@sema-agent/core 7.25.0 → 7.25.1

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 7.25.1 — 2026-09-20
+
+### A bare `NAME+=value` word is the assignment bash reads, not a program name (#993; P2; read boundary; narrowing on deny rows, widening on the rest; no wire key, no export)
+- **Before.** `A=.env` and `A+=.env` are one act to bash, and the program-position reader read only the plain spelling. The append word therefore arrived AS the program — an unrecognised one — so the segment took the verb-blind reading and its VALUE met no judge at all. Measured on the base of this entry, four faces, deny row `**/.env`: `A=.env; cat "$A"` was refused at zero cards with `read_path_denied` on all four, while `A+=.env; cat "$A"` produced ONE approval card naming no deny row on both Bash seats and a YES returned the file's bytes.
+- **After, as one rule.** A leading assignment is the plain spelling, or the append spelling whose **prefix** — the NAME and the OPERATOR — is written bare in the raw token (`isLeadingAssignmentWord`, `src/tools/fs/bash-program-position.ts`). That is the question bash itself asks, before it removes any quoting and about those characters only: quoting any of `NAME+=` makes the whole word a program name on PATH (`'A+=x'`, `"A+=x"`, `A\+=x` — their argument stays judged), while quoting the VALUE does not (`A+=".env"` and `A+='.env'` assign `.env` exactly as `A+=.env` does — verified against the shell). A whole-word bareness test conflates the two and leaves the quoted-value spelling one quote character away from the escape this entry closes; the adversarial round found it and it is pinned as a mutation. The value channel is the same one rule: an assignment word carries TWO independent facts — what the text could not settle, and what path the text DOES name — and the append form has both, so both are handed over (`assignmentWordPayload`). A tilde-bearing or empty value still names nothing. The seat that answers "which program, and where its argv begins" (`argvProgramOf`) no longer strips the leading assignments a second time; the one reader answers.
+- **NARROWING — who is hurt.** A deny row spelled in a bare append word is now REFUSED at zero cards on every face (`deniedBy: "read_boundary"`, `structured.read_path_denied`) where it was an approvable card: `A+=.env; cat "$A"`, `A+=".env"; cat "$A"`, `A+=.env cat x`, `A+=.env && …`, `A+=.env | …`, `B+=.env` behind another assignment, and the same word behind a launcher that owns assignment operands (`env A+=.env dd if=f`). Anyone whose command spells a deny-listed path in an append word loses the card. Compensation: none is owed — the plain spelling has had exactly this verdict since 7.25.0, and the card it replaces was one no approver could read the deny row from.
+- **WIDENING — who is hurt.** The same alignment runs the other way for values that are merely outside the roots: `A+=/etc/passwd <unlisted>` and `A+=~/secret <unlisted>` were a MANDATED card (the verb-blind reading of a word mistaken for a program) and now vouch, because a leading environment word's value is the deny judge's alone and no containment candidate (KL-945a, the standing rule for `A=…`). A deployment that relied on that card as an out-of-root alarm on the append spelling loses it; the deny list is the channel that still fires, on either spelling.
+- **Unchanged, pinned:** a quoted or escaped append word is a program name and its path argument is judged; `env A+=x dd if=<root>/f` reads word for word as before (the launcher owns the word, `dd` is the program); behind a launcher with no assignment grammar (`nice A+=x true`) the word is still the program it execs; `A+="$(cat <deny row>)"` is refused through the nested plan as before.
+- **ONE question for both operators (E5; P2, narrowing; closes KL-945h / the #987 program-position格).** The predicate asks what bash asks — is the matched `NAME=` / `NAME+=` prefix written bare in the raw token — for BOTH operators. Reading the plain spelling on the FOLDED word alone conflated the two the other way: `'A=x' /outside/report.txt` is a command NAMED `A=x` to bash, and the reader took it for an assignment, stepped over the real program and read the file as a program PATH (executed, not disclosed, so no containment question at all). It is that program's operand now, and it is judged — a mandated card with a `readRootCandidate`, where there was none. Who is hurt: a command whose first word is a quoted or escaped assignment shape (`'A=x' file`, `"A+=x" file`) loses its free pass. Compensation: the card carries the way out; the bare spelling is unchanged, and so is a quoted VALUE.
+- **A subscripted name is an assignment too (E6; P2, narrowing; closes KL-993a).** `A[0]=.env` writes one element of `A` and `${A[0]}` reads it back — bash's own reading, verified against the shell — and the grammar knew only unsubscripted names, so the whole word became a program name and its VALUE met no judge. `ASSIGNMENT_PREFIX` reads a subscript carrying no whitespace; the subscript itself is not parsed and the value is judged like any other. A quoted `'A[0]=x'` stays a program name. One element does not settle the whole variable, so the delete walk treats it as it treats an append: verifiable only where the prior content was. Who is hurt: a command spelling a deny-listed path in a subscripted assignment loses its card.
+- **A declaration's operand is read after quote removal (G2).** `export` / `declare` and their family are BUILTINS: the word reaches them with the quotes gone, so `export 'D=/tmp/safe'` assigns what the bare spelling assigns. Requiring the word to be written bare there — the question the LEADING position asks, where the shell itself decides whether a word is an assignment at all — refused to read a word the builtin reads and left the name unregistered, which is a finding on a command that settles its target. The quoted spelling now answers exactly as its bare twin does in both directions: `export "D+=$UNKNOWN"` and `export 'D+=x'` (no prior value) revoke, `D=/tmp/safe; export 'D+=x'` does not.
+- **The declared spelling is the same state transition (E7; P2, narrowing).** `export` / `declare` / `typeset` / `local` / `readonly` carry the same operand, and the second write site of the in-window-assignment rule kept its own copy of the grammar — `NAME=` only, `export` only. So `export D+=$UNKNOWN` left `D` verifiable while the bare `D+=$UNKNOWN` revoked it, and `rm -rf "$D"` behind the declared spelling drew no finding. Both sites read the one grammar now, and both answer "does this settle the whole name?" the same way. Who is hurt: a command that used a declaration head to keep a name verifiable through an append or a subscript now draws the finding the bare spelling always drew.
+- **The activity summary skips every leading assignment (E8; privacy).** `primaryActivityArg` (`src/core/arg-summary.ts`) steps over a command's leading assignments to reach the command NAME, and its own copy of the grammar knew `NAME=` alone — so `PAYLOAD+=<secret> cat f` was read as a command called `PAYLOAD+=<secret>` and the VALUE was written out as the activity's name. That summary is persisted and SSE-forwarded. It reads the one grammar now; a lone assignment and a quoted one still withhold.
