@sema-agent/core 7.30.0 → 7.31.0

package/dist/engine/execution-env/node-execution-env.js

@@ -7,7 +7,7 @@ import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { createInterface } from "node:readline";
 import { ExecutionError, err, FileError, ok, toError, } from "../harness/types.js";
 import { killProcessTree, shutdownDebug } from "./kill-tree.js";
-import { scrubSecretEnv } from "../../core/secret-env.js";
+import { __resetSecretEnvScrubNoticeAnnouncement, announceSecretEnvScrub, scrubSecretEnv } from "../../core/secret-env.js";
 import { physicalPathOfAsync } from "../../core/physical-path.js";
 import { isUncSpelling } from "../../tools/fs/safety.js";
 import { RollingTailBuffer, markTruncated, newStreamCursorState, sliceStreamIncrement, } from "../../core/exec-output-tail.js";
@@ -197,13 +197,12 @@ export async function getShellConfig(customShellPath) {
     return ok({ shell: "sh", args: ["-c"] });
 }
 const EXEC_FORCE_SETTLE_GRACE_MS = 3000;
-let secretScrubConsoleAnnounced = false;
 let secretScrubSeatDefectAnnounced = false;
 export function __resetSecretScrubAnnouncement() {
-    secretScrubConsoleAnnounced = false;
     secretScrubSeatDefectAnnounced = false;
+    __resetSecretEnvScrubNoticeAnnouncement();
 }
-function getShellEnv(inheritEnv, baseEnv, extraEnv, onScrub) {
+function getShellEnv(inheritEnv, baseEnv, extraEnv, onScrub, onNotice) {
     let inherited;
     if (inheritEnv === "all") {
         inherited = process.env;
@@ -230,20 +229,17 @@ function getShellEnv(inheritEnv, baseEnv, extraEnv, onScrub) {
                 catch {
                 }
             }
-            else {
-                if (onScrub !== undefined && !secretScrubSeatDefectAnnounced) {
-                    secretScrubSeatDefectAnnounced = true;
-                    try {
-                        console.warn(`onSecretEnvScrub seat holds ${onScrub === null ? "null" : typeof onScrub} — not a function; scrub findings fall back to the console summary (once per process)`);
-                    }
-                    catch {
-                    }
+            else if (onScrub !== undefined && !secretScrubSeatDefectAnnounced) {
+                secretScrubSeatDefectAnnounced = true;
+                try {
+                    console.warn(`onSecretEnvScrub seat holds ${onScrub === null ? "null" : typeof onScrub} — not a function; scrub findings fall back to the console summary (once per process)`);
                 }
-                if (!secretScrubConsoleAnnounced) {
-                    secretScrubConsoleAnnounced = true;
-                    console.warn(`secret_env_scrubbed: ${findings.length} env key(s) withheld from the shell child (${findings.map((f) => f.key).join(", ")}) — once per process; wire onSecretEnvScrub for per-exec telemetry`);
+                catch {
                 }
             }
+            if (!(typeof onScrub === "function" && onNotice === undefined)) {
+                announceSecretEnvScrub(onNotice, findings);
+            }
         }
     }
     return {
@@ -302,6 +298,7 @@ export class NodeExecutionEnv {
     bgCounter = 0;
     retainBackgroundProcesses;
     onSecretEnvScrub;
+    onNotice;
     bgSpoolDir;
     backgroundCapabilities;
     constructor(options) {
@@ -312,6 +309,7 @@ export class NodeExecutionEnv {
         this.scheduler = options.scheduler;
         this.retainBackgroundProcesses = options.retainBackgroundProcesses ?? false;
         this.onSecretEnvScrub = options.onSecretEnvScrub;
+        this.onNotice = options.onNotice;
         this.backgroundCapabilities = {
             supported: true,
             maxConcurrent: 8,
@@ -469,7 +467,7 @@ export class NodeExecutionEnv {
                 child = spawn(shellConfig.value.shell, [...shellConfig.value.args, command], {
                     cwd,
                     detached: process.platform !== "win32",
-                    env: getShellEnv(this.inheritEnv, this.shellEnv, options?.env, this.onSecretEnvScrub),
+                    env: getShellEnv(this.inheritEnv, this.shellEnv, options?.env, this.onSecretEnvScrub, this.onNotice),
                     stdio: execSpoolFds ? ["ignore", execSpoolFds[0], execSpoolFds[1]] : ["ignore", "pipe", "pipe"],
                     windowsHide: true,
                 });
@@ -1221,7 +1219,7 @@ export class NodeExecutionEnv {
             child = spawn(shellConfig.value.shell, [...shellConfig.value.args, command], {
                 cwd: options?.cwd ? resolvePath(this.cwd, options.cwd) : this.cwd,
                 detached: process.platform !== "win32",
-                env: getShellEnv(this.inheritEnv, this.shellEnv, options?.env, this.onSecretEnvScrub),
+                env: getShellEnv(this.inheritEnv, this.shellEnv, options?.env, this.onSecretEnvScrub, this.onNotice),
                 stdio: spoolFds ? ["ignore", spoolFds[0], spoolFds[1]] : ["ignore", "pipe", "pipe"],
                 windowsHide: true,
             });

