@sema-agent/core 7.24.4 → 7.25.0

package/dist/tools/fs/shell-read-establish.js

@@ -1,5 +1,6 @@
-import { normalizeAbsPathLexically, withinAnyRoot } from "./safety.js";
+import { normalizeAbsPathLexically, pathFamilyOf } from "./safety.js";
 import { boundaryIsTheSandbox, canonicalPathIsAuthoritative } from "../../core/remote-env.js";
+import { resolveOperandSpellings } from "./bash-readonly-classifier.js";
 const GLOB_METACHAR_RE = /[*?[]/;
 export const MAX_GLOB_DIRS = 256;
 export const MAX_GLOB_MATCHES = 8192;
@@ -69,26 +70,75 @@ function globSegmentMatches(re, pattern, name) {
         return false;
     return re.test(name);
 }
-function joinCandidate(dir, name) {
-    return `${dir.replace(/[\\/]+$/, "")}/${name}`;
-}
-function pathSegmentsFrom(p, from) {
+function pathSegmentsFrom(p, from, posix = false) {
     const segs = [];
+    const isSep = (c) => c === "/" || (!posix && c === "\\");
     let scan = from;
     while (scan < p.length) {
-        while (scan < p.length && (p[scan] === "/" || p[scan] === "\\"))
+        while (scan < p.length && isSep(p[scan]))
             scan++;
         const s = scan;
-        while (scan < p.length && p[scan] !== "/" && p[scan] !== "\\")
+        while (scan < p.length && !isSep(p[scan]))
             scan++;
         if (scan > s)
             segs.push({ text: p.slice(s, scan), start: s });
     }
     return segs;
 }
-export function createCanonicalReadBoundary(env, readRoots) {
+function basesFor(candidate, boundary) {
+    if (candidate.bases === "unmodelled")
+        return "unmodelled";
+    if (candidate.bases.length > 0)
+        return candidate.bases;
+    return [boundary.cwd ?? boundary.roots[0] ?? ""];
+}
+function lexicalReadsOf(candidate, boundary) {
+    if (candidate.expands === "unresolvable") {
+        return [{ candidate, established: "unestablishable", spellings: [candidate.spelled], cause: `"${candidate.raw}" is rewritten by the shell before the program sees it` }];
+    }
+    const bases = basesFor(candidate, boundary);
+    if (bases === "unmodelled") {
+        return [{ candidate, established: "unestablishable", spellings: [candidate.spelled], cause: `"${candidate.raw}" is relative to a working directory this command's text does not settle` }];
+    }
+    const out = [];
+    const seen = new Set();
+    for (const base of bases) {
+        const sp = resolveOperandSpellings(base === "" ? undefined : base, candidate.spelled, boundary.homeDir);
+        if (sp === undefined) {
+            const key = `?${candidate.spelled}`;
+            if (!seen.has(key)) {
+                seen.add(key);
+                out.push({ candidate, established: "unestablishable", spellings: [candidate.spelled], cause: `"${candidate.raw}" cannot be placed against ${base === "" ? "no working directory" : `"${base}"`}` });
+            }
+            continue;
+        }
+        if (seen.has(sp.folded))
+            continue;
+        seen.add(sp.folded);
+        out.push({ candidate, established: "lexical", target: sp.folded, spellings: sp.spelled !== undefined ? [sp.folded, sp.spelled] : [sp.folded] });
+    }
+    return out;
+}
+function judgedCandidatesOf(segment) {
+    return segment.reads.filter((c) => c.provenance !== "write_redirect_target");
+}
+export function establishShellReadsLexically(plan, boundary) {
+    const reads = new Map();
+    const nested = new Map();
+    for (const segment of plan.segments) {
+        reads.set(segment, judgedCandidatesOf(segment).flatMap((c) => lexicalReadsOf(c, boundary)));
+        for (const n of segment.nested)
+            nested.set(n, establishShellReadsLexically(n, boundary));
+    }
+    return { plan, reads, nested, roots: boundary.roots };
+}
+export function createShellReadEstablisher(env, readRoots) {
     const lexicalOnly = boundaryIsTheSandbox(env);
     const resolverIsAuthoritative = canonicalPathIsAuthoritative(env);
+    const family = pathFamilyOf({ root: readRoots[0] ?? "/" });
+    const SEP = family === "posix" ? /\// : /[\\/]/;
+    const TRAILING_SEP = family === "posix" ? /\/+$/ : /[\\/]+$/;
+    const joinUnder = (dir, name) => `${dir.replace(TRAILING_SEP, "")}/${name}`;
     let rootsOnce;
     const canonicalRoots = async (signal) => {
         rootsOnce ??= (async () => {
@@ -102,7 +152,7 @@ export function createCanonicalReadBoundary(env, readRoots) {
         return await rootsOnce;
     };
     const resolveWithoutParentSteps = async (p, signal) => {
-        const parts = p.split(/[\\/]/);
+        const parts = p.split(SEP);