+- **Same grammar, second walk (leg B; P2, narrowing).** The unverifiable-recursive-delete walk (`findUnverifiableRecursiveDelete`, `src/core/tool-policy.ts`) skips a statement's leading assignments to reach the command, and recognised them with a private copy of the grammar that knew only the plain operator — so `A+=x rm -rf $UNSET` stopped that walk on its first token and the delete behind it was never examined, while `A=x rm -rf $UNSET` reported its unverifiable target. Both walks now read ONE spelling (`ASSIGNMENT_PREFIX`, exported beside the reader). With it comes the append form's own asymmetry: `NAME+=value` hands the program what NAME already held plus this value, so a readable value settles only the tail — the name is verifiable only where its prior content was (`A+=/tmp/j rm -rf $A` reports; `A=/tmp/j; A+=/k rm -rf $A` does not), and the root mark an append carries is only ever added, never cleared. Who is hurt: a command that used one `+` in front of a delete and drew no finding now draws one — the fail-closed side, and the plain spelling's answer. A quoted prefix (`'A+=x' rm …`, a program name to bash) is unchanged on both spellings. `test/backlog993-tool-policy-leading-assignment.test.ts`.
+- **Which `$` opens a quote form is ONE question (H; regression, fail-open).** The word scan decided it with a one-character peek behind the `$`, and the expansion scan did not look behind at all — so `cat x\\$'…'` (a literal backslash followed by a REAL ANSI-C quote: bash reads `x\\$'y'` as `x\y`) was read as a literal `$` by one and as a quote by the other. The word folded to a path INSIDE the roots while nothing reported an expansion, and the read ran at zero cards on the seat with no shape tier. Both walkers now ask one function, and it counts the backslash RUN — odd is escaped (`\$'y'` is a literal `$`), even is bare — which a peek at one character cannot do.
+- **The same class, third walk (leg C; P2, narrowing).** `$'…'` (ANSI-C quoting) and `$"…"` are QUOTE FORMS, and the lexer folded their `$` into the word — so a deny row written `$'.env'` reached every judge as `$.env`, a spelling no filesystem has, and the read escaped into an approvable card a yes then executed (measured: one card naming no deny row on both Bash seats, sentinel returned, for `cat $'.env'`, `A=$'.env'; cat "$A"` and `A+=$'.env'; cat "$A"`). The forms are read as quotes now: a body with no backslash is its own text exactly as a single-quoted one is, `$"…"` is an ordinary double-quoted string, an unterminated `$'` is a command bash refuses to parse and is unreadable here too, and the quote walks know that `\'` does not close the region. `raw` keeps the written spelling, so every reader that asks "was this written bare" is unaffected. A `$` that OPENS a quote no longer counts as an unquoted expansion either — calling it one made the word unresolvable, which names no path for a judge to meet. **The ESCAPE SEQUENCES are deliberately not folded**: a body carrying any backslash is unreadable (the card this release started from, fail-closed). Three adversarial rounds each found a different transcription error in a decoder for them — a code point read where bash builds a byte, a UTF-16 unit encoded where bash writes a character, a control-letter formula off by one table — and each named a DIFFERENT FILE than the shell would open, so the table belongs with the single-lexer work (#994) where a differential test against `/bin/bash printf` bytes can carry it. `test/backlog993-ansi-c-quoting.test.ts`; KL-993g records the limit, KL-993d the read-only shell's own `$` grammar.
+- **The tilde question is asked of the PREFIX, not the word (E3).** A slot expands only where its tilde-PREFIX — up to the terminating `/` or `:` — carries no quoting, which is bash's own rule. Asking it of the whole word answered it for `A=~/'.env'` and `A+=x:~/'.env'`, whose prefixes are bare and whose values are not: bash expands those (`A=~/".env"` gives `<home>/.env`, verified against the shell) and calling the value literal named a file no shell would open. Both now read unresolved and ask on both faces; `A='~'/x` — a QUOTED prefix — is the ordinary relative path it is.
+- **The same class, fourth walk (leg D; P2, narrowing).** A tilde in an assignment value is read by POSITION, as bash reads it: expanded at the start of the value and right after each `:`, LITERAL everywhere else, and nowhere at all where the word is not written bare. Reading "contains a tilde" as "cannot be settled" threw away every value whose tilde was literal, and a value nobody names is a value no judge meets — so `A=.env~` / `A+=.env~` (the editor-backup spelling) reached a deny row spelled `**/.env*` as nothing at all, on both spellings, and asked where `cat .env~` refused. The value is now named (`.env~`), the row bites, and a quoted leading tilde is an ordinary path component spelled `./~…`. A tilde WHERE BASH EXPANDS ONE is still reported unresolved and still asks on both faces, unchanged. Who is hurt: these values lose their card where they name a deny row. KL-993b now records only what is left — such a tilde is not placed against the declared home.
+- **Three corners of the same three legs (F1–F3).** (F1, regression) An ANSI-C body's LITERAL run was encoded by UTF-16 unit, so a character outside the basic plane became two replacement characters — bytes that decode cleanly and name a different file: `cat $'🔒/credentials.txt'` under a deny row for that directory read it at zero cards on the seat with no shape tier. Literal runs are encoded by code point now, and the decoder keeps a BOM instead of stripping bytes bash keeps. (F2) The bareness question covers the NAME and the OPERATOR and nothing else: a quoted SUBSCRIPT still names the element (`A['0']=v` assigns it), and comparing the whole prefix took that for a program name — a card where a refusal was owed. (F3) A declaration carries its own OPTIONS and as many operands as it likes; reading one word after the head word left every later name unregistered and every option-carrying declaration unread, so `export -n D=/tmp/safe; rm -rf "$D"` drew a finding on a command that settles its target. Every operand takes the same state transition now, an unreadable one revokes rather than vouches, and the transition is written once for both sites.
+- **KNOWN-LIMITS:** KL-945h and KL-993a are CLOSED by E5 / E6 above (both operators and the subscripted name now take the one bare-prefix question). Left open: KL-993b (a tilde in an expansion slot reports "unresolved" rather than resolving against the declared home), KL-993c (a value assembled across two appends — `A+=.en; A+=v` — is not one text, so the read it feeds is the ordinary unresolvable-expansion card), KL-993d (the read-only shell's own grammar still refuses every `$` spelling, `$'…'` included), KL-993e (a value equal to the substitution placeholder text is dropped as a substitution), KL-993f (a subscript carrying whitespace is not read as one word).
+- Reach: @server / @cli / @client-core — zero: no wire key, no notice code, no export added or removed, no card SHAPE changed. Headless: a deny row in an append word refuses (`read_boundary`) where it auto-denied an unanswerable card; an out-of-root value in one vouches where it refused. `test/backlog993-append-assignment-word.test.ts` pins P1–P5 with a positive control; `backlog860` G2 and `backlog862b` ③/⑧ carry the retired dialect's tripwire.
+
 ## 7.25.0 — 2026-09-20
 