package/dist/engine/harness/agent-harness.js

@@ -858,7 +858,7 @@ export class AgentHarness {
         await this.handleAgentEvent({ type: "agent_end", messages: [failureMessage] }, signal);
         return [failureMessage];
     }
-    async executeTurn(turnState, text, options) {
+    async executeTurn(turnState, text, options, abortController) {
         let activeTurnState = turnState;
         const userMessage = createUserMessage(text, options?.images, options);
         const beforeResult = await this.emitHook({
@@ -897,12 +897,10 @@ export class AgentHarness {
             }
             return messages;
         };
-        const abortController = new AbortController();
         const getTurnState = () => activeTurnState;
         const setTurnState = (nextTurnState) => {
             activeTurnState = nextTurnState;
         };
-        this.runAbortController = abortController;
         const runResultPromise = (async () => {
             try {
                 return await runAgentLoop(takePrompts, this.createContext(turnState, beforeResult?.systemPrompt), this.createLoopConfig(getTurnState, setTurnState, beforeResult?.systemPrompt), (event) => this.handleAgentEvent(event, abortController.signal), abortController.signal, this.createStreamFn(getTurnState), undefined, this.loopTrace, {
@@ -938,7 +936,7 @@ export class AgentHarness {
                     return mergeTruncatedOutputChain(newMessages, i);
                 }
             }
-            if (this.stopRequested)
+            if (this.stopRequested || abortController.signal.aborted)
                 return undefined;
             if (this.trailingBatchEndedOn !== undefined)
                 return this.trailingBatchEndedOn;
@@ -976,17 +974,21 @@ export class AgentHarness {
             }
         }
         this.phase = "turn";
+        const abortController = new AbortController();
+        this.runAbortController = abortController;
         const finishRunPromise = this.startRunPromise();
         try {
             await this.flushPendingSessionWrites();
             const turnState = await this.createTurnState();
-            return await this.executeTurn(turnState, text, options);
+            return await this.executeTurn(turnState, text, options, abortController);
         }
         catch (error) {
             this.phase = "idle";
             throw normalizeHarnessError(error, "unknown");
         }
         finally {
+            if (this.runAbortController === abortController)
+                this.runAbortController = undefined;
             finishRunPromise();
         }
     }

