@sema-agent/core 7.27.0 → 7.28.0

package/dist/tools/fs/bash-program-position.d.ts

@@ -8,7 +8,7 @@
  * readable, minted into one sentence by {@link programPositionRefusalSentence}. Reading less than this reader
  * does (an option skipped, a chain member missed) is how one face used to vouch for a program another refused.
  */
-import type { SegmentTokens } from "./bash-lexer.js";
+import { SHELL_CONTROL_PREFIXES, type SegmentTokens } from "../../shell/lex.js";
 /** The verdict every unresolvable / out-of-root / unbounded finding ends on. The findings differ in what
  *  they found; the consequence is one consequence, and a copy that drifts reads as a second rule. */
 export declare const NOT_AUTO_ALLOWED = "\u2014 not auto-allowed";
@@ -35,9 +35,7 @@ export declare function writtenAssignmentPrefix(token: string): {
     readonly appends: boolean;
     readonly settlesWholeName: boolean;
 } | undefined;
-/** Shell control words that stand BEFORE a command: transparent for the boundary walk (the command behind them is
- *  judged). */
-export declare const SHELL_CONTROL_PREFIXES: ReadonlySet<string>;
+export { SHELL_CONTROL_PREFIXES };
 /** Shell block words that name no command of their own (a loop head, a block close, a case head). */
 export declare const SHELL_BLOCK_WORDS: ReadonlySet<string>;
 /** A control word is a keyword only when bash sees it BARE: `'if'` / `"do"` / `\\!` are command names (a program

package/dist/tools/fs/bash-program-position.js

@@ -1,3 +1,4 @@
+import { SHELL_CONTROL_PREFIXES } from "../../shell/lex.js";
 export const NOT_AUTO_ALLOWED = "— not auto-allowed";
 export function programBasename(word) {
     return word.includes("/") ? (word.split("/").pop() ?? word) : word;
@@ -12,7 +13,7 @@ export function writtenAssignmentPrefix(token) {
     const bracket = written.indexOf("[");
     return { prefix, name: bracket < 0 ? written : written.slice(0, bracket), appends, settlesWholeName: !appends && bracket < 0 };
 }
-export const SHELL_CONTROL_PREFIXES = new Set(["!", "if", "then", "elif", "else", "while", "until", "do", "time"]);
+export { SHELL_CONTROL_PREFIXES };
 export const SHELL_BLOCK_WORDS = new Set(["for", "select", "case", "esac", "fi", "done", "function", "coproc", "[[", "]]", "in"]);
 export function isBareControlWord(toks, i, words) {
     const word = toks.folded[i];

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -1,4 +1,4 @@
-import { type SegmentTokens, type ShellSegmentConnector } from "./bash-lexer.js";
+import { type SegmentTokens, type ShellSegmentConnector } from "../../shell/lex.js";
 /**
  * Bare command names `bash_readonly` permits out of the box, ALSO the default reversible set for the
  * The {@link import("./fs-bash.js").bashReversibilityProbe} classifier. **Coarse first filter, NOT a security
@@ -31,7 +31,7 @@ import { type SegmentTokens, type ShellSegmentConnector } from "./bash-lexer.js"
  * value-taking options defeat the stdin-floor operand count without a per-verb option-value model
  * — those are a follow-on slice, not a silent drop.
  */
-export type { ShellSegmentConnector } from "./bash-lexer.js";
+export type { ShellSegmentConnector } from "../../shell/lex.js";
 export declare const BASH_READONLY_DEFAULT_ALLOW: readonly string[];
 /**
  * The verbs the CLASSIFY face admits ON TOP of the shared list ({@link bashClassifyDefaultAllow}) —

package/dist/tools/fs/bash-readonly-classifier.js

@@ -1,5 +1,5 @@
 import { isAbsoluteForFamily, isAbsolutePathForm, isBlockedDevicePath, isShellRootedSpellingUnmapped, joinForFamily, nativeUncSpellingOf, normalizeAbsPathLexically, win32NamespaceScreen, pathFamilyOf } from "./safety.js";
-import { lexShellText, literalTildeSpelling, ansiCQuoteClose, dollarOpensQuote, quoteMask, wordsOf, } from "./bash-lexer.js";
+import { lexShellText, literalTildeSpelling, ansiCQuoteClose, dollarOpensQuote, quoteMask, wordsOf, } from "../../shell/lex.js";
 import { COMMAND_LAUNCHERS, NOT_AUTO_ALLOWED, SHELL_BLOCK_WORDS, argvReentryUnjudged, isBareControlWord, programPositionRefusalSentence, ASSIGNMENT_PREFIX, readProgramPosition, writtenAssignmentPrefix, } from "./bash-program-position.js";
 export const BASH_READONLY_DEFAULT_ALLOW = [
     "ls", "cat", "head", "tail", "wc", "pwd", "echo", "whoami", "uname",

