@sema-agent/core 7.24.1 → 7.24.3

package/dist/tools/fs/bash-readonly-classifier.js

@@ -203,12 +203,12 @@ function outOfRootGrantCandidateOf(paths, boundary) {
         return paths.length === 1 ? { path: paths[0], exact: true } : undefined;
     return { path: candidate };
 }
-const NO_PATH_OPERAND_COMMANDS = new Set([
+export const NO_PATH_OPERAND_COMMANDS = new Set([
     "pwd", "echo", "printf", "whoami", "uname", "which", "tr", "basename", "dirname",
     "cal", "uptime", "id", "groups", "nproc", "locale", "free", "true", "false", "seq", "expr", "type", "sleep",
 ]);
 const XARGS_TARGETS_ACCEPTED_UNJUDGED = NO_PATH_OPERAND_COMMANDS;
-function isPathShapedToken(tok) {
+export function isPathShapedToken(tok) {
     return tok.includes("/") || tok.startsWith("~") || tok === "." || tok === "..";
 }
 export function resolveOperandLexically(base, operand, homeDir) {
@@ -261,7 +261,7 @@ function tokensMoveBase(toks) {
         return false;
     return pos.refusal !== undefined || pos.program?.basename === "cd";
 }
-const SHELL_REENTRY_PROGRAM_RE = /^(?:(?:ba|z|da|k|fi|a|mk|ya|pdk|c|tc)?sh|eval|source|\.|parallel)$/;
+export const SHELL_REENTRY_PROGRAM_RE = /^(?:(?:ba|z|da|k|fi|a|mk|ya|pdk|c|tc)?sh|eval|source|\.|parallel)$/;
 export function refusedCommandMayRead(command, allow, boundary, declinesAreEvidence) {
     const scan = { declined: false };
     const exempt = refusedCommandExempt(command, allow, boundary, declinesAreEvidence, scan, 0);
@@ -436,7 +436,7 @@ function tokenizeSegment(segment) {
         return { folded: [], raw: [] };
     return wordsOf(lexed.segments[0]);
 }
-function hasUnquotedExpansionMetachar(rawToken) {
+export function hasUnquotedExpansionMetachar(rawToken) {
     let open;
     for (const ch of rawToken) {
         if (open === undefined && (ch === '"' || ch === "'")) {
@@ -454,7 +454,7 @@ function hasUnquotedExpansionMetachar(rawToken) {
     }
     return false;
 }
-function hasUnquotedGlobMetachar(rawToken) {
+export function hasUnquotedGlobMetachar(rawToken) {
     let open;
     for (const ch of rawToken) {
         if (open === undefined && (ch === '"' || ch === "'")) {
@@ -481,7 +481,7 @@ function longOptionNameOf(tok) {
 function isLongOptionAbbrevOf(name, full) {
     return full.startsWith(name);
 }
-function suppliesFirstOperandSlot(slot, tok) {
+export function suppliesFirstOperandSlot(slot, tok) {
     if (tok.startsWith("--")) {
         const long = longOptionNameOf(tok);
         return long !== undefined && slot.suppliedByLongNames.some((full) => isLongOptionAbbrevOf(long, full));
@@ -716,7 +716,7 @@ const VERB_OPTION_SLOTS = {
         ],
     },
 };
-function readVerbOptionSlot(name, tok) {
+export function readVerbOptionSlot(name, tok) {
     const row = VERB_OPTION_SLOTS[name];
     if (row === undefined)
         return undefined;
@@ -777,9 +777,12 @@ function readVerbOptionSlot(name, tok) {
     }
     return { form: "no-value" };
 }
-function verbOptionsArePositionIndependent(name) {
+export function verbOptionsArePositionIndependent(name) {
     return VERB_OPTION_SLOTS[name]?.optionsArePositionIndependent === true;
 }
+export function verbFirstOperandSlot(name) {
+    return VERB_OPTION_SLOTS[name]?.firstOperand;
+}
 function localFileUrlPath(value) {
     const m = /^file:(?:\/\/[^/?#]*)?(\/[^?#]*)/i.exec(value.trim());
     if (m === null)
@@ -804,7 +807,7 @@ function formSpecFileNames(value) {
         after(part);
     return [...new Set(out)];
 }
-function slotValueCandidates(value, kind) {
+export function slotValueCandidates(value, kind) {
     if (!valueNamesAFile(kind))
         return [];
     if (kind === "url") {
@@ -877,7 +880,7 @@ const GREP_RECURSIVE_READ_FORM = {
     enumOptions: [{ shortLetter: "d", longName: "directories", recursiveValue: "recurse" }],
     dashIsStdin: true,
 };
-const RECURSIVE_READ_FORMS = {
+export const RECURSIVE_READ_FORMS = {
     grep: GREP_RECURSIVE_READ_FORM,