         const tail = [];
         let allAbsent = true;
         while (parts.length > 0) {
@@ -110,7 +160,7 @@ export function createCanonicalReadBoundary(env, readRoots) {
             if (canon.ok) {
                 if (tail.length === 0)
                     return { value: canon.value, exact: true };
-                return { value: [canon.value.replace(/[\\/]+$/, ""), ...[...tail].reverse()].join("/"), exact: false, missing: allAbsent };
+                return { value: [canon.value.replace(TRAILING_SEP, ""), ...[...tail].reverse()].join("/"), exact: false, missing: allAbsent };
             }
             if (canon.error.code !== "not_found" && canon.error.code !== "not_directory")
                 allAbsent = false;
@@ -120,7 +170,7 @@ export function createCanonicalReadBoundary(env, readRoots) {
     };
     const parentOf = (canonical) => normalizeAbsPathLexically(`${canonical}/..`);
     const resolve = async (p, signal) => {
-        const parts = p.split(/[\\/]/);
+        const parts = p.split(SEP);
         const first = parts.findIndex((seg) => seg === "..");
         if (first < 0)
             return await resolveWithoutParentSteps(p, signal);
@@ -132,7 +182,7 @@ export function createCanonicalReadBoundary(env, readRoots) {
         const flush = async () => {
             if (pending.length === 0)
                 return true;
-            const next = await resolveWithoutParentSteps([head.value.replace(/[\\/]+$/, ""), ...pending].join("/"), signal);
+            const next = await resolveWithoutParentSteps([head.value.replace(TRAILING_SEP, ""), ...pending].join("/"), signal);
             pending = [];
             if (next === undefined)
                 return false;
@@ -170,40 +220,37 @@ export function createCanonicalReadBoundary(env, readRoots) {
     };
     const expandGlobCandidate = async (p, roots, signal) => {
         const head = literalRootHead(p, roots);
-        let segs = pathSegmentsFrom(p, head?.length ?? 0);
+        let segs = pathSegmentsFrom(p, head?.length ?? 0, family === "posix");
         let first = segs.findIndex((s) => GLOB_METACHAR_RE.test(s.text));
         if (first < 0 && head !== undefined && GLOB_METACHAR_RE.test(head)) {
-            segs = pathSegmentsFrom(p, 0);
+            segs = pathSegmentsFrom(p, 0, family === "posix");
             first = segs.findIndex((s) => GLOB_METACHAR_RE.test(s.text));
         }
         if (first < 0)
             return undefined;
-        let frontier = [p.slice(0, segs[first].start).replace(/[\\/]+$/, "") || "/"];
+        let frontier = [p.slice(0, segs[first].start).replace(TRAILING_SEP, "") || "/"];
         let dirsUsed = 0;
         let matches = 0;
         const canonicalOfMatch = new Map();
         for (let j = first; j < segs.length; j++) {
             const seg = segs[j].text;
             if (!GLOB_METACHAR_RE.test(seg)) {
-                frontier = frontier.map((d) => joinCandidate(d, seg));
+                frontier = frontier.map((d) => joinUnder(d, seg));
                 continue;
             }
             const re = compileGlobSegment(seg);
-            if (re === undefined) {
+            if (re === undefined)
                 return { unverifiable: `the pattern "${seg}" cannot be expanded to verify what it would read` };
-            }
             const isLast = j === segs.length - 1;
             const next = [];
             for (const dir of frontier) {
-                if (++dirsUsed > MAX_GLOB_DIRS) {
+                if (++dirsUsed > MAX_GLOB_DIRS)
                     return { unverifiable: `"${p}" expands over more than ${MAX_GLOB_DIRS} directories, too many to enumerate to verify` };
-                }
                 const canonDir = await resolve(dir, signal);
                 if (canonDir !== undefined && canonDir.missing === true)
                     continue;
-                if (canonDir !== undefined && !canonDir.exact) {
+                if (canonDir !== undefined && !canonDir.exact)
                     return { unverifiable: `"${dir}" cannot be resolved to verify what "${seg}" would expand to` };
-                }
                 const listed = await env.listDir(canonDir?.value ?? dir, signal);
                 if (!listed.ok) {
                     if (listed.error.code === "not_found" || listed.error.code === "not_directory")
@@ -213,18 +260,17 @@ export function createCanonicalReadBoundary(env, readRoots) {
                 if (seg.startsWith(".")) {
                     for (const dot of [".", ".."])
