@sema-agent/core 7.24.3 → 7.25.0

package/dist/tools/fs/bash-readonly-classifier.js

@@ -1,7 +1,6 @@
-import { sensitivePathDenyList } from "./read-deny.js";
-import { hasWin32AliasedComponent, isAbsoluteForFamily, isAbsolutePathForm, isBlockedDevicePath, isShellRootedSpellingUnmapped, joinForFamily, nativeUncSpellingOf, normalizeAbsPathLexically, win32NamespaceScreen, pathFamilyOf, withinAnyRoot } from "./safety.js";
-import { lexShellText, literalTildeSpelling, quoteMask, substitutionsInHeredocBody, SUBSTITUTION_PLACEHOLDER, wordsOf, } from "./bash-lexer.js";
-import { ASSIGNMENT_WORD, COMMAND_LAUNCHERS, NOT_AUTO_ALLOWED, SHELL_BLOCK_WORDS, argvReentryUnjudged, isBareControlWord, programPositionRunsShell, shellScanDeclineOf, programBasename, programPositionRefusalSentence, readProgramPosition, } from "./bash-program-position.js";
+import { isAbsoluteForFamily, isAbsolutePathForm, isBlockedDevicePath, isShellRootedSpellingUnmapped, joinForFamily, nativeUncSpellingOf, normalizeAbsPathLexically, win32NamespaceScreen, pathFamilyOf } from "./safety.js";
+import { lexShellText, literalTildeSpelling, quoteMask, wordsOf, } from "./bash-lexer.js";
+import { ASSIGNMENT_WORD, COMMAND_LAUNCHERS, NOT_AUTO_ALLOWED, SHELL_BLOCK_WORDS, argvReentryUnjudged, isBareControlWord, programPositionRefusalSentence, readProgramPosition, } from "./bash-program-position.js";
 export const BASH_READONLY_DEFAULT_ALLOW = [
     "ls", "cat", "head", "tail", "wc", "pwd", "echo", "whoami", "uname",
     "grep", "cut", "tr", "basename", "dirname", "stat", "du", "df", "which",
@@ -154,55 +153,12 @@ function stripExemptRedirections(command) {
     flush();
     return out;
 }
-const POLL_LOOP_CAUSE_MAX_PATHS = 3;
 export function formatOutOfRootReadApprovalOption(directory) {
     const trimmed = directory.replace(/[/\\]+$/, "");
     const cut = Math.max(trimmed.lastIndexOf("/"), trimmed.lastIndexOf("\\"));
     const leaf = cut >= 0 ? trimmed.slice(cut + 1) : trimmed;
     return `Yes, allow reading from ${leaf || directory}/ from this project`;
 }
-function parentDirLexically(p) {
-    return normalizeAbsPathLexically(`${p}/..`);
-}
-export function deepestCommonDir(a, b) {
-    if (a === b)
-        return a;
-    const shorter = Math.min(a.length, b.length);
-    let end = 0;
-    let i = 0;
-    while (i < shorter && a[i] === b[i]) {
-        if (a[i] === "/" || a[i] === "\\")
-            end = i;
-        i++;
-    }
-    if (i === shorter && (a[shorter] === "/" || a[shorter] === "\\" || b[shorter] === "/" || b[shorter] === "\\"))
-        end = shorter;
-    const cut = a.slice(0, end);
-    const candidate = cut.includes("/") || cut.includes("\\") ? cut : a.slice(0, end + 1);
-    if (candidate.length === 0 || !withinAnyRoot([candidate], a) || !withinAnyRoot([candidate], b))
-        return undefined;
-    return candidate;
-}
-function outOfRootGrantCandidateOf(paths, boundary) {
-    if (paths.length === 0)
-        return undefined;
-    if (paths.some(hasWin32AliasedComponent))
-        return undefined;
-    let candidate = parentDirLexically(paths[0]);
-    for (const path of paths.slice(1)) {
-        if (candidate === undefined)
-            return undefined;
-        candidate = deepestCommonDir(candidate, parentDirLexically(path));
-    }
-    if (candidate === undefined)
-        return undefined;
-    const tooWide = parentDirLexically(candidate) === candidate ||
-        (boundary.homeDir !== undefined && withinAnyRoot([candidate], boundary.homeDir)) ||
-        boundary.roots.some((root) => withinAnyRoot([candidate], root));
-    if (tooWide)
-        return paths.length === 1 ? { path: paths[0], exact: true } : undefined;
-    return { path: candidate };
-}
 export const NO_PATH_OPERAND_COMMANDS = new Set([
     "pwd", "echo", "printf", "whoami", "uname", "which", "tr", "basename", "dirname",
     "cal", "uptime", "id", "groups", "nproc", "locale", "free", "true", "false", "seq", "expr", "type", "sleep",
@@ -243,193 +199,7 @@ function spellingsOf(absolute) {
 function reheadSegment(toks, head, from = 0) {
     return { folded: [head, ...toks.folded.slice(from + 1)], raw: [head, ...toks.raw.slice(from + 1)] };
 }
-function tokensMoveBase(toks) {
-    const pos = readProgramPosition(toks);
-    if (pos.written === undefined)
-        return false;
-    const written = toks.folded[pos.written];
-    if (toks.raw[pos.written] !== written)
-        return true;
-    if (pos.assignments.length > 0)
-        return false;
-    if (pos.launchers.length === 0) {
-        if (written.startsWith("-") && written !== "-")
-            return true;
-        return written === "cd";
-    }
-    if (!COMMAND_LAUNCHERS.has(written))
-        return false;
-    return pos.refusal !== undefined || pos.program?.basename === "cd";
-}
 export const SHELL_REENTRY_PROGRAM_RE = /^(?:(?:ba|z|da|k|fi|a|mk|ya|pdk|c|tc)?sh|eval|source|\.|parallel)$/;
-export function refusedCommandMayRead(command, allow, boundary, declinesAreEvidence) {
-    const scan = { declined: false };
-    const exempt = refusedCommandExempt(command, allow, boundary, declinesAreEvidence, scan, 0);
-    return { mayRead: !exempt, declined: scan.declined };
-}
-const STDIN_ONLY_READER_FLAGS = new Map([
-    ["cat", /^-[AbeEnstTuv]+$/],
-    ["wc", /^-[clmwL]+$/],
-]);
-function whitelistSegment(segment) {
-    const tokens = [...segment.tokens];
-    for (let k = 0; k + 2 < tokens.length; k++) {
-        const [a, b, c] = [tokens[k], tokens[k + 1], tokens[k + 2]];
-        if (a.kind === "word" && b.kind === "group" && b.op === "(" && c.kind === "group" && c.op === ")" && /^[A-Za-z_][A-Za-z0-9_]*$/.test(a.folded))
-            tokens.splice(k, 3);
-    }
-    const words = tokens.filter((t) => t.kind === "word" && !(t.raw === t.folded && (t.folded === "{" || t.folded === "}")));
-    let from = 0;
-    while (from < words.length && SHELL_BLOCK_WORDS.has(words[from].folded))
-        from++;
-    return {
-        words: { folded: words.slice(from).map((w) => w.folded), raw: words.slice(from).map((w) => w.raw) },
