@sema-agent/core 7.29.0 → 7.30.1

package/dist/tools/fs/shell-read-check.js

@@ -8,7 +8,7 @@ import { planShellReads } from "./shell-read-plan.js";
 import { createShellReadEstablisher, establishShellReadsLexically } from "./shell-read-establish.js";
 import { allFindings, decideShellRead, foldShellReadFindings, judgeEstablishedPlan, readRootGrantCandidateOf, } from "./shell-read-judge.js";
 import { normalizeReadRootCandidate } from "../../core/read-root-candidate.js";
-import { wordsOf, lexShellText } from "../../shell/lex.js";
+import { argvOf, lexShellText } from "../../shell/lex.js";
 function containmentDetails(paths) {
     return { type: "readonly_out_of_root", code: "readonly_out_of_root", paths };
 }
@@ -18,9 +18,9 @@ function shellCommandOf(args) {
     return typeof command === "string" ? command : undefined;
 }
 function declineSentence(segment) {
-    const lexed = lexShellText(segment.text, { mode: "lenient" });
+    const lexed = lexShellText(segment.text);
     if (!("reject" in lexed) && lexed.segments[0] !== undefined) {
-        const pos = readProgramPosition(wordsOf(lexed.segments[0]));
+        const pos = readProgramPosition(argvOf(lexed.segments[0]));
         if (pos.refusal !== undefined)
             return programPositionRefusalSentence(pos.refusal);
         if (pos.argvFromStdin) {

package/dist/tools/fs/shell-read-establish.d.ts

@@ -35,7 +35,7 @@
  */
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { ShellReadPlan, ShellReadSegment } from "./shell-read-plan.js";
-import type { EstablishedRead, ShellReadBoundary } from "./shell-read-judge.js";
+import { type EstablishedRead, type ShellReadBoundary } from "./shell-read-judge.js";
 /**
  * How many directories one glob operand (or one traversal root) may enumerate, and how many names it may
  * match, before the leg gives up and answers `unestablishable`.

package/dist/tools/fs/shell-read-establish.js

@@ -1,6 +1,8 @@
 import { normalizeAbsPathLexically, pathFamilyOf } from "./safety.js";
 import { boundaryIsTheSandbox, canonicalPathIsAuthoritative } from "../../core/remote-env.js";
 import { resolveOperandSpellings } from "./bash-readonly-classifier.js";
+import { denyFloorShadowsOf } from "./shell-read-judge.js";
+import { movedReads } from "./shell-read-identity.js";
 const GLOB_METACHAR_RE = /[*?[]/;
 export const MAX_GLOB_DIRS = 256;
 export const MAX_GLOB_MATCHES = 8192;
@@ -130,7 +132,8 @@ function lexicalReadsOf(candidate, boundary) {
     return out;
 }
 function judgedCandidatesOf(segment) {
-    return segment.reads.filter((c) => c.provenance !== "write_redirect_target");
+    const reads = segment.reads.filter((c) => c.provenance !== "write_redirect_target");
+    return [...reads, ...denyFloorShadowsOf(reads)];
 }
 export function establishShellReadsLexically(plan, boundary) {
     const reads = new Map();
@@ -424,38 +427,7 @@ export function createShellReadEstablisher(env, readRoots) {
             if (lexicalOnly)
                 return { changed: [] };
             const again = await establishPlan(previous.plan, { ...boundary, roots: previous.roots }, previous.roots, signal);
-            const settled = (e) => {
-                const out = [];
-                const walk = (p) => {
-                    for (const reads of p.reads.values())
-                        for (const r of reads)
-                            if ((r.established === "canonical" || r.established === "expansion") && r.target !== undefined)
-                                out.push(r.target);
-                    for (const n of p.nested.values())
-                        walk(n);
-                };
-                walk(e);
-                return out.sort();
-            };
-            const before = settled(previous);
-            const after = new Set(settled(again));
-            const beforeSet = new Set(before);
-            const moved = before.filter((t) => !after.has(t));
-            const appeared = [...after].filter((t) => !beforeSet.has(t));
-            if (moved.length === 0 && appeared.length === 0)
-                return { changed: [] };
-            const changed = [];
-            const collect = (p) => {
-                for (const reads of p.reads.values())
-                    for (const r of reads)
-                        if (r.target !== undefined && (moved.includes(r.target) || appeared.includes(r.target)))
-                            changed.push(r);
-                for (const n of p.nested.values())
-                    collect(n);
-            };
-            collect(previous);
-            collect(again);
-            return { changed };
+            return { changed: movedReads(previous, again) };
         },
     };
 }

