@sema-agent/core 7.24.4 → 7.25.1

package/dist/stores/file/adoption/adopt.js

@@ -3,6 +3,7 @@ import { existsSync, readdirSync, readFileSync, unlinkSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { adoptFilePermissionRuleStore } from "../permission-rule-adopt.js";
 import { BootLock, atomicWriteFile, ensureDir, sanitizeScope } from "../fs-atomic.js";
+import { SESSION_POLICY_MARK_SUFFIX, readSessionPolicyMark } from "../session-policy-store.js";
 import { thrownText } from "../../../core/thrown-value.js";
 import { AdoptionError, NOT_MIGRATED_BY_DESIGN, readRootAdoptionFile, writeRootAdoptionFile, } from "./marker.js";
 const CONFIG_ACCOUNT_FILE = "adoption-configs.json";
@@ -194,6 +195,10 @@ function rewriteSessionPolicyRows(root, fromPrincipal, toPrincipal) {
     for (const file of files) {
         if (!file.endsWith(".json"))
             continue;
+        if (file.endsWith(SESSION_POLICY_MARK_SUFFIX)) {
+            carrySessionPolicyMark(dir, tmpDir, file, fromPrincipal, toPrincipal);
+            continue;
+        }
         const source = join(dir, file);
         let raw;
         try {
@@ -218,8 +223,9 @@ function rewriteSessionPolicyRows(root, fromPrincipal, toPrincipal) {
             continue;
         if (typeof row.__sid !== "string")
             continue;
+        const stem = sanitizeScope(JSON.stringify([row.__sid, toPrincipal]));
         const rewritten = JSON.stringify({ ...row, __principal: toPrincipal });
-        const target = join(dir, `${sanitizeScope(JSON.stringify([row.__sid, toPrincipal]))}.json`);
+        const target = join(dir, `${stem}.json`);
         if (existsSync(target)) {
             if (readFileSync(target, "utf8") === rewritten) {
                 removeIfPresent(source);
@@ -235,6 +241,22 @@ function rewriteSessionPolicyRows(root, fromPrincipal, toPrincipal) {
     }
     return rows;
 }
+function carrySessionPolicyMark(dir, tmpDir, file, fromPrincipal, toPrincipal) {
+    const source = join(dir, file);
+    const mark = readSessionPolicyMark(source);
+    if (mark === null)
+        return;
+    if (mark.__principal !== fromPrincipal)
+        return;
+    if (typeof mark.__sid !== "string")
+        return;
+    const target = join(dir, `${sanitizeScope(JSON.stringify([mark.__sid, toPrincipal]))}${SESSION_POLICY_MARK_SUFFIX}`);
+    const there = readSessionPolicyMark(target);
+    const merged = there === null ? mark.__hwm : Math.max(mark.__hwm, there.__hwm);
+    const mergedGen = Math.max(mark.__gen ?? 0, there?.__gen ?? 0);
+    atomicWriteFile(tmpDir, target, JSON.stringify({ ...mark, __principal: toPrincipal, __hwm: merged, __gen: mergedGen }));
+    removeIfPresent(source);
+}
 function removeIfPresent(path) {
     try {
         unlinkSync(path);

package/dist/stores/file/permission-rule-store.js

@@ -311,7 +311,9 @@ class FileDurableRulePartition {
             }
             const next = delta.kind === "redemption-add"
                 ? (assertWriteDeltaScopeDurable(delta), assertRedemptionNotQuarantined(cur.quarantined ?? [], delta), { ...cur, rev: cur.rev + 1, rules: foldDelta(cur.rules, delta) })
-                : (assertWriteDeltaScopeDurable(delta), assertDeleteDeltaCarriesNoAdd(delta), { ...cur, rev: cur.rev + 1, tombstones: [...cur.tombstones, delta.tombstone] });
+                : delta.kind === "tighten-add"
+                    ? (assertWriteDeltaScopeDurable(delta), { ...cur, rev: cur.rev + 1, rules: foldDelta(cur.rules, delta) })
+                    : (assertWriteDeltaScopeDurable(delta), assertDeleteDeltaCarriesNoAdd(delta), { ...cur, rev: cur.rev + 1, tombstones: [...cur.tombstones, delta.tombstone] });
             if (!this.writeAndVerify(next)) {
                 throw new Error("the permission-rule store did not survive its own write; the change was not committed");
             }