     egrep: GREP_RECURSIVE_READ_FORM,
     fgrep: GREP_RECURSIVE_READ_FORM,
@@ -914,12 +917,29 @@ function utf8Length(text) {
     }
     return bytes;
 }
+function sedReadingKind(reading) {
+    return typeof reading === "string" ? reading : "names";
+}
 function readSedScript(script) {
     if (script.split("\n").some((line) => utf8Length(line) >= SED_SCRIPT_LINE_LIMIT))
         return "unseen";
     let i = 0;
     let depth = 0;
     const len = script.length;
+    const reads = [];
+    const writes = [];
+    const commands = [];
+    let executesPatternSpace = false;
+    const anyName = () => reads.length + writes.length + commands.length > 0 || executesPatternSpace;
+    const named = () => ({ names: { reads, writes, commands, executesPatternSpace } });
+    const failed = () => (anyName() ? named() : "unparsed");
+    const restOfLine = () => {
+        skipBlank();
+        const from = i;
+        while (i < len && script[i] !== "\n")
+            i++;
+        return script.slice(from, i);
+    };
     const isBlank = (ch) => ch === " " || ch === "\t" || ch === "\v" || ch === "\f";
     const skipBlank = () => {
         while (i < len && isBlank(script[i]))
@@ -1011,14 +1031,14 @@ function readSedScript(script) {
         }
         if (ch === "}") {
             if (depth === 0)
-                return "unparsed";
+                return failed();
             depth--;
             i++;
             continue;
         }
         const first = readAddress();
         if (first === false)
-            return "unparsed";
+            return failed();
         if (first === true) {
             skipBlank();
             if (script[i] === ",") {
@@ -1027,11 +1047,11 @@ function readSedScript(script) {
                 if (script[i] === "+" || script[i] === "~") {
                     i++;
                     if (!(script[i] >= "0" && script[i] <= "9"))
-                        return "unparsed";
+                        return failed();
                     digits();
                 }
                 else if (readAddress() !== true)
-                    return "unparsed";
+                    return failed();
             }
             skipBlank();
         }
@@ -1041,10 +1061,22 @@ function readSedScript(script) {
         }
         const cmd = script[i];
         if (cmd === undefined)
-            return "unparsed";
+            return failed();
         i++;
-        if (SED_FILE_OR_EXEC_COMMANDS.has(cmd))
-            return "names";
+        if (SED_FILE_OR_EXEC_COMMANDS.has(cmd)) {
+            const arg = restOfLine();
+            if (cmd === "e") {
+                if (arg === "")
+                    executesPatternSpace = true;
+                else
+                    commands.push(arg);
+            }
+            else if (cmd === "r" || cmd === "R")
+                reads.push(arg);
+            else
+                writes.push(arg);
+            continue;
+        }
         if (cmd === "{") {
             depth++;
             continue;
@@ -1052,25 +1084,33 @@ function readSedScript(script) {
         if (cmd === "s" || cmd === "y") {
             const delim = script[i];
             if (delim === undefined || delim === "\\" || delim === "\n")
-                return "unparsed";
+                return failed();
             i++;
             if (!consumeDelimited(delim, cmd === "s"))
-                return "unparsed";
+                return failed();
             if (!consumeDelimited(delim, false))
-                return "unparsed";
+                return failed();
             if (cmd === "y")
                 continue;
             while (i < len) {
                 const flag = script[i];
-                if (flag === "w" || flag === "W" || flag === "e")
-                    return "names";
+                if (flag === "w" || flag === "W") {
+                    i++;
+                    writes.push(restOfLine());