package/dist/engine/lsp/node-lsp-manager.d.ts

@@ -2,6 +2,7 @@ import { type SessionWarmup } from "../../core/lsp-session.js";
 import { type LspChildProcess } from "./stdio-lsp-transport.js";
 import { type LspServerManager, type LspSession, type LspReadText } from "../../core/lsp.js";
 import type { ExecutionEnv } from "../../internal/harness-types.js";
+import type { EngineNotice } from "../../core/engine-notice.js";
 /**
  * Default language → server command table (the DETERMINED supported set). Each value is a `command [args…]`
  * whose binary must be on the host `PATH`; absent ⇒ that language degrades. Mirrors the servers service bakes
@@ -19,6 +20,12 @@ export interface NodeLspManagerOptions {
     servers?: Record<string, string | null>;
     /** Injectable spawn (tests supply a fake server; default = {@link defaultLspSpawn} over `child_process.spawn`). */
     spawn?: LspSpawn;
+    /** The language server's environment for the default spawn, verbatim. Omitted ⇒ the host environment scrubbed of
+     *  credential-shaped names (`scrubSecretEnv`, a tool child's scrub). Unread when {@link spawn} is supplied. */
+    env?: Record<string, string>;
+    /** #1081 — the withheld-keys notice sink, SAME shared once-per-process latch/code as the shell-exec
+     *  site's `NodeExecutionEnv.onNotice`. Absent ⇒ console only. Unread when {@link spawn} is supplied. */
+    onNotice?: (notice: EngineNotice) => void;
     /** Read a file's CURRENT text for the session's didOpen/didChange re-sync (default = local `fs.readFile` utf8). */
     readText?: LspReadText;
     /** Resolve the server `cwd`/`rootUri` for a file (default = env.cwd ?? nearest project marker ?? file dir). */

package/dist/engine/lsp/node-lsp-manager.js

@@ -9,6 +9,7 @@ import { TransportLspSession } from "../../core/lsp-session.js";
 import { StdioLspTransport } from "./stdio-lsp-transport.js";
 import { MAX_LSP_FILE_BYTES, SharedAbortScope, settleOnAbort } from "../../core/lsp.js";
 import { asThrownError, thrownText } from "../../core/thrown-value.js";
+import { announceSecretEnvScrub, scrubSecretEnv } from "../../core/secret-env.js";
 export const DEFAULT_LSP_SERVERS = {
     typescript: "typescript-language-server --stdio",
     javascript: "typescript-language-server --stdio",
@@ -66,7 +67,7 @@ export class NodeLspManager {
     disposed = false;
     constructor(opts = {}) {
         this.servers = { ...DEFAULT_LSP_SERVERS, ...opts.servers };
-        this.spawnFn = opts.spawn ?? defaultLspSpawn;
+        this.spawnFn = opts.spawn ?? lspSpawnWithEnv(opts.env, opts.onNotice);
         this.readTextFn = opts.readText ?? defaultLspReadText;
         this.resolveRootFn = opts.resolveRoot ?? defaultResolveRoot;
         this.log = opts.log ?? (() => { });
@@ -328,10 +329,17 @@ export function lspSpawnOptions(cwd) {
         ? { cwd, stdio: ["pipe", "pipe", "ignore"], shell: true }
         : { cwd, stdio: ["pipe", "pipe", "ignore"] };
 }
-export const defaultLspSpawn = (command, args, cwd, signal) => new Promise((resolve, reject) => {
+export const defaultLspSpawn = (command, args, cwd, signal) => lspSpawnWithEnv(undefined)(command, args, cwd, signal);
+const lspSpawnWithEnv = (env, onNotice) => (command, args, cwd, signal) => new Promise((resolve, reject) => {
     let child;
     try {
-        child = spawn(command, args, lspSpawnOptions(cwd));
+        let scrubbedEnv = env;
+        if (scrubbedEnv == null) {
+            const findings = [];
+            scrubbedEnv = scrubSecretEnv(process.env, findings);
+            announceSecretEnvScrub(onNotice, findings);
+        }
+        child = spawn(command, args, { ...lspSpawnOptions(cwd), env: scrubbedEnv });
     }
     catch (e) {
         return reject(asThrownError(e));