package/dist/stores/file/session-policy-store.d.ts

@@ -15,6 +15,32 @@ export interface FileSessionPolicyStoreOptions {
      *  Never fires on plain ENOENT. Swallow-guarded: a throwing sink cannot re-introduce the fault. */
     onCorruptRead?: (info: SessionPolicyCorruptReadInfo) => void;
 }
+/**
+ * The suffix that tells a MARK file apart from a rules ROW in the shared directory — injective by
+ * construction, not by convention: `sanitizeScope` ends every row's basename with a 64-hex digest, so the
+ * character before a row's `.json` is always a hex digit and no row can be spelled `*.hwm.json`. Every sweep
+ * of this directory tests it FIRST: a mark must never be listed as a row, nor judged as crash litter.
+ */
+export declare const SESSION_POLICY_MARK_SUFFIX = ".hwm.json";
+/** What one mark file carries: the number, plus the row's attribution fields (the filename is a one-way hash,
+ *  so those are the only way a sweep can tell whose mark it is). Attribution is OPTIONAL on the read side —
+ *  this store always writes it, a hand-written file need not, and a mark with no owner is simply nobody's. */
+export interface StoredHighWaterMark {
+    __hwm: number;
+    /** The lineage the key's NEXT row starts (bumped by every erase); absent = 0 (a mark written before lineages). */
+    __gen?: number;
+    __sid?: string;
+    __principal?: string | null;
+}
+/**
+ * The ONE reader of a mark file — the number it holds, or `null` when there is no file (the ordinary state of
+ * a key nobody erased). Every other outcome is a refusal, and that is the point: for a ROW "unreadable"
+ * degrades to "absent" and costs nothing, while for a mark absence reads as ZERO, which is precisely the
+ * rollback the erase contract forbids. Bytes that are not a mark raise `SessionPolicyError("corrupt")` naming
+ * the file; an IO failure propagates as it already does for a row. Exported because ownership adoption moves
+ * these files too, and a second, more tolerant reader over there is how the guarantee goes quietly missing.
+ */
+export declare function readSessionPolicyMark(path: string): StoredHighWaterMark | null;
 export declare class FileSessionPolicyStore implements SessionPolicyStore {
     private readonly dir;
     private readonly onCorruptRead;
@@ -40,6 +66,11 @@ export declare class FileSessionPolicyStore implements SessionPolicyStore {
      *  composite key, so distinct keys never collide on disk). On a local-owner-adopted root the
      *  anonymous lane resolves to the adopted principal's key (#132 — see {@link anonymousAlias}). */
     private pathFor;
+    /** The shared, injective stem of a key's two files — the row (`<stem>.json`) and its mark
+     *  (`<stem>${MARK_SUFFIX}`), so the pair can never drift onto different keys. */
+    private basenameFor;
+    private markPathFor;
+    private writeMarkFile;
     private read;
     getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;
     putRules(sessionId: string, principal: string | undefined, rules: SessionPermissionRules, opts?: PutRulesOptions): Promise<StoredSessionRules>;