+                    break;
+                }
+                if (flag === "e") {
+                    executesPatternSpace = true;
+                    i++;
+                    continue;
+                }
                 if (SED_SUBSTITUTE_FLAGS.test(flag) || isBlank(flag)) {
                     i++;
                     continue;
                 }
                 if (flag === ";" || flag === "\n" || flag === "\r" || flag === "}" || flag === "#")
                     break;
-                return "unparsed";
+                return failed();
             }
             continue;
         }
@@ -1091,9 +1131,11 @@ function readSedScript(script) {
             continue;
         }
         if (!SED_PLAIN_COMMANDS.has(cmd))
-            return "unparsed";
+            return failed();
     }
-    return depth === 0 ? "clean" : "unparsed";
+    if (depth !== 0)
+        return failed();
+    return anyName() ? named() : "clean";
 }
 const SED_OPTION_DIALECTS = [
     { separated: "efl", suffix: "iI", stopsAtFirstOperand: false },
@@ -1108,6 +1150,9 @@ const SED_LONG_PLAIN_OPTIONS = [
     "sandbox", "separate", "silent", "unbuffered", "version", "zero-terminated",
 ];
 function readSedInvocation(args, dialect) {
+    return sedReadingKind(readSedInvocationDetailed(args, dialect));
+}
+function readSedInvocationDetailed(args, dialect) {
     const scripts = [];
     let scriptSupplied = false;
     let endOfOptions = false;
@@ -1181,6 +1226,25 @@ function readSedInvocation(args, dialect) {
     return readSedScript(script);
 }
 const SED_SHORT_PLAIN_LETTERS = "nsuzEraHl";
+export function sedScriptSlotFiles(args) {
+    const reads = new Set();
+    const writes = new Set();
+    const commands = new Set();
+    let executesPatternSpace = false;
+    for (const dialect of SED_OPTION_DIALECTS) {
+        const reading = readSedInvocationDetailed(args, dialect);
+        if (typeof reading === "string")
+            continue;
+        for (const f of reading.names.reads)
+            reads.add(f);
+        for (const f of reading.names.writes)
+            writes.add(f);
+        for (const c of reading.names.commands)
+            commands.add(c);
+        executesPatternSpace ||= reading.names.executesPatternSpace;
+    }
+    return { reads: [...reads], writes: [...writes], commands: [...commands], executesPatternSpace };
+}
 const SCRIPT_SLOT_VERBS = new Map([
     ["sed", (args) => {
             const readings = SED_OPTION_DIALECTS.map((dialect) => readSedInvocation(args, dialect));
@@ -1286,7 +1350,7 @@ const BUN_INLINE = {
     ...BLANK_INLINE, longText: new Set(["--eval", "--print"]), textLetters: "ep",
     separatedValueLetters: "r", bannerLetters: "vh", stdinWhenUnnamed: false,
 };
-const INTERPRETER_INLINE_PROGRAMS = new Map([
+export const INTERPRETER_INLINE_PROGRAMS = new Map([
     ["perl", PERL_INLINE],
     ["ruby", RUBY_INLINE],
     ["python", PYTHON_INLINE],
@@ -1314,10 +1378,10 @@ const INTERPRETER_INLINE_PROGRAMS = new Map([
     ["groovy", GROOVY_INLINE],
     ["bun", BUN_INLINE],
 ]);
-function interpreterKey(name) {
+export function interpreterKey(name) {
     return name.replace(/\d+(?:\.\d+)*$/, "");
 }
-function inlineProgramClause(model, args) {
+export function inlineProgramClause(model, args) {
     let endOfOptions = false;
     let banner = false;
     let interactive = false;
@@ -1527,7 +1591,7 @@ function guardedVerbFormReason(name, toks, raw) {
     }
     return undefined;
 }
-function segmentSelectsRecursiveRead(name, args) {
+export function segmentSelectsRecursiveRead(name, args) {
     const model = RECURSIVE_READ_FORMS[name];
     if (model === undefined)
         return false;
@@ -1604,7 +1668,7 @@ function isGrepFileStdinLongOption(tok) {
 }
 const CLUSTER_OPTION_CHAR = /[A-Za-z0-9]/;
 const ASSIGNMENT_OR_APPEND_WORD = /^[A-Za-z_][A-Za-z0-9_]*\+?=/;
-function assignmentWordPayload(word) {
+export function assignmentWordPayload(word) {
