENCE))) {
-                const cause = recursiveReadCause(verdict);
-                return { reversible: false, mandated: true, ...(cause !== undefined ? { cause } : {}) };
+                return { reversible: false, mandated: true, ...probeAccountOf(command, allowSet, resolved, verdict) };
             }
             if (boundaryUndecided(verdict)) {
-                const cause = recursiveReadCause(verdict);
-                return { reversible: false, ...(cause !== undefined ? { cause } : {}) };
+                return { reversible: false, ...probeAccountOf(command, allowSet, resolved, verdict) };
             }
             if (verdict.reason === undefined)
                 return { reversible: true };
@@ -165,7 +213,7 @@ export function bashReadBoundaryProbe(boundary) {
         if (mandated !== undefined)
             return { ...mandated, ...offerFrom(detailed), ...offerFrom(loop) };
         if (readBoundaryMandate(command, allowSet, resolved, detailed, BOUNDARY_SEAT_DECLINE_EVIDENCE).mandated === true)
-            return { reversible: false, mandated: true };
+            return { reversible: false, mandated: true, ...probeAccountOf(command, allowSet, resolved, detailed) };
         return compoundVerdict ?? loopVerdict ?? { reversible: true };
     };
     return (args) => {
@@ -763,30 +811,7 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
     const bgRetained = hasBackgroundShell(env) && env.backgroundCapabilities.retainBackgroundProcesses === true;
     const bgSessionScoped = taskOpts.sessionId !== undefined && taskOpts.taskRegistry !== undefined;
     const bgEnvIsolatedOwned = hasDestroy(env) && isIsolated(env);
-    const recheckReaders = new Set(bashClassifyDefaultAllow());
-    let canonicalForRoots;
-    const canonicalBoundaryFor = (roots) => {
-        const key = roots.join("\u0000");
-        if (canonicalForRoots?.key !== key)
-            canonicalForRoots = { key, boundary: createCanonicalReadBoundary(env, roots) };
-        return canonicalForRoots.boundary;
-    };
-    const canonicalEscape = async (command, signal) => {
-        const resolvedBoundary = typeof taskOpts.readBoundary === "function" ? taskOpts.readBoundary() : taskOpts.readBoundary;
-        if (resolvedBoundary === undefined)
-            return undefined;
-        const ask = { deny: resolvedBoundary.denyMatch, containment: resolvedBoundary.face !== "open" };
-        if (ask.deny === undefined && !ask.containment)
-            return undefined;
-        const faces = [
-            classifyCompoundReadonlyDetailed(command, recheckReaders, resolvedBoundary),
-            classifyBoundedReadonlyPollLoopDetailed(command, recheckReaders, resolvedBoundary),
-        ];
-        const literal = [...new Set(faces.flatMap((v) => [...(v.checkedPaths ?? []), ...(v.checkedSpellings ?? [])]))];
-        const asked = new Set(faces.flatMap((v) => v.outOfRootPaths ?? []));
-        const patterns = [...new Set(faces.flatMap((v) => [...(v.undecidedPaths ?? []), ...(v.undecidedSpellings ?? [])]))].filter((p) => !asked.has(normalizeAbsPathLexically(p)));
-        return await canonicalEscapeRefusal(canonicalBoundaryFor(resolvedBoundary.roots), { literal, patterns }, resolvedBoundary.roots, FULL_SHELL_FACE_ESCAPE_PROSE, ask, signal);
-    };
+    const canonicalEscape = createShellCanonicalRecheck(env, taskOpts.readBoundary);
     return defineTool({
         name: "Bash",
         ...toolFace("bash"),
@@ -1259,13 +1284,15 @@ function createCanonicalReadBoundary(env, readRoots) {
                 if (deny === undefined || denied !== undefined)
                     return false;
                 const folded = normalizeAbsPathLexically(p);
+                if (ask.denyAnswered.has(folded))
+                    return false;
                 const pattern = deny(folded);
                 if (pattern === null)
                     return false;
                 denied = { path: folded, pattern };
                 return true;
             };
-            const judge = async (p, canonicalKnown) => {
+            const judge = async (p, canonicalKnown, origin) => {