                         if (re.test(dot))
-                            next.push(joinCandidate(dir, dot));
+                            next.push(joinUnder(dir, dot));
                 }
                 const canonDirHere = isLast ? canonDir?.value : undefined;
                 for (const entry of listed.value) {
                     if (!globSegmentMatches(re, seg, entry.name))
                         continue;
-                    if (++matches > MAX_GLOB_MATCHES) {
+                    if (++matches > MAX_GLOB_MATCHES)
                         return { unverifiable: `"${p}" expands to more than ${MAX_GLOB_MATCHES} names, too many to enumerate to verify` };
-                    }
-                    const candidate = joinCandidate(dir, entry.name);
+                    const candidate = joinUnder(dir, entry.name);
                     if (canonDirHere !== undefined && entry.kind !== "symlink")
-                        canonicalOfMatch.set(candidate, joinCandidate(canonDirHere, entry.name));
+                        canonicalOfMatch.set(candidate, joinUnder(canonDirHere, entry.name));
                     next.push(candidate);
                 }
             }
@@ -234,93 +280,161 @@ export function createCanonicalReadBoundary(env, readRoots) {
         }
         return { paths: frontier, canonical: canonicalOfMatch };
     };
-    return {
-        escapesAfterResolution: async (paths, ask, signal) => {
-            const deny = ask.deny;
-            if (lexicalOnly || (paths.literal.length === 0 && paths.patterns.length === 0))
-                return { escaping: [] };
-            const roots = await canonicalRoots(signal);
-            const escaping = [];
-            let unresolvable;
-            let denied;
-            const denyHit = (p) => {
-                if (deny === undefined || denied !== undefined)
-                    return false;
-                const folded = normalizeAbsPathLexically(p);
-                if (ask.denyAnswered.has(folded))
-                    return false;
-                const pattern = deny(folded);
-                if (pattern === null)
-                    return false;
-                denied = { path: folded, pattern };
-                return true;
-            };
-            const judge = async (p, canonicalKnown, origin) => {
-                if (denyHit(p))
-                    return;
-                const real = canonicalKnown !== undefined ? { value: canonicalKnown, exact: true } : await resolve(p, signal);
-                if (real === undefined) {
-                    if (resolverIsAuthoritative)
-                        unresolvable ??= `"${p}" cannot be resolved to verify where it reads`;
-                    return;
+    const enumerateTraversal = async (rootCanonical, signal) => {
+        const members = [];
+        const stack = [{ dir: rootCanonical, spell: rootCanonical }];
+        const visited = new Set([rootCanonical]);
+        let dirsUsed = 0;
+        while (stack.length > 0) {
+            const { dir, spell } = stack.pop();
+            if (++dirsUsed > MAX_GLOB_DIRS)
+                return { unverifiable: `"${rootCanonical}" holds more than ${MAX_GLOB_DIRS} directories, too many to enumerate to verify what a recursive read would open` };
+            const listed = await env.listDir(dir, signal);
+            if (!listed.ok) {
+                if (listed.error.code === "not_directory" || listed.error.code === "not_found")
+                    continue;
+                return { unverifiable: `"${dir}" cannot be enumerated to verify what a recursive read would open (${listed.error.code})` };
+            }
+            for (const entry of listed.value) {
+                if (members.length >= MAX_GLOB_MATCHES)
+                    return { unverifiable: `"${rootCanonical}" holds more than ${MAX_GLOB_MATCHES} entries, too many to enumerate to verify what a recursive read would open` };
+                const path = joinUnder(spell, entry.name);
+                const canonicalPath = joinUnder(dir, entry.name);
+                if (entry.kind === "symlink") {
+                    const canon = await env.canonicalPath(canonicalPath, signal);
+                    members.push({ path, ...(canon.ok ? { canonical: canon.value } : {}), symlink: true });
+                    if (canon.ok && !visited.has(canon.value)) {
+                        visited.add(canon.value);
+                        stack.push({ dir: canon.value, spell: path });
+                    }
+                    continue;
                 }
-                if (!real.exact && real.missing !== true) {
