@sema-agent/core 7.25.0 → 7.26.0

package/dist/tools/fs/bash-program-position.d.ts

@@ -14,9 +14,27 @@ import type { SegmentTokens } from "./bash-lexer.js";
 export declare const NOT_AUTO_ALLOWED = "\u2014 not auto-allowed";
 /** argv[0] as the program bash will resolve it: `/usr/bin/cat` and `cat` are one name. */
 export declare function programBasename(word: string): string;
-/** A leading `NAME=value` word: an assignment bash applies to the command's environment rather than a
- *  program name. Same shape the exit-code reader in `fs-bash.ts` skips for the same reason. */
-export declare const ASSIGNMENT_WORD: RegExp;
+/**
+ * The `NAME=` / `NAME+=` prefix bash reads as an ASSIGNMENT — the ONE spelling of that grammar, matched where
+ * it is WRITTEN. Both operators, because bash reads both; the match IS the prefix, so a caller holding raw
+ * text can ask whether its token carries one bare. Every walk that strips leading assignments reads this:
+ * a second copy of the grammar is how one walk came to strip `A=x` and skip `A+=x`.
+ */
+export declare const ASSIGNMENT_PREFIX: RegExp;
+/**
+ * The prefix this raw token BEGINS with, or `undefined`.
+ *
+ * `name` is the VARIABLE the word assigns to, which is the part before any subscript: `A[0]=x` writes one
+ * element of `A`, so a reader asking "is `$A` settled" must not be told that `A[0]` is. `settlesWholeName` is
+ * false for exactly the two spellings that do not settle it — an append (the earlier content is not in the
+ * text) and a subscript (the other elements are not) — so a consumer of that question asks it once.
+ */
+export declare function writtenAssignmentPrefix(token: string): {
+    readonly prefix: string;
+    readonly name: string;
+    readonly appends: boolean;
+    readonly settlesWholeName: boolean;
+} | undefined;
 /** Shell control words that stand BEFORE a command: transparent for the boundary walk (the command behind them is
  *  judged). */
 export declare const SHELL_CONTROL_PREFIXES: ReadonlySet<string>;
@@ -25,6 +43,17 @@ export declare const SHELL_BLOCK_WORDS: ReadonlySet<string>;
 /** A control word is a keyword only when bash sees it BARE: `'if'` / `"do"` / `\\!` are command names (a program
  *  looked up on PATH, whose failure changes nothing), so a quoted or escaped spelling never counts as one. */
 export declare function isBareControlWord(toks: SegmentTokens, i: number, words: ReadonlySet<string>): boolean;
+/**
+ * A word bash strips as an ASSIGNMENT before it chooses the program.
+ *
+ * WHAT HAS TO BE BARE IS THE PREFIX, NOT THE WORD, and it is ONE question for BOTH operators. Bash decides this
+ * before it removes any quoting, and only the NAME and the OPERATOR take part in it: quoting any of `NAME=` /
+ * `NAME+=` makes the whole word a program name looked up on PATH (`'A=x'`, `'A+=x'`, `A\+=x`), while quoting the
+ * VALUE does not (`A+=".env"` assigns `.env` exactly as `A+=.env` does — verified against the shell). A
+ * whole-word test conflates the two and reads the quoted VALUE as a program name; a FOLDED-word test conflates
+ * them the other way and reads the quoted PROGRAM NAME as an assignment, stepping over the real program.
+ */
+export declare function isLeadingAssignmentWord(toks: SegmentTokens, i: number): boolean;
 /**
  * Programs that turn their STANDARD INPUT into the OPERANDS of another program, and EXEC that program directly.