-        redirects: tokens.filter((t) => t.kind === "redirect"),
-    };
-}
-function refusedCommandExempt(command, allow, boundary, declinesAreEvidence, scan, depth, baseMovedOutside = false) {
-    if (depth > 4)
-        return false;
-    const lexed = lexShellText(command, { mode: "lenient" });
-    if ("reject" in lexed)
-        return false;
-    const bodies = [...lexed.substitutions];
-    const segments = [];
-    for (const segment of lexed.segments) {
-        for (const t of segment.tokens) {
-            if (t.kind !== "heredoc" || t.quoted)
-                continue;
-            const inner = substitutionsInHeredocBody(t.body);
-            if (inner === undefined)
-                return false;
-            for (const body of inner)
-                bodies.push(body);
-        }
-        segments.push(whitelistSegment(segment));
-    }
-    let declined;
-    for (const { words } of segments) {
-        const pos = readProgramPosition(words);
-        if (programPositionRunsShell(pos, SHELL_REENTRY_PROGRAM_RE))
-            return false;
-        const decline = shellScanDeclineOf(pos, XARGS_TARGETS_ACCEPTED_UNJUDGED);
-        if (decline !== undefined)
-            scan.declined = true;
-        if (decline !== undefined && declinesAreEvidence.has(decline))
-            return false;
-        declined ??= decline;
-    }
-    if (declined !== undefined)
-        return true;
-    const baseMoved = baseMovedOutside ||
-        segments.some(({ words }) => {
-            const runs = readProgramPosition(words).program?.basename;
-            return runs === "cd" || (runs !== undefined && UNMODELLED_BASE_MOVERS.has(runs));
-        });
-    for (const body of bodies) {
-        const walked = classifyCompoundReadonlyDetailed(body, allow, boundary);
-        const fullyGreen = !baseMoved && walked.reason === undefined && walked.readDenied !== true && walked.outOfRootRead !== true && walked.refusedWhole !== true &&
-            (walked.undecidedPaths?.length ?? 0) === 0 && (walked.unresolvedOperands?.length ?? 0) === 0 && (walked.recursiveReadPaths?.length ?? 0) === 0;
-        if (fullyGreen)
-            continue;
-        if (!refusedCommandExempt(body, allow, boundary, declinesAreEvidence, scan, depth + 1, baseMoved))
-            return false;
-    }
-    const stdinFileJudgedInside = (word) => {
-        if (word === undefined || word === "" || word.includes(SUBSTITUTION_PLACEHOLDER) || UNREADABLE_WHITELIST_WORD.test(word))
-            return false;
-        if (boundary === undefined || baseMoved)
-            return false;
-        const resolved = resolveOperandLexically(boundary.cwd ?? boundary.roots[0], word, boundary.homeDir);
-        if (resolved === undefined || boundary.denyMatch?.(resolved) != null)
-            return false;
-        return boundary.face === "open" || withinAnyRoot(boundary.roots, resolved);
-    };
-    const unlistedSegmentJudgedInside = (words, from, leadingAssignments = []) => {
-        if (boundary === undefined)
-            return true;
-        const assignmentJudgedInside = (word) => {
-            const payload = assignmentWordPayload(word);
-            return payload === undefined || (payload.kind === "value" && stdinFileJudgedInside(payload.value));
-        };
-        for (const k of leadingAssignments) {
-            if (k >= from)
-                continue;
-            if (!assignmentJudgedInside(words.folded[k]))
-                return false;
-        }
-        const argv = argvProgramOf(words);
-        const argvStart = argv?.from ?? words.folded.length;
-        const declaredNotPaths = ASSIGNMENT_VALUE_NOT_PATHS.has(argv?.program ?? "");
-        let endOfOptions = false;
-        for (let j = from; j < words.folded.length; j++) {
-            const word = words.folded[j];
-            if (j > from && !endOfOptions && word === "--") {
-                endOfOptions = true;
-                continue;
-            }
-            if (j === from && !isPathShapedToken(word)) {
-                if (UNREADABLE_WHITELIST_WORD.test(word) || word.includes(SUBSTITUTION_PLACEHOLDER))
-                    return false;
-                continue;
-            }
-            const optionShaped = !endOfOptions && word.startsWith("-") && word !== "-";
-            const candidates = optionShaped ? [...attachedOptionPayloads(word), ...(isPathShapedToken(word) ? [word] : [])] : [word];
-            for (const candidate of candidates) {
-                if (!stdinFileJudgedInside(candidate))
-                    return false;
-            }
-            if (!optionShaped && (j < argvStart || !declaredNotPaths) && !assignmentJudgedInside(word))
-                return false;
-        }
-        return true;
-    };
-    for (const { words, redirects } of segments) {
-        for (const r of redirects)
-            if (r.op === "<" && !stdinFileJudgedInside(r.target?.folded))
-                return false;
-        const pos = readProgramPosition(words);
-        for (const k of words.folded.keys()) {
-            const word = words.folded[k];
-            if (ASSIGNMENT_WORD.test(word) && /\$\(|`/.test(word) && (pos.assignments.includes(k) || pos.launchers.some((l) => l.index < k)))
-                return false;
-        }
-        const program = pos.program;
-        const listed = (name) => allow.has(name) || name === "cd";
-        if (program === undefined) {
-            if (pos.launchers.length === 0)
-                continue;
-            if (!unlistedSegmentJudgedInside(words, pos.launchers[0].index, pos.assignments))
-                return false;
-            continue;
-        }
-        if (program.name.includes(SUBSTITUTION_PLACEHOLDER) || /[$`]/.test(program.name))
-            return false;
-        if (pos.launchers.length > 0 && !listed(program.basename)) {
-            if (!unlistedSegmentJudgedInside(words, pos.launchers[0].index, pos.assignments))
-                return false;
-            continue;
-        }
-        const head = program.basename;
-        if (head === "cd" || UNMODELLED_BASE_MOVERS.has(head))
