@sema-agent/core 7.26.0 → 7.26.2

package/dist/stores/file/session-policy-store.js

@@ -40,6 +40,34 @@ export function readSessionPolicyMark(path) {
         return refuse("carries a lineage that is not a whole number");
     return mark;
 }
+export function judgeSessionPolicyRowObject(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { corrupt: { grade: "unparseable", reason: "unparseable JSON (torn/zero-byte write?)" } };
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return { corrupt: { grade: "malformed", reason: "not a JSON object" } };
+    }
+    return { row: parsed };
+}
+export function judgeSessionPolicyRowShape(row) {
+    const bad = (reason) => ({ corrupt: { grade: "malformed", reason } });
+    if (typeof row.rev !== "number" || !Number.isFinite(row.rev) || row.rev < 1)
+        return bad("rev is not a positive number");
+    if (row.gen !== undefined && (typeof row.gen !== "number" || !Number.isInteger(row.gen) || row.gen < 0))
+        return bad("gen is not a whole number");
+    const strArr = (x) => x === undefined || (Array.isArray(x) && x.every((e) => typeof e === "string"));
+    if (!strArr(row.toolAllow) || !strArr(row.toolDeny) || !strArr(row.commandAllow) || !strArr(row.commandDeny) || !strArr(row.allowDirs)) {
+        return bad("malformed rule field");
+    }
+    const { __sid: _sid, __principal: _principal, ...clean } = row;
+    void _sid;
+    void _principal;
+    return { rules: clean };
+}
 export class FileSessionPolicyStore {
     dir;
     onCorruptRead;
@@ -75,7 +103,9 @@ export class FileSessionPolicyStore {
         return join(this.dir, `${this.basenameFor(sessionId, principal)}${MARK_SUFFIX}`);
     }
     writeMarkFile(path, rev, sessionId, principal, gen) {
-        const mark = { __hwm: rev, __gen: gen, __sid: sessionId, __principal: principal };
+        this.writeMark(path, { __hwm: rev, __gen: gen, __sid: sessionId, __principal: principal });
+    }
+    writeMark(path, mark) {
         atomicWriteFile(join(this.dir, "tmp"), path, JSON.stringify(mark));
     }
     read(sessionId, principal) {
@@ -88,35 +118,17 @@ export class FileSessionPolicyStore {
                 return null;
             throw err;
         }
-        try {
-            const parsed = JSON.parse(raw);
-            if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-                this.discloseCorrupt(sessionId, principal, "not a JSON object");
-                return null;
-            }
-            const r = parsed;
-            if (typeof r.rev !== "number" || !Number.isFinite(r.rev) || r.rev < 1) {
-                this.discloseCorrupt(sessionId, principal, "rev is not a positive number");
-                return null;
-            }
-            if (r.gen !== undefined && (typeof r.gen !== "number" || !Number.isInteger(r.gen) || r.gen < 0)) {
-                this.discloseCorrupt(sessionId, principal, "gen is not a whole number");
-                return null;
-            }
-            const strArr = (x) => x === undefined || (Array.isArray(x) && x.every((e) => typeof e === "string"));
-            if (!strArr(r.toolAllow) || !strArr(r.toolDeny) || !strArr(r.commandAllow) || !strArr(r.commandDeny) || !strArr(r.allowDirs)) {
-                this.discloseCorrupt(sessionId, principal, "malformed rule field");
-                return null;
-            }
-            const { __sid: _sid, __principal: _principal, ...clean } = r;
-            void _sid;
-            void _principal;
-            return clean;
+        const judged = judgeSessionPolicyRowObject(raw);
+        if ("corrupt" in judged) {
+            this.discloseCorrupt(sessionId, principal, judged.corrupt.reason);
+            return null;
         }
-        catch {
-            this.discloseCorrupt(sessionId, principal, "unparseable JSON (torn/zero-byte write?)");
+        const shaped = judgeSessionPolicyRowShape(judged.row);
+        if ("corrupt" in shaped) {
+            this.discloseCorrupt(sessionId, principal, shaped.corrupt.reason);
             return null;
         }
+        return shaped.rules;
     }
     async getRules(sessionId, principal) {
         return this.read(sessionId, principal);