     if (!ASSIGNMENT_OR_APPEND_WORD.test(word))
         return undefined;
     const eq = word.indexOf("=");
@@ -1615,8 +1679,8 @@ function assignmentWordPayload(word) {
         return { kind: "unresolved", reason: `"${word}" carries a tilde whose expansion the text does not settle` };
     return value === "" ? undefined : { kind: "value", value };
 }
-const ASSIGNMENT_VALUE_NOT_PATHS = new Set(["make", "gmake", "bmake", "cmake", "ninja", "meson", "docker", "podman"]);
-function argvProgramOf(tokens) {
+export const ASSIGNMENT_VALUE_NOT_PATHS = new Set(["make", "gmake", "bmake", "cmake", "ninja", "meson", "docker", "podman"]);
+export function argvProgramOf(tokens) {
     let lead = 0;
     while (lead < tokens.folded.length && ASSIGNMENT_OR_APPEND_WORD.test(tokens.folded[lead]))
         lead++;
@@ -1626,7 +1690,7 @@ function argvProgramOf(tokens) {
     const at = lead + pos.program.index;
     return ASSIGNMENT_OR_APPEND_WORD.test(tokens.folded[at] ?? "") ? undefined : { program: pos.program.basename, from: at };
 }
-function attachedOptionPayloads(tok) {
+export function attachedOptionPayloads(tok) {
     const literal = literalTildeSpelling;
     const out = [];
     if (tok.startsWith("--")) {
@@ -2309,7 +2373,7 @@ export function classifySimpleCommandReadBoundary(command, boundary) {
 }
 const NOT_GATED = { gated: false, paths: [], checked: [], undecided: [] };
 const UNREADABLE_WHITELIST_WORD = /[$`()*?[\]{}]/;
-const UNMODELLED_BASE_MOVERS = new Set(["pushd", "popd"]);
+export const UNMODELLED_BASE_MOVERS = new Set(["pushd", "popd"]);
 export const COMMAND_LAUNCHERS_FOR_TEST = COMMAND_LAUNCHERS;
 const LAUNCHER_SCAN_HEAD = "cat";
 export function classifyOutOfRootReadGate(command, allow, boundary) {

package/dist/tools/fs/fs-bash.js

@@ -10,7 +10,7 @@ import { delimitUntrusted } from "../../core/untrusted-text.js";
 import { sliceHeadSafe, sliceTailSafe } from "../../core/surrogate-safe-slice.js";
 import { MCP_IMAGE_MAX_BASE64 } from "../../core/mcp.js";
 import { imageMagicMatches, normalizeAbsPathLexically, violationDetails, withinAnyRoot } from "./safety.js";
-import { boundaryIsTheSandbox, canonicalPathIsAuthoritative, hasDestroy, isIsolated } from "../../core/remote-env.js";
+import { boundaryIsTheSandbox, hasDestroy, isIsolated } from "../../core/remote-env.js";
 import { ghRateLimitHint } from "./gh-rate-limit.js";
 import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, createShellOverflowSpoolFence, shellRecoveryHint, CWD_SENTINEL, stripCwdSentinel, BASH_READONLY_CONFINEMENT_NOTE, } from "./fs-shared.js";
 import { PROBE_CAUSE_PATH_MAX, PROBE_REASON_MAX, inlineUntrusted } from "../../core/untrusted-text.js";
@@ -1037,330 +1037,7 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
         },
     });
 }
-const GLOB_METACHAR_RE = /[*?[]/;
-const MAX_GLOB_DIRS = 256;
-const MAX_GLOB_MATCHES = 8192;
-function compileGlobSegment(pattern) {
-    if (pattern.includes("\\"))
-        return undefined;
-    let src = "";
-    for (let i = 0; i < pattern.length; i++) {
-        const ch = pattern[i];
-        if (ch === "*") {
-            src += "[^/]*";
-        }
-        else if (ch === "?") {
-            src += "[^/]";
-        }
-        else if (ch === "[") {
-            const cls = parseBracketExpression(pattern, i);
-            if (cls === undefined)
-                src += "\\[";
-            else {
-                src += cls.source;
-                i = cls.end;
-            }
-        }
-        else {
-            src += ch.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-        }
-    }
-    try {
-        return new RegExp(`^${src}$`, "s");
-    }
-    catch {
-        return undefined;
-    }
-}
-function parseBracketExpression(pattern, start) {
-    let i = start + 1;
-    let negate = false;
-    if (pattern[i] === "!" || pattern[i] === "^") {
-        negate = true;
-        i++;
-    }
-    const contentStart = i;
