@sema-agent/core 7.30.0 → 7.30.1

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 7.30.1 — 2026-09-24
+
+### An unquoted extended-glob opener makes a shell text unestablishable (#1064 ⑨; patch; read boundary NARROWING; +0 exports; +0 wire keys; @cli @test)
+
+- **What was wrong.** After `shopt -s extglob`, bash reads `pack@(age.json)` as one pattern and `<<@(x)` as the here-document delimiter `@(x)`; the lexer reads a split word (`pack@`, `age.json`) and the delimiter `@`. The read station judged the split words, found nothing, and vouched: `shopt -s extglob` on one line and `head -c 64 < pack@(age.json)` on the next read a deny-row file at zero cards on the real lane (v7.29.0 and v7.30.0 alike). The only extglob reading lived inside the HOME-rebinding check.
+- **One rule.** An unquoted `?(` `*(` `+(` `@(` `!(` in an argv word, a redirection target or a here-document delimiter joins the plan's `unreadable` floor (`unreadableSentenceOf`, beside the unresolved-word sentence): the whole text is unestablishable — mandated on `bash_off` and `bash_classify`, refused on the read-only face, denied headless — and a deny hit anywhere in it still refuses. A quoted opener, a comment and a here-document body are the text they always were; an `$((…))` arithmetic body is never globbed and keeps its reading.
+- **Review round (before release).** Two bypasses of the first cut are closed: an executable substitution whose text equals an arithmetic body (the exemption is granted only to a body that is one parenthesised group spanning the whole body — `$((cat x); :)` is a command substitution — and only where every substitution spelled so is such a body), and a here-document delimiter quoted in part (`<<'E'@(X)` — a delimiter quoted anywhere counts).
+- **Pre-release batch 2.** The arithmetic test reads the lexer's structure (a quoted, escaped or commented parenthesis is text: `$((echo '('; …); (echo ')'))` is a command substitution and keeps the floor), and a here-document body keeps each substitution's kind (`cat <<EOF\n$((2*(3+4)))\nEOF` stays vouched on every seat, as on 7.30.0).
+- **Who is hurt.** A text with an unquoted opener costs a card even when extglob is off (`ls !(x)` — a syntax error there — and the arithmetic command `(( 2*(3+4) ))`, whose `2*(` reads as an opener), and so do pattern positions bash never globs: `[[ $v =~ ^[0-9]+(\.[0-9]+)?$ ]]`, `[[ $f == *.@(js|ts) ]]`, `case $x in @(a|b))` (both full-shell seats ask, the read-only face refuses; ≈0 in the corpus). KL-994k.
+
+### The declared-home deny floor is established as a read — pattern, tree, canonical target (#1064 ⑬; patch; read boundary NARROWING; `ReadCandidate.denyOnly?` added (optional); +0 exports; +0 wire keys; @cli @test)
+
+- **What was wrong.** 7.30.0 gave an unplaced home word (a text that may rebind `HOME`, a home word inside a value) its declared-home spelling as one more LITERAL spelling for the deny judge. A pattern (`~/k*.txt`), a traversal (`grep -r KEY ~`) or a symlink under the home never matched it, so those asked — and, approved, read the deny row — where v7.29.0 refused them.
+- **One rule.** Each such word's `floorSpelled` becomes a SHADOW candidate (`denyFloorShadowsOf`, `shell-read-judge.ts`) established exactly as a read is — canonical target, a pattern's matches, a traversal root's tree — and judged for deny rows only (`ReadCandidate.denyOnly`): it never adds a containment finding and never vouches, so a read that is not a deny row still asks through its own unplaced candidate. The literal spelling the unresolvable arm used to carry is gone (one mechanism, not two).
+- **Also on the floor.** A bare `cd` / `cd --` puts the declared home on the deny floor (`cd && cat <deny row under home>` refuses); a `[k]=` compound element is read as the value bash assigns, so its `~` expands and its `$HOME` is a home word (`A=([0]="$HOME/<deny>")`, `A=([0]=~/<deny>)` refuse).
+- **Review round (before release).** A shadow is never an identity in the pre-spawn re-check (a real read retargeted onto a shadow's target is still refused), and a `[k]=` element is re-read as an assignment VALUE (a leading `#` stays literal — `A=([0]=#dir/".env")` refuses as on 7.30.0; a quoted `"[k]=…"` element keeps its tail's spelling too, as on 7.30.0).
+- **Pre-release batch 2.** A `[k]=` element keeps its word's own reading (its folded tail, globbed as the word is) as a deny-only candidate beside the assignment value: an unquoted `${A[k]}` expands a stored `pack*`, and `A=([0]="pack*"); head ${A[0]}` refuses on disk as on 7.30.0.
+- **Admission.** A deny-only read (a shadow, an element word's own reading) is its own identity class in the pre-spawn re-check: a real read retargeted onto a shadow's target is still caught, and a deny-only read retargeted onto a deny row between approval and spawn is re-judged and refused (`read_path_denied`), as a real read is.
+- **Pre-release batch 4.** Candidate de-duplication keys on `denyOnly` too: a deny-only read never absorbs an ordinary read of the same spelling (a real match retargeted after judgment is refused at admission in either assignment order, as on 7.30.0); and the arithmetic test follows its group across the segments the lexer cuts at `&&` `||` `&` `|` and line breaks (`$((2*(3+4) && 1))`, a multi-line body stay vouched).
+- **Pre-release batch 5.** The pre-spawn identity comparison is PER CANDIDATE (`shell-read-identity.ts`): each candidate's established targets are compared with its own re-establishment, keyed by where it stands in the plan and what it is. A pooled set let another word's pattern (`A=([0]="pair*") B=pair*; head linkx`) or a home shadow already reaching the new target hide a retargeted read, which was admitted; it is refused now (the `pair*` form was admitted on 7.30.0 too).
+- **Consumer face.** `judgeShellRead().establishment` now lists the shadow reads too (`candidate.denyOnly: true`); a consumer that counts established reads sees them.
+- **Not covered** (KL-994l): an option payload's home word (`--file="$HOME/…"`), `pushd ~`, parameter modifiers (`${HOME:-…}`), and a `~` assignment value no program opens (`A=~/<deny>; head "$A"` still asks — the #1004 ruling keeps `A=~/.env; true` vouched).
+
+### A language server's child process gets the tool child's environment scrub (#1073; patch; env face NARROWING; `NodeLspManagerOptions.env?` added (optional); +0 exports; @server)
+
+- `defaultLspSpawn` passed no `env` to `child_process.spawn`, so a language server inherited the whole host `process.env` — credentials included — while a tool's child process got `scrubSecretEnv`. The default spawn now passes the same scrub (the one function, applied at each spawn). A host that wants another environment passes `NodeLspManagerOptions.env`, used verbatim; a host-supplied `spawn` owns its child's environment as before. The LSP scrub has no findings collector: what it removed is not reported (the tool child's `onScrub` channel has no LSP twin). **Who is hurt:** a language server that read a credential-shaped variable from the host environment no longer sees it; pass it through `env`.
+
+### Plural credential names are scrubbed from a spawned environment (#1072; patch; env face NARROWING; +0 exports; @server @web-admin)
+
+- `SECRET_ENV_RE` reads `KEYS`, `TOKENS` and `PASSWORDS` as it reads their singulars (`SECRETS` / `CREDENTIALS` already were): `SERVICE_AUTH_TOKENS`, `API_KEYS`, `DB_PASSWORDS` no longer reach a child shell. The exact-name exemptions (`PARTITION_KEY`, …) still win.
+- **A token COUNT is not a credential.** `TOKENS` is also a count word: right after `MAX` / `OUTPUT` / `INPUT` / `THINKING` / `NUM` / `TOTAL` (`TOKEN_COUNT_WORDS`, the reverse ledger in the same place) it is the count and is kept — `MODEL_MAX_TOKENS`, `MAX_THINKING_TOKENS`, `CLAUDE_CODE_MAX_OUTPUT_TOKENS`, `MAX_TOKENS` still reach an agent CLI run in the child shell. The singular `TOKEN` keeps its 7.30.0 reading.
+
 ## 7.30.0 — 2026-09-24
 ### A resumed leg with no shell is no longer told to run `git status` (#1046; prompt-face NARROWING; +0 exports; +0 wire keys; @server @test)
 