-            continue;
-        if (!allow.has(head)) {
-            if (!unlistedSegmentJudgedInside(words, program.index, pos.assignments))
-                return false;
-            continue;
-        }
-        if (NO_PATH_OPERAND_COMMANDS.has(head))
-            continue;
-        const flags = STDIN_ONLY_READER_FLAGS.get(head);
-        if (flags === undefined)
-            return false;
-        for (let j = program.index + 1; j < words.folded.length; j++) {
-            if (!flags.test(words.folded[j]))
-                return false;
-        }
-    }
-    return true;
-}
 function tokenizeSegment(segment) {
     const lexed = lexShellText(segment, { mode: "strict", connectors: "text" });
     if ("reject" in lexed)
@@ -922,7 +692,7 @@ function sedReadingKind(reading) {
 }
 function readSedScript(script) {
     if (script.split("\n").some((line) => utf8Length(line) >= SED_SCRIPT_LINE_LIMIT))
-        return "unseen";
+        return "oversized";
     let i = 0;
     let depth = 0;
     const len = script.length;
@@ -1231,8 +1001,10 @@ export function sedScriptSlotFiles(args) {
     const writes = new Set();
     const commands = new Set();
     let executesPatternSpace = false;
+    const kinds = [];
     for (const dialect of SED_OPTION_DIALECTS) {
         const reading = readSedInvocationDetailed(args, dialect);
+        kinds.push(sedReadingKind(reading));
         if (typeof reading === "string")
             continue;
         for (const f of reading.names.reads)
@@ -1243,12 +1015,17 @@ export function sedScriptSlotFiles(args) {
             commands.add(c);
         executesPatternSpace ||= reading.names.executesPatternSpace;
     }
-    return { reads: [...reads], writes: [...writes], commands: [...commands], executesPatternSpace };
+    const unread = kinds.includes("oversized")
+        ? "a script line is longer than an implementation compiles whole, so what runs is not the text written here"
+        : kinds.every((k) => k === "unparsed")
+            ? "its script could not be read to its end"
+            : undefined;
+    return { reads: [...reads], writes: [...writes], commands: [...commands], executesPatternSpace, ...(unread !== undefined ? { unread } : {}) };
 }
 const SCRIPT_SLOT_VERBS = new Map([
     ["sed", (args) => {
             const readings = SED_OPTION_DIALECTS.map((dialect) => readSedInvocation(args, dialect));
-            if (readings.includes("names") || readings.includes("unseen"))
+            if (readings.includes("names") || readings.includes("unseen") || readings.includes("oversized"))
                 return true;
             return readings.every((reading) => reading === "unparsed");
         }],
@@ -1711,182 +1488,6 @@ export function attachedOptionPayloads(tok) {
     }
     return out;
 }
-function collectSegmentBoundaryFindings(tokens, boundary) {
-    const name = tokens.folded[0];
-    const slotVerb = tokens.slotVerb ?? name;
-    const declaredNotPaths = ASSIGNMENT_VALUE_NOT_PATHS.has(tokens.argvProgram ?? slotVerb);
-    const argvFrom = tokens.argvFrom ?? (tokens.slotVerb === undefined ? 1 : Number.MAX_SAFE_INTEGER);
-    if (NO_PATH_OPERAND_COMMANDS.has(name))
-        return [];
-    const declaresNoPathOperands = tokens.slotVerb !== undefined && NO_PATH_OPERAND_COMMANDS.has(tokens.slotVerb) && tokens.argvFrom !== undefined;
-    const args = declaresNoPathOperands ? tokens.folded.slice(1, tokens.argvFrom + 1) : tokens.folded.slice(1);
-    const findings = [];
-    const candidates = [];
-    const bareWordOperands = [];
-    const judgeOperand = (text, globbed) => {
-        (isPathShapedToken(text) || isAbsolutePathForm(text) ? candidates : bareWordOperands).push({ text, globbed });
-    };
-    const positionalOperands = [];
-    const argvOperandsStartAt = tokens.slotVerb !== undefined ? 1 : 0;
-    let stdinOperand = false;
-    const argGlobs = (k) => {
-        const raw = tokens.raw[k + 1];
-        return raw !== undefined && hasUnquotedGlobMetachar(raw);
-    };
-    const expandingArgs = new Set();
-    tokens.raw.slice(1).forEach((rawArg, k) => {
-        if (!hasUnquotedExpansionMetachar(rawArg))
-            return;
-        expandingArgs.add(k);
-        findings.push({
-            kind: "unresolvable",
-            operand: rawArg,
-            reason: `"${name}" is given the argument "${rawArg}", which the shell expands (brace/variable/command expansion) before the command runs — the path it would actually read cannot be resolved statically, so it is not auto-allowed`,
-        });
-    });
-    if (name === "cd" && expandingArgs.size > 0)
-        return findings;
-    if (name === "cd") {
-        const targetIdx = args.findIndex((t) => !t.startsWith("-") || t === "-");
-        const target = targetIdx === -1 ? undefined : args[targetIdx];
-        if (target !== undefined && argGlobs(targetIdx)) {
-            return [{ kind: "unresolvable", operand: target, reason: `\`cd\` is given the pattern "${target}", which the shell expands to a directory this check cannot know ${NOT_AUTO_ALLOWED}` }];
-        }
-        if (target === undefined) {
-            return [{ kind: "unresolvable", operand: "cd", reason: '`cd` with no argument targets the home directory, which cannot be checked against the allowed directories ' + NOT_AUTO_ALLOWED }];
-        }
-        if (target === "-") {
-            return [{ kind: "unresolvable", operand: "-", reason: '`cd -` targets the previous working directory, which cannot be resolved statically ' + NOT_AUTO_ALLOWED }];
-        }
-        candidates.push({ text: target, globbed: false });
-    }
-    else {
-        const eoo = args.indexOf("--");
-        const firstOperandSlot = VERB_OPTION_SLOTS[name]?.firstOperand;
-        const firstOperandSuppliedByFlag = firstOperandSlot !== undefined && (eoo === -1 ? args : args.slice(0, eoo)).some((t) => suppliesFirstOperandSlot(firstOperandSlot, t));
-        let sawOperand = false;
-        let sawArgvOperand = false;
-        let endOfOptions = false;
-        for (let k = 0; k < args.length; k++) {