package/dist/index.d.ts

@@ -229,7 +229,7 @@ export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootA
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, type AdoptionStatus, type AdoptLocalDataRootOptions, type AdoptLocalDataRootResult, type AdoptionCarriageLeg, type AdoptionCarriageLegContext, type AdoptionConfigWitnessReceipt, } from "./stores/file/adoption/adopt.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, type PersistedRuleHit, type PersistedRuleHitRule, type PersistedRuleUnreadable, type PersistedRuleCoverage, type PersistedRuleAnswer, normalizePersistedRuleHit, type Hooks, type HookToolContext, type HookInvocationIdentity, type UserPromptSubmitContext, type PostToolBatchContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, } from "./core/hooks.js";
 export { HOOK_FAMILIES, HOOKS_INVALID_CODE, type HookFamily, type WiringManifestHookEntry } from "./core/hook-seats.js";
-export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, MemoryProjectionError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, } from "./core/memory.js";
+export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, MemoryProjectionError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, MEMORY_PROJECT_KEY_ABSENT_REASONS, type MemoryProjectKeyAbsentReason, type MemoryProjectKey, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, writableRootOf, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, type OriginClearanceRow, type OriginClearanceEvent, type OriginClearanceShadow, committedDistilledOf, distilledEquals, type MemoryEntryDistilled, type MemoryEntryDistilledInput, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, deriveShadowedSet, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type MemoryConsolidationOptions, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, type ConsolidationPlanFoldEvidence, type SessionMemoryStatus, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, type CleanArmLeakFinding, type CleanArmLeakVerdict, type MemoryDistillerPurityContract, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanArm, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, type ConsolidationDriverEngine, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type ConsolidationRunStopReason, type RunMemoryConsolidationOptions, isInstructionEntry, type MemoryEntryOrigin, type MemoryOriginCause, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, type SessionCaptureOptOutRecord, type SessionCaptureOptOutMarkOutcome, type SessionCaptureRecordStore, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type CleanMemorySearchHit, type ExposedMemorySearchHit, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, type MemoryGetDetails, type MemoryIndexDetails, type MemoryIndexRow, type CleanMemoryIndexRow, type ExposedMemoryIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, computeMemoryBundleHash, type MemoryExportBundle, type MemoryImportReport, type MemoryExportSnapshot, type MemoryBundleImportPlan, type BundleChallengeRow, type BundleLineageRow, type BundlePollutedSession, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type MemoryScopeEnumeration, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryPagedList, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, type SharedMemoryFixture, type SharedMemoryStoreContractHooks, } from "./core/shared-memory/contract.js";

package/dist/index.js

@@ -179,7 +179,7 @@ export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootA
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, } from "./stores/file/adoption/adopt.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, normalizePersistedRuleHit, } from "./core/hooks.js";
 export { HOOK_FAMILIES, HOOKS_INVALID_CODE } from "./core/hook-seats.js";
-export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, MemoryProjectionError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, } from "./core/memory.js";
+export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, MemoryProjectionError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, MEMORY_PROJECT_KEY_ABSENT_REASONS, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, writableRootOf, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, committedDistilledOf, distilledEquals, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, deriveShadowedSet, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, isInstructionEntry, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, erasureSelectHash, computeMemoryBundleHash, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, } from "./core/shared-memory/contract.js";

package/dist/shell/lex.d.ts

@@ -25,8 +25,10 @@ export declare const SHELL_LEX_DIALECT = "bash";
 /** What holds a character quoted: the four quote forms and the backslash escape, one reason each. */
 export declare const QUOTE_KINDS: readonly ["'", "\"", "$'", "$\"", "\\"];
 export type QuoteKind = (typeof QUOTE_KINDS)[number];
-/** The expansions this lexer names. Extended globs are absent on purpose: `bash -c` runs with `extglob` off, so
- *  `?(…)` is a syntax error there and `(` is a group token here. */
+/** The expansions this lexer names. Extended globs are not among them: `extglob` is off when `bash -c` starts, where
+ *  `?(…)` is a syntax error and `(` is a group token here — but a text may turn it on (`shopt -s extglob` on an earlier
+ *  line), after which bash reads `pack@(age.json)` as one pattern. A reader that plans reads treats an unquoted opener
+ *  as a pattern it does not expand (`extglobOpenerIn`, the read station's `unreadable` floor). */
 export declare const EXPANSION_KINDS: readonly ["parameter", "command", "process", "arithmetic", "tilde", "brace", "glob"];
 export type ExpansionKind = (typeof EXPANSION_KINDS)[number];
 /** Why a word's value cannot be read off the text. Each member is a spelling whose value the text does not
@@ -242,7 +244,10 @@ export declare function argvOf(segment: LexedSegment): readonly LexedWord[];
 export declare function wordsOf(segment: LexedSegment): SegmentTokens;
 /** The substitution bodies of an UNQUOTED here-document body: `$(…)` and backticks are live there, quotes are
  *  ordinary characters, a backslash protects the next character. `undefined` when a substitution never closes. */
-export declare function substitutionsInHeredocBody(body: string): string[] | undefined;
+export declare function substitutionsInHeredocBody(body: string): {
+    readonly body: string;
+    readonly kind: "command" | "arithmetic";
+}[] | undefined;
 /** Lex a command: its segments, or the one reason bash (or this lexer) cannot delimit them. */
 export declare function lexShell(source: string): ShellLex;
 /**