package/dist/core/secret-env.js

@@ -1,4 +1,5 @@
-const SECRET_ENV_RE = /(^|_)(KEY|TOKEN|SECRET|SECRETS|PASSWORD|PASSWD|CREDENTIAL|CREDENTIALS|PRIVATEKEY|APIKEY|ACCESS_KEY|SESSION_TOKEN)(?:_(?:\d+|ID))?$/i;
+const TOKEN_COUNT_WORDS = ["MAX", "OUTPUT", "INPUT", "THINKING", "NUM", "TOTAL"];
+const SECRET_ENV_RE = new RegExp(`(^|_)(KEY|KEYS|TOKEN|(?<!(?:^|_)(?:${TOKEN_COUNT_WORDS.join("|")})_)TOKENS|SECRET|SECRETS|PASSWORD|PASSWORDS|PASSWD|CREDENTIAL|CREDENTIALS|PRIVATEKEY|APIKEY|ACCESS_KEY|SESSION_TOKEN)(?:_(?:\\d+|ID))?$`, "i");
 const SECRET_ENV_EXACT_NAMES = new Set([
     "DATABASE_URL", "CONNECTION_STRING", "DSN", "NPM_AUTH",
     "PGPASSWORD", "MYSQL_PWD", "SSHPASS", "GPG_PASSPHRASE", "GH_PAT", "GITHUB_PAT",

package/dist/engine/lsp/node-lsp-manager.d.ts

@@ -19,6 +19,9 @@ export interface NodeLspManagerOptions {
     servers?: Record<string, string | null>;
     /** Injectable spawn (tests supply a fake server; default = {@link defaultLspSpawn} over `child_process.spawn`). */
     spawn?: LspSpawn;
+    /** The language server's environment for the default spawn, verbatim. Omitted ⇒ the host environment scrubbed of
+     *  credential-shaped names (`scrubSecretEnv`, a tool child's scrub). Unread when {@link spawn} is supplied. */
+    env?: Record<string, string>;
     /** Read a file's CURRENT text for the session's didOpen/didChange re-sync (default = local `fs.readFile` utf8). */
     readText?: LspReadText;
     /** Resolve the server `cwd`/`rootUri` for a file (default = env.cwd ?? nearest project marker ?? file dir). */

package/dist/engine/lsp/node-lsp-manager.js

@@ -9,6 +9,7 @@ import { TransportLspSession } from "../../core/lsp-session.js";
 import { StdioLspTransport } from "./stdio-lsp-transport.js";
 import { MAX_LSP_FILE_BYTES, SharedAbortScope, settleOnAbort } from "../../core/lsp.js";
 import { asThrownError, thrownText } from "../../core/thrown-value.js";
+import { scrubSecretEnv } from "../../core/secret-env.js";
 export const DEFAULT_LSP_SERVERS = {
     typescript: "typescript-language-server --stdio",
     javascript: "typescript-language-server --stdio",
@@ -66,7 +67,7 @@ export class NodeLspManager {
     disposed = false;
     constructor(opts = {}) {
         this.servers = { ...DEFAULT_LSP_SERVERS, ...opts.servers };
-        this.spawnFn = opts.spawn ?? defaultLspSpawn;
+        this.spawnFn = opts.spawn ?? (opts.env !== undefined ? lspSpawnWithEnv(opts.env) : defaultLspSpawn);
         this.readTextFn = opts.readText ?? defaultLspReadText;
         this.resolveRootFn = opts.resolveRoot ?? defaultResolveRoot;
         this.log = opts.log ?? (() => { });
@@ -328,10 +329,11 @@ export function lspSpawnOptions(cwd) {
         ? { cwd, stdio: ["pipe", "pipe", "ignore"], shell: true }
         : { cwd, stdio: ["pipe", "pipe", "ignore"] };
 }
-export const defaultLspSpawn = (command, args, cwd, signal) => new Promise((resolve, reject) => {
+export const defaultLspSpawn = (command, args, cwd, signal) => lspSpawnWithEnv(undefined)(command, args, cwd, signal);
+const lspSpawnWithEnv = (env) => (command, args, cwd, signal) => new Promise((resolve, reject) => {
     let child;
     try {
-        child = spawn(command, args, lspSpawnOptions(cwd));
+        child = spawn(command, args, { ...lspSpawnOptions(cwd), env: env ?? scrubSecretEnv(process.env) });
     }
     catch (e) {
         return reject(asThrownError(e));