-            const t = args[k];
-            if (expandingArgs.has(k))
-                continue;
-            if (!endOfOptions) {
-                if (t === "--") {
-                    endOfOptions = true;
-                    continue;
-                }
-                if (t.startsWith("-") && t !== "-") {
-                    const slot = readVerbOptionSlot(slotVerb, t);
-                    const permutes = !verbOptionsArePositionIndependent(slotVerb);
-                    if (sawArgvOperand && permutes) {
-                        judgeOperand(t, argGlobs(k));
-                        if (slot !== undefined && slot.form === "separated") {
-                            const ahead = args[k + 1];
-                            if (ahead !== undefined && !expandingArgs.has(k + 1)) {
-                                for (const c of slotValueCandidates(ahead, slot.kind))
-                                    judgeOperand(c, argGlobs(k + 1));
-                            }
-                        }
-                    }
-                    if (slot !== undefined && slot.form !== "unexplained" && !(slot.form === "separated" && sawArgvOperand && permutes)) {
-                        if (slot.form === "attached") {
-                            for (const c of slotValueCandidates(literalTildeSpelling(slot.value), slot.kind))
-                                judgeOperand(c, argGlobs(k));
-                        }
-                        else if (slot.form === "separated") {
-                            const value = args[++k];
-                            if (value !== undefined && !expandingArgs.has(k)) {
-                                const named = slotValueCandidates(value, slot.kind);
-                                for (const c of named)
-                                    judgeOperand(c, argGlobs(k));
-                                if (named.length > 0)
-                                    positionalOperands.push(value);
-                            }
-                        }
-                        continue;
-                    }
-                    for (const payload of attachedOptionPayloads(t))
-                        judgeOperand(payload, argGlobs(k));
-                    continue;
-                }
-            }
-            const inFirstOperandSlot = firstOperandSlot !== undefined && !firstOperandSuppliedByFlag && !sawOperand;
-            sawOperand = true;
-            if (k >= argvOperandsStartAt)
-                sawArgvOperand = true;
-            if (t === "-") {
-                if (inFirstOperandSlot)
-                    continue;
-                const m = RECURSIVE_READ_FORMS[slotVerb];
-                if (m === undefined || m.dashIsStdin === true) {
-                    stdinOperand = true;
-                    continue;
-                }
-                if (k >= argvOperandsStartAt)
-                    positionalOperands.push(t);
-                continue;
-            }
-            if (inFirstOperandSlot) {
-                const named = slotValueCandidates(t, firstOperandSlot.kind);
-                for (const c of named)
-                    judgeOperand(c, argGlobs(k));
-                if (named.length > 0 && k >= argvOperandsStartAt)
-                    positionalOperands.push(t);
-                continue;
-            }
-            if (k >= argvOperandsStartAt)
-                positionalOperands.push(t);
-            judgeOperand(t, argGlobs(k));
-            const payload = assignmentWordPayload(t);
-            if (payload !== undefined && (k + 1 < argvFrom || !declaredNotPaths)) {
-                if (payload.kind === "value")
-                    judgeOperand(payload.value, argGlobs(k));
-                else
-                    findings.push({ kind: "unresolvable", operand: t, reason: `"${name}": ${payload.reason} ${NOT_AUTO_ALLOWED}` });
-            }
-        }
-    }
-    for (let k = 0; k < args.length; k++) {
-        if (!argGlobs(k) || expandingArgs.has(k))
-            continue;
-        const r = resolveOperandSpellings(boundary.cwd ?? boundary.roots[0], args[k], boundary.homeDir);
-        findings.push({ kind: "undecided", path: r?.folded ?? args[k], ...(r?.spelled !== undefined ? { spelled: r.spelled } : {}) });
-    }
-    for (const { text: candidate, globbed } of candidates) {
-        const spellings = resolveOperandSpellings(boundary.cwd ?? boundary.roots[0], candidate, boundary.homeDir);
-        if (spellings === undefined) {
-            findings.push({
-                kind: "unresolvable",
-                operand: candidate,
-                reason: `"${name}" names the path "${candidate}", which cannot be resolved statically ${NOT_AUTO_ALLOWED}`,
-            });
-            continue;
-        }
-        const resolved = spellings.folded;
-        if (withinAnyRoot(boundary.roots, resolved)) {
-            if (!globbed)
-                findings.push({ kind: "inside", path: resolved, ...(spellings.spelled !== undefined ? { spelled: spellings.spelled } : {}) });
-        }
-        else
-            findings.push({ kind: "outside", command: name, path: resolved, ...(spellings.spelled !== undefined ? { spelled: spellings.spelled } : {}) });
-    }
-    for (const { text: operand, globbed } of bareWordOperands) {
-        const spellings = resolveOperandSpellings(boundary.cwd ?? boundary.roots[0], operand, boundary.homeDir);
-        if (spellings === undefined)
-            continue;
-        if (!globbed && withinAnyRoot(boundary.roots, spellings.folded))
-            findings.push({ kind: "inside", path: spellings.folded, ...(spellings.spelled !== undefined ? { spelled: spellings.spelled } : {}) });
-    }
-    if (boundary.denyMatch !== undefined && (boundary.denyEntries?.length ?? 1) > 0 && segmentSelectsRecursiveRead(slotVerb, args.slice(argvOperandsStartAt))) {
-        const roots = positionalOperands.length > 0 ? positionalOperands : stdinOperand ? [] : ["."];
-        for (const operand of roots) {
-            const resolved = resolveOperandLexically(boundary.cwd ?? boundary.roots[0], operand, boundary.homeDir);