package/dist/tools/fs/shell-read-check.js

@@ -8,7 +8,7 @@ import { planShellReads } from "./shell-read-plan.js";
 import { createShellReadEstablisher, establishShellReadsLexically } from "./shell-read-establish.js";
 import { allFindings, decideShellRead, foldShellReadFindings, judgeEstablishedPlan, readRootGrantCandidateOf, } from "./shell-read-judge.js";
 import { normalizeReadRootCandidate } from "../../core/read-root-candidate.js";
-import { wordsOf, lexShellText } from "./bash-lexer.js";
+import { wordsOf, lexShellText } from "../../shell/lex.js";
 function containmentDetails(paths) {
     return { type: "readonly_out_of_root", code: "readonly_out_of_root", paths };
 }

package/dist/tools/fs/shell-read-establish.js

@@ -98,7 +98,17 @@ function lexicalReadsOf(candidate, boundary) {
     }
     const bases = basesFor(candidate, boundary);
     if (bases === "unmodelled") {
-        return [{ candidate, established: "unestablishable", spellings: [candidate.spelled], cause: `"${candidate.raw}" is relative to a working directory this command's text does not settle` }];
+        const floors = candidate.floorBases ?? [boundary.cwd ?? boundary.roots[0] ?? ""];
+        const spellings = [candidate.spelled];
+        for (const floorBase of floors) {
+            const viaFloor = floorBase === "" ? undefined : resolveOperandSpellings(floorBase, candidate.spelled, boundary.homeDir);
+            if (viaFloor === undefined)
+                continue;
+            spellings.push(viaFloor.folded);
+            if (viaFloor.spelled !== undefined)
+                spellings.push(viaFloor.spelled);
+        }
+        return [{ candidate, established: "unestablishable", spellings, cause: `"${candidate.raw}" is relative to a working directory this command's text does not settle` }];
     }
     const out = [];
     const seen = new Set();

package/dist/tools/fs/shell-read-plan.d.ts

@@ -4,7 +4,7 @@
  * The read boundary today re-derives "which words may be read" at several sites (the compound walk, the
  * containment-only gate, the refused-command whitelist, the execute-time recheck), each with its own idea
  * of launchers, option slots, redirections and re-entry. This module is the single extraction those sites
- * are to consume: a pure, zero-I/O function over the lenient lexer (`bash-lexer.ts`) and the program-position
+ * are to consume: a pure, zero-I/O function over the lenient lexer (`src/shell/lex.ts`) and the program-position
  * reader (`bash-program-position.ts`), returning every path word a command MAY read, each tagged with its
  * PROVENANCE (why it is a candidate) and the working-directory candidates it is relative to. Establishment
  * (`shell-read-establish.ts`) and judgment are downstream; nothing here decides allow/ask/deny.
@@ -26,7 +26,7 @@
  *    otherwise loses the base for what follows.
  * Every ambiguity resolves toward MORE candidates, never fewer.
  */
-import { type LenientConnector, type LexedRedirect, type LexedWord } from "./bash-lexer.js";
+import { type LenientConnector, type LexedRedirect, type LexedWord } from "../../shell/lex.js";
 import { type ShellScanDecline } from "./bash-program-position.js";
 /** WHY a word is a read candidate — a closed set, registered in `docs/CLOSED-SETS.md`. */
 export declare const READ_CANDIDATE_PROVENANCES: readonly ["operand", "option_value", "stdin_redirect", "write_redirect_target", "env_assignment", "unlisted_word", "traversal_root", "cd_target", "program_path", "script_slot_file"];
@@ -55,6 +55,11 @@ export interface ReadCandidate {
      *  EMPTY for an absolute or home-rooted spelling; `"unmodelled"` for a relative word in a segment whose base the
      *  text does not settle (an unfollowable move before it, a loop this parser cannot count) — it cannot be placed. */
     readonly bases: readonly string[] | "unmodelled";
+    /** Only beside `bases: "unmodelled"`: the working directories the text was certainly standing in when it LOST
+     *  track (the reachable candidate set at the unprovable move; the declared cwd when nothing had moved yet).
+     *  A deny row is a floor, so the judge resolves the spelling against these for deny rows ONLY — never to
+     *  establish a read. `cd sub && cd $'\x2e' && cat <deny row under sub>` (bash: `cd .`) is refused through it. */
+    readonly floorBases?: readonly string[];
 }
 /** How the shell reached one segment — what the base-candidate walk needs from the connectors. */
 export interface SegmentReach {