@@ -134,8 +146,12 @@ export class FileSessionPolicyStore {
             }
         }
         const mark = readSessionPolicyMark(this.markPathFor(sessionId, principal));
+        const rowFilePresent = prior === null && existsSync(this.pathFor(sessionId, principal));
+        if (mark?.__lineage === "lost" || (rowFilePresent && mark === null)) {
+            throw new SessionPolicyError("corrupt", `session rules for ${JSON.stringify(sessionId)} have no lineage evidence (${mark?.__lineage === "lost" ? "the erase left a lost-lineage mark" : "an unreadable row and no high-water mark"}) — refusing to restart the key's lineage by guessing; delete the mark${rowFilePresent ? " and the row file" : ""} to restart it`);
+        }
         const floor = Math.max(prior?.rev ?? 0, mark?.__hwm ?? 0);
-        const gen = prior?.gen ?? (existsSync(this.pathFor(sessionId, principal)) ? (mark?.__gen ?? 0) + 1 : (mark?.__gen ?? 0));
+        const gen = prior !== null ? (prior.gen ?? 0) : rowFilePresent ? (mark?.__gen ?? 0) + 1 : (mark?.__gen ?? 0);
         const next = { ...clean, rev: floor + 1, gen };
         const attributedPrincipal = (principal ?? this.anonymousAlias) ?? null;
         this.writeMarkFile(this.markPathFor(sessionId, principal), next.rev, sessionId, attributedPrincipal, gen);
@@ -169,24 +185,28 @@ export class FileSessionPolicyStore {
                 }
                 continue;
             }
-            let parsed;
-            try {
-                parsed = JSON.parse(raw);
+            const judged = judgeSessionPolicyRowObject(raw);
+            if ("corrupt" in judged) {
+                this.disclose({ sessionId, path: full, reason: judged.corrupt.reason });
+                continue;
             }
-            catch {
-                this.disclose({ sessionId, path: full, reason: "unparseable JSON (torn/zero-byte write?)" });
+            if (typeof judged.row.__sid !== "string") {
+                this.disclose({ sessionId, path: full, reason: "session metadata is not a string" });
                 continue;
             }
-            if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-                this.disclose({ sessionId, path: full, reason: "not a JSON object" });
+            if (judged.row.__sid !== sessionId)
+                continue;
+            const shaped = judgeSessionPolicyRowShape(judged.row);
+            if ("corrupt" in shaped) {
+                this.disclose({ sessionId, path: full, reason: shaped.corrupt.reason });
                 continue;
             }
-            const r = parsed;
-            if (r.__sid !== sessionId)
+            const attributed = judged.row.__principal;
+            if (attributed !== undefined && attributed !== null && typeof attributed !== "string") {
+                this.disclose({ sessionId, path: full, reason: "principal metadata is not a string" });
                 continue;
-            const { __sid: _sid, __principal, ...rules } = r;
-            void _sid;
-            out.push({ principal: __principal ?? undefined, rules: rules });
+            }
+            out.push({ principal: attributed ?? undefined, rules: shaped.rules });
         }
         return out;
     }
@@ -212,21 +232,25 @@ export class FileSessionPolicyStore {
             catch {
                 continue;
             }
-            let parsed;
-            try {
-                parsed = JSON.parse(raw);
-            }
-            catch {
+            const judged = judgeSessionPolicyRowObject(raw);
+            if ("corrupt" in judged) {
+                if (judged.corrupt.grade !== "unparseable")
+                    continue;
                 const tornMarkPath = join(this.dir, `${file.slice(0, -".json".length)}${MARK_SUFFIX}`);
                 try {
                     const tornMark = readSessionPolicyMark(tornMarkPath);
-                    if (tornMark !== null && tornMark.__sid === sessionId) {
-                        this.writeMarkFile(tornMarkPath, tornMark.__hwm, sessionId, tornMark.__principal ?? null, (tornMark.__gen ?? 0) + 1);
+                    if (tornMark === null) {