-    let body = "";
-    let anyChar = false;
-    for (; i < pattern.length; i++) {
-        const ch = pattern[i];
-        if (ch === "]" && i > contentStart) {
-            if (body.length === 0 && !anyChar)
-                return undefined;
-            return { source: anyChar ? "[^/]" : `[${negate ? "^" : ""}${body}]`, end: i };
-        }
-        if (ch === "[" && (pattern[i + 1] === ":" || pattern[i + 1] === "." || pattern[i + 1] === "=")) {
-            const close = pattern.indexOf(`${pattern[i + 1]}]`, i + 2);
-            if (close < 0)
-                return undefined;
-            anyChar = true;
-            i = close + 1;
-            continue;
-        }
-        body += ch === "-" ? "-" : ch.replace(/[\]\\^]/g, "\\$&");
-    }
-    return undefined;
-}
-function globSegmentMatches(re, pattern, name) {
-    if (name.startsWith(".") && !pattern.startsWith("."))
-        return false;
-    return re.test(name);
-}
-function joinCandidate(dir, name) {
-    return `${dir.replace(/[\\/]+$/, "")}/${name}`;
-}
-function pathSegmentsFrom(p, from) {
-    const segs = [];
-    let scan = from;
-    while (scan < p.length) {
-        while (scan < p.length && (p[scan] === "/" || p[scan] === "\\"))
-            scan++;
-        const s = scan;
-        while (scan < p.length && p[scan] !== "/" && p[scan] !== "\\")
-            scan++;
-        if (scan > s)
-            segs.push({ text: p.slice(s, scan), start: s });
-    }
-    return segs;
-}
-function createCanonicalReadBoundary(env, readRoots) {
-    const lexicalOnly = boundaryIsTheSandbox(env);
-    const resolverIsAuthoritative = canonicalPathIsAuthoritative(env);
-    let rootsOnce;
-    const canonicalRoots = async (signal) => {
-        rootsOnce ??= (async () => {
-            const out = [];
-            for (const r of readRoots) {
-                const c = await env.canonicalPath(r, signal);
-                out.push(c.ok ? c.value : r);
-            }
-            return out;
-        })();
-        return await rootsOnce;
-    };
-    const resolveWithoutParentSteps = async (p, signal) => {
-        const parts = p.split(/[\\/]/);
-        const tail = [];
-        let allAbsent = true;
-        while (parts.length > 0) {
-            const canon = await env.canonicalPath(parts.join("/") || "/", signal);
-            if (canon.ok) {
-                if (tail.length === 0)
-                    return { value: canon.value, exact: true };
-                return { value: [canon.value.replace(/[\\/]+$/, ""), ...[...tail].reverse()].join("/"), exact: false, missing: allAbsent };
-            }
-            if (canon.error.code !== "not_found" && canon.error.code !== "not_directory")
-                allAbsent = false;
-            tail.push(parts.pop());
-        }
-        return undefined;
-    };
-    const parentOf = (canonical) => normalizeAbsPathLexically(`${canonical}/..`);
-    const resolve = async (p, signal) => {
-        const parts = p.split(/[\\/]/);
-        const first = parts.findIndex((seg) => seg === "..");
-        if (first < 0)
-            return await resolveWithoutParentSteps(p, signal);
-        const headEnd = parts.slice(0, first).reduce((n, seg) => n + seg.length + 1, 0);
-        let head = await resolveWithoutParentSteps(p.slice(0, headEnd) || "/", signal);
-        if (head === undefined)
-            return undefined;
-        let pending = [];
-        const flush = async () => {
-            if (pending.length === 0)
-                return true;
-            const next = await resolveWithoutParentSteps([head.value.replace(/[\\/]+$/, ""), ...pending].join("/"), signal);
-            pending = [];
-            if (next === undefined)
-                return false;
-            head = next;
-            return true;
-        };
-        for (let i = first; i < parts.length; i++) {
-            const seg = parts[i];
-            if (seg === "" || seg === ".")