-            findings.push({ kind: "recursive", path: resolved ?? operand });
-        }
-    }
-    return findings;
-}
 export function foldHomeVariableSpelling(command, homeDir) {
     if (homeDir === undefined || !command.includes("$") || /[\\`]/.test(command))
         return command;
@@ -1945,11 +1546,11 @@ function segmentCompoundForReadonly(command, homeDir) {
         : redirectionStripped;
     return splitShellCompoundSegments(terminatorStripped, { trailingTerminator: "keep" });
 }
-export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts) {
+export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
     const split = segmentCompoundForReadonly(command, boundary?.homeDir);
     if ("reject" in split)
-        return { reason: split.reject, refusedWhole: true };
-    const { segments, pipeFed, connectors } = split;
+        return { reason: split.reject };
+    const { segments, pipeFed } = split;
     let nameRefusal;
     const unlistedSegments = new Set();
     const reheaded = new Map();
@@ -1962,7 +1563,7 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
         if (written === undefined)
             return { reason: "empty command" };
         if (written === "coproc")
-            return { reason: "`coproc` backgrounds a command — a backgrounded process outlives the command", refusedWhole: true };
+            return { reason: "`coproc` backgrounds a command — a backgrounded process outlives the command" };
         if (isBareControlWord(toks, from, SHELL_BLOCK_WORDS)) {
             unlistedSegments.add(si);
             nameRefusal ??= `command "${written}" is not in the read-only allowlist`;
@@ -1976,13 +1577,13 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
         }
         const parsed = parseLeadingCommandName(toks.raw.slice(from).join(" "), { quotedOperatorsAreText: true, pathPrefixedNameIsText: true });
         if ("reject" in parsed)
-            return { reason: parsed.reject, refusedWhole: true };
+            return { reason: parsed.reject };
         const pathPrefixed = parsed.name.includes("/");
         const name = pathPrefixed ? parsed.name.slice(parsed.name.lastIndexOf("/") + 1) : parsed.name;
         if (pathPrefixed)
             nameRefusal ??= "the command must be a bare name resolved via PATH (no path prefix)";
         if (pos.refusal !== undefined)
-            return { reason: programPositionRefusalSentence(pos.refusal), refusedWhole: true };
+            return { reason: programPositionRefusalSentence(pos.refusal) };
         if (allow.has(name)) {
             if (pathPrefixed || from > 0)
                 reheaded.set(si, { from, head: name });
@@ -1992,14 +1593,14 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
         }
         nameRefusal ??= `command "${parsed.name}" is not in the read-only allowlist`;
         if (SHELL_REENTRY_PROGRAM_RE.test(name))
-            return { reason: unjudgedProgramTextRefusal(parsed.name, "runs its argument as shell text"), refusedWhole: true };
+            return { reason: unjudgedProgramTextRefusal(parsed.name, "runs its argument as shell text") };
         if (pos.launchers.length > 0) {
             const listed = program !== undefined && (allow.has(program.basename) || program.basename === "cd");
             if (program !== undefined && !listed && SHELL_REENTRY_PROGRAM_RE.test(program.basename)) {
-                return { reason: `"${written}" runs "${program.basename}", which runs its argument as shell text this walk does not judge ${NOT_AUTO_ALLOWED}`, refusedWhole: true };
+                return { reason: `"${written}" runs "${program.basename}", which runs its argument as shell text this classifier does not read ${NOT_AUTO_ALLOWED}` };
             }
             if (argvReentryUnjudged(pos, XARGS_TARGETS_ACCEPTED_UNJUDGED)) {
-                return { reason: `"${written}" takes the operands of the program it runs from its standard input, which this walk does not judge ${NOT_AUTO_ALLOWED}`, refusedWhole: true };
+                return { reason: `"${written}" takes the operands of the program it runs from its standard input, which this classifier does not read ${NOT_AUTO_ALLOWED}` };
             }
             if (!listed || program === undefined)
                 unlistedSegments.add(si);
@@ -2039,44 +1640,16 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
     };
     const STDIN_FILE_FLOOR = { cat: 1, grep: 2, head: 1, tail: 1, wc: 1, cut: 1, tr: Infinity, diff: 2, cmp: 2, comm: 2, sed: 2 };
     const foldedSegments = [];
-    const foldedReach = [];
-    let crossedAllAnd = true;
-    let crossedAnyOr = false;
     let shapeRefusal = nameRefusal;
     for (let si = 0; si < segments.length; si++) {
-        if (si > 0) {
-            if (connectors[si] !== "&&")
-                crossedAllAnd = false;
-            if (connectors[si] === "||")
-                crossedAnyOr = true;
-        }
-        const moveProvable = pipeFed[si] !== true && pipeFed[si + 1] !== true && reheaded.get(si) === undefined;
-        const pushReach = () => {
-            foldedReach.push({ andJoined: si > 0 && crossedAllAnd, orBroken: !crossedAllAnd && crossedAnyOr, moveProvable });
-            crossedAllAnd = true;
-            crossedAnyOr = false;
-        };
-        if (unlistedSegments.has(si)) {
-            const unlisted = tokenizeSegment(segments[si]);
-            if (unlisted.folded.length === 0)
-                continue;
-            const unlistedArgv = argvProgramOf(unlisted);
-            foldedSegments.push({
-                folded: [LAUNCHER_SCAN_HEAD, ...unlisted.folded],
-                raw: [LAUNCHER_SCAN_HEAD, ...unlisted.raw],
-                slotVerb: programBasename(unlisted.folded[0]),
-                ...(unlistedArgv !== undefined ? { argvProgram: unlistedArgv.program, argvFrom: unlistedArgv.from + 1 } : {}),
-            });
-            pushReach();
+        if (unlistedSegments.has(si))
             continue;
-        }
         const rehead = reheaded.get(si);