package/dist/stores/file/session-policy-store.js

@@ -1,4 +1,4 @@
-import { readFileSync, readdirSync, unlinkSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { loosenReasons, normalizeRules, stripRev, SessionPolicyError, } from "../../core/session-policy-store.js";
 import { atomicWriteFile, ensureDir, sanitizeScope } from "./fs-atomic.js";
@@ -9,6 +9,37 @@ function containSinkThenable(r) {
         });
     }
 }
+export const SESSION_POLICY_MARK_SUFFIX = ".hwm.json";
+const MARK_SUFFIX = SESSION_POLICY_MARK_SUFFIX;
+export function readSessionPolicyMark(path) {
+    let raw;
+    try {
+        raw = readFileSync(path, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw err;
+    }
+    const refuse = (fault) => {
+        throw new SessionPolicyError("corrupt", `session rules high-water mark ${fault}: ${path} — refusing rather than restart this key's rev from zero. Deleting that file is the repair, and it gives up the number it was holding.`);
+    };
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return refuse("is unparseable");
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+        return refuse("is not a JSON object");
+    const mark = parsed;
+    if (typeof mark.__hwm !== "number" || !Number.isFinite(mark.__hwm))
+        return refuse("carries no numeric value");
+    if (mark.__gen !== undefined && (typeof mark.__gen !== "number" || !Number.isInteger(mark.__gen) || mark.__gen < 0))
+        return refuse("carries a lineage that is not a whole number");
+    return mark;
+}
 export class FileSessionPolicyStore {
     dir;
     onCorruptRead;
@@ -33,9 +64,19 @@ export class FileSessionPolicyStore {
         this.disclose({ sessionId, ...(principal !== undefined ? { principal } : {}), path: this.pathFor(sessionId, principal), reason });
     }
     pathFor(sessionId, principal) {
+        return join(this.dir, `${this.basenameFor(sessionId, principal)}.json`);
+    }
+    basenameFor(sessionId, principal) {
         const effective = principal ?? this.anonymousAlias;
         const composite = JSON.stringify([sessionId, effective ?? null]);
-        return join(this.dir, `${sanitizeScope(composite)}.json`);
+        return sanitizeScope(composite);
+    }
+    markPathFor(sessionId, principal) {
+        return join(this.dir, `${this.basenameFor(sessionId, principal)}${MARK_SUFFIX}`);
+    }
+    writeMarkFile(path, rev, sessionId, principal, gen) {
+        const mark = { __hwm: rev, __gen: gen, __sid: sessionId, __principal: principal };
+        atomicWriteFile(join(this.dir, "tmp"), path, JSON.stringify(mark));
     }
     read(sessionId, principal) {
         let raw;
@@ -54,8 +95,12 @@ export class FileSessionPolicyStore {
                 return null;
             }
             const r = parsed;
-            if (r.rev !== undefined && (typeof r.rev !== "number" || !Number.isFinite(r.rev))) {
-                this.discloseCorrupt(sessionId, principal, "non-numeric rev");
+            if (typeof r.rev !== "number" || !Number.isFinite(r.rev) || r.rev < 1) {
+                this.discloseCorrupt(sessionId, principal, "rev is not a positive number");
+                return null;
+            }
+            if (r.gen !== undefined && (typeof r.gen !== "number" || !Number.isInteger(r.gen) || r.gen < 0)) {
+                this.discloseCorrupt(sessionId, principal, "gen is not a whole number");
                 return null;
             }
             const strArr = (x) => x === undefined || (Array.isArray(x) && x.every((e) => typeof e === "string"));
@@ -88,8 +133,13 @@ export class FileSessionPolicyStore {
                 throw new SessionPolicyError("loosen_forbidden", `a non-operator session-rule write may only tighten; refused: ${loosens.join("; ")}`);
             }
         }
-        const next = { ...clean, rev: (prior?.rev ?? 0) + 1 };
-        atomicWriteFile(join(this.dir, "tmp"), this.pathFor(sessionId, principal), JSON.stringify({ ...next, __sid: sessionId, __principal: (principal ?? this.anonymousAlias) ?? null }));
+        const mark = readSessionPolicyMark(this.markPathFor(sessionId, principal));
+        const floor = Math.max(prior?.rev ?? 0, mark?.__hwm ?? 0);
+        const gen = prior?.gen ?? (existsSync(this.pathFor(sessionId, principal)) ? (mark?.__gen ?? 0) + 1 : (mark?.__gen ?? 0));
+        const next = { ...clean, rev: floor + 1, gen };
+        const attributedPrincipal = (principal ?? this.anonymousAlias) ?? null;
+        this.writeMarkFile(this.markPathFor(sessionId, principal), next.rev, sessionId, attributedPrincipal, gen);
+        atomicWriteFile(join(this.dir, "tmp"), this.pathFor(sessionId, principal), JSON.stringify({ ...next, __sid: sessionId, __principal: attributedPrincipal }));
         return next;
     }
     async listBySession(sessionId) {
@@ -104,6 +154,8 @@ export class FileSessionPolicyStore {
         }
         const out = [];
         for (const file of files) {
+            if (file.endsWith(MARK_SUFFIX))
+                continue;
             if (!file.endsWith(".json"))
                 continue;
             const full = join(this.dir, file);
@@ -149,6 +201,8 @@ export class FileSessionPolicyStore {
             throw err;
         }
         for (const file of files) {
+            if (file.endsWith(MARK_SUFFIX))
+                continue;
             if (!file.endsWith(".json"))
                 continue;
             let raw;
@@ -163,6 +217,17 @@ export class FileSessionPolicyStore {
                 parsed = JSON.parse(raw);
             }
             catch {
+                const tornMarkPath = join(this.dir, `${file.slice(0, -".json".length)}${MARK_SUFFIX}`);
+                try {
+                    const tornMark = readSessionPolicyMark(tornMarkPath);
+                    if (tornMark !== null && tornMark.__sid === sessionId) {
+                        this.writeMarkFile(tornMarkPath, tornMark.__hwm, sessionId, tornMark.__principal ?? null, (tornMark.__gen ?? 0) + 1);
+                    }
+                }
+                catch (err) {
+                    if (!(err instanceof SessionPolicyError))
+                        throw err;
+                }
                 try {
                     unlinkSync(join(this.dir, file));
                 }
@@ -174,8 +239,23 @@ export class FileSessionPolicyStore {
             }
             if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
                 continue;
-            if (parsed.__sid !== sessionId)
+            const row = parsed;
+            if (row.__sid !== sessionId)
                 continue;
+            const markPath = join(this.dir, `${file.slice(0, -".json".length)}${MARK_SUFFIX}`);
+            let mark;
+            try {
+                mark = readSessionPolicyMark(markPath);
+            }
+            catch (err) {
+                if (!(err instanceof SessionPolicyError))
+                    throw err;
+                mark = undefined;
+            }
+            if (mark !== undefined) {
+                const rowRev = typeof row.rev === "number" && Number.isFinite(row.rev) ? row.rev : 0;
+                this.writeMarkFile(markPath, Math.max(mark?.__hwm ?? 0, rowRev), sessionId, row.__principal ?? null, (mark?.__gen ?? 0) + 1);
+            }
             try {
                 unlinkSync(join(this.dir, file));
             }