-                continue;
-            if (seg !== "..") {
-                pending.push(seg);
-                continue;
-            }
-            if (!(await flush()))
-                return undefined;
-            if (!head.exact)
-                return head;
-            head = { value: parentOf(head.value), exact: true };
-        }
-        return (await flush()) ? head : undefined;
-    };
-    const literalRootHead = (p, roots) => {
-        let best;
-        for (const r of [...readRoots, ...roots]) {
-            if (!r)
-                continue;
-            const withSep = r.endsWith("/") || r.endsWith("\\") ? r : `${r}/`;
-            if (p !== r && !p.startsWith(withSep))
-                continue;
-            if (best === undefined || r.length > best.length)
-                best = r;
-        }
-        return best;
-    };
-    const expandGlobCandidate = async (p, roots, signal) => {
-        const head = literalRootHead(p, roots);
-        let segs = pathSegmentsFrom(p, head?.length ?? 0);
-        let first = segs.findIndex((s) => GLOB_METACHAR_RE.test(s.text));
-        if (first < 0 && head !== undefined && GLOB_METACHAR_RE.test(head)) {
-            segs = pathSegmentsFrom(p, 0);
-            first = segs.findIndex((s) => GLOB_METACHAR_RE.test(s.text));
-        }
-        if (first < 0)
-            return undefined;
-        let frontier = [p.slice(0, segs[first].start).replace(/[\\/]+$/, "") || "/"];
-        let dirsUsed = 0;
-        let matches = 0;
-        const canonicalOfMatch = new Map();
-        for (let j = first; j < segs.length; j++) {
-            const seg = segs[j].text;
-            if (!GLOB_METACHAR_RE.test(seg)) {
-                frontier = frontier.map((d) => joinCandidate(d, seg));
-                continue;
-            }
-            const re = compileGlobSegment(seg);
-            if (re === undefined) {
-                return { unverifiable: `the pattern "${seg}" cannot be expanded to verify what it would read` };
-            }
-            const isLast = j === segs.length - 1;
-            const next = [];
-            for (const dir of frontier) {
-                if (++dirsUsed > MAX_GLOB_DIRS) {
-                    return { unverifiable: `"${p}" expands over more than ${MAX_GLOB_DIRS} directories, too many to enumerate to verify` };
-                }
-                const canonDir = await resolve(dir, signal);
-                if (canonDir !== undefined && canonDir.missing === true)
-                    continue;
-                if (canonDir !== undefined && !canonDir.exact) {
-                    return { unverifiable: `"${dir}" cannot be resolved to verify what "${seg}" would expand to` };
-                }
-                const listed = await env.listDir(canonDir?.value ?? dir, signal);
-                if (!listed.ok) {
-                    if (listed.error.code === "not_found" || listed.error.code === "not_directory")
-                        continue;
-                    return { unverifiable: `"${dir}" cannot be enumerated to verify what "${seg}" would expand to (${listed.error.code})` };
-                }
-                if (seg.startsWith(".")) {
-                    for (const dot of [".", ".."])