+                        this.writeMark(tornMarkPath, { __hwm: 0, __gen: 0, __lineage: "lost" });
+                        this.disclose({ sessionId, path: join(this.dir, file), reason: "erase purged a torn row that had no high-water mark: the key's lineage is lost, writes are refused until the mark is deleted" });
+                    }
+                    else {
+                        this.writeMark(tornMarkPath, { ...tornMark, __gen: (tornMark.__gen ?? 0) + 1 });
                     }
                 }
                 catch (err) {
                     if (!(err instanceof SessionPolicyError))
                         throw err;
+                    this.disclose({ sessionId, path: join(this.dir, file), reason: `erase purged a torn row whose high-water mark is corrupt (${err.message}); the mark is left for the operator` });
                 }
                 try {
                     unlinkSync(join(this.dir, file));
@@ -237,9 +261,7 @@ export class FileSessionPolicyStore {
                 }
                 continue;
             }
-            if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
-                continue;
-            const row = parsed;
+            const row = judged.row;
             if (row.__sid !== sessionId)
                 continue;
             const markPath = join(this.dir, `${file.slice(0, -".json".length)}${MARK_SUFFIX}`);

package/dist/tools/fs/shell-read-check.d.ts

@@ -12,10 +12,15 @@
  * tools' execute legs judge nothing: what they run is what this station admitted, and the admission only
  * re-establishes the SAME candidates (a symlink re-pointed while the approver was thinking) — it never
  * parses text or judges a word the station did not.
+ *
+ * That pipeline is written ONCE (`runShellReadStation`) and has two entries: the gate input above, and
+ * {@link judgeShellRead}, the offline face. The steps between stay private — the station's working, not
+ * its answer, and a caller composing them would be a second judgment of the same question.
  */
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { violationDetails } from "./safety.js";
-import { type ShellReadBoundary, type ShellReadDisposition, type ShellReadFinding, type ShellReadSeat } from "./shell-read-judge.js";
+import { type ShellReadPlan } from "./shell-read-plan.js";
+import { type EstablishedRead, type ShellReadBoundary, type ShellReadDisposition, type ShellReadFinding, type ShellReadSeat } from "./shell-read-judge.js";
 import type { ReadRootGrantCandidate } from "../../core/tool-spec.js";
 /** The ONE mint of the containment card — every arm that refuses or asks on a containment finding (a refusal, a
  *  mandated card's own card, a station that could not answer, the pre-spawn re-establishment) spells it here. */
@@ -85,6 +90,58 @@ export interface ShellReadStationOptions {
     /** The listed read verbs (decides whether a segment is read by verb slots or word by word). */
     readonly readers?: ReadonlySet<string>;
 }
+/** What a consumer hands {@link judgeShellRead}: the command as written, the environment whose filesystem
+ *  answers where its words land (symlinks resolved, patterns expanded — a `NodeExecutionEnv` over a real
+ *  directory is what the gate itself runs on), the boundary it is judged against, and the trust-policy seat
+ *  it is judged on. The working directory a relative operand starts from is the boundary's own `cwd`. */
+export interface ShellReadJudgeInput {
+    readonly command: string;
+    readonly env: ExecutionEnv;
+    readonly boundary: ShellReadBoundary;
+    readonly seat: ShellReadSeat;
+    /** The listed read verbs — which words of a segment are read operands. Defaults to the classify face's. */
+    readonly readers?: ReadonlySet<string>;
+    /** The face named in a refusal sentence. Defaults to `Bash`. */
+    readonly tool?: string;
+    /** Handed to the ENVIRONMENT's own primitives (`canonicalPath`, `listDir`) while the reads are
+     *  established; whether an abort stops one is the adapter's answer, and a walk short enough to finish
+     *  first finishes. It is NOT a deadline and it does not reach `boundary.alsoInside`, whose signature