  *

package/dist/tools/fs/bash-program-position.js

@@ -2,13 +2,44 @@ export const NOT_AUTO_ALLOWED = "— not auto-allowed";
 export function programBasename(word) {
     return word.includes("/") ? (word.split("/").pop() ?? word) : word;
 }
-export const ASSIGNMENT_WORD = /^[A-Za-z_][A-Za-z0-9_]*=/;
+export const ASSIGNMENT_PREFIX = /^[A-Za-z_][A-Za-z0-9_]*(?:\[[^\]\s]*\])?\+?=/;
+export function writtenAssignmentPrefix(token) {
+    const prefix = ASSIGNMENT_PREFIX.exec(token)?.[0];
+    if (prefix === undefined)
+        return undefined;
+    const appends = prefix.endsWith("+=");
+    const written = prefix.slice(0, prefix.length - (appends ? 2 : 1));
+    const bracket = written.indexOf("[");
+    return { prefix, name: bracket < 0 ? written : written.slice(0, bracket), appends, settlesWholeName: !appends && bracket < 0 };
+}
 export const SHELL_CONTROL_PREFIXES = new Set(["!", "if", "then", "elif", "else", "while", "until", "do", "time"]);
 export const SHELL_BLOCK_WORDS = new Set(["for", "select", "case", "esac", "fi", "done", "function", "coproc", "[[", "]]", "in"]);
 export function isBareControlWord(toks, i, words) {
     const word = toks.folded[i];
     return word !== undefined && toks.raw[i] === word && words.has(word);
 }
+export function isLeadingAssignmentWord(toks, i) {
+    const word = toks.folded[i];
+    const raw = toks.raw[i];
+    if (word === undefined || raw === undefined)
+        return false;
+    const written = writtenAssignmentPrefix(word);
+    return written !== undefined && prefixWrittenBare(raw, written);
+}
+function prefixWrittenBare(raw, written) {
+    if (!raw.startsWith(written.name))
+        return false;
+    let at = written.name.length;
+    if (written.prefix[at] === "[") {
+        if (raw[at] !== "[")
+            return false;
+        const close = raw.indexOf("]", at);
+        if (close < 0)
+            return false;
+        at = close + 1;
+    }
+    return raw.startsWith(written.appends ? "+=" : "=", at);
+}
 export const ARGV_REENTRY_PROGRAM_RE = /^xargs$/;
 export const ARGV_REENTRY_DEFAULT_PROGRAM = "echo";
 const NO_DECLARED_OPTIONS = { optionArity: new Map() };
@@ -90,7 +121,7 @@ export function readProgramPosition(toks) {
         return none(undefined, []);
     const written = i;
     const assignments = [];
-    while (i < folded.length && ASSIGNMENT_WORD.test(folded[i])) {
+    while (i < folded.length && isLeadingAssignmentWord(toks, i)) {
         assignments.push(i);
         i++;
     }

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -811,12 +811,14 @@ export declare function inlineProgramClause(model: InlineProgramModel, args: rea
  *  command name. Names-only traversals (`find`, `ls -R`, `du`, `tree`, an archive write) are in the table
  *  and answer `false` here — see {@link RecursiveReadFormModel.discloses}. */
 export declare function segmentSelectsRecursiveRead(name: string, args: readonly string[]): boolean;
-export declare function assignmentWordPayload(word: string): {
+/** `raw` is the word as WRITTEN; it defaults to the folded spelling, which is the reading that expands most. */
+export declare function assignmentWordPayload(word: string, raw?: string): {
     kind: "value";
     value: string;
 } | {
     kind: "unresolved";
     reason: string;
+    value?: string;
 } | undefined;
 /** WHICH programs are DECLARED not to open the value of a `NAME=value` ARGUMENT — an allow-list, because
  *  the other polarity was measured false. `make PREFIX=/usr/local`, `cmake -D…`, `docker run -e HOME=/root`
@@ -834,9 +836,9 @@ export declare function assignmentWordPayload(word: string): {
 export declare const ASSIGNMENT_VALUE_NOT_PATHS: ReadonlySet<string>;
 /** The program the shell will RUN here and where its OWN argv begins — the two seats