                 if (denyHit(p))
                     return;
                 const real = canonicalKnown !== undefined ? { value: canonicalKnown, exact: true } : await resolve(p, signal);
@@ -1280,6 +1307,8 @@ function createCanonicalReadBoundary(env, readRoots) {
                 }
                 if (denyHit(real.value))
                     return;
+                if (ask.containmentAnswered.has(normalizeAbsPathLexically(origin ?? p)))
+                    return;
                 if (ask.containment && !withinAnyRoot(roots, real.value) && !escaping.includes(real.value))
                     escaping.push(real.value);
             };
@@ -1300,7 +1329,7 @@ function createCanonicalReadBoundary(env, readRoots) {
                     for (const t of expanded.paths) {
                         if (denied !== undefined)
                             break;
-                        await judge(t, expanded.canonical.get(t));
+                        await judge(t, expanded.canonical.get(t), p);
                     }
                 }
                 else
@@ -1331,18 +1360,56 @@ function createCanonicalReadBoundary(env, readRoots) {
         },
     };
 }
+const NOTHING_ANSWERED = new Set();
+export function createShellCanonicalRecheck(env, readBoundary, face) {
+    const recheckReaders = new Set(bashClassifyDefaultAllow());
+    let canonicalForRoots;
+    const canonicalBoundaryFor = (roots) => {
+        const key = roots.join("\u0000");
+        if (canonicalForRoots?.key !== key)
+            canonicalForRoots = { key, boundary: createCanonicalReadBoundary(env, roots) };
+        return canonicalForRoots.boundary;
+    };
+    return async (command, signal) => {
+        const resolvedBoundary = typeof readBoundary === "function" ? readBoundary() : readBoundary;
+        if (resolvedBoundary === undefined)
+            return undefined;
+        const containmentAsked = resolvedBoundary.face !== "open";
+        if (resolvedBoundary.denyMatch === undefined && !containmentAsked)
+            return undefined;
+        const faces = [
+            classifyCompoundReadonlyDetailed(command, recheckReaders, resolvedBoundary),
+            classifyBoundedReadonlyPollLoopDetailed(command, recheckReaders, resolvedBoundary),
+        ];
+        const named = classifyOutOfRootReadGate(command, recheckReaders, resolvedBoundary);
+        const literalAll = [
+            ...new Set([
+                ...faces.flatMap((v) => [...(v.checkedPaths ?? []), ...(v.checkedSpellings ?? []), ...(v.outOfRootPaths ?? [])]),
+                ...named.checked,
+                ...named.paths,
+            ]),
+        ];
+        const folded = (ps) => new Set(ps.map((p) => normalizeAbsPathLexically(p)));
+        const answered = {
+            containment: folded([...faces.flatMap((v) => v.outOfRootPaths ?? []), ...named.paths]),
+            deny: folded([...faces.flatMap((v) => (v.readDeniedPath !== undefined ? [v.readDeniedPath] : [])), ...(named.denied !== undefined ? [named.denied.path] : [])]),
+        };
+        const patterns = [...new Set([...faces.flatMap((v) => [...(v.undecidedPaths ?? []), ...(v.undecidedSpellings ?? [])]), ...named.undecided])];
+        return await canonicalEscapeRefusal(canonicalBoundaryFor(resolvedBoundary.roots), { literal: literalAll, patterns }, resolvedBoundary.roots, face ?? FULL_SHELL_FACE_ESCAPE_PROSE, { deny: resolvedBoundary.denyMatch, containment: containmentAsked, denyAnswered: answered.deny, containmentAnswered: answered.containment }, signal);
+    };
+}
 async function canonicalEscapeRefusal(canonical, candidates, readRoots, face, ask, signal) {
     const resolved = await canonical.escapesAfterResolution(candidates, ask, signal);
     if (resolved.denied !== undefined) {
-        return readDenyRefusal(resolved.denied.path, resolved.denied.pattern);
+        return readDenyRefusal(resolved.denied.path, resolved.denied.pattern, face.tool);
     }
     if (resolved.unverifiable !== undefined) {
-        return readContainmentRefusal(`Error (Bash): ${resolved.unverifiable}, so this command cannot be confirmed to read only inside the allowed directories for this session: ${readRoots.join(", ")}. ` +