package/dist/tools/fs/bash-lexer.d.ts

@@ -93,6 +93,19 @@ export interface SegmentTokens {
  *  judges words sees "this word carries text the shell computes" rather than the computing text itself. */
 export declare const SUBSTITUTION_PLACEHOLDER = " subst";
 export type QuoteOpen = '"' | "'" | undefined;
+/**
+ * Does the `$` at `at` OPEN a quote form (`$'…'` / `$"…"`)? ONE question, asked by every walker that has to
+ * answer it — the word scan here and the expansion scan in the classifier — because a `$` one of them reads
+ * as escaped and the other as bare yields two different words for the same text, and the judge then compares
+ * the wrong one. Escaped means an ODD run of backslashes in front of it: `\$'y'` is a literal `$`, while
+ * `x\\$'y'` is a literal backslash followed by a real ANSI-C quote (both read off /bin/bash). Counting the
+ * run is what a one-character peek behind cannot do.
+ */
+export declare function dollarOpensQuote(text: string, at: number): boolean;
+/** The `'` that CLOSES the ANSI-C quote opened at `open`, or `undefined` when none does. `\'` does not close
+ *  one — the single place a quote region honours a backslash, and a pairing walk blind to it reads the real
+ *  closing quote as an OPENING one and everything after as quoted, which hides an expansion the shell performs. */
+export declare function ansiCQuoteClose(source: string, open: number): number | undefined;
 /**
  * Which QUOTE holds each character of `s`, by the same pairing rule the lexer walks with, and the boolean view
  * of it. The pairing quote characters themselves belong to the region they bound — they are not operators