  *  {@link HeadedSegment.argvProgram} / {@link HeadedSegment.argvFrom} carry, from one reader so they cannot
- *  disagree. Both assignment spellings are stripped BEFORE the program-position reader runs: it does not
- *  read `NAME+=value` as an assignment (quoting makes `'A+=x'` a command NAME on folded text), so a leading
- *  append word arrives AS the program and hides any launcher — measured on `A+=x env B=<outside> <prog>`. */
+ *  disagree. The LEADING assignments (both spellings) are the program-position reader's own step, so this
+ *  seat no longer strips them a second time: a second strip read the quoted `'A+=x'` as an assignment the
+ *  one reader calls a program name, which is two readers with two answers. */
 export declare function argvProgramOf(tokens: SegmentTokens): {
     program: string;
     from: number;

package/dist/tools/fs/bash-readonly-classifier.js

@@ -1,6 +1,6 @@
 import { isAbsoluteForFamily, isAbsolutePathForm, isBlockedDevicePath, isShellRootedSpellingUnmapped, joinForFamily, nativeUncSpellingOf, normalizeAbsPathLexically, win32NamespaceScreen, pathFamilyOf } from "./safety.js";
-import { lexShellText, literalTildeSpelling, quoteMask, wordsOf, } from "./bash-lexer.js";
-import { ASSIGNMENT_WORD, COMMAND_LAUNCHERS, NOT_AUTO_ALLOWED, SHELL_BLOCK_WORDS, argvReentryUnjudged, isBareControlWord, programPositionRefusalSentence, readProgramPosition, } from "./bash-program-position.js";
+import { lexShellText, literalTildeSpelling, ansiCQuoteClose, dollarOpensQuote, quoteMask, wordsOf, } from "./bash-lexer.js";
+import { COMMAND_LAUNCHERS, NOT_AUTO_ALLOWED, SHELL_BLOCK_WORDS, argvReentryUnjudged, isBareControlWord, programPositionRefusalSentence, ASSIGNMENT_PREFIX, readProgramPosition, writtenAssignmentPrefix, } from "./bash-program-position.js";
 export const BASH_READONLY_DEFAULT_ALLOW = [
     "ls", "cat", "head", "tail", "wc", "pwd", "echo", "whoami", "uname",
     "grep", "cut", "tr", "basename", "dirname", "stat", "du", "df", "which",
@@ -208,7 +208,21 @@ function tokenizeSegment(segment) {
 }
 export function hasUnquotedExpansionMetachar(rawToken) {
     let open;
-    for (const ch of rawToken) {
+    for (let i = 0; i < rawToken.length; i++) {
+        const ch = rawToken[i];
+        const opener = rawToken[i + 1];
+        if (open === undefined && ch === "$" && dollarOpensQuote(rawToken, i)) {
+            if (opener === '"') {
+                open = opener;
+                i += 1;
+                continue;
+            }
+            const close = ansiCQuoteClose(rawToken, i + 1);
+            if (close === undefined)
+                return true;
+            i = close;
+            continue;
+        }
         if (open === undefined && (ch === '"' || ch === "'")) {
             open = ch;
             continue;
@@ -1444,28 +1458,51 @@ function isGrepFileStdinLongOption(tok) {
     return name !== undefined && isLongOptionAbbrevOf(name, "file");
 }
 const CLUSTER_OPTION_CHAR = /[A-Za-z0-9]/;
-const ASSIGNMENT_OR_APPEND_WORD = /^[A-Za-z_][A-Za-z0-9_]*\+?=/;
-export function assignmentWordPayload(word) {
-    if (!ASSIGNMENT_OR_APPEND_WORD.test(word))
+function tildeExpandsInValue(rawValue) {
+    if (rawValue === undefined)
+        return false;
+    for (let at = 0; at <= rawValue.length;) {
+        if (rawValue[at] === "~") {
+            let quoted = false;
+            for (let k = at + 1; k < rawValue.length && rawValue[k] !== "/" && rawValue[k] !== ":"; k++) {
+                if (rawValue[k] === "'" || rawValue[k] === '"' || rawValue[k] === "\\") {
+                    quoted = true;
+                    break;
+                }
+            }
+            if (!quoted)
+                return true;
+        }
+        const next = rawValue.indexOf(":", at);
+        if (next < 0)