-                    unresolvable ??= `"${p}" cannot be resolved to verify where it reads`;
-                    return;
+                if (entry.kind === "directory") {
+                    if (!visited.has(canonicalPath)) {
+                        visited.add(canonicalPath);
+                        stack.push({ dir: canonicalPath, spell: path });
+                    }
+                    continue;
                 }
-                if (denyHit(real.value))
+                members.push({ path, canonical: canonicalPath, symlink: false });
+            }
+        }
+        return { members };
+    };
+    const canonicalReadOf = async (candidate, spelling, spellings, established, origin, canonicalKnown, signal) => {
+        const real = canonicalKnown !== undefined ? { value: canonicalKnown, exact: true } : await resolve(spelling, signal);
+        if (real === undefined) {
+            if (resolverIsAuthoritative)
+                return { candidate, established: "unestablishable", spellings, ...(origin !== undefined ? { origin } : {}), cause: `"${spelling}" cannot be resolved to verify where it reads` };
+            return { candidate, established: "lexical", target: normalizeAbsPathLexically(spelling), spellings, ...(origin !== undefined ? { origin } : {}) };
+        }
+        if (!real.exact && real.missing !== true) {
+            return { candidate, established: "unestablishable", spellings, ...(origin !== undefined ? { origin } : {}), cause: `"${spelling}" cannot be resolved to verify where it reads` };
+        }
+        return { candidate, established, target: real.value, spellings, ...(origin !== undefined ? { origin } : {}) };
+    };
+    const establishSegment = async (segment, boundary, roots, signal) => {
+        const out = [];
+        for (const candidate of judgedCandidatesOf(segment)) {
+            const traversal = candidate.provenance === "traversal_root";
+            const land = async (read, spellings, folded) => {
+                out.push(read);
+                if (!traversal || (read.established !== "canonical" && read.established !== "expansion") || read.target === undefined)
                     return;
-                if (ask.containmentAnswered.has(normalizeAbsPathLexically(origin ?? p)))
+                const walkedTree = await enumerateTraversal(read.target, signal);
+                if ("unverifiable" in walkedTree) {
+                    out.push({ candidate, established: "unestablishable", spellings, origin: folded, cause: walkedTree.unverifiable });
                     return;
-                if (ask.containment && !withinAnyRoot(roots, real.value) && !escaping.includes(real.value))
-                    escaping.push(real.value);
+                }
+                for (const m of walkedTree.members)
+                    out.push(await canonicalReadOf(candidate, m.path, [m.path], "expansion", folded, m.canonical, signal));
             };
-            for (const p of paths.literal) {
-                if (denied !== undefined)
-                    break;
-                await judge(p);
-            }
-            for (const p of paths.patterns) {
-                if (denied !== undefined)
-                    break;
-                const expanded = await expandGlobCandidate(p, roots, signal);
-                if (expanded !== undefined && "unverifiable" in expanded) {
-                    unresolvable ??= expanded.unverifiable;
+            for (const lexical of lexicalReadsOf(candidate, boundary)) {
+                if (lexical.established !== "lexical") {
+                    out.push(lexical);
                     continue;
                 }
-                if (expanded !== undefined && expanded.paths.length > 0) {
-                    for (const t of expanded.paths) {
-                        if (denied !== undefined)
-                            break;
-                        await judge(t, expanded.canonical.get(t), p);
+                const folded = lexical.target;
+                const spellings = lexical.spellings;
+                const walked = spellings.find((s) => s !== folded) ?? folded;
+                if (candidate.expands === "glob") {
+                    let matched = false;
+                    for (const p of spellings) {
+                        const expanded = await expandGlobCandidate(p, roots, signal);
+                        if (expanded !== undefined && "unverifiable" in expanded) {
+                            out.push({ candidate, established: "unestablishable", spellings, origin: folded, cause: expanded.unverifiable });