         const segmentTokens = rehead === undefined ? tokenizeSegment(segments[si]) : reheadSegment(tokenizeSegment(segments[si]), rehead.head, rehead.from);
         const toks = segmentTokens.folded;
         if (toks.length === 0)
             continue;
         foldedSegments.push(segmentTokens);
-        pushReach();
         const name = toks[0];
         const guardReason = guardedVerbFormReason(name, toks, segmentTokens.raw);
         if (guardReason !== undefined) {
@@ -2152,311 +1725,13 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
             shapeRefusal ??= "reads a device/special file that is either unbounded (/dev/zero, /dev/stdin, /proc/<pid>/fd/0, … — blocks the pipeline until the tool timeout) or process-private (/proc/<pid>/environ, /proc/<pid>/mem, …) " + NOT_AUTO_ALLOWED;
         }
     }
-    if (opts?.iterated !== true) {
-        const cdSegments = foldedSegments.filter((st) => st.folded[0] === "cd");
-        if (cdSegments.length > 1)
-            shapeRefusal ??= `multiple directory changes in one command require approval for clarity ${NOT_AUTO_ALLOWED}`;
-    }
-    if (boundary !== undefined) {
-        const walk = evaluateReadBoundary(foldedSegments, boundary, true, foldedReach);
-        if (shapeRefusal === undefined)
-            return walk;
-        const { reason: _walkSentence, outOfRootGrantCandidate: walkGrantCandidate, outOfRootGrantCoversExactPath: walkGrantExact, ...structure } = walk;
-        const nameOnly = shapeRefusal === nameRefusal;
-        return {
-            ...structure,
-            reason: shapeRefusal,
-            ...(nameOnly && walkGrantCandidate !== undefined ? { outOfRootGrantCandidate: walkGrantCandidate, ...(walkGrantExact === true ? { outOfRootGrantCoversExactPath: true } : {}) } : {}),
-            ...(nameOnly ? { segmentNameRefusal: true } : {}),
-        };
-    }
-    if (shapeRefusal !== undefined)
-        return { reason: shapeRefusal };
-    if (foldedSegments.some((st) => st.folded[0] === "cd")) {
-        return { reason: `\`cd\` cannot be judged without a read boundary (no base to resolve the directory change against) ${NOT_AUTO_ALLOWED}` };
-    }
-    return {};
+    const cdSegments = foldedSegments.filter((st) => st.folded[0] === "cd");
+    if (cdSegments.length > 1)
+        shapeRefusal ??= `multiple directory changes in one command require approval for clarity ${NOT_AUTO_ALLOWED}`;
+    return shapeRefusal !== undefined ? { reason: shapeRefusal } : {};
 }
-const BASE_CANDIDATE_MAX = 256;
-function evaluateReadBoundary(foldedSegments, boundary, mintGrantCandidate, reach) {
-    const seen = { outside: new Set(), inside: new Set(), undecided: new Set(), recursive: new Set(), unresolved: new Set(), checkedSpelled: new Set(), undecidedSpelled: new Set(), outsideSpelled: new Set() };
-    const outside = [];
-    const inside = [];
-    let unresolvable;
-    const unresolved = [];
-    let baseLost = false;
-    const undecided = [];
-    const checkedSpellings = [];
-    const undecidedSpellings = [];
-    const outOfRootSpellings = [];
-    const recordSpelling = (into, seenHere, finding) => {
-        if (finding.spelled === undefined || seenHere.has(finding.spelled))
-            return;
-        seenHere.add(finding.spelled);
-        into.push(finding.spelled);
-    };
-    const recursive = [];
-    let candidates = [{ base: boundary.cwd ?? boundary.roots[0], skippedCd: -1 }];
-    let andRunStart = 0;
-    const findingsByWords = new Map();
-    const findingsRowFor = (wordsKey) => {
-        const row = findingsByWords.get(wordsKey);
-        if (row !== undefined)
-            return row;
-        const fresh = new Map();
-        findingsByWords.set(wordsKey, fresh);
-        return fresh;
-    };
-    const findingsFor = (row, toks, base) => {
-        const hit = row.get(base);
-        if (hit !== undefined)
-            return hit;
-        const segBoundary = base === (boundary.cwd ?? boundary.roots[0]) ? boundary : { ...boundary, cwd: base };
-        const computed = collectSegmentBoundaryFindings(toks, segBoundary);
-        row.set(base, computed);
-        return computed;
-    };
-    for (let si = 0; si < foldedSegments.length; si++) {
-        const toks = foldedSegments[si];
-        if (baseLost)
-            break;
-        if (si > 0 && reach?.[si]?.andJoined !== true)
-            andRunStart = reach?.[si]?.orBroken === true ? si + 1 : si;
-        const reachable = candidates.filter((c) => c.skippedCd < andRunStart);
-        const row = findingsRowFor(JSON.stringify([toks.folded, toks.raw, toks.slotVerb]));
-        for (const { base: currentBase } of reachable) {
-            for (const finding of findingsFor(row, toks, currentBase)) {
-                if (finding.kind === "unresolvable") {
-                    unresolvable ??= finding.reason;
-                    if (!seen.unresolved.has(finding.operand)) {
-                        seen.unresolved.add(finding.operand);
-                        unresolved.push(finding.operand);
-                    }
-                    if (toks.folded[0] === "cd")
-                        baseLost = true;
-                    continue;
-                }
-                const denied = boundary.denyMatch?.(finding.path);
-                if (denied != null) {
-                    return {
-                        reason: `a command operand resolves to "${finding.path}", which matches ${sensitivePathDenyList(denied)} ${NOT_AUTO_ALLOWED}`,
-                        readDenied: true,
-                        readDeniedPath: finding.path,
-                        readDeniedPattern: denied,
-                    };
-                }
-                if (finding.kind === "inside") {
-                    if (!seen.inside.has(finding.path)) {
-                        seen.inside.add(finding.path);
-                        inside.push(finding.path);
-                    }
-                    recordSpelling(checkedSpellings, seen.checkedSpelled, finding);
-                    continue;
-                }