+            return false;
+        at = next + 1;
+    }
+    return false;
+}
+export function assignmentWordPayload(word, raw = word) {
+    const written = writtenAssignmentPrefix(word);
+    if (written === undefined)
         return undefined;
-    const eq = word.indexOf("=");
-    const value = word.slice(eq + 1);
-    if (word[eq - 1] === "+")
-        return { kind: "unresolved", reason: `"${word}" appends to a value the text does not contain` };
-    if (value.includes("~"))
+    const eq = written.prefix.length - 1;
+    const spelled = word.slice(eq + 1);
+    const expands = tildeExpandsInValue(raw.startsWith(written.prefix) ? raw.slice(written.prefix.length) : undefined);
+    const value = expands ? spelled : literalTildeSpelling(spelled);
+    if (written.appends) {
+        const reason = `"${word}" appends to a value the text does not contain`;
+        return spelled === "" || expands ? { kind: "unresolved", reason } : { kind: "unresolved", reason, value };
+    }
+    if (expands)
         return { kind: "unresolved", reason: `"${word}" carries a tilde whose expansion the text does not settle` };
-    return value === "" ? undefined : { kind: "value", value };
+    return spelled === "" ? undefined : { kind: "value", value };
 }
 export const ASSIGNMENT_VALUE_NOT_PATHS = new Set(["make", "gmake", "bmake", "cmake", "ninja", "meson", "docker", "podman"]);
 export function argvProgramOf(tokens) {
-    let lead = 0;
-    while (lead < tokens.folded.length && ASSIGNMENT_OR_APPEND_WORD.test(tokens.folded[lead]))
-        lead++;
-    const pos = readProgramPosition({ folded: tokens.folded.slice(lead), raw: tokens.raw.slice(lead) });
+    const pos = readProgramPosition(tokens);
     if (pos.program === undefined)
         return undefined;
-    const at = lead + pos.program.index;
-    return ASSIGNMENT_OR_APPEND_WORD.test(tokens.folded[at] ?? "") ? undefined : { program: pos.program.basename, from: at };
+    const at = pos.program.index;
+    return ASSIGNMENT_PREFIX.test(tokens.folded[at] ?? "") ? undefined : { program: pos.program.basename, from: at };
 }
 export function attachedOptionPayloads(tok) {
     const literal = literalTildeSpelling;

package/dist/tools/fs/shell-read-plan.js

@@ -285,7 +285,7 @@ function segmentFacts(segment, p, decl, nestedPlan) {
                 reads.push({ spelled: word, raw, provenance: "unlisted_word", expands: "unresolvable" });
                 continue;
             }
-            if (assignmentWordPayload(word) !== undefined) {
+            if (assignmentWordPayload(word, toks.raw[j]) !== undefined) {
                 pushAssignment(reads, toks, j, "env_assignment");
                 continue;
             }
@@ -465,15 +465,13 @@ function redirectFact(r) {
 }
 function pushAssignment(reads, toks, k, provenance) {
     const word = toks.folded[k];
-    const payload = assignmentWordPayload(word);
+    const payload = assignmentWordPayload(word, toks.raw[k]);
     if (payload === undefined)
         return;
-    if (payload.kind === "value" && payload.value === SUBSTITUTION_PLACEHOLDER)
-        return;
-    if (payload.kind === "value")
-        reads.push(bare(toks.raw[k], payload.value, provenance));
-    else
+    if (payload.kind === "unresolved")
         reads.push({ spelled: word, raw: toks.raw[k], provenance, expands: "unresolvable" });
+    if (payload.value !== undefined && payload.value !== SUBSTITUTION_PLACEHOLDER)
+        reads.push(bare(toks.raw[k], payload.value, provenance));
 }
 function unlistedWords(reads, toks, from, launcherIndices, provenance, program) {
     const argv = program !== undefined ? { program: program.basename, from: program.index } : argvProgramOf(toks);
@@ -742,11 +740,11 @@ function listedVerbCandidates(name, args, rawArgs, reads) {