package/dist/shell/lex.d.ts

@@ -25,8 +25,10 @@ export declare const SHELL_LEX_DIALECT = "bash";
 /** What holds a character quoted: the four quote forms and the backslash escape, one reason each. */
 export declare const QUOTE_KINDS: readonly ["'", "\"", "$'", "$\"", "\\"];
 export type QuoteKind = (typeof QUOTE_KINDS)[number];
-/** The expansions this lexer names. Extended globs are absent on purpose: `bash -c` runs with `extglob` off, so
- *  `?(…)` is a syntax error there and `(` is a group token here. */
+/** The expansions this lexer names. Extended globs are not among them: `extglob` is off when `bash -c` starts, where
+ *  `?(…)` is a syntax error and `(` is a group token here — but a text may turn it on (`shopt -s extglob` on an earlier
+ *  line), after which bash reads `pack@(age.json)` as one pattern. A reader that plans reads treats an unquoted opener
+ *  as a pattern it does not expand (`extglobOpenerIn`, the read station's `unreadable` floor). */
 export declare const EXPANSION_KINDS: readonly ["parameter", "command", "process", "arithmetic", "tilde", "brace", "glob"];
 export type ExpansionKind = (typeof EXPANSION_KINDS)[number];
 /** Why a word's value cannot be read off the text. Each member is a spelling whose value the text does not
@@ -242,7 +244,10 @@ export declare function argvOf(segment: LexedSegment): readonly LexedWord[];
 export declare function wordsOf(segment: LexedSegment): SegmentTokens;
 /** The substitution bodies of an UNQUOTED here-document body: `$(…)` and backticks are live there, quotes are
  *  ordinary characters, a backslash protects the next character. `undefined` when a substitution never closes. */
-export declare function substitutionsInHeredocBody(body: string): string[] | undefined;
+export declare function substitutionsInHeredocBody(body: string): {
+    readonly body: string;
+    readonly kind: "command" | "arithmetic";
+}[] | undefined;
 /** Lex a command: its segments, or the one reason bash (or this lexer) cannot delimit them. */
 export declare function lexShell(source: string): ShellLex;
 /**

package/dist/shell/lex.js

@@ -305,7 +305,7 @@ export function substitutionsInHeredocBody(body) {
             const tick = backtickBody(body, i);
             if (tick === undefined)
                 return undefined;
-            out.push(tick.body);
+            out.push({ body: tick.body, kind: "command" });
             i = tick.close;
             continue;
         }
@@ -313,7 +313,7 @@ export function substitutionsInHeredocBody(body) {
             const end = parenBodyEnd(body, i + 1);
             if (typeof end !== "number")
                 return undefined;
-            out.push(body.slice(i + 2, end - 1));
+            out.push({ body: body.slice(i + 2, end - 1), kind: body[i + 2] === "(" ? "arithmetic" : "command" });
             i = end - 1;
         }
     }

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -1,4 +1,4 @@
-import { type LexedSegment, type LexedWord, type ShellLex, type ShellSegmentConnector, type WordPiece } from "../../shell/lex.js";
+import { type LexedCommand, type LexedSegment, type LexedWord, type ShellLex, type ShellSegmentConnector, type WordPiece } from "../../shell/lex.js";
 /**
  * Bare command names `bash_readonly` permits out of the box, ALSO the default reversible set for the
  * The {@link import("./fs-bash.js").bashReversibilityProbe} classifier. **Coarse first filter, NOT a security
@@ -876,6 +876,12 @@ export declare function homeExpansionOf(w: LexedWord, home: string): {
  *  Elsewhere a computed word is its own unresolvable candidate, and an escape the lexer does not decode is
  *  unresolved on its own (asked). */
 export declare function homeMayBeRebound(text: string): boolean;
+/** {@link hasUnquotedExtglobOpener} over an already-lexed text. A here-document delimiter counts too: the lexer ends
+ *  it at the `(` (`<<@(x)` reads as the delimiter `@` and a group), where bash with `extglob` on reads the one word
+ *  `@(x)` — a different delimiter, so the body the lexer read as data is not the body bash reads. The token keeps no
+ *  per-character quoting, so a delimiter quoted anywhere (`<<'E'@(X)`) counts as well: a quoted opener is bash's
+ *  syntax error, where reading it as one costs a card and runs nothing. */
+export declare function extglobOpenerIn(lexed: LexedCommand, text: string): boolean;
 /**
  * {@link classifyCompoundReadonly} with the structured verdict. The name/operator/blocking arms
  * run FIRST and unchanged, so an existing demotion keeps its exact reason and never acquires the

package/dist/tools/fs/bash-readonly-classifier.js

@@ -1510,10 +1510,14 @@ export function homeMayBeRebound(text) {
 }
 function hasUnquotedExtglobOpener(text) {
     const lexed = lexShell(text);
-    if ("parseFailure" in lexed)
-        return true;
+    return "parseFailure" in lexed || extglobOpenerIn(lexed, text);
+}
+export function extglobOpenerIn(lexed, text) {
     for (const seg of lexed.segments) {
-        for (const tok of seg.tokens) {
+        for (const [k, tok] of seg.tokens.entries()) {
+            const next = seg.tokens[k + 1];
+            if (tok.kind === "heredoc" && /[?*+@!]$/.test(tok.delimiter) && next?.kind === "group" && next.op === "(")
+                return true;
             const t = tok.kind === "word" ? tok : tok.kind === "redirect" ? tok.target : undefined;
             if (t === undefined)
                 continue;