package/dist/shell/lex.js

@@ -305,7 +305,7 @@ export function substitutionsInHeredocBody(body) {
             const tick = backtickBody(body, i);
             if (tick === undefined)
                 return undefined;
-            out.push(tick.body);
+            out.push({ body: tick.body, kind: "command" });
             i = tick.close;
             continue;
         }
@@ -313,7 +313,7 @@ export function substitutionsInHeredocBody(body) {
             const end = parenBodyEnd(body, i + 1);
             if (typeof end !== "number")
                 return undefined;
-            out.push(body.slice(i + 2, end - 1));
+            out.push({ body: body.slice(i + 2, end - 1), kind: body[i + 2] === "(" ? "arithmetic" : "command" });
             i = end - 1;
         }
     }

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -1,4 +1,4 @@
-import { type LexedSegment, type LexedWord, type ShellLex, type ShellSegmentConnector, type WordPiece } from "../../shell/lex.js";
+import { type LexedCommand, type LexedSegment, type LexedWord, type ShellLex, type ShellSegmentConnector, type WordPiece } from "../../shell/lex.js";
 /**
  * Bare command names `bash_readonly` permits out of the box, ALSO the default reversible set for the
  * The {@link import("./fs-bash.js").bashReversibilityProbe} classifier. **Coarse first filter, NOT a security
@@ -876,6 +876,12 @@ export declare function homeExpansionOf(w: LexedWord, home: string): {
  *  Elsewhere a computed word is its own unresolvable candidate, and an escape the lexer does not decode is
  *  unresolved on its own (asked). */
 export declare function homeMayBeRebound(text: string): boolean;
+/** {@link hasUnquotedExtglobOpener} over an already-lexed text. A here-document delimiter counts too: the lexer ends
+ *  it at the `(` (`<<@(x)` reads as the delimiter `@` and a group), where bash with `extglob` on reads the one word
+ *  `@(x)` — a different delimiter, so the body the lexer read as data is not the body bash reads. The token keeps no
+ *  per-character quoting, so a delimiter quoted anywhere (`<<'E'@(X)`) counts as well: a quoted opener is bash's
+ *  syntax error, where reading it as one costs a card and runs nothing. */
+export declare function extglobOpenerIn(lexed: LexedCommand, text: string): boolean;
 /**
  * {@link classifyCompoundReadonly} with the structured verdict. The name/operator/blocking arms
  * run FIRST and unchanged, so an existing demotion keeps its exact reason and never acquires the

package/dist/tools/fs/bash-readonly-classifier.js

@@ -1510,10 +1510,14 @@ export function homeMayBeRebound(text) {
 }
 function hasUnquotedExtglobOpener(text) {
     const lexed = lexShell(text);
-    if ("parseFailure" in lexed)
-        return true;
+    return "parseFailure" in lexed || extglobOpenerIn(lexed, text);
+}
+export function extglobOpenerIn(lexed, text) {
     for (const seg of lexed.segments) {
-        for (const tok of seg.tokens) {
+        for (const [k, tok] of seg.tokens.entries()) {
+            const next = seg.tokens[k + 1];
+            if (tok.kind === "heredoc" && /[?*+@!]$/.test(tok.delimiter) && next?.kind === "group" && next.op === "(")
+                return true;
             const t = tok.kind === "word" ? tok : tok.kind === "redirect" ? tok.target : undefined;
             if (t === undefined)
                 continue;

package/dist/tools/fs/shell-read-establish.d.ts

@@ -35,7 +35,7 @@
  */
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { ShellReadPlan, ShellReadSegment } from "./shell-read-plan.js";
-import type { EstablishedRead, ShellReadBoundary } from "./shell-read-judge.js";
+import { type EstablishedRead, type ShellReadBoundary } from "./shell-read-judge.js";
 /**
  * How many directories one glob operand (or one traversal root) may enumerate, and how many names it may
  * match, before the leg gives up and answers `unestablishable`.