         positional.push({ word: t, raw: rawArgs[k] });
         push(k, t, "operand");
         if (!ASSIGNMENT_VALUE_NOT_PATHS.has(name)) {
-            const payload = assignmentWordPayload(t);
-            if (payload?.kind === "value")
-                push(k, payload.value, "operand");
-            else if (payload !== undefined)
+            const payload = assignmentWordPayload(t, rawArgs[k]);
+            if (payload?.kind === "unresolved")
                 reads.push({ spelled: t, raw: rawArgs[k], provenance: "operand", expands: "unresolvable" });
+            if (payload?.value !== undefined)
+                push(k, payload.value, "operand");
         }
     }
     for (let k = 0; k < args.length; k++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.25.0",
+  "version": "7.26.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2410,
+  "count": 2424,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -84,6 +84,7 @@
     "AggregateBudgetOptions": "interface",
     "AnthropicBrainConfig": "interface",
     "AppendLog": "class",
+    "ApproverPosture": "type",
     "ArtifactAction": "type",
     "ArtifactCallContext": "interface",
     "ArtifactCommitCertainty": "type",
@@ -716,6 +717,7 @@
     "McpInjectionDropFacts": "interface",
     "McpInjectionDropReason": "type",
     "McpLivenessState": "type",
+    "McpProbeResult": "interface",
     "McpReconnectResult": "interface",
     "McpRefreshResult": "interface",
     "McpServerLiveness": "interface",
@@ -984,6 +986,7 @@
     "PermissionRuleSyncContractHooks": "interface",
     "PermissionRuleSyncResult": "interface",
     "PermissionRuleSyncTransport": "type",
+    "PermissionRuleWriteContractHooks": "interface",
     "PermissionRuleWriter": "interface",
     "PersistedOrgRuleState": "interface",
     "PersistedRule": "interface",
@@ -1059,6 +1062,7 @@
     "READ_ONLY_EXACT_FORMS": "variable",
     "READ_ONLY_FLAG_ARITIES": "variable",
     "READ_ONLY_GLOB_PROGRAMS": "variable",
+    "READ_ROOT_CANDIDATE_DIR_MAX": "variable",
     "READ_RULE_TOOL": "variable",
     "REAL_APPROVAL_CHECKPOINT_VERSION": "variable",
     "REASONING_BUDGET_SHARE": "variable",
@@ -1066,6 +1070,7 @@
     "RECOMMENDED_SENSITIVE_PATTERNS": "variable",
     "REMOTE_HARVEST_PER_FILE_BYTES": "variable",
     "REMOTE_MASS_DELETION_FUSE_RATIO": "variable",
+    "REMOVAL_LIVENESS_WORDS": "variable",
     "RENDER_HINT_ACTIVITY_MAX_CHARS": "variable",
     "RENDER_HINT_MAX_CHARS": "variable",
     "RENDER_HINT_MAX_LIST": "variable",
@@ -1085,6 +1090,7 @@
     "RULE_OFFERS_ABSENCE_BASELINE": "variable",
     "RULE_STORE_UNREADABLE_KINDS": "variable",
     "RULE_SYNC_DROP_CODES": "variable",
+    "RULE_WRITE_COMMITTED_WORDS": "variable",
     "RUN_WORKFLOW_TOOL_NAME": "variable",
     "RawPrefixInputs": "interface",
     "RawRuleSyncState": "interface",
@@ -1122,6 +1128,7 @@
     "RemoteMaterialization": "interface",
     "RemoteMemoryBaseline": "interface",
     "RemoteMemoryFile": "interface",
+    "RemovalLiveness": "type",
     "RemoveResult": "type",
     "RemovedPermissionRule": "interface",
     "ReopenReason": "type",
@@ -1211,6 +1218,7 @@
     "RuleTicket": "type",
     "RuleTightenAddDelta": "interface",
     "RuleTombstone": "interface",
+    "RuleWriteCommitted": "type",
     "RuleWriteDelta": "type",
     "RuleWriteOutcome": "type",
     "RunInternals": "interface",
@@ -1388,6 +1396,7 @@
     "SystemInjection": "interface",
     "SystemInjectionPriority": "type",
     "SystemInjectionQueue": "class",
+    "TASK_OUTPUT_REPLAY_KINDS": "variable",
     "TEACHER_PROFILE": "variable",
     "TEACHER_PROMPT": "variable",
     "TEAMMATE_COMMUNICATION_ADDENDUM": "variable",
@@ -1421,6 +1430,7 @@
     "TaskNotificationPayload": "interface",
     "TaskNotificationStatus": "type",
     "TaskOutcome": "interface",