package/dist/tools/fs/shell-read-establish.d.ts

@@ -35,7 +35,7 @@
  */
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { ShellReadPlan, ShellReadSegment } from "./shell-read-plan.js";
-import type { EstablishedRead, ShellReadBoundary } from "./shell-read-judge.js";
+import { type EstablishedRead, type ShellReadBoundary } from "./shell-read-judge.js";
 /**
  * How many directories one glob operand (or one traversal root) may enumerate, and how many names it may
  * match, before the leg gives up and answers `unestablishable`.

package/dist/tools/fs/shell-read-establish.js

@@ -1,6 +1,8 @@
 import { normalizeAbsPathLexically, pathFamilyOf } from "./safety.js";
 import { boundaryIsTheSandbox, canonicalPathIsAuthoritative } from "../../core/remote-env.js";
 import { resolveOperandSpellings } from "./bash-readonly-classifier.js";
+import { denyFloorShadowsOf } from "./shell-read-judge.js";
+import { movedReads } from "./shell-read-identity.js";
 const GLOB_METACHAR_RE = /[*?[]/;
 export const MAX_GLOB_DIRS = 256;
 export const MAX_GLOB_MATCHES = 8192;
@@ -94,7 +96,7 @@ function basesFor(candidate, boundary) {
 }
 function lexicalReadsOf(candidate, boundary) {
     if (candidate.expands === "unresolvable") {
-        return [{ candidate, established: "unestablishable", spellings: [candidate.spelled, ...(candidate.floorSpelled !== undefined ? [candidate.floorSpelled] : [])], cause: `"${candidate.raw}" is rewritten by the shell before the program sees it` }];
+        return [{ candidate, established: "unestablishable", spellings: [candidate.spelled], cause: `"${candidate.raw}" is rewritten by the shell before the program sees it` }];
     }
     const bases = basesFor(candidate, boundary);
     if (bases === "unmodelled") {
@@ -130,7 +132,8 @@ function lexicalReadsOf(candidate, boundary) {
     return out;
 }
 function judgedCandidatesOf(segment) {
-    return segment.reads.filter((c) => c.provenance !== "write_redirect_target");
+    const reads = segment.reads.filter((c) => c.provenance !== "write_redirect_target");
+    return [...reads, ...denyFloorShadowsOf(reads)];
 }
 export function establishShellReadsLexically(plan, boundary) {
     const reads = new Map();
@@ -424,38 +427,7 @@ export function createShellReadEstablisher(env, readRoots) {
             if (lexicalOnly)
                 return { changed: [] };
             const again = await establishPlan(previous.plan, { ...boundary, roots: previous.roots }, previous.roots, signal);
-            const settled = (e) => {
-                const out = [];
-                const walk = (p) => {
-                    for (const reads of p.reads.values())
-                        for (const r of reads)
-                            if ((r.established === "canonical" || r.established === "expansion") && r.target !== undefined)
-                                out.push(r.target);
-                    for (const n of p.nested.values())
-                        walk(n);
-                };
-                walk(e);
-                return out.sort();
-            };
-            const before = settled(previous);
-            const after = new Set(settled(again));
-            const beforeSet = new Set(before);
-            const moved = before.filter((t) => !after.has(t));
-            const appeared = [...after].filter((t) => !beforeSet.has(t));
-            if (moved.length === 0 && appeared.length === 0)
-                return { changed: [] };
-            const changed = [];
-            const collect = (p) => {
-                for (const reads of p.reads.values())
-                    for (const r of reads)
-                        if (r.target !== undefined && (moved.includes(r.target) || appeared.includes(r.target)))
-                            changed.push(r);
-                for (const n of p.nested.values())
-                    collect(n);
-            };
-            collect(previous);
-            collect(again);
-            return { changed };
+            return { changed: movedReads(previous, again) };
         },
     };
 }

package/dist/tools/fs/shell-read-identity.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The pre-spawn identity comparison: which established reads of one plan resolve somewhere else now.
+ *
+ * Compared PER CANDIDATE, never as one pooled set of targets: a candidate is keyed by where it stands in the plan
+ * (segment, nested plan) and by what it is (deny-only or a read, provenance, spelling, expansion, raw word), and its
+ * set of established targets is compared with the same candidate's set from the re-establishment. A pooled set let
+ * one candidate's targets hide another's move — `head linkx` retargeted onto a path some other word's pattern already
+ * matched, or onto a home shadow's target, left the pool unchanged and the call was admitted unjudged.
+ */
+import type { EstablishedPlan } from "./shell-read-establish.js";
+import type { EstablishedRead } from "./shell-read-judge.js";
+/** Every read of either establishment whose candidate's settled target set differs between the two. */
+export declare function movedReads(previous: EstablishedPlan, again: EstablishedPlan): EstablishedRead[];