+     *  carries no signal — see {@link judgeShellRead} on which layer owns the bound. */
+    readonly signal?: AbortSignal;
+}
+/** What {@link judgeShellRead} answers about ONE command. */
+export interface ShellReadJudgment {
+    /** What the station read out of the command's text before any filesystem was consulted. */
+    readonly plan: ShellReadPlan;
+    /** Every read candidate the station established, in the plan's own order, nested plans included — each
+     *  carrying how far it got (`EstablishedRead.established`) and the target it was judged on. */
+    readonly establishment: readonly EstablishedRead[];
+    readonly verdict: ShellReadVerdict;
+    /** The directory-scoped grant offer THIS STATION is willing to make — the verdict's candidate through the
+     *  same validator the gate applies, so a candidate that validator drops is absent here as it is there. It
+     *  is the station's offer, not the composed card's: over an ask another layer already raised, the fold
+     *  adds the mandate and nothing else, so the offer does not land there. */
+    readonly offer?: ReadRootGrantCandidate;
+}
+/**
+ * The station's judgment of ONE command, OUTSIDE a run — the consumer face of everything above. Same plan,
+ * same establishment, same judge, same table, same verdict the gate fold reads: this is
+ * {@link createShellReadStation}'s own derivation with the admission bookkeeping left out, so a caller
+ * holding a command, an environment and a boundary gets the decision the gate would reach for them.
+ *
+ * An ENVIRONMENT question, not a text question: a symlink that leaves the roots, a pattern that expands
+ * onto a deny row, a traversal root that cannot be enumerated are answered by `env`, not guessed from the
+ * spelling. {@link judgeShellReadLexically} is the no-environment reading and not a substitute — it is
+ * LAXER where only a filesystem sees the escape (an in-root symlink pointing out vouches) and answers a
+ * pattern on its spelling alone, so the two diverge in both directions.
+ *
+ * It carries NO deadline. Bounding an environment-facing wait and substituting a fail-closed verdict is the
+ * gate FOLD's policy on the gate's one deadline seat; the station has never held one on either entry, and a
+ * second default here would decide the same number twice and turn a slow-but-correct filesystem's true
+ * answer into a fail-closed one unasked. A consumer wanting that posture races its own deadline and reads
+ * the row the fold reads: `SHELL_READ_DECISION.unestablishable[seat]`.
+ */
+export declare function judgeShellRead(input: ShellReadJudgeInput): Promise<ShellReadJudgment>;
 /**
  * The station's verdict with NO environment — the lexical reading (what an isolated sandbox gets, and what a
  * pin or a lexical pre-read can compute): the same plan, the same judge, the same table, over the folded

package/dist/tools/fs/shell-read-check.js

@@ -7,6 +7,7 @@ import { bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
 import { planShellReads } from "./shell-read-plan.js";
 import { createShellReadEstablisher, establishShellReadsLexically } from "./shell-read-establish.js";
 import { allFindings, decideShellRead, foldShellReadFindings, judgeEstablishedPlan, readRootGrantCandidateOf, } from "./shell-read-judge.js";
+import { normalizeReadRootCandidate } from "../../core/read-root-candidate.js";
 import { wordsOf, lexShellText } from "./bash-lexer.js";
 function containmentDetails(paths) {
     return { type: "readonly_out_of_root", code: "readonly_out_of_root", paths };
@@ -113,6 +114,48 @@ function judgePlan(plan, established, boundary) {
         return nested === undefined ? { plan: n, segments: [] } : judgePlan(n, nested, boundary);
     });
 }
+async function applyAlsoInside(judged, boundary) {
+    const alsoInside = boundary.alsoInside;
+    if (alsoInside === undefined)
+        return judged;
+    const rescued = new Set();
+    for (const f of allFindings(judged)) {
+        if (f.kind !== "outside_roots" || f.read.target === undefined || rescued.has(f.read.target))
+            continue;
+        if (await alsoInside(f.read.target))
+            rescued.add(f.read.target);
+    }