-                if (finding.kind === "undecided") {
-                    if (!seen.undecided.has(finding.path)) {
-                        seen.undecided.add(finding.path);
-                        undecided.push(finding.path);
-                    }
-                    recordSpelling(undecidedSpellings, seen.undecidedSpelled, finding);
-                    continue;
-                }
-                if (finding.kind === "recursive") {
-                    if (!seen.recursive.has(finding.path)) {
-                        seen.recursive.add(finding.path);
-                        recursive.push(finding.path);
-                    }
-                    continue;
-                }
-                if (boundary.face === "open") {
-                    if (!seen.inside.has(finding.path)) {
-                        seen.inside.add(finding.path);
-                        inside.push(finding.path);
-                    }
-                    continue;
-                }
-                if (!seen.outside.has(finding.path)) {
-                    seen.outside.add(finding.path);
-                    outside.push(finding);
-                }
-                recordSpelling(outOfRootSpellings, seen.outsideSpelled, finding);
-            }
-        }
-        if (!baseLost && toks.folded[0] === "cd") {
-            const cdArgs = toks.folded.slice(1);
-            const cdTargetIdx = cdArgs.findIndex((t) => !t.startsWith("-") || t === "-");
-            const cdTarget = cdTargetIdx === -1 ? undefined : cdArgs[cdTargetIdx];
-            if (cdTarget !== undefined && cdTarget !== "-") {
-                const provable = reach?.[si]?.moveProvable === true;
-                const branched = [];
-                for (const c of candidates) {
-                    if (c.skippedCd < andRunStart)
-                        branched.push({ base: resolveOperandLexically(c.base, cdTarget, boundary.homeDir) ?? c.base, skippedCd: c.skippedCd });
-                    branched.push({ base: c.base, skippedCd: provable ? si : c.skippedCd });
-                }
-                const byBase = new Map();
-                for (const c of branched) {
-                    const prior = byBase.get(c.base);
-                    if (prior === undefined || c.skippedCd < prior.skippedCd)
-                        byBase.set(c.base, c);
-                }
-                const next = [...byBase.values()];
-                if (next.length > BASE_CANDIDATE_MAX) {
-                    unresolvable ??= `too many directory changes to track where "${cdTarget}" leaves the working directory ${NOT_AUTO_ALLOWED}`;
-                    if (!seen.unresolved.has(cdTarget)) {
-                        seen.unresolved.add(cdTarget);
-                        unresolved.push(cdTarget);
-                    }
-                    baseLost = true;
-                }
-                else
-                    candidates = next;
-            }
-        }
-    }
-    const undecidedAll = [...undecided, ...recursive.filter((p) => !seen.undecided.has(p))];
-    const undecidedField = {
-        ...(undecidedAll.length > 0 ? { undecidedPaths: undecidedAll } : {}),
-        ...(recursive.length > 0 ? { recursiveReadPaths: recursive } : {}),
-        ...(undecidedSpellings.length > 0 ? { undecidedSpellings } : {}),
-    };
-    const checkedField = {
-        ...(inside.length > 0 ? { checkedPaths: inside } : {}),
-        ...(checkedSpellings.length > 0 ? { checkedSpellings } : {}),
-    };
-    const outsideField = outOfRootSpellings.length > 0 ? { outOfRootSpellings } : {};
-    if (unresolvable !== undefined) {
-        return {
-            reason: unresolvable,
-            unresolvedOperands: unresolved,
-            ...(outside.length > 0 ? { outOfRootRead: true, outOfRootPaths: outside.map((o) => o.path), ...outsideField } : {}),
-            ...checkedField,
-            ...undecidedField,
-        };
-    }
-    if (outside.length === 0)
-        return { ...checkedField, ...undecidedField };
-    const paths = outside.map((o) => `"${o.path}"`).join(", ");
-    const allowed = boundary.roots.length > 0 ? boundary.roots.join(", ") : "(none)";
-    const grantCandidate = (() => {
-        if (!mintGrantCandidate || outOfRootSpellings.length > 0)
-            return undefined;
-        const proposed = outOfRootGrantCandidateOf(outside.map((o) => o.path), boundary);
-        if (proposed === undefined)
-            return undefined;
-        const replay = evaluateReadBoundary(foldedSegments, { ...boundary, roots: [...boundary.roots, proposed.path] }, false, reach);
-        return replay.reason === undefined && (replay.undecidedPaths ?? []).length === 0 ? proposed : undefined;
-    })();
-    return {
-        reason: `"${outside[0].command}" reads ${paths}, outside the allowed directories for this session: ${allowed} ${NOT_AUTO_ALLOWED}`,
-        outOfRootRead: true,
-        outOfRootPaths: outside.map((o) => o.path),
-        ...(grantCandidate !== undefined ? { outOfRootGrantCandidate: grantCandidate.path, ...(grantCandidate.exact === true ? { outOfRootGrantCoversExactPath: true } : {}) } : {}),
-        ...outsideField,
-        ...checkedField,
-        ...undecidedField,
-    };
-}
-export function classifySimpleCommandReadBoundary(command, boundary) {
-    const toks = tokenizeSegment(command);
-    if (toks.folded.length === 0)
-        return {};
-    const pos = readProgramPosition(toks);
-    if (pos.refusal !== undefined)
-        return { reason: programPositionRefusalSentence(pos.refusal), refusedWhole: true };
-    if (pos.program !== undefined) {
-        const familyRefusal = argumentAsProgramRefusal(pos.program.basename, pos.program.basename, toks.folded.slice(pos.program.index + 1));
-        if (familyRefusal !== undefined)
-            return { reason: familyRefusal };
-    }
-    return evaluateReadBoundary([toks], boundary, true);
-}
-const NOT_GATED = { gated: false, paths: [], checked: [], undecided: [] };
-const UNREADABLE_WHITELIST_WORD = /[$`()*?[\]{}]/;
 export const UNMODELLED_BASE_MOVERS = new Set(["pushd", "popd"]);