package/dist/tools/fs/shell-read-identity.js

@@ -0,0 +1,39 @@
+export function movedReads(previous, again) {
+    const before = targetsByCandidate(previous);
+    const after = targetsByCandidate(again);
+    const changed = [];
+    for (const key of new Set([...before.keys(), ...after.keys()])) {
+        const b = before.get(key);
+        const a = after.get(key);
+        if (b !== undefined && a !== undefined && sameTargets(b.targets, a.targets))
+            continue;
+        changed.push(...(b?.reads ?? []), ...(a?.reads ?? []));
+    }
+    return changed.filter((r) => r.target !== undefined);
+}
+function targetsByCandidate(e) {
+    const out = new Map();
+    const walk = (p, at) => {
+        p.plan.segments.forEach((segment, si) => {
+            for (const r of p.reads.get(segment) ?? []) {
+                const c = r.candidate;
+                const key = [at, si, c.denyOnly === true ? "floor" : "read", c.provenance, c.spelled, String(c.expands), c.raw].join("\0");
+                const landing = out.get(key) ?? { targets: new Set(), reads: [] };
+                out.set(key, landing);
+                landing.reads.push(r);
+                if ((r.established === "canonical" || r.established === "expansion") && r.target !== undefined)
+                    landing.targets.add(r.target);
+            }
+            segment.nested.forEach((n, ni) => {
+                const nested = p.nested.get(n);
+                if (nested !== undefined)
+                    walk(nested, `${at}/${si}.${ni}`);
+            });
+        });
+    };
+    walk(e, "");
+    return out;
+}
+function sameTargets(a, b) {
+    return a.size === b.size && [...a].every((t) => b.has(t));
+}

package/dist/tools/fs/shell-read-judge.d.ts

@@ -173,6 +173,14 @@ export interface ReadFinding {
  * neither is a containment candidate — both still meet the deny judge, on every spelling.
  */
 export declare function judgeRead(read: EstablishedRead, boundary: ShellReadBoundary): ReadFinding;
+/**
+ * The deny floor of every home word the plan does not place: each candidate carrying a `floorSpelled` (the word
+ * spelled with the DECLARED home) gets a SHADOW candidate at that spelling, established exactly as a read is — the
+ * canonical target, a pattern's matches (a glob the word carries unquoted), a traversal root's tree — and judged for
+ * deny rows only (`denyOnly`). A deny row is a floor the text's rebinding may never reach past; the shadow adds no
+ * other finding, so a read that is not a deny row still asks through its own unplaced candidate.
+ */
+export declare function denyFloorShadowsOf(candidates: readonly ReadCandidate[]): ReadCandidate[];
 /** One segment's judged reads and declines, with its nested plans judged the same way. */
 export interface JudgedSegment {
     readonly segment: ShellReadSegment;

package/dist/tools/fs/shell-read-judge.js

@@ -1,4 +1,6 @@
 import { hasWin32AliasedComponent, normalizeAbsPathLexically, withinAnyRoot } from "./safety.js";
+import { globInWord } from "./bash-readonly-classifier.js";
+import { readOfText } from "./shell-read-word.js";
 export const SHELL_READ_FINDINGS = ["deny_hit", "outside_roots", "unestablishable", "declined", "identity_changed", "none"];
 export const SHELL_READ_SEATS = ["bash_off", "bash_classify", "readonly", "rejudge"];
 export const SHELL_READ_FINDING_RANK = {
@@ -32,6 +34,8 @@ export function judgeRead(read, boundary) {
         }
     }
     const containment = containmentOf(read, boundary);
+    if (read.candidate.denyOnly === true)
+        return { read, kind: "none", containment };
     const provenance = read.candidate.provenance;
     if (provenance === "env_assignment" || (provenance === "program_path" && read.candidate.expands !== "unresolvable"))
         return { read, kind: "none", containment };
@@ -39,6 +43,9 @@ export function judgeRead(read, boundary) {
         return { read, kind: "unestablishable", containment };
     return { read, kind: containment === "outside" ? "outside_roots" : "none", containment };
 }
+export function denyFloorShadowsOf(candidates) {
+    return candidates.flatMap((c) => (c.floorSpelled === undefined ? [] : [{ spelled: c.floorSpelled, raw: c.raw, provenance: c.provenance, expands: globInWord(readOfText(c.raw).word) ? "glob" : false, bases: [], denyOnly: true }]));
+}
 function containmentOf(read, boundary) {
     if (boundary.face === "open")
         return "open";

package/dist/tools/fs/shell-read-plan.d.ts

@@ -65,6 +65,8 @@ export interface ReadCandidate {
     /** A home word the plan does not place (the text may rebind `HOME`, or it sits in a value): spelled with the DECLARED
      *  home. A deny row is a floor: the judge reads it for deny rows ONLY, never to establish a read. */
     readonly floorSpelled?: string;
+    /** A deny-floor shadow of a `floorSpelled` spelling, established as a read and judged for deny rows only. */
+    readonly denyOnly?: true;
 }
 /** How the shell reached one segment — what the base-candidate walk needs from the connectors. */
 export interface SegmentReach {
@@ -123,4 +125,6 @@ export interface ShellReadPlan {
         readonly strayRedirection: boolean;
     };
 }
-export declare function planShellReads(command: string, decl: ShellReadDeclarations, depth?: number, homeRebound?: boolean): ShellReadPlan;
+/** Plan every read candidate of one command (the contract is this module's header). `arithmetic` = the text is an
+ *  `$((…))` body, which bash evaluates and never globs (no extended-glob floor). */
+export declare function planShellReads(command: string, decl: ShellReadDeclarations, depth?: number, homeRebound?: boolean, arithmetic?: boolean): ShellReadPlan;