+    "TaskOutputReplay": "type",
     "TaskRegistry": "class",
     "TaskRequestBody": "interface",
     "TaskResult": "interface",
@@ -1862,6 +1872,7 @@
     "deriveRepoControlPlaneDir": "function",
     "deriveRepoKey": "function",
     "deriveRepoMemoryDir": "function",
+    "deriveShadowedSet": "function",
     "deriveSupersededSet": "function",
     "deriveTripwire": "function",
     "deriveWiringManifest": "function",
@@ -2095,6 +2106,7 @@
     "normalizePersistedRuleHit": "function",
     "normalizePromptEpoch": "function",
     "normalizePublishedPath": "function",
+    "normalizeReadRootCandidate": "function",
     "normalizeRules": "function",
     "normalizeToolResultProvenance": "function",
     "noticeAudienceOf": "function",
@@ -2151,6 +2163,7 @@
     "peerSendVerdictSeverity": "function",
     "peerSessionBoxHandle": "function",
     "permissionRuleSyncContract": "function",
+    "permissionRuleWriteContract": "function",
     "pgQuery": "function",
     "physicalPathOf": "function",
     "physicalPathOfExisting": "function",
@@ -2160,6 +2173,7 @@
     "prepareCardApproval": "function",
     "prepareCcImport": "function",
     "prepareStarterBatch": "function",
+    "probeMcpServers": "function",
     "probeParkRoundTrip": "function",
     "probeSearchBackend": "function",
     "processFingerprint": "function",
@@ -2496,6 +2510,7 @@
     "AggregateBudgetOptions": "advanced",
     "AnthropicBrainConfig": "advanced",
     "AppendLog": "advanced",
+    "ApproverPosture": "advanced",
     "ArtifactAction": "advanced",
     "ArtifactCallContext": "advanced",
     "ArtifactCommitCertainty": "advanced",
@@ -3128,6 +3143,7 @@
     "McpInjectionDropFacts": "advanced",
     "McpInjectionDropReason": "advanced",
     "McpLivenessState": "advanced",
+    "McpProbeResult": "advanced",
     "McpReconnectResult": "advanced",
     "McpRefreshResult": "advanced",
     "McpServerLiveness": "advanced",
@@ -3396,6 +3412,7 @@
     "PermissionRuleSyncContractHooks": "advanced",
     "PermissionRuleSyncResult": "advanced",
     "PermissionRuleSyncTransport": "advanced",
+    "PermissionRuleWriteContractHooks": "advanced",
     "PermissionRuleWriter": "advanced",
     "PersistedOrgRuleState": "stable",
     "PersistedRule": "advanced",
@@ -3471,6 +3488,7 @@
     "READ_ONLY_EXACT_FORMS": "advanced",
     "READ_ONLY_FLAG_ARITIES": "advanced",
     "READ_ONLY_GLOB_PROGRAMS": "advanced",
+    "READ_ROOT_CANDIDATE_DIR_MAX": "advanced",
     "READ_RULE_TOOL": "advanced",
     "REAL_APPROVAL_CHECKPOINT_VERSION": "advanced",
     "REASONING_BUDGET_SHARE": "advanced",
@@ -3478,6 +3496,7 @@
     "RECOMMENDED_SENSITIVE_PATTERNS": "advanced",
     "REMOTE_HARVEST_PER_FILE_BYTES": "advanced",
     "REMOTE_MASS_DELETION_FUSE_RATIO": "advanced",
+    "REMOVAL_LIVENESS_WORDS": "advanced",
     "RENDER_HINT_ACTIVITY_MAX_CHARS": "advanced",
     "RENDER_HINT_MAX_CHARS": "advanced",
     "RENDER_HINT_MAX_LIST": "advanced",
@@ -3497,6 +3516,7 @@
     "RULE_OFFERS_ABSENCE_BASELINE": "advanced",
     "RULE_STORE_UNREADABLE_KINDS": "advanced",
     "RULE_SYNC_DROP_CODES": "advanced",
+    "RULE_WRITE_COMMITTED_WORDS": "advanced",
     "RUN_WORKFLOW_TOOL_NAME": "stable",
     "RawPrefixInputs": "advanced",
     "RawRuleSyncState": "advanced",
@@ -3534,6 +3554,7 @@
     "RemoteMaterialization": "advanced",
     "RemoteMemoryBaseline": "advanced",
     "RemoteMemoryFile": "advanced",
+    "RemovalLiveness": "advanced",
     "RemoveResult": "advanced",
     "RemovedPermissionRule": "advanced",
     "ReopenReason": "stable",
@@ -3623,6 +3644,7 @@
     "RuleTicket": "advanced",
     "RuleTightenAddDelta": "advanced",
     "RuleTombstone": "advanced",
+    "RuleWriteCommitted": "advanced",
     "RuleWriteDelta": "advanced",
     "RuleWriteOutcome": "advanced",