+    if (rescued.size === 0)
+        return judged;
+    const rewrite = (j) => ({
+        plan: j.plan,
+        segments: j.segments.map((s) => ({
+            segment: s.segment,
+            findings: s.findings.map((f) => (f.kind === "outside_roots" && f.read.target !== undefined && rescued.has(f.read.target) ? { ...f, kind: "none", containment: "inside" } : f)),
+            nested: s.nested.map(rewrite),
+        })),
+    });
+    return rewrite(judged);
+}
+async function runShellReadStation(tool, command, declared, seat, readers, establisher, signal) {
+    const plan = planShellReads(command, declarationsOf(declared, readers));
+    const established = await establisher.establish(plan, declared, signal);
+    const boundary = { ...declared, roots: established.roots };
+    const judged = await applyAlsoInside(judgePlan(plan, established, boundary), boundary);
+    const verdict = verdictOf(tool, seat, foldShellReadFindings(judged), judged, boundary);
+    return { plan, established, judged, boundary, verdict };
+}
+export async function judgeShellRead(input) {
+    const readers = input.readers ?? new Set(bashClassifyDefaultAllow());
+    const run = await runShellReadStation(input.tool ?? "Bash", input.command, input.boundary, input.seat, readers, createShellReadEstablisher(input.env, input.boundary.roots), input.signal);
+    const offer = normalizeReadRootCandidate(run.verdict.readRootCandidate);
+    return {
+        plan: run.plan,
+        establishment: allFindings(run.judged).map((f) => f.read),
+        verdict: run.verdict,
+        ...(offer !== undefined ? { offer } : {}),
+    };
+}
 export function judgeShellReadLexically(command, boundary, seat, opts) {
     const readers = opts?.readers ?? new Set(bashClassifyDefaultAllow());
     const plan = planShellReads(command, declarationsOf(boundary, readers));
@@ -141,29 +184,6 @@ export function createShellReadStation(opts) {
         }
         admissions.set(toolCallId, a);
     };
-    const applyAlsoInside = async (judged, boundary) => {
-        const alsoInside = boundary.alsoInside;
-        if (alsoInside === undefined)
-            return judged;
-        const rescued = new Set();
-        for (const f of allFindings(judged)) {
-            if (f.kind !== "outside_roots" || f.read.target === undefined || rescued.has(f.read.target))
-                continue;
-            if (await alsoInside(f.read.target))
-                rescued.add(f.read.target);
-        }
-        if (rescued.size === 0)
-            return judged;
-        const rewrite = (j) => ({
-            plan: j.plan,
-            segments: j.segments.map((s) => ({
-                segment: s.segment,
-                findings: s.findings.map((f) => (f.kind === "outside_roots" && f.read.target !== undefined && rescued.has(f.read.target) ? { ...f, kind: "none", containment: "inside" } : f)),
-                nested: s.nested.map(rewrite),
-            })),
-        });
-        return rewrite(judged);
-    };
     const check = {
         judge(toolName, args, cwd, signal, callOpts) {
             if (!opts.tools.has(toolName))
@@ -176,16 +196,10 @@ export function createShellReadStation(opts) {
                 return null;
             const seat = callOpts.seat ?? opts.seatOf(toolName);
             return (async () => {
-                const plan = planShellReads(command, declarationsOf(boundary, readers));
-                const establisher = establisherFor(boundary.roots);
-                const established = await establisher.establish(plan, boundary, signal);
-                const judgedBoundary = { ...boundary, roots: established.roots };
-                const judged = await applyAlsoInside(judgePlan(plan, established, judgedBoundary), judgedBoundary);
-                const fold = foldShellReadFindings(judged);
-                const verdict = verdictOf(toolName, seat, fold, judged, judgedBoundary);
-                if (verdict.disposition !== "refuse" && callOpts.toolCallId !== undefined)
-                    remember(callOpts.toolCallId, { toolName, boundary: judgedBoundary, established, command });
-                return verdict;