package/dist/tools/fs/shell-read-plan.js

@@ -1,5 +1,5 @@
-import { lexShell, PARSE_FAILURE_SENTENCE, UNRESOLVED_SENTENCE, substitutionsInHeredocBody, literalTildeSpelling, } from "../../shell/lex.js";
-import { compoundArrayElements, dropDefinitionHeads, expandsOf, readOfText, readsOf, rewritten, spelledWithHome } from "./shell-read-word.js";
+import { lexShell, PARSE_FAILURE_SENTENCE, substitutionsInHeredocBody, literalTildeSpelling, } from "../../shell/lex.js";
+import { compoundArrayElements, dropDefinitionHeads, expandsOf, readOfText, readsOf, rewritten, spelledWithHome, isArithmeticBody, unreadableSentenceOf } from "./shell-read-word.js";
 import { LAUNCHER_TABLE, SHELL_BLOCK_WORDS, programBasename, programPositionRunsShell, readProgramPosition, shellScanDeclineOf, } from "./bash-program-position.js";
 import { ASSIGNMENT_VALUE_NOT_PATHS, INTERPRETER_INLINE_PROGRAMS, NO_PATH_OPERAND_COMMANDS, POLL_LOOP_MAX_BEATS, RECURSIVE_READ_FORMS, SHELL_REENTRY_PROGRAM_RE, UNMODELLED_BASE_MOVERS, argvProgramOf, homeMayBeRebound, attachedOptionPayloads, resolveOperandLexically, inlineProgramClause, interpreterKey, isPathShapedToken, readVerbOptionSlot, sedScriptSlotFiles, segmentSelectsRecursiveRead, slotValueCandidates, suppliesFirstOperandSlot, verbFirstOperandSlot, verbOptionsArePositionIndependent, } from "./bash-readonly-classifier.js";
 import { isAbsolutePathForm } from "./safety.js";
@@ -18,17 +18,7 @@ export const READ_CANDIDATE_PROVENANCES = [
 ];
 const NESTING_MAX = 4;
 const BASE_CANDIDATE_MAX = 256;
-function firstUnresolvedSentence(lexed) {
-    for (const segment of lexed.segments) {
-        for (const token of segment.tokens) {
-            const word = token.kind === "word" ? token : token.kind === "redirect" ? token.target : undefined;
-            if (word?.unresolved !== undefined)
-                return UNRESOLVED_SENTENCE[word.unresolved];
-        }
-    }
-    return undefined;
-}
-export function planShellReads(command, decl, depth = 0, homeRebound = false) {
+export function planShellReads(command, decl, depth = 0, homeRebound = false, arithmetic = false) {
     const shape = { grouped: false, backgrounded: false, strayRedirection: false };
     if (depth > NESTING_MAX)
         return { segments: [], unreadable: `command text nested more than ${NESTING_MAX} levels deep`, shape };
@@ -36,8 +26,8 @@ export function planShellReads(command, decl, depth = 0, homeRebound = false) {
     if ("parseFailure" in lexed)
         return { segments: [], unreadable: PARSE_FAILURE_SENTENCE[lexed.parseFailure.reason], shape };
     const home = homeRebound || homeMayBeRebound(command) ? undefined : decl.homeDir;
-    const unreadable = firstUnresolvedSentence(lexed);
-    const nestedPlan = (text) => planShellReads(text, decl, depth + 1, home === undefined);
+    const unreadable = unreadableSentenceOf(lexed, command, !arithmetic);
+    const nestedPlan = (text, arithmetic = false) => planShellReads(text, decl, depth + 1, home === undefined, arithmetic);
     const projected = lexed.segments.map((segment) => projectSegment(segment));
     const facts = projected.map((p, si) => segmentFacts(lexed.segments[si], p, decl, home, nestedPlan));
     shape.grouped = projected.some((p) => p.grouped);
@@ -86,7 +76,7 @@ export function planShellReads(command, decl, depth = 0, homeRebound = false) {
         if (move === undefined || baseLost)
             return;
         if (typeof move.target === "string" || move.target.expands !== false) {
-            loseBase(reachable, typeof move.target === "string" ? undefined : move.target.floorSpelled);
+            loseBase(reachable, typeof move.target !== "string" ? move.target.floorSpelled : move.target === "home" ? decl.homeDir : undefined);
             return;
         }
         const target = move.target.spelled;
@@ -214,8 +204,10 @@ function segmentFacts(segment, p, decl, home, nestedPlan) {
 }
 function segmentFactsRead(segment, p, decl, home, nestedPlan) {
     const nested = [];
+    const arithmetic = segment.tokens.flatMap((t) => (t.kind === "word" ? t : t.kind === "redirect" ? t.target : undefined)?.pieces ?? []).flatMap((q) => (q.expansion?.kind === "arithmetic" && q.expansion.body !== undefined && isArithmeticBody(q.expansion.body) ? [q.expansion.body] : []));
+    const count = (list, body) => list.filter((b) => b === body).length;
     for (const body of segment.substitutions)
-        nested.push(nestedPlan(body));
+        nested.push(nestedPlan(body, count(arithmetic, body) === count(segment.substitutions, body)));
     let unreadableHeredoc = false;
     for (const t of segment.tokens) {
         if (t.kind !== "heredoc" || t.quoted)
@@ -225,8 +217,8 @@ function segmentFactsRead(segment, p, decl, home, nestedPlan) {
             unreadableHeredoc = true;
             continue;
         }
-        for (const body of inner)
-            nested.push(nestedPlan(body));
+        for (const s of inner)
+            nested.push(nestedPlan(s.body, s.kind === "arithmetic" && isArithmeticBody(s.body)));
     }
     if (unreadableHeredoc)
         nested.push({ segments: [], unreadable: "a here-document body carries a substitution this lexer cannot delimit", shape: { grouped: false, backgrounded: false, strayRedirection: false } });
@@ -470,7 +462,7 @@ function dedupe(reads) {
     const seen = new Set();
     const out = [];
     for (const c of reads) {
-        const key = `${c.provenance}\u0000${c.spelled}\u0000${c.expands}`;
+        const key = `${c.provenance}\u0000${c.spelled}\u0000${c.expands}\u0000${c.denyOnly === true}`;
         if (seen.has(key))
             continue;
         seen.add(key);
@@ -515,7 +507,7 @@ function pushAssignment(reads, w, provenance, opensValue = true) {
         reads.push({ spelled: named, raw: w.raw, provenance, expands: expandsOf(w) });
     if (a.form === "compound")
         for (const e of compoundArrayElements(a.value))
-            reads.push({ spelled: e.folded, raw: e.raw, provenance, expands: e.expands });
+            reads.push({ spelled: e.folded, raw: e.raw, provenance, expands: e.expands, ...(e.denyOnly === true ? { denyOnly: true } : {}) });
 }
 function unlistedWords(reads, toks, from, launcherIndices, provenance, program) {
     const argv = program !== undefined ? { program: program.basename, from: program.index } : argvProgramOf(toks.map((r) => r.word));