     "RunInternals": "internal",
@@ -3800,6 +3822,7 @@
     "SystemInjection": "advanced",
     "SystemInjectionPriority": "advanced",
     "SystemInjectionQueue": "advanced",
+    "TASK_OUTPUT_REPLAY_KINDS": "advanced",
     "TEACHER_PROFILE": "advanced",
     "TEACHER_PROMPT": "advanced",
     "TEAMMATE_COMMUNICATION_ADDENDUM": "advanced",
@@ -3833,6 +3856,7 @@
     "TaskNotificationPayload": "advanced",
     "TaskNotificationStatus": "advanced",
     "TaskOutcome": "advanced",
+    "TaskOutputReplay": "advanced",
     "TaskRegistry": "advanced",
     "TaskRequestBody": "advanced",
     "TaskResult": "stable",
@@ -4274,6 +4298,7 @@
     "deriveRepoControlPlaneDir": "advanced",
     "deriveRepoKey": "advanced",
     "deriveRepoMemoryDir": "advanced",
+    "deriveShadowedSet": "advanced",
     "deriveSupersededSet": "advanced",
     "deriveTripwire": "advanced",
     "deriveWiringManifest": "advanced",
@@ -4507,6 +4532,7 @@
     "normalizePersistedRuleHit": "advanced",
     "normalizePromptEpoch": "advanced",
     "normalizePublishedPath": "advanced",
+    "normalizeReadRootCandidate": "advanced",
     "normalizeRules": "advanced",
     "normalizeToolResultProvenance": "advanced",
     "noticeAudienceOf": "advanced",
@@ -4563,6 +4589,7 @@
     "peerSendVerdictSeverity": "advanced",
     "peerSessionBoxHandle": "advanced",
     "permissionRuleSyncContract": "advanced",
+    "permissionRuleWriteContract": "advanced",
     "pgQuery": "advanced",
     "physicalPathOf": "advanced",
     "physicalPathOfExisting": "advanced",
@@ -4572,6 +4599,7 @@
     "prepareCardApproval": "advanced",
     "prepareCcImport": "advanced",
     "prepareStarterBatch": "advanced",
+    "probeMcpServers": "advanced",
     "probeParkRoundTrip": "stable",
     "probeSearchBackend": "advanced",
     "processFingerprint": "advanced",

package/wire-changes/core@7.25.1.json

@@ -0,0 +1,64 @@
+{
+  "repo": "core",
+  "version": "7.25.1",
+  "from": "b205840bf3354e748513a90e5d698b8dd8a639fd",
+  "to": "v7.25.1",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#993, P2, read boundary): a deny-listed path spelled through an assignment word or a quote form is REFUSED at zero cards on every shell face — bare `NAME+=value`, `NAME[sub]=value` (subscript may be quoted), a `$'…'` / `$\"…\"` body with no backslash, a tilde outside an expansion slot (`A=.env~`), and a declaration operand (`export`/`declare`/`local` …) of those spellings."
+    },
+    {
+      "id": "F3",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#993 E5): a QUOTED assignment-shaped first word (`'A=x' cmd`, `\"A+=x\" cmd`) is the program name bash runs, so it is judged as an unknown program and its path operands are judged — one bare-prefix question for `=` and `+=` alike; KL-945h closed."
+    },
+    {
+      "id": "F4",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#993 leg B / E7 / F3 / G2, irreversibility): the unverifiable-recursive-delete walk skips leading assignments with the same bare-prefix grammar and applies one state transition to every declaration operand, so `A+=x rm -rf $UNSET` and `export -n D+=$UNKNOWN; rm -rf $D` report a finding where they reported none; `export -n D=/tmp/safe; rm -rf \"$D\"` no longer over-asks."
+    }
+  ],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.gate",
+      "assertions": [
+        "G1.a",
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.structured",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.requiresRealApproval",
+      "assertions": [
+        "G2.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "NOT SCANNED: sema-cli, sema-server, sema-sdk — an empty list for those repos means \"not checked out\", not \"no consumer\""
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "ce38d4e944d7b23bd648af718325db86e81b57c6"
+}