 export const COMMAND_LAUNCHERS_FOR_TEST = COMMAND_LAUNCHERS;
-const LAUNCHER_SCAN_HEAD = "cat";
-export function classifyOutOfRootReadGate(command, allow, boundary) {
-    const containmentOnly = {
-        roots: boundary.roots,
-        ...(boundary.cwd !== undefined ? { cwd: boundary.cwd } : {}),
-        ...(boundary.homeDir !== undefined ? { homeDir: boundary.homeDir } : {}),
-        ...(boundary.face !== undefined ? { face: boundary.face } : {}),
-    };
-    const judge = (text) => {
-        const split = segmentCompoundForReadonly(text, containmentOnly.homeDir);
-        if ("reject" in split)
-            return NOT_GATED;
-        const readers = [];
-        const readerReach = [];
-        let crossedAllAnd = true;
-        let crossedAnyOr = false;
-        let baseMoved = false;
-        for (let si = 0; si < split.segments.length; si++) {
-            const segment = split.segments[si];
-            if (si > 0) {
-                if (split.connectors[si] !== "&&")
-                    crossedAllAnd = false;
-                if (split.connectors[si] === "||")
-                    crossedAnyOr = true;
-            }
-            const moveProvable = split.pipeFed[si] !== true && split.pipeFed[si + 1] !== true;
-            const pushReader = (st) => {
-                readers.push(st);
-                readerReach.push({ andJoined: si > 0 && crossedAllAnd, orBroken: !crossedAllAnd && crossedAnyOr, moveProvable });
-                crossedAllAnd = true;
-                crossedAnyOr = false;
-            };
-            const toks = tokenizeSegment(segment);
-            if (toks.folded.length === 0)
-                continue;
-            let i = 0;
-            while (i < toks.folded.length && ASSIGNMENT_WORD.test(toks.folded[i]))
-                i++;
-            const written = toks.folded[i];
-            if (written === undefined)
-                continue;
-            const name = programBasename(written);
-            if (UNMODELLED_BASE_MOVERS.has(name))
-                baseMoved = true;
-            if (!allow.has(name) && name !== "cd") {
-                const argv = argvProgramOf(toks);
-                pushReader({ folded: [LAUNCHER_SCAN_HEAD, ...toks.folded], raw: [LAUNCHER_SCAN_HEAD, ...toks.raw], slotVerb: name, ...(argv !== undefined ? { argvProgram: argv.program, argvFrom: argv.from + 1 } : {}) });
-                continue;
-            }
-            pushReader(i === 0 && name === written ? toks : { folded: [name, ...toks.folded.slice(i + 1)], raw: [toks.raw[i] ?? name, ...toks.raw.slice(i + 1)] });
-        }
-        if (readers.length === 0)
-            return NOT_GATED;
-        if (baseMoved)
-            return { gated: true, paths: [], checked: [], undecided: [] };
-        const verdict = evaluateReadBoundary(readers, containmentOnly, false, readerReach);
-        const denyPass = boundary.denyMatch === undefined ? undefined : evaluateReadBoundary(readers, boundary, false, readerReach);
-        const denied = denyPass?.readDenied === true && denyPass.readDeniedPath !== undefined && denyPass.readDeniedPattern !== undefined
-            ? { path: denyPass.readDeniedPath, pattern: denyPass.readDeniedPattern }
-            : undefined;
-        const resolvedOperands = {
-            checked: [...(verdict.checkedPaths ?? []), ...(verdict.checkedSpellings ?? [])],
-            undecided: [...(verdict.undecidedPaths ?? []), ...(verdict.undecidedSpellings ?? [])],
-        };
-        if (verdict.outOfRootRead === true) {
-            return { gated: true, paths: verdict.outOfRootPaths ?? [], ...resolvedOperands, ...(denied !== undefined ? { denied } : {}) };
-        }
-        if (denied !== undefined)
-            return { gated: false, paths: [], ...resolvedOperands, denied };
-        return resolvedOperands.checked.length === 0 && resolvedOperands.undecided.length === 0 ? NOT_GATED : { gated: false, paths: [], ...resolvedOperands };
-    };
-    const direct = judge(command);
-    if (direct.gated || direct.denied !== undefined)
-        return direct;
-    const shape = POLL_LOOP_SHAPE.exec(command.trim());
-    if (shape === null)
-        return direct;
-    const loop = judge(shape[3]);
-    return loop.gated || loop.denied !== undefined
-        ? loop
-        : { ...loop, checked: [...direct.checked, ...loop.checked], undecided: [...direct.undecided, ...loop.undecided] };
-}
 export function classifyCompoundReadonly(command, allow, boundary) {
     return classifyCompoundReadonlyDetailed(command, allow, boundary).reason;
 }
@@ -2549,18 +1824,5 @@ export function classifyBoundedReadonlyPollLoopDetailed(command, allow, boundary
     if (readSegments.length === 0) {
         return { reason: "the loop body has no read command — a sleep-only loop observes nothing and is not auto-allowed" };
     }
-    const bodyHasCd = readSegments.some((seg) => tokensMoveBase(tokenizeSegment(seg)));
-    const modelled = bodyHasCd ? Array.from({ length: beats }, () => readSegments.join("; ")).join("; ") : readSegments.join("; ");
-    const verdict = classifyCompoundReadonlyDetailed(modelled, allow, boundary, { iterated: bodyHasCd });
-    if (verdict.reason !== undefined)
-        return verdict;
-    if (verdict.recursiveReadPaths !== undefined) {
-        const roots = verdict.recursiveReadPaths;
-        const shown = roots.slice(0, POLL_LOOP_CAUSE_MAX_PATHS);
-        return { ...verdict, reason: `this lexical check cannot bound what a recursive read form in the loop body traverses — ${roots.length} path(s) taken as traversal roots: ${shown.join(", ")}${roots.length > shown.length ? `, and ${roots.length - shown.length} more` : ""}` };
-    }
-    if (verdict.undecidedPaths !== undefined) {
-        return { ...verdict, reason: `the loop body carries an unexpanded glob (${verdict.undecidedPaths.join(", ")}) — what a REPEATED read touches is decided at run time, so it is not auto-allowed` };
-    }
-    return verdict;
+    return classifyCompoundReadonlyDetailed(readSegments.join("; "), allow, boundary);
 }