package/dist/tools/fs/shell-read-word.d.ts

@@ -4,7 +4,7 @@
  * (the home-directory word spelled with the declared home, as bash hands it to the program), and what the shell
  * does to the word before the program sees it.
  */
-import { type LexedToken, type LexedWord, type WordPiece } from "../../shell/lex.js";
+import { type LexedCommand, type LexedToken, type LexedWord, type WordPiece } from "../../shell/lex.js";
 /** `"glob"` = an unquoted pathname-expansion character; `"unresolvable"` = the shell rewrites the word (a brace,
  *  variable or command substitution) so its text is not the path. The read candidate's own field, spelled here. */
 export type WordExpands = false | "glob" | "unresolvable";
@@ -35,13 +35,27 @@ export declare function spelledWithHome(spelled: string, raw: string, home: stri
  *  spelling. The lexer puts the body's compound command back at command position after the head, so a definition
  *  nested in a body is dropped the same way; after a drop the token that moved up is looked at again. */
 export declare function dropDefinitionHeads(tokens: LexedToken[]): void;
+/** Why a lexed text's reads cannot all be named — the plan's `unreadable` floor, or `undefined`: the first word whose
+ *  value the text does not contain (an unresolved word), or an unquoted extended-glob opener anywhere a word, a
+ *  redirection target or a here-document delimiter stands (`pack@(age.json)`, `<<@(x)`). After `shopt -s extglob`
+ *  bash expands the pattern (or reads another delimiter) where the lexer reads a split word, so what the text opens is
+ *  not what the plan names: the whole text asks, and a deny hit anywhere still refuses. `globs: false` = the text is an
+ *  arithmetic expression (`$((2*(3+4)))`), which bash evaluates and never globs. */
+export declare function unreadableSentenceOf(lexed: LexedCommand, text: string, globs?: boolean): string | undefined;
 /** The elements of a compound array value `(e1 [k]=e2 …)`, read with the one lexer as the words bash assigns (a
  *  `[k]=` subscript prefix dropped): each is a value spelling the deny judge reads, as a scalar value is. The list is
  *  words across lines and comments, so every segment's words count, whatever else a segment carries (a word bash
  *  would reject leaves its siblings readable). None when the list does not lex — the value stays the unread list. */
 export declare function compoundArrayElements(value: {
     readonly raw: string;
-}): readonly Read[];
+}): readonly (Read & {
+    readonly denyOnly?: true;
+})[];
+/** An `$((…))` body the shell reads as ARITHMETIC: one parenthesised group spanning the whole body (`(2*(3+4))`),
+ *  its bounds read off the lexer's structure — a quoted, escaped or commented parenthesis is text, not a bound — across
+ *  the segments the lexer cuts at `&&` `||` `&` `|` and line breaks (operators arithmetic shares with the shell).
+ *  `$((cat x); :)` opens the same way but its first group closes early: a command substitution holding a subshell. */
+export declare function isArithmeticBody(body: string): boolean;
 /** What the shell does to a word (or an assignment's value) before the program sees it, read off its pieces. */
 export declare function expandsOf(w: {
     readonly pieces: readonly WordPiece[];

package/dist/tools/fs/shell-read-word.js

@@ -1,5 +1,5 @@
-import { argvOf, lexShell, literalTildeSpelling } from "../../shell/lex.js";
-import { expansionInWord, globInWord, homeExpansionOf } from "./bash-readonly-classifier.js";
+import { argvOf, lexShell, literalTildeSpelling, UNRESOLVED_SENTENCE } from "../../shell/lex.js";
+import { expansionInWord, extglobOpenerIn, globInWord, homeExpansionOf } from "./bash-readonly-classifier.js";
 export function readsOf(words, home) {
     return words.map((word) => {
         const spelled = home === undefined ? undefined : homeExpansionOf(word, home)?.spelled;
@@ -39,17 +39,52 @@ export function dropDefinitionHeads(tokens) {
             tokens.splice(k, 3);
     }
 }
+export function unreadableSentenceOf(lexed, text, globs = true) {
+    for (const segment of lexed.segments) {
+        for (const token of segment.tokens) {
+            const word = token.kind === "word" ? token : token.kind === "redirect" ? token.target : undefined;
+            if (word?.unresolved !== undefined)
+                return UNRESOLVED_SENTENCE[word.unresolved];
+        }
+    }
+    return globs && extglobOpenerIn(lexed, text) ? "an extended pattern (`?(…)` `*(…)` `+(…)` `@(…)` `!(…)`) is one this reader does not expand" : undefined;
+}
 export function compoundArrayElements(value) {
     const inner = /^\(([\s\S]*)\)$/.exec(value.raw)?.[1];
     const l = inner === undefined ? undefined : lexShell(inner);
     if (l === undefined || "parseFailure" in l)
         return [];
-    return l.segments.flatMap((sg) => argvOf(sg)).map((word) => {
-        const folded = word.folded.replace(/^\[[^\]]*\]\+?=/, "");
+    return l.segments.flatMap((sg) => argvOf(sg)).flatMap((element) => {
+        const sub = /^\[[^\]]*\]\+?=/.exec(element.raw)?.[0];
+        const value = sub === undefined ? undefined : readOfText(`V=${element.raw.slice(sub.length)}`).word.assignment?.value;
+        const word = value === undefined ? element : { ...element, raw: value.raw, folded: value.folded, pieces: value.pieces };
         const tilde = word.pieces.some((q) => q.expansion?.kind === "tilde");
-        return { word, raw: word.raw, folded: tilde ? folded : literalTildeSpelling(folded), expands: expandsOf(word) };
+        const read = { word, raw: word.raw, folded: tilde ? word.folded : literalTildeSpelling(word.folded), expands: expandsOf(word) };
+        const prefix = /^\[[^\]]*\]\+?=/.exec(element.folded)?.[0];
+        if (prefix === undefined)
+            return [read];
+        const spelled = element.pieces.some((q) => q.expansion?.kind === "tilde") ? element.folded.slice(prefix.length) : literalTildeSpelling(element.folded.slice(prefix.length));
+        return [read, { word: element, raw: element.raw, folded: spelled, expands: expandsOf(element), denyOnly: true }];
     });
 }
+export function isArithmeticBody(body) {
+    const l = body.startsWith("(") && body.endsWith(")") ? lexShell(body) : undefined;
+    if (l === undefined || "parseFailure" in l)
+        return false;
+    const tokens = l.segments.flatMap((sg) => sg.tokens);
+    if (tokens[0]?.kind !== "group" || tokens[0].op !== "(")
+        return false;
+    let depth = 0;
+    for (const [i, t] of tokens.entries()) {
+        if (t.kind !== "group")
+            continue;
+        if (t.op === "(")
+            depth++;
+        else if (--depth === 0)
+            return i === tokens.length - 1;
+    }
+    return false;
+}
 export function expandsOf(w) {
     if (expansionInWord(w) || /[`()]/.test(w.raw))
         return "unresolvable";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.30.0",
+  "version": "7.30.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.30.1.json