 ### One station judges every shell read, before approval (#945 S1; BREAKING ×3; one narrowing, three widenings; #976 closed structurally)

package/dist/core/arg-summary.d.ts

@@ -1,10 +1,3 @@
-/**
- * design/99 — a SHORT, SECRET-SCRUBBED one-line summary of a tool call's arguments, for an OPERATOR-FACING
- * display (the MF-W workflow monitor's `Read(path)` / `Bash(grep …)` activity line; the MF-24 permission-denial
- * ledger's denied-tool input). Shared so both the activity sink and the denial record scrub identically — a
- * single audited boundary. NOT `redactHostLeaks` (that is for untrusted-LLM egress and over-redacts the very
- * path the trusted owner-scoped monitor wants to show). Reviewed: 3 blocker + 5 major findings closed.
- */
 /** Known credential SHAPES + `secretKey=value` — redacted from the FINAL abbreviated string, the single scrub
  *  point before any store/SSE fan-out. Conservative (real credential formats). */
 /** every prefix is LEFT-ANCHORED with \`(?<![A-Za-z0-9])\` — without it, ordinary words whose

package/dist/core/arg-summary.js

@@ -1,3 +1,4 @@
+import { writtenAssignmentPrefix } from "../tools/fs/bash-program-position.js";
 const ACTIVITY_ARG_MAX = 80;
 const SENSITIVE_KEY = /token|secret|key|password|passwd|credential|auth/i;
 export function summarizeRedactions(findings) {
@@ -234,7 +235,7 @@ export function primaryActivityArg(args) {
     if (command !== undefined) {
         const tokens = command.trim().split(/\s+/);
         let i = 0;
-        while (i < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i])) {
+        while (i < tokens.length && writtenAssignmentPrefix(tokens[i]) !== undefined) {
             if (/["'\\]/.test(tokens[i]))
                 return undefined;
             i++;