+                            matched = true;
+                            continue;
+                        }
+                        if (expanded !== undefined && expanded.paths.length > 0) {
+                            matched = true;
+                            for (const t of expanded.paths)
+                                await land(await canonicalReadOf(candidate, t, [t, folded], "expansion", folded, expanded.canonical.get(t), signal), spellings, folded);
+                        }
                     }
+                    if (!matched)
+                        await land(await canonicalReadOf(candidate, walked, spellings, "canonical", undefined, undefined, signal), spellings, folded);
+                    continue;
                 }
-                else
-                    await judge(p);
+                await land(await canonicalReadOf(candidate, walked, spellings, "canonical", undefined, undefined, signal), spellings, folded);
             }
-            if (denied !== undefined)
-                return { escaping, denied };
-            return unresolvable === undefined ? { escaping } : { escaping, unverifiable: unresolvable };
-        },
-        canonicalOf: async (path, signal) => {
+        }
+        return out;
+    };
+    const establishPlan = async (plan, boundary, roots, signal) => {
+        const reads = new Map();
+        const nested = new Map();
+        for (const segment of plan.segments) {
+            reads.set(segment, await establishSegment(segment, boundary, roots, signal));
+            for (const n of segment.nested)
+                nested.set(n, await establishPlan(n, boundary, roots, signal));
+        }
+        return { plan, reads, nested, roots };
+    };
+    return {
+        lexicalOnly,
+        establish: async (plan, boundary, signal) => {
             if (lexicalOnly)
-                return undefined;
-            const real = await resolve(path, signal);
-            return real === undefined || (!real.exact && real.missing !== true) ? undefined : real.value;
-        },
-        allResolveInside: async (paths, signal) => {
-            if (lexicalOnly || paths.length === 0)
-                return false;
+                return establishShellReadsLexically(plan, boundary);
             const roots = await canonicalRoots(signal);
-            for (const p of paths) {
-                const real = await resolve(p, signal);
-                if (real === undefined || (!real.exact && real.missing !== true))
-                    return false;
-                if (!withinAnyRoot(roots, real.value))
-                    return false;
-            }
-            return true;
+            return await establishPlan(plan, { ...boundary, roots }, roots, signal);
+        },
+        reestablish: async (previous, boundary, signal) => {
+            if (lexicalOnly)
+                return { changed: [] };
+            const again = await establishPlan(previous.plan, { ...boundary, roots: previous.roots }, previous.roots, signal);
+            const settled = (e) => {
+                const out = [];
+                const walk = (p) => {
+                    for (const reads of p.reads.values())
+                        for (const r of reads)
+                            if ((r.established === "canonical" || r.established === "expansion") && r.target !== undefined)
+                                out.push(r.target);
+                    for (const n of p.nested.values())
+                        walk(n);
+                };
+                walk(e);
+                return out.sort();
+            };
+            const before = settled(previous);
+            const after = new Set(settled(again));
+            const beforeSet = new Set(before);
+            const moved = before.filter((t) => !after.has(t));
+            const appeared = [...after].filter((t) => !beforeSet.has(t));
+            if (moved.length === 0 && appeared.length === 0)
+                return { changed: [] };
+            const changed = [];
+            const collect = (p) => {
+                for (const reads of p.reads.values())
+                    for (const r of reads)
+                        if (r.target !== undefined && (moved.includes(r.target) || appeared.includes(r.target)))
+                            changed.push(r);
+                for (const n of p.nested.values())
+                    collect(n);
+            };
+            collect(previous);
+            collect(again);
+            return { changed };
         },
     };
 }
-export const NOTHING_ANSWERED = new Set();