package/dist/tools/fs/bash-lexer.js

@@ -4,11 +4,44 @@ function quoteStep(open, ch) {
         return ch === '"' || ch === "'" ? ch : undefined;
     return open === ch ? undefined : open;
 }
+export function dollarOpensQuote(text, at) {
+    const next = text[at + 1];
+    if (next !== "'" && next !== '"')
+        return false;
+    let run = 0;
+    for (let k = at - 1; k >= 0 && text[k] === "\\"; k--)
+        run += 1;
+    return run % 2 === 0;
+}
+export function ansiCQuoteClose(source, open) {
+    for (let i = open + 1; i < source.length; i++) {
+        if (source[i] === "\\") {
+            i += 1;
+            continue;
+        }
+        if (source[i] === "'")
+            return i;
+    }
+    return undefined;
+}
 export function quoteMask(s) {
     const openedBy = new Array(s.length).fill(undefined);
     const quoted = new Array(s.length).fill(false);
     let open;
     for (let i = 0; i < s.length; i++) {
+        if (open === undefined && s[i] === "$" && s[i + 1] === "'") {
+            const close = ansiCQuoteClose(s, i + 1);
+            for (let k = i; k <= (close ?? s.length - 1); k++) {
+                openedBy[k] = "'";
+                quoted[k] = true;
+            }
+            if (close === undefined) {
+                open = "'";
+                break;
+            }
+            i = close;
+            continue;
+        }
         const before = open;
         open = quoteStep(open, s[i]);
         const holds = before ?? open;
@@ -32,6 +65,13 @@ function tildeIsLiteral(raw) {
     }
     return false;
 }
+function ansiCBody(source, open) {
+    const close = ansiCQuoteClose(source, open);
+    if (close === undefined)
+        return undefined;
+    const body = source.slice(open + 1, close);
+    return body.includes("\\") ? { unreadable: true, close } : { text: body, close };
+}
 export function wordsOf(segment) {
     const folded = [];
     const raw = [];
@@ -310,6 +350,27 @@ function scan(source, opts, quotesLiteral) {
             i = j;
         }
         const ch = source[i];
+        if (!quotesLiteral && ch === "$" && !inSingle && !inDouble && dollarOpensQuote(source, i)) {
+            const q = next(i);
+            if (source[q] === '"') {
+                raw += ch;
+                started = true;
+                i = q - 1;
+                continue;
+            }
+            if (source[q] === "'") {
+                const ansi = ansiCBody(source, q);
+                if (ansi === undefined)
+                    return { reject: "an ANSI-C quoted word never closes" };
+                if ("unreadable" in ansi)
+                    return { reject: "an ANSI-C quoted word carries an escape this lexer does not fold" };
+                raw += source.slice(i, ansi.close + 1);
+                folded += ansi.text;
+                started = true;
+                i = ansi.close;
+                continue;
+            }
+        }
         if (!quotesLiteral) {
             if (ch === "'" && !inDouble) {
                 inSingle = !inSingle;