package/dist/core/tool-policy.js

@@ -13,6 +13,7 @@ import { thrownText } from "./thrown-value.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, parsePermissionRule } from "./permission-rules.js";
 import { protocolOf } from "./protocol-table.js";
 import { isAbsoluteForFamily, isAbsolutePathForm, joinForFamily, normalizeAbsPathLexically, pathFamilyOf, writeTargetPath } from "../tools/fs/safety.js";
+import { ASSIGNMENT_PREFIX, writtenAssignmentPrefix } from "../tools/fs/bash-program-position.js";
 export function advertisedWritableRootsSeat(seat) {
     return seat === undefined ? {} : { advertisedWritableRoots: Object.freeze([...seat.roots]) };
 }
@@ -618,22 +619,28 @@ export function findUnverifiableRecursiveDelete(command, safeVars = new Set(UNVE
         }
         return false;
     };
+    const applyAssignmentWord = (words, at) => {
+        const written = writtenAssignmentPrefix(words[at]);
+        if (written === undefined) {
+            assigned.delete(words[at].replace(/\[.*$/, ""));
+            return;
+        }
+        const value = restOfAssignment(words, at, written.prefix.length - 1);
+        if ((!written.settlesWholeName && !assigned.has(written.name)) || valueIsOpaque(value, assigned, safeVars))
+            assigned.delete(written.name);
+        else
+            assigned.add(written.name);
+        if (valueEscapesRoot(value, safeVars))
+            assignedEscapesRoot.add(written.name);
+        else if (written.settlesWholeName)
+            assignedEscapesRoot.delete(written.name);
+    };
     const statements = command.replace(/\\\r?\n/g, " ").split(STATEMENT_SPLIT);
     for (const stmt of statements) {
         const tokens = stmt.trim().split(/\s+/).filter(Boolean);
         let i = 0;
-        while (i < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i])) {
-            const eq = tokens[i].indexOf("=");
-            const name = tokens[i].slice(0, eq);
-            const value = restOfAssignment(tokens, i, eq);
-            if (valueIsOpaque(value, assigned, safeVars))
-                assigned.delete(name);
-            else
-                assigned.add(name);
-            if (valueEscapesRoot(value, safeVars))
-                assignedEscapesRoot.add(name);
-            else
-                assignedEscapesRoot.delete(name);
+        while (i < tokens.length && ASSIGNMENT_PREFIX.test(tokens[i])) {
+            applyAssignmentWord(tokens, i);
             i += assignmentTokenSpan(tokens, i);
         }
         let sawWrapper = false;
@@ -646,7 +653,7 @@ export function findUnverifiableRecursiveDelete(command, safeVars = new Set(UNVE
             if (DELETE_WRAPPERS.has(t)) {
                 sawWrapper = true;
                 i++;
-                while (i < tokens.length && (/^-/.test(tokens[i]) || /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i])))
+                while (i < tokens.length && (/^-/.test(tokens[i]) || ASSIGNMENT_PREFIX.test(tokens[i])))
                     i++;
                 continue;
             }
@@ -672,16 +679,16 @@ export function findUnverifiableRecursiveDelete(command, safeVars = new Set(UNVE
         i = headIdx;
         const head = stripTokenEdges(tokens[i]).replace(/^\\/, "");
         const headName = head.split("/").pop() ?? head;
-        let m;
-        if ((m = stmt.trim().match(/^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/))) {
-            if (valueIsOpaque(m[2], assigned, safeVars))
-                assigned.delete(m[1]);
-            else
-                assigned.add(m[1]);
-            if (valueEscapesRoot(m[2], safeVars))
-                assignedEscapesRoot.add(m[1]);
-            else
-                assignedEscapesRoot.delete(m[1]);
+        const declStmt = stmt.trim();
+        const declaredWords = /^(?:export|declare|typeset|local|readonly)\b/.test(declStmt) ? declStmt.split(/\s+/).filter(Boolean).slice(1) : ASSIGNMENT_PREFIX.test(declStmt) ? [declStmt] : [];
+        for (let d = 0; d < declaredWords.length;) {
+            if (/^[-+]/.test(declaredWords[d])) {
+                d += 1;
+                continue;
+            }
+            declaredWords[d] = stripTokenEdges(declaredWords[d]);
+            applyAssignmentWord(declaredWords, d);
+            d += assignmentTokenSpan(declaredWords, d);
         }
         if (headName === "read") {
             void 0;

package/dist/tools/fs/bash-lexer.d.ts

@@ -93,6 +93,19 @@ export interface SegmentTokens {
  *  judges words sees "this word carries text the shell computes" rather than the computing text itself. */
 export declare const SUBSTITUTION_PLACEHOLDER = " subst";
 export type QuoteOpen = '"' | "'" | undefined;
+/**
+ * Does the `$` at `at` OPEN a quote form (`$'…'` / `$"…"`)? ONE question, asked by every walker that has to
+ * answer it — the word scan here and the expansion scan in the classifier — because a `$` one of them reads
+ * as escaped and the other as bare yields two different words for the same text, and the judge then compares
+ * the wrong one. Escaped means an ODD run of backslashes in front of it: `\$'y'` is a literal `$`, while
+ * `x\\$'y'` is a literal backslash followed by a real ANSI-C quote (both read off /bin/bash). Counting the
+ * run is what a one-character peek behind cannot do.
+ */
+export declare function dollarOpensQuote(text: string, at: number): boolean;
+/** The `'` that CLOSES the ANSI-C quote opened at `open`, or `undefined` when none does. `\'` does not close
+ *  one — the single place a quote region honours a backslash, and a pairing walk blind to it reads the real
+ *  closing quote as an OPENING one and everything after as quoted, which hides an expansion the shell performs. */
+export declare function ansiCQuoteClose(source: string, open: number): number | undefined;
 /**
  * Which QUOTE holds each character of `s`, by the same pairing rule the lexer walks with, and the boolean view
  * of it. The pairing quote characters themselves belong to the region they bound — they are not operators