package/dist/tools/fs/shell-read-plan.js

@@ -1,4 +1,4 @@
-import { lexShellText, substitutionsInHeredocBody, wordsOf, literalTildeSpelling, SUBSTITUTION_PLACEHOLDER, } from "./bash-lexer.js";
+import { lexShell, PARSE_FAILURE_SENTENCE, UNRESOLVED_SENTENCE, UNRESOLVED_VIEW, substitutionsInHeredocBody, wordsOf, literalTildeSpelling, SUBSTITUTION_PLACEHOLDER, } from "../../shell/lex.js";
 import { LAUNCHER_TABLE, SHELL_BLOCK_WORDS, programBasename, programPositionRunsShell, readProgramPosition, shellScanDeclineOf, writtenAssignmentPrefix, } from "./bash-program-position.js";
 import { ASSIGNMENT_VALUE_NOT_PATHS, INTERPRETER_INLINE_PROGRAMS, NO_PATH_OPERAND_COMMANDS, POLL_LOOP_MAX_BEATS, RECURSIVE_READ_FORMS, SHELL_REENTRY_PROGRAM_RE, UNMODELLED_BASE_MOVERS, argvProgramOf, assignmentWordPayload, attachedOptionPayloads, foldHomeVariableSpelling, resolveOperandLexically, hasUnquotedExpansionMetachar, hasUnquotedGlobMetachar, inlineProgramClause, interpreterKey, isPathShapedToken, readVerbOptionSlot, sedScriptSlotFiles, segmentSelectsRecursiveRead, slotValueCandidates, suppliesFirstOperandSlot, verbFirstOperandSlot, verbOptionsArePositionIndependent, } from "./bash-readonly-classifier.js";
 import { isAbsolutePathForm } from "./safety.js";
@@ -16,14 +16,25 @@ export const READ_CANDIDATE_PROVENANCES = [
 ];
 const NESTING_MAX = 4;
 const BASE_CANDIDATE_MAX = 256;
+function firstRefusedUnresolvedSentence(lexed) {
+    for (const segment of lexed.segments) {
+        for (const token of segment.tokens) {
+            const word = token.kind === "word" ? token : token.kind === "redirect" ? token.target : undefined;
+            if (word?.unresolved !== undefined && UNRESOLVED_VIEW[word.unresolved] === "refuse")
+                return UNRESOLVED_SENTENCE[word.unresolved];
+        }
+    }
+    return undefined;
+}
 export function planShellReads(command, decl, depth = 0) {
     const shape = { grouped: false, backgrounded: false, strayRedirection: false };
     if (depth > NESTING_MAX)
         return { segments: [], unreadable: `command text nested more than ${NESTING_MAX} levels deep`, shape };
     const homeReassigned = /(^|[\s;&|(){}`])(?:export\s+)?HOME\+?=/.test(command);
-    const lexed = lexShellText(foldHomeVariableSpelling(command, homeReassigned ? undefined : decl.homeDir), { mode: "lenient" });
-    if ("reject" in lexed)
-        return { segments: [], unreadable: lexed.reject, shape };
+    const lexed = lexShell(foldHomeVariableSpelling(command, homeReassigned ? undefined : decl.homeDir), { mode: "lenient" });
+    if ("parseFailure" in lexed)
+        return { segments: [], unreadable: PARSE_FAILURE_SENTENCE[lexed.parseFailure.reason], shape };
+    const unreadable = firstRefusedUnresolvedSentence(lexed);
     const nestedPlan = (text) => planShellReads(text, decl, depth + 1);
     const projected = lexed.segments.map((segment) => projectSegment(segment));
     const facts = projected.map((p, si) => segmentFacts(lexed.segments[si], p, decl, nestedPlan));
@@ -34,6 +45,11 @@ export function planShellReads(command, decl, depth = 0) {
     const unmodelled = facts.map(() => false);
     let candidates = [{ base: decl.cwd, skippedCd: -1 }];
     let baseLost = false;
+    let floorBases;
+    const loseBase = (reachable) => {
+        baseLost = true;
+        floorBases ??= [...new Set(reachable.map((c) => c.base))];
+    };
     let andRunStart = 0;
     let crossedAllAnd = true;
     let crossedAnyOr = false;
@@ -68,7 +84,7 @@ export function planShellReads(command, decl, depth = 0) {
         if (move === undefined || baseLost)
             return;
         if (typeof move.target === "string" || move.target.expands !== false) {
-            baseLost = true;
+            loseBase(reachable);
             return;
         }
         const target = move.target.spelled;
@@ -78,7 +94,7 @@ export function planShellReads(command, decl, depth = 0) {
             if (c.skippedCd < andRunStart) {
                 const moved = joinBase(c.base, target, decl.homeDir);
                 if (moved === undefined) {