@@ -0,0 +1,154 @@
+{
+  "repo": "core",
+  "version": "7.30.1",
+  "from": "3a100146dad04ac157def06e16d624fc8c1fe6a1",
+  "to": "v7.30.1",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#1064 ⑨, shell read boundary): an unquoted extended-glob opener (`?(` `*(` `+(` `@(` `!(`) in an argv word, a redirection target or a here-document delimiter makes the WHOLE text unestablishable — it joins the plan's `unreadable` floor, so both full-shell seats raise one MANDATED card, the read-only face and every headless face refuse, and a deny hit elsewhere in the same text still refuses outright. An `$((…))` arithmetic body keeps its reading only when the whole body is ONE complete parenthesised group, read off the lexer's structure (a quoted parenthesis is text) and followed across the segments the lexer cuts at `&&` `||` `&` `|` and line breaks; a quoted opener and a here-document body are the text they always were."
+    },
+    {
+      "id": "F2",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#1064 ⑬, shell read boundary; the CHANGELOG reads it as the repair of a 7.30.0 regression against 7.29.0 on the answered seats — 7.29.0 is not measured here): the declared-home spelling of an unplaced home word becomes a deny-only SHADOW candidate (`ReadCandidate.denyOnly`) established exactly as a read is — canonical target, a pattern's matches, a traversal root's tree — and judged for deny rows only; a bare `cd` / `cd --` puts the declared home on the deny floor; a `[k]=` compound element is read as the value bash assigns. The pre-spawn identity re-check compares each candidate's targets with its own re-establishment (keyed by plan position and candidate identity, deny-only reads their own class), and candidate de-duplication keys on `denyOnly`."
+    },
+    {
+      "id": "F3",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#1072, spawned-environment scrub): `SECRET_ENV_RE` reads `KEYS`, `TOKENS` and `PASSWORDS` as it reads their singulars, so `SERVICE_AUTH_TOKENS`, `API_KEYS`, `DB_PASSWORDS`, `GITHUB_TOKENS` no longer reach a tool's child shell; a `TOKENS` right after a count word (`TOKEN_COUNT_WORDS`: MAX OUTPUT INPUT THINKING NUM TOTAL) is a token count and is kept. The singular `TOKEN` and the exact-name exemptions keep their 7.30.0 reading."
+    },
+    {
+      "id": "F4",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING + additive option (#1073, language-server environment): `defaultLspSpawn` passes `scrubSecretEnv(process.env)` to `child_process.spawn` instead of no `env` at all, so a language server no longer inherits credential-shaped host variables; `NodeLspManagerOptions.env?` (new, optional) is the server's environment used VERBATIM by the manager's default spawn. A host-supplied `spawn` still owns its child's environment. The LSP scrub reports nothing (no findings collector)."
+    }
+  ],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [
+    {
+      "type": "NodeLspManagerOptions",
+      "at": [
+        "src/engine/lsp/node-lsp-manager.ts:76"
+      ],
+      "added": [
+        "env"
+      ],
+      "addedDetail": [
+        {
+          "key": "env",
+          "optional": true
+        }
+      ],
+      "addedRequired": [],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": true
+    },
+    {
+      "type": "ReadCandidate",
+      "at": [
+        "src/tools/fs/shell-read-plan.ts:104"
+      ],
+      "added": [
+        "denyOnly"
+      ],
+      "addedDetail": [
+        {
+          "key": "denyOnly",
+          "optional": true
+        }
+      ],
+      "addedRequired": [],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": true
+    }
+  ],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 215,
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.gate",
+      "assertions": [
+        "G1.a",
+        "G1.b",
+        "G2.a"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.isError",
+      "assertions": [
+        "G1.b",
+        "G3.a"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.output",
+      "assertions": [
+        "G1.b",
+        "G2.a",
+        "G3.a",
+        "G4.a",
+        "G4.b"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.structured",
+      "assertions": [
+        "G1.b",
+        "G2.a",
+        "G3.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.mandated",
+      "assertions": [
+        "G1.a",
+        "G2.b",
+        "G3.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "NodeLspManagerOptions.env",
+      "assertions": [
+        "G5.a",
+        "G5.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ReadCandidate.denyOnly",
+      "assertions": [
+        "G2.b",
+        "G3.b"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [
+      "ReadCandidate"
+    ],
+    "server": [
+      "ReadCandidate"
+    ],
+    "sdk": [],
+    "note": "scanned cli@4e593722 server@fa3e0b9b sdk@350f64f — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it. Ledger files (**/docs/core-consumption/**, **/docs/wire-consumption/**, **/*LEDGER*.json) are not evidence of use — server: 1 name(s) matched ONLY in bookkeeping files and were set aside (NodeLspManagerOptions)"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "0034a646af1de9c0cdd8ad7bd9b56234ec527c2c"
+}