package/dist/tools/fs/bash-lexer.js

@@ -4,11 +4,44 @@ function quoteStep(open, ch) {
         return ch === '"' || ch === "'" ? ch : undefined;
     return open === ch ? undefined : open;
 }
+export function dollarOpensQuote(text, at) {
+    const next = text[at + 1];
+    if (next !== "'" && next !== '"')
+        return false;
+    let run = 0;
+    for (let k = at - 1; k >= 0 && text[k] === "\\"; k--)
+        run += 1;
+    return run % 2 === 0;
+}
+export function ansiCQuoteClose(source, open) {
+    for (let i = open + 1; i < source.length; i++) {
+        if (source[i] === "\\") {
+            i += 1;
+            continue;
+        }
+        if (source[i] === "'")
+            return i;
+    }
+    return undefined;
+}
 export function quoteMask(s) {
     const openedBy = new Array(s.length).fill(undefined);
     const quoted = new Array(s.length).fill(false);
     let open;
     for (let i = 0; i < s.length; i++) {
+        if (open === undefined && s[i] === "$" && s[i + 1] === "'") {
+            const close = ansiCQuoteClose(s, i + 1);
+            for (let k = i; k <= (close ?? s.length - 1); k++) {
+                openedBy[k] = "'";
+                quoted[k] = true;
+            }
+            if (close === undefined) {
+                open = "'";
+                break;
+            }
+            i = close;
+            continue;
+        }
         const before = open;
         open = quoteStep(open, s[i]);
         const holds = before ?? open;
@@ -32,6 +65,13 @@ function tildeIsLiteral(raw) {
     }
     return false;
 }
+function ansiCBody(source, open) {
+    const close = ansiCQuoteClose(source, open);
+    if (close === undefined)
+        return undefined;
+    const body = source.slice(open + 1, close);
+    return body.includes("\\") ? { unreadable: true, close } : { text: body, close };
+}
 export function wordsOf(segment) {
     const folded = [];
     const raw = [];
@@ -310,6 +350,27 @@ function scan(source, opts, quotesLiteral) {
             i = j;
         }
         const ch = source[i];
+        if (!quotesLiteral && ch === "$" && !inSingle && !inDouble && dollarOpensQuote(source, i)) {
+            const q = next(i);
+            if (source[q] === '"') {
+                raw += ch;
+                started = true;
+                i = q - 1;
+                continue;
+            }
+            if (source[q] === "'") {
+                const ansi = ansiCBody(source, q);
+                if (ansi === undefined)
+                    return { reject: "an ANSI-C quoted word never closes" };
+                if ("unreadable" in ansi)
+                    return { reject: "an ANSI-C quoted word carries an escape this lexer does not fold" };
+                raw += source.slice(i, ansi.close + 1);
+                folded += ansi.text;
+                started = true;
+                i = ansi.close;
+                continue;
+            }
+        }
         if (!quotesLiteral) {
             if (ch === "'" && !inDouble) {
                 inSingle = !inSingle;

package/dist/tools/fs/bash-program-position.d.ts

@@ -14,9 +14,27 @@ import type { SegmentTokens } from "./bash-lexer.js";
 export declare const NOT_AUTO_ALLOWED = "\u2014 not auto-allowed";
 /** argv[0] as the program bash will resolve it: `/usr/bin/cat` and `cat` are one name. */
 export declare function programBasename(word: string): string;
-/** A leading `NAME=value` word: an assignment bash applies to the command's environment rather than a
- *  program name. Same shape the exit-code reader in `fs-bash.ts` skips for the same reason. */
-export declare const ASSIGNMENT_WORD: RegExp;
+/**
+ * The `NAME=` / `NAME+=` prefix bash reads as an ASSIGNMENT — the ONE spelling of that grammar, matched where
+ * it is WRITTEN. Both operators, because bash reads both; the match IS the prefix, so a caller holding raw
+ * text can ask whether its token carries one bare. Every walk that strips leading assignments reads this:
+ * a second copy of the grammar is how one walk came to strip `A=x` and skip `A+=x`.
+ */
+export declare const ASSIGNMENT_PREFIX: RegExp;
+/**
+ * The prefix this raw token BEGINS with, or `undefined`.
+ *
+ * `name` is the VARIABLE the word assigns to, which is the part before any subscript: `A[0]=x` writes one
+ * element of `A`, so a reader asking "is `$A` settled" must not be told that `A[0]` is. `settlesWholeName` is
+ * false for exactly the two spellings that do not settle it — an append (the earlier content is not in the
+ * text) and a subscript (the other elements are not) — so a consumer of that question asks it once.
+ */
+export declare function writtenAssignmentPrefix(token: string): {
+    readonly prefix: string;
+    readonly name: string;
+    readonly appends: boolean;
+    readonly settlesWholeName: boolean;
+} | undefined;
 /** Shell control words that stand BEFORE a command: transparent for the boundary walk (the command behind them is
  *  judged). */
 export declare const SHELL_CONTROL_PREFIXES: ReadonlySet<string>;
@@ -25,6 +43,17 @@ export declare const SHELL_BLOCK_WORDS: ReadonlySet<string>;
 /** A control word is a keyword only when bash sees it BARE: `'if'` / `"do"` / `\\!` are command names (a program
  *  looked up on PATH, whose failure changes nothing), so a quoted or escaped spelling never counts as one. */
 export declare function isBareControlWord(toks: SegmentTokens, i: number, words: ReadonlySet<string>): boolean;
+/**
+ * A word bash strips as an ASSIGNMENT before it chooses the program.
+ *
+ * WHAT HAS TO BE BARE IS THE PREFIX, NOT THE WORD, and it is ONE question for BOTH operators. Bash decides this
+ * before it removes any quoting, and only the NAME and the OPERATOR take part in it: quoting any of `NAME=` /
+ * `NAME+=` makes the whole word a program name looked up on PATH (`'A=x'`, `'A+=x'`, `A\+=x`), while quoting the
+ * VALUE does not (`A+=".env"` assigns `.env` exactly as `A+=.env` does — verified against the shell). A
+ * whole-word test conflates the two and reads the quoted VALUE as a program name; a FOLDED-word test conflates
+ * them the other way and reads the quoted PROGRAM NAME as an assignment, stepping over the real program.
+ */
+export declare function isLeadingAssignmentWord(toks: SegmentTokens, i: number): boolean;
 /**
  * Programs that turn their STANDARD INPUT into the OPERANDS of another program, and EXEC that program directly.
  *