package/dist/tools/fs/bash-program-position.d.ts

@@ -9,15 +9,32 @@
  * does (an option skipped, a chain member missed) is how one face used to vouch for a program another refused.
  */
 import type { SegmentTokens } from "./bash-lexer.js";
-import type { AssertAllKeysHandled } from "../../core/ask-origin.js";
 /** The verdict every unresolvable / out-of-root / unbounded finding ends on. The findings differ in what
  *  they found; the consequence is one consequence, and a copy that drifts reads as a second rule. */
 export declare const NOT_AUTO_ALLOWED = "\u2014 not auto-allowed";
 /** argv[0] as the program bash will resolve it: `/usr/bin/cat` and `cat` are one name. */
 export declare function programBasename(word: string): string;
-/** A leading `NAME=value` word: an assignment bash applies to the command's environment rather than a
- *  program name. Same shape the exit-code reader in `fs-bash.ts` skips for the same reason. */
-export declare const ASSIGNMENT_WORD: RegExp;
+/**
+ * The `NAME=` / `NAME+=` prefix bash reads as an ASSIGNMENT — the ONE spelling of that grammar, matched where
+ * it is WRITTEN. Both operators, because bash reads both; the match IS the prefix, so a caller holding raw
+ * text can ask whether its token carries one bare. Every walk that strips leading assignments reads this:
+ * a second copy of the grammar is how one walk came to strip `A=x` and skip `A+=x`.
+ */
+export declare const ASSIGNMENT_PREFIX: RegExp;
+/**
+ * The prefix this raw token BEGINS with, or `undefined`.
+ *
+ * `name` is the VARIABLE the word assigns to, which is the part before any subscript: `A[0]=x` writes one
+ * element of `A`, so a reader asking "is `$A` settled" must not be told that `A[0]` is. `settlesWholeName` is
+ * false for exactly the two spellings that do not settle it — an append (the earlier content is not in the
+ * text) and a subscript (the other elements are not) — so a consumer of that question asks it once.
+ */
+export declare function writtenAssignmentPrefix(token: string): {
+    readonly prefix: string;
+    readonly name: string;
+    readonly appends: boolean;
+    readonly settlesWholeName: boolean;
+} | undefined;
 /** Shell control words that stand BEFORE a command: transparent for the boundary walk (the command behind them is
  *  judged). */
 export declare const SHELL_CONTROL_PREFIXES: ReadonlySet<string>;
@@ -26,6 +43,17 @@ export declare const SHELL_BLOCK_WORDS: ReadonlySet<string>;
 /** A control word is a keyword only when bash sees it BARE: `'if'` / `"do"` / `\\!` are command names (a program
  *  looked up on PATH, whose failure changes nothing), so a quoted or escaped spelling never counts as one. */
 export declare function isBareControlWord(toks: SegmentTokens, i: number, words: ReadonlySet<string>): boolean;
+/**
+ * A word bash strips as an ASSIGNMENT before it chooses the program.
+ *
+ * WHAT HAS TO BE BARE IS THE PREFIX, NOT THE WORD, and it is ONE question for BOTH operators. Bash decides this
+ * before it removes any quoting, and only the NAME and the OPERATOR take part in it: quoting any of `NAME=` /
+ * `NAME+=` makes the whole word a program name looked up on PATH (`'A=x'`, `'A+=x'`, `A\+=x`), while quoting the
+ * VALUE does not (`A+=".env"` assigns `.env` exactly as `A+=.env` does — verified against the shell). A
+ * whole-word test conflates the two and reads the quoted VALUE as a program name; a FOLDED-word test conflates
+ * them the other way and reads the quoted PROGRAM NAME as an assignment, stepping over the real program.
+ */
+export declare function isLeadingAssignmentWord(toks: SegmentTokens, i: number): boolean;
 /**
  * Programs that turn their STANDARD INPUT into the OPERANDS of another program, and EXEC that program directly.
  *
@@ -169,35 +197,14 @@ export declare function readProgramPosition(toks: SegmentTokens): ProgramPositio
  *  consumer; WHICH targets are accepted is the caller's declaration, not this reader's. */
 export declare function argvReentryUnjudged(pos: ProgramPosition, acceptedTargets: ReadonlySet<string>): boolean;
 /**
- * The two ways this reader DECLINES rather than judges — a CLOSED set, because which of them a seat reads as
- * evidence is a table each seat declares against (`fs-bash.ts`, where the argument is), not a boolean buried
- * in a caller. `unreadable_program_position`: the walk cannot name the program bash will run (`env -- ls`).
+ * The two ways this reader DECLINES rather than judges — a CLOSED set (`docs/CLOSED-SETS.md`), because what a
+ * seat does with a declined segment is a ROW of the shell read decision table (`shell-read-judge.ts`, the
+ * `declined` row: the one row the seats disagree on), not a boolean buried in a caller.
+ * `unreadable_program_position`: the walk cannot name the program bash will run (`env -- ls`).
  * `stream_fed_operands`: the operands arrive on a STREAM it never saw (`… | xargs cat`). Neither names a WORD.
  */
 export declare const SHELL_SCAN_DECLINES: readonly ["unreadable_program_position", "stream_fed_operands"];
 export type ShellScanDecline = (typeof SHELL_SCAN_DECLINES)[number];
-/** The two SEAT TABLES over that set — ROW PER MEMBER behind a compile-time fence, registered in
- *  `docs/CLOSED-SETS.md` so `gate:closed-sets` is their runtime twin. The ARGUMENT for the rows is at the
- *  seats that read them (`fs-bash.ts`), which DERIVE the `Set` shape their readers take. Rows and not two
- *  sets because a derived set beside an empty literal made a third decline SILENTLY asymmetric, in the
- *  widening direction; a member with no row now reds `tsc` at both fences with the word spelled out. */
-export declare const BOUNDARY_SEAT_READS_DECLINE: {
-    readonly unreadable_program_position: true;
-    readonly stream_fed_operands: true;
-};
-/** The fence over the read-boundary seat's table: `never` while every decline has a row. */
-export type BoundarySeatTableCoversEveryDecline = AssertAllKeysHandled<Exclude<ShellScanDecline, keyof typeof BOUNDARY_SEAT_READS_DECLINE>>;
-/** The classify doctrine's table — every row `false` BY THE ARGUMENT (stated at the seat), not by omission. */
-export declare const CLASSIFY_SEAT_READS_DECLINE: {
-    readonly unreadable_program_position: false;
-    readonly stream_fed_operands: false;
-};
-/** The fence over the classify seat's table. */
-export type ClassifySeatTableCoversEveryDecline = AssertAllKeysHandled<Exclude<ShellScanDecline, keyof typeof CLASSIFY_SEAT_READS_DECLINE>>;
-/** A seat's table in the shape its readers take — the members it answers YES for. DERIVED, so the ROWS are
- *  the single source and a set can never say something its table does not. The parameter is TOTAL, not
- *  `Partial`: that stops a third seat being written `seatDeclineEvidence({})`, one level up from the fences. */
-export declare function seatDeclineEvidence(table: Record<ShellScanDecline, boolean>): ReadonlySet<ShellScanDecline>;
 /** Does a SHELL stand where this segment's program would be — as the program itself (`sh -c`), or as a launcher
  *  ROW handing its operands to one (`watch "…"`)? ONE predicate for the re-entry class, so the two spellings
  *  cannot be answered differently; which names are shells is the caller's declaration. Not a decline. */