package/dist/tools/fs/shell-read-identity.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The pre-spawn identity comparison: which established reads of one plan resolve somewhere else now.
+ *
+ * Compared PER CANDIDATE, never as one pooled set of targets: a candidate is keyed by where it stands in the plan
+ * (segment, nested plan) and by what it is (deny-only or a read, provenance, spelling, expansion, raw word), and its
+ * set of established targets is compared with the same candidate's set from the re-establishment. A pooled set let
+ * one candidate's targets hide another's move — `head linkx` retargeted onto a path some other word's pattern already
+ * matched, or onto a home shadow's target, left the pool unchanged and the call was admitted unjudged.
+ */
+import type { EstablishedPlan } from "./shell-read-establish.js";
+import type { EstablishedRead } from "./shell-read-judge.js";
+/** Every read of either establishment whose candidate's settled target set differs between the two. */
+export declare function movedReads(previous: EstablishedPlan, again: EstablishedPlan): EstablishedRead[];

package/dist/tools/fs/shell-read-identity.js

@@ -0,0 +1,39 @@
+export function movedReads(previous, again) {
+    const before = targetsByCandidate(previous);
+    const after = targetsByCandidate(again);
+    const changed = [];
+    for (const key of new Set([...before.keys(), ...after.keys()])) {
+        const b = before.get(key);
+        const a = after.get(key);
+        if (b !== undefined && a !== undefined && sameTargets(b.targets, a.targets))
+            continue;
+        changed.push(...(b?.reads ?? []), ...(a?.reads ?? []));
+    }
+    return changed.filter((r) => r.target !== undefined);
+}
+function targetsByCandidate(e) {
+    const out = new Map();
+    const walk = (p, at) => {
+        p.plan.segments.forEach((segment, si) => {
+            for (const r of p.reads.get(segment) ?? []) {
+                const c = r.candidate;
+                const key = [at, si, c.denyOnly === true ? "floor" : "read", c.provenance, c.spelled, String(c.expands), c.raw].join("\0");
+                const landing = out.get(key) ?? { targets: new Set(), reads: [] };
+                out.set(key, landing);
+                landing.reads.push(r);
+                if ((r.established === "canonical" || r.established === "expansion") && r.target !== undefined)
+                    landing.targets.add(r.target);
+            }
+            segment.nested.forEach((n, ni) => {
+                const nested = p.nested.get(n);
+                if (nested !== undefined)
+                    walk(nested, `${at}/${si}.${ni}`);
+            });
+        });
+    };
+    walk(e, "");
+    return out;
+}
+function sameTargets(a, b) {
+    return a.size === b.size && [...a].every((t) => b.has(t));
+}

package/dist/tools/fs/shell-read-judge.d.ts

@@ -173,6 +173,14 @@ export interface ReadFinding {
  * neither is a containment candidate — both still meet the deny judge, on every spelling.
  */
 export declare function judgeRead(read: EstablishedRead, boundary: ShellReadBoundary): ReadFinding;
+/**
+ * The deny floor of every home word the plan does not place: each candidate carrying a `floorSpelled` (the word
+ * spelled with the DECLARED home) gets a SHADOW candidate at that spelling, established exactly as a read is — the
+ * canonical target, a pattern's matches (a glob the word carries unquoted), a traversal root's tree — and judged for
+ * deny rows only (`denyOnly`). A deny row is a floor the text's rebinding may never reach past; the shadow adds no
+ * other finding, so a read that is not a deny row still asks through its own unplaced candidate.
+ */
+export declare function denyFloorShadowsOf(candidates: readonly ReadCandidate[]): ReadCandidate[];
 /** One segment's judged reads and declines, with its nested plans judged the same way. */
 export interface JudgedSegment {
     readonly segment: ShellReadSegment;

package/dist/tools/fs/shell-read-judge.js

@@ -1,4 +1,6 @@
 import { hasWin32AliasedComponent, normalizeAbsPathLexically, withinAnyRoot } from "./safety.js";
+import { globInWord } from "./bash-readonly-classifier.js";
+import { readOfText } from "./shell-read-word.js";
 export const SHELL_READ_FINDINGS = ["deny_hit", "outside_roots", "unestablishable", "declined", "identity_changed", "none"];
 export const SHELL_READ_SEATS = ["bash_off", "bash_classify", "readonly", "rejudge"];
 export const SHELL_READ_FINDING_RANK = {
@@ -32,6 +34,8 @@ export function judgeRead(read, boundary) {
         }
     }
     const containment = containmentOf(read, boundary);
+    if (read.candidate.denyOnly === true)
+        return { read, kind: "none", containment };
     const provenance = read.candidate.provenance;
     if (provenance === "env_assignment" || (provenance === "program_path" && read.candidate.expands !== "unresolvable"))
         return { read, kind: "none", containment };
@@ -39,6 +43,9 @@ export function judgeRead(read, boundary) {
         return { read, kind: "unestablishable", containment };
     return { read, kind: containment === "outside" ? "outside_roots" : "none", containment };
 }
+export function denyFloorShadowsOf(candidates) {
+    return candidates.flatMap((c) => (c.floorSpelled === undefined ? [] : [{ spelled: c.floorSpelled, raw: c.raw, provenance: c.provenance, expands: globInWord(readOfText(c.raw).word) ? "glob" : false, bases: [], denyOnly: true }]));
+}
 function containmentOf(read, boundary) {
     if (boundary.face === "open")
         return "open";