+        return readContainmentRefusal(`Error (${face.tool}): ${resolved.unverifiable}, so this command cannot be confirmed to read only inside the allowed directories for this session: ${readRoots.join(", ")}. ` +
             face.note);
     }
     if (resolved.escaping.length > 0) {
         const quoted = resolved.escaping.map((p) => `"${p}"`).join(", ");
-        return readContainmentRefusal(`Error (Bash): ${face.subject} resolves through a symlink to ${quoted}, outside the allowed directories for this session: ${readRoots.join(", ")}${face.verdictPhrase}. ` +
+        return readContainmentRefusal(`Error (${face.tool}): ${face.subject} resolves through a symlink to ${quoted}, outside the allowed directories for this session: ${readRoots.join(", ")}${face.verdictPhrase}. ` +
             face.note, resolved.escaping);
     }
     return undefined;
@@ -1352,22 +1419,24 @@ const DENY_REFUSAL_NOTE = "The read boundary judges this command's written spell
 function readContainmentRefusal(content, paths = []) {
     return errorResult(content, { type: "readonly_out_of_root", code: "readonly_out_of_root", paths });
 }
-function readDenyRefusal(target, pattern) {
-    const content = `Error (Bash): reading "${target}" is refused: the target matches the sensitive-path ` +
-        `read deny list (pattern "${pattern}"). This list guards credential-class paths and ` +
-        `applies regardless of the containment roots. ${DENY_REFUSAL_NOTE}`;
+function readDenyRefusal(target, pattern, tool = "Bash") {
+    const content = `Error (${tool}): reading "${target}" is refused: the target matches ${sensitivePathDenyList(pattern)}. ` +
+        `${SENSITIVE_PATH_DENY_SCOPE} ${DENY_REFUSAL_NOTE}`;
     return errorResult(content, violationDetails({ code: "read_path_denied", message: content, target, pattern }));
 }
 const READONLY_FACE_ESCAPE_PROSE = {
+    tool: "Bash",
     subject: "a path this command reads",
     verdictPhrase: ` ${NOT_AUTO_ALLOWED}`,
     note: BASH_READONLY_CONFINEMENT_NOTE,
 };
 const FULL_SHELL_FACE_ESCAPE_PROSE = {
+    tool: "Bash",
     subject: "a path this command names",
     verdictPhrase: "",
     note: "The read boundary judged this command's written spelling before the call was approved, and execution is past the approval step — a target reached only through symlink resolution is refused here rather than escalated.",
 };
+export const MONITOR_ESCAPE_PROSE = { ...FULL_SHELL_FACE_ESCAPE_PROSE, tool: "Monitor" };
 export function createBashReadonlyTool(env, rootCanonical, allow, opts) {
     const timeoutCaps = resolveBashTimeoutCaps(opts);
     const timeoutCapsSecView = bashTimeoutCapsSec(timeoutCaps);
@@ -1439,7 +1508,7 @@ export function createBashReadonlyTool(env, rootCanonical, allow, opts) {
                     return readContainmentRefusal(`Error (Bash): ${boundary.reason}. ${BASH_READONLY_CONFINEMENT_NOTE}`, boundary.outOfRootPaths ?? []);
                 }
             }
-            const escape = await canonicalEscapeRefusal(canonicalBoundary, { literal: [...(boundary.checkedPaths ?? []), ...(boundary.checkedSpellings ?? []), ...releasedByGrant], patterns: [...(boundary.undecidedPaths ?? []), ...(boundary.undecidedSpellings ?? [])] }, readRoots, READONLY_FACE_ESCAPE_PROSE, { deny: denySeat.denyMatch, containment: true }, ctx.signal);
+            const escape = await canonicalEscapeRefusal(canonicalBoundary, { literal: [...(boundary.checkedPaths ?? []), ...(boundary.checkedSpellings ?? []), ...releasedByGrant], patterns: [...(boundary.undecidedPaths ?? []), ...(boundary.undecidedSpellings ?? [])] }, readRoots, READONLY_FACE_ESCAPE_PROSE, { deny: denySeat.denyMatch, containment: true, denyAnswered: NOTHING_ANSWERED, containmentAnswered: NOTHING_ANSWERED }, ctx.signal);
             if (escape !== undefined)
                 return escape;
             const readOnlyTick = opts?.onToolProgress === undefined ? undefined : (t) => describeSafely(opts.onToolProgress, { toolCallId: ctx.toolCallId, toolName: "Bash", ...t });