package/dist/tools/fs/bash-program-position.js

@@ -2,13 +2,44 @@ export const NOT_AUTO_ALLOWED = "— not auto-allowed";
 export function programBasename(word) {
     return word.includes("/") ? (word.split("/").pop() ?? word) : word;
 }
-export const ASSIGNMENT_WORD = /^[A-Za-z_][A-Za-z0-9_]*=/;
+export const ASSIGNMENT_PREFIX = /^[A-Za-z_][A-Za-z0-9_]*(?:\[[^\]\s]*\])?\+?=/;
+export function writtenAssignmentPrefix(token) {
+    const prefix = ASSIGNMENT_PREFIX.exec(token)?.[0];
+    if (prefix === undefined)
+        return undefined;
+    const appends = prefix.endsWith("+=");
+    const written = prefix.slice(0, prefix.length - (appends ? 2 : 1));
+    const bracket = written.indexOf("[");
+    return { prefix, name: bracket < 0 ? written : written.slice(0, bracket), appends, settlesWholeName: !appends && bracket < 0 };
+}
 export const SHELL_CONTROL_PREFIXES = new Set(["!", "if", "then", "elif", "else", "while", "until", "do", "time"]);
 export const SHELL_BLOCK_WORDS = new Set(["for", "select", "case", "esac", "fi", "done", "function", "coproc", "[[", "]]", "in"]);
 export function isBareControlWord(toks, i, words) {
     const word = toks.folded[i];
     return word !== undefined && toks.raw[i] === word && words.has(word);
 }
+export function isLeadingAssignmentWord(toks, i) {
+    const word = toks.folded[i];
+    const raw = toks.raw[i];
+    if (word === undefined || raw === undefined)
+        return false;
+    const written = writtenAssignmentPrefix(word);
+    return written !== undefined && prefixWrittenBare(raw, written);
+}
+function prefixWrittenBare(raw, written) {
+    if (!raw.startsWith(written.name))
+        return false;
+    let at = written.name.length;
+    if (written.prefix[at] === "[") {
+        if (raw[at] !== "[")
+            return false;
+        const close = raw.indexOf("]", at);
+        if (close < 0)
+            return false;
+        at = close + 1;
+    }
+    return raw.startsWith(written.appends ? "+=" : "=", at);
+}
 export const ARGV_REENTRY_PROGRAM_RE = /^xargs$/;
 export const ARGV_REENTRY_DEFAULT_PROGRAM = "echo";
 const NO_DECLARED_OPTIONS = { optionArity: new Map() };
@@ -90,7 +121,7 @@ export function readProgramPosition(toks) {
         return none(undefined, []);
     const written = i;
     const assignments = [];
-    while (i < folded.length && ASSIGNMENT_WORD.test(folded[i])) {
+    while (i < folded.length && isLeadingAssignmentWord(toks, i)) {
         assignments.push(i);
         i++;
     }
@@ -159,17 +190,6 @@ export function argvReentryUnjudged(pos, acceptedTargets) {
     return runs === undefined || !acceptedTargets.has(runs);
 }
 export const SHELL_SCAN_DECLINES = ["unreadable_program_position", "stream_fed_operands"];
-export const BOUNDARY_SEAT_READS_DECLINE = {
-    unreadable_program_position: true,
-    stream_fed_operands: true,
-};
-export const CLASSIFY_SEAT_READS_DECLINE = {
-    unreadable_program_position: false,
-    stream_fed_operands: false,
-};
-export function seatDeclineEvidence(table) {
-    return new Set(SHELL_SCAN_DECLINES.filter((decline) => table[decline] === true));
-}
 export function programPositionRunsShell(pos, shellProgram) {
     if (pos.refusal !== undefined)
         return pos.refusal.kind === "control_syntax_at_program_position" && pos.refusal.runsShell === true;