package/dist/tools/fs/bash-program-position.js

@@ -2,13 +2,44 @@ export const NOT_AUTO_ALLOWED = "— not auto-allowed";
 export function programBasename(word) {
     return word.includes("/") ? (word.split("/").pop() ?? word) : word;
 }
-export const ASSIGNMENT_WORD = /^[A-Za-z_][A-Za-z0-9_]*=/;
+export const ASSIGNMENT_PREFIX = /^[A-Za-z_][A-Za-z0-9_]*(?:\[[^\]\s]*\])?\+?=/;
+export function writtenAssignmentPrefix(token) {
+    const prefix = ASSIGNMENT_PREFIX.exec(token)?.[0];
+    if (prefix === undefined)
+        return undefined;
+    const appends = prefix.endsWith("+=");
+    const written = prefix.slice(0, prefix.length - (appends ? 2 : 1));
+    const bracket = written.indexOf("[");
+    return { prefix, name: bracket < 0 ? written : written.slice(0, bracket), appends, settlesWholeName: !appends && bracket < 0 };
+}
 export const SHELL_CONTROL_PREFIXES = new Set(["!", "if", "then", "elif", "else", "while", "until", "do", "time"]);
 export const SHELL_BLOCK_WORDS = new Set(["for", "select", "case", "esac", "fi", "done", "function", "coproc", "[[", "]]", "in"]);
 export function isBareControlWord(toks, i, words) {
     const word = toks.folded[i];
     return word !== undefined && toks.raw[i] === word && words.has(word);
 }
+export function isLeadingAssignmentWord(toks, i) {
+    const word = toks.folded[i];
+    const raw = toks.raw[i];
+    if (word === undefined || raw === undefined)
+        return false;
+    const written = writtenAssignmentPrefix(word);
+    return written !== undefined && prefixWrittenBare(raw, written);
+}
+function prefixWrittenBare(raw, written) {
+    if (!raw.startsWith(written.name))
+        return false;
+    let at = written.name.length;
+    if (written.prefix[at] === "[") {
+        if (raw[at] !== "[")
+            return false;
+        const close = raw.indexOf("]", at);
+        if (close < 0)
+            return false;
+        at = close + 1;
+    }
+    return raw.startsWith(written.appends ? "+=" : "=", at);
+}
 export const ARGV_REENTRY_PROGRAM_RE = /^xargs$/;
 export const ARGV_REENTRY_DEFAULT_PROGRAM = "echo";
 const NO_DECLARED_OPTIONS = { optionArity: new Map() };
@@ -90,7 +121,7 @@ export function readProgramPosition(toks) {
         return none(undefined, []);
     const written = i;
     const assignments = [];
-    while (i < folded.length && ASSIGNMENT_WORD.test(folded[i])) {
+    while (i < folded.length && isLeadingAssignmentWord(toks, i)) {
         assignments.push(i);
         i++;
     }

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -811,12 +811,14 @@ export declare function inlineProgramClause(model: InlineProgramModel, args: rea
  *  command name. Names-only traversals (`find`, `ls -R`, `du`, `tree`, an archive write) are in the table
  *  and answer `false` here — see {@link RecursiveReadFormModel.discloses}. */
 export declare function segmentSelectsRecursiveRead(name: string, args: readonly string[]): boolean;
-export declare function assignmentWordPayload(word: string): {
+/** `raw` is the word as WRITTEN; it defaults to the folded spelling, which is the reading that expands most. */
+export declare function assignmentWordPayload(word: string, raw?: string): {
     kind: "value";
     value: string;
 } | {
     kind: "unresolved";
     reason: string;
+    value?: string;
 } | undefined;
 /** WHICH programs are DECLARED not to open the value of a `NAME=value` ARGUMENT — an allow-list, because
  *  the other polarity was measured false. `make PREFIX=/usr/local`, `cmake -D…`, `docker run -e HOME=/root`
@@ -834,9 +836,9 @@ export declare function assignmentWordPayload(word: string): {
 export declare const ASSIGNMENT_VALUE_NOT_PATHS: ReadonlySet<string>;
 /** The program the shell will RUN here and where its OWN argv begins — the two seats
  *  {@link HeadedSegment.argvProgram} / {@link HeadedSegment.argvFrom} carry, from one reader so they cannot
- *  disagree. Both assignment spellings are stripped BEFORE the program-position reader runs: it does not
- *  read `NAME+=value` as an assignment (quoting makes `'A+=x'` a command NAME on folded text), so a leading
- *  append word arrives AS the program and hides any launcher — measured on `A+=x env B=<outside> <prog>`. */
+ *  disagree. The LEADING assignments (both spellings) are the program-position reader's own step, so this
+ *  seat no longer strips them a second time: a second strip read the quoted `'A+=x'` as an assignment the
+ *  one reader calls a program name, which is two readers with two answers. */
 export declare function argvProgramOf(tokens: SegmentTokens): {
     program: string;
     from: number;

