@sema-agent/core 7.28.1 → 7.30.0

package/dist/tools/fs/shell-read-check.js

@@ -8,7 +8,7 @@ import { planShellReads } from "./shell-read-plan.js";
 import { createShellReadEstablisher, establishShellReadsLexically } from "./shell-read-establish.js";
 import { allFindings, decideShellRead, foldShellReadFindings, judgeEstablishedPlan, readRootGrantCandidateOf, } from "./shell-read-judge.js";
 import { normalizeReadRootCandidate } from "../../core/read-root-candidate.js";
-import { wordsOf, lexShellText } from "../../shell/lex.js";
+import { argvOf, lexShellText } from "../../shell/lex.js";
 function containmentDetails(paths) {
     return { type: "readonly_out_of_root", code: "readonly_out_of_root", paths };
 }
@@ -18,9 +18,9 @@ function shellCommandOf(args) {
     return typeof command === "string" ? command : undefined;
 }
 function declineSentence(segment) {
-    const lexed = lexShellText(segment.text, { mode: "lenient" });
+    const lexed = lexShellText(segment.text);
     if (!("reject" in lexed) && lexed.segments[0] !== undefined) {
-        const pos = readProgramPosition(wordsOf(lexed.segments[0]));
+        const pos = readProgramPosition(argvOf(lexed.segments[0]));
         if (pos.refusal !== undefined)
             return programPositionRefusalSentence(pos.refusal);
         if (pos.argvFromStdin) {

package/dist/tools/fs/shell-read-establish.js

@@ -94,7 +94,7 @@ function basesFor(candidate, boundary) {
 }
 function lexicalReadsOf(candidate, boundary) {
     if (candidate.expands === "unresolvable") {
-        return [{ candidate, established: "unestablishable", spellings: [candidate.spelled], cause: `"${candidate.raw}" is rewritten by the shell before the program sees it` }];
+        return [{ candidate, established: "unestablishable", spellings: [candidate.spelled, ...(candidate.floorSpelled !== undefined ? [candidate.floorSpelled] : [])], cause: `"${candidate.raw}" is rewritten by the shell before the program sees it` }];
     }
     const bases = basesFor(candidate, boundary);
     if (bases === "unmodelled") {

package/dist/tools/fs/shell-read-plan.d.ts

@@ -4,8 +4,8 @@
  * The read boundary today re-derives "which words may be read" at several sites (the compound walk, the
  * containment-only gate, the refused-command whitelist, the execute-time recheck), each with its own idea
  * of launchers, option slots, redirections and re-entry. This module is the single extraction those sites
- * are to consume: a pure, zero-I/O function over the lenient lexer (`src/shell/lex.ts`) and the program-position
- * reader (`bash-program-position.ts`), returning every path word a command MAY read, each tagged with its
+ * are to consume: a pure, zero-I/O function over the one lexer's word FACTS (`src/shell/lex.ts`) and the
+ * program-position reader (`bash-program-position.ts`), returning every path word a command MAY read, each tagged with its
  * PROVENANCE (why it is a candidate) and the working-directory candidates it is relative to. Establishment
  * (`shell-read-establish.ts`) and judgment are downstream; nothing here decides allow/ask/deny.
  *
@@ -15,8 +15,9 @@
  *  · an UNLISTED program hands every word of its argv (a program declared to open no path operand hands none);
  *  · a LAUNCHER chain is peeled to its program and the chain's own words are never candidates; a launcher
  *    option the row cannot read is recorded as a decline and every word after it is handed over;
- *  · a SHELL re-entry (`sh -c S`, `eval S`, a launcher handing text to a shell, `env -S S`) carries its text as a
- *    NESTED plan; an argv re-entry (`xargs`) is a decline unless the target opens nothing it is handed;
+ *  · a SHELL re-entry (`sh -c S`, `eval S`, a launcher handing text to a shell, `env -S S`, a builtin's code-body
+ *    operand the shell runs later — `trap S SIG`, `alias N=S`, `mapfile -C S`) carries its text as a NESTED plan;
+ *    an argv re-entry (`xargs`) is a decline unless the target opens nothing it is handed;
  *  · an INTERPRETER's inline program is a shape fact (`reentry:"interpreter"`), never parsed, never a finding;
  *  · `<` targets are read candidates, `>`-family targets are write targets (tagged, not read), here-documents
  *    and here-strings are data (an UNQUOTED here-document body's substitutions are nested plans);
@@ -35,7 +36,8 @@ export type ReadCandidateProvenance = (typeof READ_CANDIDATE_PROVENANCES)[number
 export interface ShellReadDeclarations {
     /** The listed read verbs. They decide whether a segment is read by verb slots or word by word, never whether it hands candidates. */
     readonly readers: ReadonlySet<string>;
-    /** Substituted for `$HOME` / `${HOME}` word spellings before lexing; `~` itself is left to establishment. */
+    /** The declared home: a word that spells it (`$HOME` / `${HOME}` — {@link homeExpansionOf}) is named by it,
+     *  unless the command may rebind `HOME` (then `~` is unresolvable too); `~` itself is left to establishment. */
     readonly homeDir?: string;
     /** The working directory the first segment's relative words resolve against. */
     readonly cwd: string;
@@ -60,6 +62,9 @@ export interface ReadCandidate {
      *  A deny row is a floor, so the judge resolves the spelling against these for deny rows ONLY — never to
      *  establish a read. `cd sub && cd $'\x2e' && cat <deny row under sub>` (bash: `cd .`) is refused through it. */
     readonly floorBases?: readonly string[];
+    /** A home word the plan does not place (the text may rebind `HOME`, or it sits in a value): spelled with the DECLARED
+     *  home. A deny row is a floor: the judge reads it for deny rows ONLY, never to establish a read. */
+    readonly floorSpelled?: string;
 }
 /** How the shell reached one segment — what the base-candidate walk needs from the connectors. */
 export interface SegmentReach {
@@ -118,4 +123,4 @@ export interface ShellReadPlan {
         readonly strayRedirection: boolean;
     };
 }
-export declare function planShellReads(command: string, decl: ShellReadDeclarations, depth?: number): ShellReadPlan;
+export declare function planShellReads(command: string, decl: ShellReadDeclarations, depth?: number, homeRebound?: boolean): ShellReadPlan;