+                const run = await runShellReadStation(toolName, command, boundary, seat, readers, establisherFor(boundary.roots), signal);
+                if (run.verdict.disposition !== "refuse" && callOpts.toolCallId !== undefined)
+                    remember(callOpts.toolCallId, { toolName, boundary: run.boundary, established: run.established, command });
+                return run.verdict;
             })();
         },
         unanswered(toolName, cause) {

package/dist/tools/fs/shell-read-establish.js

@@ -281,7 +281,9 @@ export function createShellReadEstablisher(env, readRoots) {
         return { paths: frontier, canonical: canonicalOfMatch };
     };
     const enumerateTraversal = async (rootCanonical, signal) => {
-        const members = [];
+        const found = [];
+        const listedDirs = new Set();
+        let root;
         const stack = [{ dir: rootCanonical, spell: rootCanonical }];
         const visited = new Set([rootCanonical]);
         let dirsUsed = 0;
@@ -291,18 +293,23 @@ export function createShellReadEstablisher(env, readRoots) {
                 return { unverifiable: `"${rootCanonical}" holds more than ${MAX_GLOB_DIRS} directories, too many to enumerate to verify what a recursive read would open` };
             const listed = await env.listDir(dir, signal);
             if (!listed.ok) {
+                if (dir === rootCanonical && listed.error.code === "not_directory")
+                    root = "file";
                 if (listed.error.code === "not_directory" || listed.error.code === "not_found")
                     continue;
                 return { unverifiable: `"${dir}" cannot be enumerated to verify what a recursive read would open (${listed.error.code})` };
             }
+            listedDirs.add(dir);
+            if (dir === rootCanonical)
+                root = "directory";
             for (const entry of listed.value) {
-                if (members.length >= MAX_GLOB_MATCHES)
+                if (found.length >= MAX_GLOB_MATCHES)
                     return { unverifiable: `"${rootCanonical}" holds more than ${MAX_GLOB_MATCHES} entries, too many to enumerate to verify what a recursive read would open` };
                 const path = joinUnder(spell, entry.name);
                 const canonicalPath = joinUnder(dir, entry.name);
                 if (entry.kind === "symlink") {
                     const canon = await env.canonicalPath(canonicalPath, signal);
-                    members.push({ path, ...(canon.ok ? { canonical: canon.value } : {}), symlink: true });
+                    found.push({ path, ...(canon.ok ? { canonical: canon.value } : {}), symlink: true });
                     if (canon.ok && !visited.has(canon.value)) {
                         visited.add(canon.value);
                         stack.push({ dir: canon.value, spell: path });
@@ -316,10 +323,11 @@ export function createShellReadEstablisher(env, readRoots) {
                     }
                     continue;
                 }
-                members.push({ path, canonical: canonicalPath, symlink: false });
+                found.push({ path, canonical: canonicalPath, symlink: false });
             }
         }
-        return { members };
+        const members = found.map(({ path, canonical, symlink }) => ({ path, ...(canonical !== undefined ? { canonical } : {}), node: (symlink && canonical !== undefined && listedDirs.has(canonical) ? "directory" : "file") }));
+        return { ...(root !== undefined ? { root } : {}), members };
     };
     const canonicalReadOf = async (candidate, spelling, spellings, established, origin, canonicalKnown, signal) => {
         const real = canonicalKnown !== undefined ? { value: canonicalKnown, exact: true } : await resolve(spelling, signal);
@@ -338,16 +346,19 @@ export function createShellReadEstablisher(env, readRoots) {
         for (const candidate of judgedCandidatesOf(segment)) {
             const traversal = candidate.provenance === "traversal_root";
             const land = async (read, spellings, folded) => {
-                out.push(read);
-                if (!traversal || (read.established !== "canonical" && read.established !== "expansion") || read.target === undefined)