package/dist/tools/fs/read-deny.d.ts

@@ -75,6 +75,20 @@ export interface ReadDenySeat {
  *  ONCE per mount and reuse the result — the returned closure is then the function OBJECT every face mounted
  *  from that matcher shares, which makes "the same judge" checkable rather than argued. */
 export declare function readDenySeat(matcher: ReadDenyMatcher | undefined): ReadDenySeat;
+/** The ONE naming of the deny table and the pattern that matched. Every face composes its own SUBJECT and
+ *  VERB in front of it and its own DISPOSITION behind it (the verb is not shared: one face names the
+ *  target, another the REQUESTED SPELLING under a symlink alias). What must not fork is the naming — a
+ *  reader comparing two surfaces about one finding must not be reading two findings. A LIST of patterns is
+ *  the same naming in the plural, for the one finding that names no single row: a traversal that goes PAST
+ *  the judge names the table IN FORCE, never a match it did not make. Four composers: the
+ *  structured read faces' refusal (`safety.ts`), the shell faces' refusal card (`readDenyRefusal`), the
+ *  lexical walk's verdict sentence (`bash-readonly-classifier.ts`), and the full shell's MANDATED ask card,
+ *  which is approvable and so states the finding without claiming a refusal. NOT composers, each stating
+ *  its own fact: the compaction lane's withheld-attachment HTML attribute, and the traversal notes'
+ *  withheld-COUNT lines, which name the table and a pattern LIST. */
+export declare function sensitivePathDenyList(pattern: string | readonly string[]): string;
+/** The deny table's REACH: a deny row holds INSIDE the containment roots, so no root grant answers it. */
+export declare const SENSITIVE_PATH_DENY_SCOPE = "This list guards credential-class paths and applies regardless of the containment roots.";
 /**
  * The closed set of built-in tiers. A tier is the deployment's selection unit
  * ({@link ReadDenyBuiltinConfig.tiers}); every {@link READ_FACE_BUILTIN_DENY_TABLE} row belongs to

package/dist/tools/fs/read-deny.js

@@ -4,6 +4,11 @@ export function readDenySeat(matcher) {
         return { denyEntries: entries };
     return { denyMatch: (p) => matcher.matchPath(p)?.pattern ?? null, denyEntries: entries };
 }
+export function sensitivePathDenyList(pattern) {
+    const rows = typeof pattern === "string" ? [pattern] : pattern;
+    return `the sensitive-path read deny list (pattern${rows.length === 1 ? "" : "s"} ${rows.map((p) => `"${p}"`).join(", ")})`;
+}
+export const SENSITIVE_PATH_DENY_SCOPE = "This list guards credential-class paths and applies regardless of the containment roots.";
 export const READ_DENY_BUILTIN_TIERS = ["credentials", "shell-history", "browser", "wallet", "agent-config"];
 export const READ_FACE_BUILTIN_DENY_TABLE = [
     { pattern: ".ssh", tier: "credentials" },

package/dist/tools/fs/safety.d.ts

@@ -1,3 +1,4 @@
+import type { AssertAllKeysHandled } from "../../core/ask-origin.js";
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { protectivePathTargetOf, type ToolCallLike } from "../../core/tool-registry.js";
 /**
@@ -320,7 +321,6 @@ export declare const WIN32_NAMESPACE_REFUSAL_TEXT: {
 };
 /** The fence over the text table: `never` while every refusal word has a row. */
 export type NamespaceRefusalTextCoversEveryWord = AssertAllKeysHandled<Exclude<Win32NamespaceRefusal, keyof typeof WIN32_NAMESPACE_REFUSAL_TEXT>>;
-type AssertAllKeysHandled<T extends never> = T;
 /**
  * The Win32 namespace screen — run on every model-spelled target BEFORE the family join, at every site
  * (the fs throat, the effective-target reader, the rule side, the glob splitter), so one spelling is

package/dist/tools/fs/safety.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { sensitivePathDenyList, SENSITIVE_PATH_DENY_SCOPE } from "./read-deny.js";
 import { sliceHeadSafe } from "../../core/surrogate-safe-slice.js";
 import { pathTargetValue, protectivePathTargetOf } from "../../core/tool-registry.js";
 import { withGateTimeout, DEFAULT_GATE_AWAIT_TIMEOUT_MS } from "../../core/gate-bounded-await.js";
@@ -468,7 +469,7 @@ export async function resolveKey(env, rootCanonical, path, signal, baseCwd, addi
                 ok: false,
                 violation: {
                     code: "read_path_denied",
-                    message: `reading "${path}" ${key !== path ? `(canonical target: "${key}") ` : ""}is refused: ${judged} the sensitive-path read deny list (pattern "${hit.pattern}"). This list guards credential-class paths and applies regardless of the containment roots.`,
+                    message: `reading "${path}" ${key !== path ? `(canonical target: "${key}") ` : ""}is refused: ${judged} ${sensitivePathDenyList(hit.pattern)}. ${SENSITIVE_PATH_DENY_SCOPE}`,
                     target: key,
                     pattern: hit.pattern,
                 },