package/dist/tools/fs/shell-read-plan.d.ts

@@ -4,8 +4,8 @@
  * The read boundary today re-derives "which words may be read" at several sites (the compound walk, the
  * containment-only gate, the refused-command whitelist, the execute-time recheck), each with its own idea
  * of launchers, option slots, redirections and re-entry. This module is the single extraction those sites
- * are to consume: a pure, zero-I/O function over the lenient lexer (`src/shell/lex.ts`) and the program-position
- * reader (`bash-program-position.ts`), returning every path word a command MAY read, each tagged with its
+ * are to consume: a pure, zero-I/O function over the one lexer's word FACTS (`src/shell/lex.ts`) and the
+ * program-position reader (`bash-program-position.ts`), returning every path word a command MAY read, each tagged with its
  * PROVENANCE (why it is a candidate) and the working-directory candidates it is relative to. Establishment
  * (`shell-read-establish.ts`) and judgment are downstream; nothing here decides allow/ask/deny.
  *
@@ -15,8 +15,9 @@
  *  · an UNLISTED program hands every word of its argv (a program declared to open no path operand hands none);
  *  · a LAUNCHER chain is peeled to its program and the chain's own words are never candidates; a launcher
  *    option the row cannot read is recorded as a decline and every word after it is handed over;
- *  · a SHELL re-entry (`sh -c S`, `eval S`, a launcher handing text to a shell, `env -S S`) carries its text as a
- *    NESTED plan; an argv re-entry (`xargs`) is a decline unless the target opens nothing it is handed;
+ *  · a SHELL re-entry (`sh -c S`, `eval S`, a launcher handing text to a shell, `env -S S`, a builtin's code-body
+ *    operand the shell runs later — `trap S SIG`, `alias N=S`, `mapfile -C S`) carries its text as a NESTED plan;
+ *    an argv re-entry (`xargs`) is a decline unless the target opens nothing it is handed;
  *  · an INTERPRETER's inline program is a shape fact (`reentry:"interpreter"`), never parsed, never a finding;
  *  · `<` targets are read candidates, `>`-family targets are write targets (tagged, not read), here-documents
  *    and here-strings are data (an UNQUOTED here-document body's substitutions are nested plans);
@@ -35,7 +36,8 @@ export type ReadCandidateProvenance = (typeof READ_CANDIDATE_PROVENANCES)[number
 export interface ShellReadDeclarations {
     /** The listed read verbs. They decide whether a segment is read by verb slots or word by word, never whether it hands candidates. */
     readonly readers: ReadonlySet<string>;
-    /** Substituted for `$HOME` / `${HOME}` word spellings before lexing; `~` itself is left to establishment. */
+    /** The declared home: a word that spells it (`$HOME` / `${HOME}` — {@link homeExpansionOf}) is named by it,
+     *  unless the command may rebind `HOME` (then `~` is unresolvable too); `~` itself is left to establishment. */
     readonly homeDir?: string;
     /** The working directory the first segment's relative words resolve against. */
     readonly cwd: string;
@@ -60,6 +62,11 @@ export interface ReadCandidate {
      *  A deny row is a floor, so the judge resolves the spelling against these for deny rows ONLY — never to
      *  establish a read. `cd sub && cd $'\x2e' && cat <deny row under sub>` (bash: `cd .`) is refused through it. */
     readonly floorBases?: readonly string[];
+    /** A home word the plan does not place (the text may rebind `HOME`, or it sits in a value): spelled with the DECLARED
+     *  home. A deny row is a floor: the judge reads it for deny rows ONLY, never to establish a read. */
+    readonly floorSpelled?: string;
+    /** A deny-floor shadow of a `floorSpelled` spelling, established as a read and judged for deny rows only. */
+    readonly denyOnly?: true;
 }
 /** How the shell reached one segment — what the base-candidate walk needs from the connectors. */
 export interface SegmentReach {
@@ -118,4 +125,6 @@ export interface ShellReadPlan {
         readonly strayRedirection: boolean;
     };
 }
-export declare function planShellReads(command: string, decl: ShellReadDeclarations, depth?: number): ShellReadPlan;
+/** Plan every read candidate of one command (the contract is this module's header). `arithmetic` = the text is an
+ *  `$((…))` body, which bash evaluates and never globs (no extended-glob floor). */
+export declare function planShellReads(command: string, decl: ShellReadDeclarations, depth?: number, homeRebound?: boolean, arithmetic?: boolean): ShellReadPlan;