+                if (!traversal || (read.established !== "canonical" && read.established !== "expansion") || read.target === undefined) {
+                    out.push(read);
                     return;
+                }
                 const walkedTree = await enumerateTraversal(read.target, signal);
                 if ("unverifiable" in walkedTree) {
+                    out.push(read);
                     out.push({ candidate, established: "unestablishable", spellings, origin: folded, cause: walkedTree.unverifiable });
                     return;
                 }
+                out.push({ ...read, ...(walkedTree.root !== undefined ? { node: walkedTree.root } : {}) });
                 for (const m of walkedTree.members)
-                    out.push(await canonicalReadOf(candidate, m.path, [m.path], "expansion", folded, m.canonical, signal));
+                    out.push({ ...(await canonicalReadOf(candidate, m.path, [m.path], "expansion", folded, m.canonical, signal)), node: m.node });
             };
             for (const lexical of lexicalReadsOf(candidate, boundary)) {
                 if (lexical.established !== "lexical") {

package/dist/tools/fs/shell-read-judge.d.ts

@@ -133,6 +133,9 @@ export interface EstablishedRead {
     readonly spellings: readonly string[];
     /** The pattern or traversal root an `expansion` came from, as folded. */
     readonly origin?: string;
+    /** What the environment said the target IS, where a read asked — only a traversal asks (it lists the root and
+     *  every member it walks; a link's answer is its target's). Absent = nothing asked; a plain read never lists. */
+    readonly node?: "directory" | "file";
     /** Why the candidate could not be established. */
     readonly cause?: string;
 }

package/dist/tools/fs/shell-read-judge.js

@@ -135,7 +135,9 @@ export function readRootGrantCandidateOf(judged, boundary) {
         return undefined;
     if (paths.some(hasWin32AliasedComponent))
         return undefined;
-    const readsDirectory = new Set(outside.filter((f) => f.read.candidate.provenance === "traversal_root" || f.read.candidate.provenance === "cd_target").map((f) => f.read.target));
+    const readsDirectory = new Set(outside
+        .filter((f) => (f.read.candidate.provenance === "traversal_root" && f.read.node !== "file") || f.read.candidate.provenance === "cd_target")
+        .map((f) => f.read.target));
     const dirOf = (path) => (readsDirectory.has(path) ? path : parentDirLexically(path));
     let candidate = dirOf(paths[0]);
     for (const path of paths.slice(1)) {

package/dist/tools/fs/shell-read-plan.js

@@ -1,5 +1,5 @@
 import { lexShellText, substitutionsInHeredocBody, wordsOf, literalTildeSpelling, SUBSTITUTION_PLACEHOLDER, } from "./bash-lexer.js";
-import { LAUNCHER_TABLE, SHELL_BLOCK_WORDS, programBasename, programPositionRunsShell, readProgramPosition, shellScanDeclineOf, } from "./bash-program-position.js";
+import { LAUNCHER_TABLE, SHELL_BLOCK_WORDS, programBasename, programPositionRunsShell, readProgramPosition, shellScanDeclineOf, writtenAssignmentPrefix, } from "./bash-program-position.js";
 import { ASSIGNMENT_VALUE_NOT_PATHS, INTERPRETER_INLINE_PROGRAMS, NO_PATH_OPERAND_COMMANDS, POLL_LOOP_MAX_BEATS, RECURSIVE_READ_FORMS, SHELL_REENTRY_PROGRAM_RE, UNMODELLED_BASE_MOVERS, argvProgramOf, assignmentWordPayload, attachedOptionPayloads, foldHomeVariableSpelling, resolveOperandLexically, hasUnquotedExpansionMetachar, hasUnquotedGlobMetachar, inlineProgramClause, interpreterKey, isPathShapedToken, readVerbOptionSlot, sedScriptSlotFiles, segmentSelectsRecursiveRead, slotValueCandidates, suppliesFirstOperandSlot, verbFirstOperandSlot, verbOptionsArePositionIndependent, } from "./bash-readonly-classifier.js";
 import { isAbsolutePathForm } from "./safety.js";
 export const READ_CANDIDATE_PROVENANCES = [
@@ -241,8 +241,9 @@ function segmentFacts(segment, p, decl, nestedPlan) {
     const basename = program?.basename;
     const listed = basename !== undefined && (decl.readers.has(basename) || basename === "cd");