package/dist/tools/fs/bash-readonly-classifier.js

@@ -1,6 +1,6 @@
 import { isAbsoluteForFamily, isAbsolutePathForm, isBlockedDevicePath, isShellRootedSpellingUnmapped, joinForFamily, nativeUncSpellingOf, normalizeAbsPathLexically, win32NamespaceScreen, pathFamilyOf } from "./safety.js";
-import { lexShellText, literalTildeSpelling, quoteMask, wordsOf, } from "./bash-lexer.js";
-import { ASSIGNMENT_WORD, COMMAND_LAUNCHERS, NOT_AUTO_ALLOWED, SHELL_BLOCK_WORDS, argvReentryUnjudged, isBareControlWord, programPositionRefusalSentence, readProgramPosition, } from "./bash-program-position.js";
+import { lexShellText, literalTildeSpelling, ansiCQuoteClose, dollarOpensQuote, quoteMask, wordsOf, } from "./bash-lexer.js";
+import { COMMAND_LAUNCHERS, NOT_AUTO_ALLOWED, SHELL_BLOCK_WORDS, argvReentryUnjudged, isBareControlWord, programPositionRefusalSentence, ASSIGNMENT_PREFIX, readProgramPosition, writtenAssignmentPrefix, } from "./bash-program-position.js";
 export const BASH_READONLY_DEFAULT_ALLOW = [
     "ls", "cat", "head", "tail", "wc", "pwd", "echo", "whoami", "uname",
     "grep", "cut", "tr", "basename", "dirname", "stat", "du", "df", "which",
@@ -208,7 +208,21 @@ function tokenizeSegment(segment) {
 }
 export function hasUnquotedExpansionMetachar(rawToken) {
     let open;
-    for (const ch of rawToken) {
+    for (let i = 0; i < rawToken.length; i++) {
+        const ch = rawToken[i];
+        const opener = rawToken[i + 1];
+        if (open === undefined && ch === "$" && dollarOpensQuote(rawToken, i)) {
+            if (opener === '"') {
+                open = opener;
+                i += 1;
+                continue;
+            }
+            const close = ansiCQuoteClose(rawToken, i + 1);
+            if (close === undefined)
+                return true;
+            i = close;
+            continue;
+        }
         if (open === undefined && (ch === '"' || ch === "'")) {
             open = ch;
             continue;
@@ -1444,28 +1458,51 @@ function isGrepFileStdinLongOption(tok) {
     return name !== undefined && isLongOptionAbbrevOf(name, "file");
 }
 const CLUSTER_OPTION_CHAR = /[A-Za-z0-9]/;
-const ASSIGNMENT_OR_APPEND_WORD = /^[A-Za-z_][A-Za-z0-9_]*\+?=/;
-export function assignmentWordPayload(word) {
-    if (!ASSIGNMENT_OR_APPEND_WORD.test(word))
+function tildeExpandsInValue(rawValue) {
+    if (rawValue === undefined)
+        return false;
+    for (let at = 0; at <= rawValue.length;) {
+        if (rawValue[at] === "~") {
+            let quoted = false;
+            for (let k = at + 1; k < rawValue.length && rawValue[k] !== "/" && rawValue[k] !== ":"; k++) {
+                if (rawValue[k] === "'" || rawValue[k] === '"' || rawValue[k] === "\\") {
+                    quoted = true;
+                    break;
+                }
+            }
+            if (!quoted)
+                return true;
+        }
+        const next = rawValue.indexOf(":", at);
+        if (next < 0)
+            return false;
+        at = next + 1;
+    }
+    return false;
+}
+export function assignmentWordPayload(word, raw = word) {
+    const written = writtenAssignmentPrefix(word);
+    if (written === undefined)
         return undefined;
-    const eq = word.indexOf("=");
-    const value = word.slice(eq + 1);
-    if (word[eq - 1] === "+")
-        return { kind: "unresolved", reason: `"${word}" appends to a value the text does not contain` };
-    if (value.includes("~"))
+    const eq = written.prefix.length - 1;
+    const spelled = word.slice(eq + 1);
+    const expands = tildeExpandsInValue(raw.startsWith(written.prefix) ? raw.slice(written.prefix.length) : undefined);
+    const value = expands ? spelled : literalTildeSpelling(spelled);
+    if (written.appends) {
+        const reason = `"${word}" appends to a value the text does not contain`;
+        return spelled === "" || expands ? { kind: "unresolved", reason } : { kind: "unresolved", reason, value };
+    }
+    if (expands)
         return { kind: "unresolved", reason: `"${word}" carries a tilde whose expansion the text does not settle` };
-    return value === "" ? undefined : { kind: "value", value };
+    return spelled === "" ? undefined : { kind: "value", value };
 }
 export const ASSIGNMENT_VALUE_NOT_PATHS = new Set(["make", "gmake", "bmake", "cmake", "ninja", "meson", "docker", "podman"]);
 export function argvProgramOf(tokens) {
-    let lead = 0;
-    while (lead < tokens.folded.length && ASSIGNMENT_OR_APPEND_WORD.test(tokens.folded[lead]))
-        lead++;
-    const pos = readProgramPosition({ folded: tokens.folded.slice(lead), raw: tokens.raw.slice(lead) });
+    const pos = readProgramPosition(tokens);
     if (pos.program === undefined)
         return undefined;
-    const at = lead + pos.program.index;
-    return ASSIGNMENT_OR_APPEND_WORD.test(tokens.folded[at] ?? "") ? undefined : { program: pos.program.basename, from: at };
+    const at = pos.program.index;
+    return ASSIGNMENT_PREFIX.test(tokens.folded[at] ?? "") ? undefined : { program: pos.program.basename, from: at };
 }
 export function attachedOptionPayloads(tok) {
     const literal = literalTildeSpelling;