-                        if (re.test(dot))
-                            next.push(joinCandidate(dir, dot));
-                }
-                const canonDirHere = isLast ? canonDir?.value : undefined;
-                for (const entry of listed.value) {
-                    if (!globSegmentMatches(re, seg, entry.name))
-                        continue;
-                    if (++matches > MAX_GLOB_MATCHES) {
-                        return { unverifiable: `"${p}" expands to more than ${MAX_GLOB_MATCHES} names, too many to enumerate to verify` };
-                    }
-                    const candidate = joinCandidate(dir, entry.name);
-                    if (canonDirHere !== undefined && entry.kind !== "symlink")
-                        canonicalOfMatch.set(candidate, joinCandidate(canonDirHere, entry.name));
-                    next.push(candidate);
-                }
-            }
-            frontier = next;
-            if (frontier.length === 0)
-                return { paths: [], canonical: canonicalOfMatch };
-        }
-        return { paths: frontier, canonical: canonicalOfMatch };
-    };
-    return {
-        escapesAfterResolution: async (paths, ask, signal) => {
-            const deny = ask.deny;
-            if (lexicalOnly || (paths.literal.length === 0 && paths.patterns.length === 0))
-                return { escaping: [] };
-            const roots = await canonicalRoots(signal);
-            const escaping = [];
-            let unresolvable;
-            let denied;
-            const denyHit = (p) => {
-                if (deny === undefined || denied !== undefined)
-                    return false;
-                const folded = normalizeAbsPathLexically(p);
-                if (ask.denyAnswered.has(folded))
-                    return false;
-                const pattern = deny(folded);
-                if (pattern === null)
-                    return false;
-                denied = { path: folded, pattern };
-                return true;
-            };
-            const judge = async (p, canonicalKnown, origin) => {
-                if (denyHit(p))
-                    return;
-                const real = canonicalKnown !== undefined ? { value: canonicalKnown, exact: true } : await resolve(p, signal);
-                if (real === undefined) {
-                    if (resolverIsAuthoritative)
-                        unresolvable ??= `"${p}" cannot be resolved to verify where it reads`;
-                    return;
-                }
-                if (!real.exact && real.missing !== true) {
-                    unresolvable ??= `"${p}" cannot be resolved to verify where it reads`;
-                    return;
-                }
-                if (denyHit(real.value))
-                    return;
-                if (ask.containmentAnswered.has(normalizeAbsPathLexically(origin ?? p)))
-                    return;
-                if (ask.containment && !withinAnyRoot(roots, real.value) && !escaping.includes(real.value))
-                    escaping.push(real.value);
-            };
-            for (const p of paths.literal) {
-                if (denied !== undefined)
-                    break;
-                await judge(p);
-            }
-            for (const p of paths.patterns) {
-                if (denied !== undefined)
-                    break;
-                const expanded = await expandGlobCandidate(p, roots, signal);
-                if (expanded !== undefined && "unverifiable" in expanded) {
-                    unresolvable ??= expanded.unverifiable;
-                    continue;
-                }
-                if (expanded !== undefined && expanded.paths.length > 0) {
-                    for (const t of expanded.paths) {
-                        if (denied !== undefined)
-                            break;
-                        await judge(t, expanded.canonical.get(t), p);
-                    }
-                }
-                else
-                    await judge(p);
-            }
-            if (denied !== undefined)
-                return { escaping, denied };
-            return unresolvable === undefined ? { escaping } : { escaping, unverifiable: unresolvable };
-        },
-        canonicalOf: async (path, signal) => {
-            if (lexicalOnly)
-                return undefined;
-            const real = await resolve(path, signal);
-            return real === undefined || (!real.exact && real.missing !== true) ? undefined : real.value;
-        },
-        allResolveInside: async (paths, signal) => {
-            if (lexicalOnly || paths.length === 0)
-                return false;
-            const roots = await canonicalRoots(signal);
-            for (const p of paths) {
-                const real = await resolve(p, signal);
-                if (real === undefined || (!real.exact && real.missing !== true))
-                    return false;
-                if (!withinAnyRoot(roots, real.value))
-                    return false;
-            }
-            return true;
-        },
-    };
-}
-const NOTHING_ANSWERED = new Set();
+import { createCanonicalReadBoundary, NOTHING_ANSWERED } from "./shell-read-establish.js";
 export function createShellCanonicalRecheck(env, readBoundary, face) {
     const recheckReaders = new Set(bashClassifyDefaultAllow());
     let canonicalForRoots;