     const verb = program === undefined ? undefined : { name: program.name, basename: program.basename, listed };
+    const envOpens = basename !== undefined && !NO_PATH_OPERAND_COMMANDS.has(basename);
     for (const k of pos.assignments)
-        pushAssignment(reads, toks, k, "env_assignment");
+        pushAssignment(reads, toks.folded[k], toks.raw[k], "env_assignment", envOpens);
     for (const l of pos.launchers) {
         const raw = toks.raw[l.index];
         const folded = toks.folded[l.index];
@@ -286,7 +287,7 @@ function segmentFacts(segment, p, decl, nestedPlan) {
                 continue;
             }
             if (assignmentWordPayload(word, toks.raw[j]) !== undefined) {
-                pushAssignment(reads, toks, j, "env_assignment");
+                pushAssignment(reads, word, toks.raw[j], "env_assignment", envOpens);
                 continue;
             }
             reads.push(bare(raw, word, "unlisted_word"));
@@ -463,15 +464,17 @@ function redirectFact(r) {
         return { op: r.op, direction: "in" };
     return { op: r.op, direction: "out", target: bare(r.target.raw, r.target.folded, "write_redirect_target") };
 }
-function pushAssignment(reads, toks, k, provenance) {
-    const word = toks.folded[k];
-    const payload = assignmentWordPayload(word, toks.raw[k]);
-    if (payload === undefined)
+function pushAssignment(reads, folded, raw, provenance, opensValue = true) {
+    const payload = assignmentWordPayload(folded, raw);
+    const prefix = writtenAssignmentPrefix(folded)?.prefix;
+    if (payload === undefined || prefix === undefined)
         return;
-    if (payload.kind === "unresolved")
-        reads.push({ spelled: word, raw: toks.raw[k], provenance, expands: "unresolvable" });
+    const v = { spelled: folded.slice(prefix.length), raw: raw.startsWith(prefix) ? raw.slice(prefix.length) : raw, provenance };
+    const unsettled = provenance !== "env_assignment" ? { ...v, expands: "unresolvable" } : v.spelled.startsWith("~") && !v.spelled.includes(":") ? bare(v.raw, v.spelled, provenance) : undefined;
+    if (payload.kind === "unresolved" && opensValue && unsettled !== undefined)
+        reads.push(unsettled);
     if (payload.value !== undefined && payload.value !== SUBSTITUTION_PLACEHOLDER)
-        reads.push(bare(toks.raw[k], payload.value, provenance));
+        reads.push(bare(raw, payload.value, provenance));
 }
 function unlistedWords(reads, toks, from, launcherIndices, provenance, program) {
     const argv = program !== undefined ? { program: program.basename, from: program.index } : argvProgramOf(toks);
@@ -565,9 +568,9 @@ function unlistedWords(reads, toks, from, launcherIndices, provenance, program)
         }
         reads.push(bare(raw, word, j === argvStart ? "program_path" : provenance));
         if (j < argvStart)
-            pushAssignment(reads, toks, j, "env_assignment");
+            pushAssignment(reads, word, raw, "env_assignment", slotVerb !== undefined && !noPathOperands);
         else if (!declaredNotPaths)
-            pushAssignment(reads, toks, j, provenance);
+            pushAssignment(reads, word, raw, provenance);
     }
     if (slotVerb !== undefined && argv !== undefined && segmentSelectsRecursiveRead(slotVerb, toks.folded.slice(argvStart + 1))) {
         const roots = positional.length > 0 ? positional : stdinOperand ? [] : [{ word: ".", raw: "." }];
@@ -740,11 +743,7 @@ function listedVerbCandidates(name, args, rawArgs, reads) {
         positional.push({ word: t, raw: rawArgs[k] });
         push(k, t, "operand");
         if (!ASSIGNMENT_VALUE_NOT_PATHS.has(name)) {
-            const payload = assignmentWordPayload(t, rawArgs[k]);
-            if (payload?.kind === "unresolved")
-                reads.push({ spelled: t, raw: rawArgs[k], provenance: "operand", expands: "unresolvable" });
-            if (payload?.value !== undefined)
-                push(k, payload.value, "operand");
+            pushAssignment(reads, t, rawArgs[k], "operand");
         }
     }
     for (let k = 0; k < args.length; k++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.26.0",
+  "version": "7.26.2",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",