-                    baseLost = true;
+                    loseBase(reachable);
                     return;
                 }
                 branched.push({ base: moved, skippedCd: c.skippedCd });
@@ -93,7 +109,7 @@ export function planShellReads(command, decl, depth = 0) {
         }
         const next = [...byBase.values()];
         if (next.length > BASE_CANDIDATE_MAX)
-            baseLost = true;
+            loseBase(reachable);
         else
             candidates = next;
     };
@@ -116,7 +132,7 @@ export function planShellReads(command, decl, depth = 0) {
             if (frame.beats === undefined) {
                 for (let k = frame.bodyStart; k < si; k++)
                     unmodelled[k] = true;
-                baseLost = true;
+                loseBase(candidates.filter((c) => c.skippedCd < andRunStart));
                 continue;
             }
             for (let beat = 1; beat < frame.beats && !baseLost; beat++) {
@@ -133,7 +149,11 @@ export function planShellReads(command, decl, depth = 0) {
         if (f.empty)
             continue;
         const bases = unmodelled[si] ? "unmodelled" : [...basesOf[si]];
-        const withBases = (c) => ({ ...c, bases: relativeSpelling(c.spelled) ? bases : [] });
+        const floor = unmodelled[si] && floorBases !== undefined && floorBases.length > 0 ? floorBases : undefined;
+        const withBases = (c) => {
+            const relative = relativeSpelling(c.spelled);
+            return { ...c, bases: relative ? bases : [], ...(relative && floor !== undefined ? { floorBases: floor } : {}) };
+        };
         segments.push({
             text: f.text,
             connector: f.connector,
@@ -151,7 +171,7 @@ export function planShellReads(command, decl, depth = 0) {
             reach: reaches[si] ?? { andJoined: false, orBroken: false, moveProvable: false },
         });
     }
-    return { segments, shape };
+    return { segments, shape, ...(unreadable !== undefined ? { unreadable } : {}) };
 }
 function projectSegment(segment) {
     const tokens = [...segment.tokens];
@@ -178,6 +198,24 @@ function projectSegment(segment) {
     };
 }
 function segmentFacts(segment, p, decl, nestedPlan) {
+    const facts = segmentFactsRead(segment, p, decl, nestedPlan);
+    const unresolvedRaw = new Set();
+    for (const t of segment.tokens) {
+        const w = t.kind === "word" ? t : t.kind === "redirect" ? t.target : undefined;
+        if (w?.unresolved !== undefined && UNRESOLVED_VIEW[w.unresolved] === "refuse")
+            unresolvedRaw.add(w.raw);
+    }
+    if (unresolvedRaw.size === 0)
+        return facts;
+    const unsettle = (c) => (unresolvedRaw.has(c.raw) && c.expands !== "unresolvable" ? { ...c, expands: "unresolvable" } : c);
+    const move = facts.baseMove;
+    return {
+        ...facts,
+        reads: facts.reads.map(unsettle),
+        ...(move !== undefined && typeof move.target !== "string" ? { baseMove: { target: unsettle(move.target) } } : {}),
+    };
+}
+function segmentFactsRead(segment, p, decl, nestedPlan) {
     const nested = [];
     for (const body of segment.substitutions)
         nested.push(nestedPlan(body));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.27.0",
+  "version": "7.28.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",
@@ -52,7 +52,7 @@
     "pretest": "npm run gate:debts",
     "test": "vitest run --exclude \"**/*.local.test.ts\"",
     "test:watch": "vitest",
-    "gate:skips": "vitest run --exclude \"**/node_modules/**\" --exclude \"**/*.local.test.ts\" --reporter=default --reporter=json --outputFile.json=.skip-report.json && node scripts/verify-skip-baseline.mjs --report .skip-report.json",
+    "gate:skips": "vitest run --exclude \"**/node_modules/**\" --exclude \"**/*.local.test.ts\" --reporter=default --reporter=json --outputFile.json=.skip-report.json && node scripts/verify-skip-baseline.mjs --report .skip-report.json --full",
     "gate:live": "node scripts/run-live-gate.mjs",
     "smoke": "tsx src/examples/smoke.ts",
     "eval": "tsx eval/run.ts",