package/dist/tools/fs/shell-read-plan.js

@@ -285,7 +285,7 @@ function segmentFacts(segment, p, decl, nestedPlan) {
                 reads.push({ spelled: word, raw, provenance: "unlisted_word", expands: "unresolvable" });
                 continue;
             }
-            if (assignmentWordPayload(word) !== undefined) {
+            if (assignmentWordPayload(word, toks.raw[j]) !== undefined) {
                 pushAssignment(reads, toks, j, "env_assignment");
                 continue;
             }
@@ -465,15 +465,13 @@ function redirectFact(r) {
 }
 function pushAssignment(reads, toks, k, provenance) {
     const word = toks.folded[k];
-    const payload = assignmentWordPayload(word);
+    const payload = assignmentWordPayload(word, toks.raw[k]);
     if (payload === undefined)
         return;
-    if (payload.kind === "value" && payload.value === SUBSTITUTION_PLACEHOLDER)
-        return;
-    if (payload.kind === "value")
-        reads.push(bare(toks.raw[k], payload.value, provenance));
-    else
+    if (payload.kind === "unresolved")
         reads.push({ spelled: word, raw: toks.raw[k], provenance, expands: "unresolvable" });
+    if (payload.value !== undefined && payload.value !== SUBSTITUTION_PLACEHOLDER)
+        reads.push(bare(toks.raw[k], payload.value, provenance));
 }
 function unlistedWords(reads, toks, from, launcherIndices, provenance, program) {
     const argv = program !== undefined ? { program: program.basename, from: program.index } : argvProgramOf(toks);
@@ -742,11 +740,11 @@ function listedVerbCandidates(name, args, rawArgs, reads) {
         positional.push({ word: t, raw: rawArgs[k] });
         push(k, t, "operand");
         if (!ASSIGNMENT_VALUE_NOT_PATHS.has(name)) {
-            const payload = assignmentWordPayload(t);
-            if (payload?.kind === "value")
-                push(k, payload.value, "operand");
-            else if (payload !== undefined)
+            const payload = assignmentWordPayload(t, rawArgs[k]);
+            if (payload?.kind === "unresolved")
                 reads.push({ spelled: t, raw: rawArgs[k], provenance: "operand", expands: "unresolvable" });
+            if (payload?.value !== undefined)
+                push(k, payload.value, "operand");
         }
     }
     for (let k = 0; k < args.length; k++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.25.0",
+  "version": "7.25.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.25.1.json

@@ -0,0 +1,64 @@
+{
+  "repo": "core",
+  "version": "7.25.1",
+  "from": "b205840bf3354e748513a90e5d698b8dd8a639fd",
+  "to": "v7.25.1",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#993, P2, read boundary): a deny-listed path spelled through an assignment word or a quote form is REFUSED at zero cards on every shell face — bare `NAME+=value`, `NAME[sub]=value` (subscript may be quoted), a `$'…'` / `$\"…\"` body with no backslash, a tilde outside an expansion slot (`A=.env~`), and a declaration operand (`export`/`declare`/`local` …) of those spellings."
+    },
+    {
+      "id": "F3",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#993 E5): a QUOTED assignment-shaped first word (`'A=x' cmd`, `\"A+=x\" cmd`) is the program name bash runs, so it is judged as an unknown program and its path operands are judged — one bare-prefix question for `=` and `+=` alike; KL-945h closed."
+    },
+    {
+      "id": "F4",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#993 leg B / E7 / F3 / G2, irreversibility): the unverifiable-recursive-delete walk skips leading assignments with the same bare-prefix grammar and applies one state transition to every declaration operand, so `A+=x rm -rf $UNSET` and `export -n D+=$UNKNOWN; rm -rf $D` report a finding where they reported none; `export -n D=/tmp/safe; rm -rf \"$D\"` no longer over-asks."
+    }
+  ],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.gate",
+      "assertions": [
+        "G1.a",
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.structured",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.requiresRealApproval",
+      "assertions": [
+        "G2.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "NOT SCANNED: sema-cli, sema-server, sema-sdk — an empty list for those repos means \"not checked out\", not \"no consumer\""
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "ce38d4e944d7b23bd648af718325db86e81b57c6"
+}