package/dist/tools/fs/shell-read-establish.js

@@ -1,6 +1,8 @@
 import { normalizeAbsPathLexically, pathFamilyOf } from "./safety.js";
 import { boundaryIsTheSandbox, canonicalPathIsAuthoritative } from "../../core/remote-env.js";
 import { resolveOperandSpellings } from "./bash-readonly-classifier.js";
+import { denyFloorShadowsOf } from "./shell-read-judge.js";
+import { movedReads } from "./shell-read-identity.js";
 const GLOB_METACHAR_RE = /[*?[]/;
 export const MAX_GLOB_DIRS = 256;
 export const MAX_GLOB_MATCHES = 8192;
@@ -94,7 +96,7 @@ function basesFor(candidate, boundary) {
 }
 function lexicalReadsOf(candidate, boundary) {
     if (candidate.expands === "unresolvable") {
-        return [{ candidate, established: "unestablishable", spellings: [candidate.spelled, ...(candidate.floorSpelled !== undefined ? [candidate.floorSpelled] : [])], cause: `"${candidate.raw}" is rewritten by the shell before the program sees it` }];
+        return [{ candidate, established: "unestablishable", spellings: [candidate.spelled], cause: `"${candidate.raw}" is rewritten by the shell before the program sees it` }];
     }
     const bases = basesFor(candidate, boundary);
     if (bases === "unmodelled") {
@@ -130,7 +132,8 @@ function lexicalReadsOf(candidate, boundary) {
     return out;
 }
 function judgedCandidatesOf(segment) {
-    return segment.reads.filter((c) => c.provenance !== "write_redirect_target");
+    const reads = segment.reads.filter((c) => c.provenance !== "write_redirect_target");
+    return [...reads, ...denyFloorShadowsOf(reads)];
 }
 export function establishShellReadsLexically(plan, boundary) {
     const reads = new Map();
@@ -424,38 +427,7 @@ export function createShellReadEstablisher(env, readRoots) {
             if (lexicalOnly)
                 return { changed: [] };
             const again = await establishPlan(previous.plan, { ...boundary, roots: previous.roots }, previous.roots, signal);
-            const settled = (e) => {
-                const out = [];
-                const walk = (p) => {
-                    for (const reads of p.reads.values())
-                        for (const r of reads)
-                            if ((r.established === "canonical" || r.established === "expansion") && r.target !== undefined)
-                                out.push(r.target);
-                    for (const n of p.nested.values())
-                        walk(n);
-                };
-                walk(e);
-                return out.sort();
-            };
-            const before = settled(previous);
-            const after = new Set(settled(again));
-            const beforeSet = new Set(before);
-            const moved = before.filter((t) => !after.has(t));
-            const appeared = [...after].filter((t) => !beforeSet.has(t));
-            if (moved.length === 0 && appeared.length === 0)
-                return { changed: [] };
-            const changed = [];
-            const collect = (p) => {
-                for (const reads of p.reads.values())
-                    for (const r of reads)
-                        if (r.target !== undefined && (moved.includes(r.target) || appeared.includes(r.target)))
-                            changed.push(r);
-                for (const n of p.nested.values())
-                    collect(n);
-            };
-            collect(previous);
-            collect(again);
-            return { changed };
+            return { changed: movedReads(previous, again) };
         },
     };
 }

package/dist/tools/fs/shell-read-identity.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The pre-spawn identity comparison: which established reads of one plan resolve somewhere else now.
+ *
+ * Compared PER CANDIDATE, never as one pooled set of targets: a candidate is keyed by where it stands in the plan
+ * (segment, nested plan) and by what it is (deny-only or a read, provenance, spelling, expansion, raw word), and its
+ * set of established targets is compared with the same candidate's set from the re-establishment. A pooled set let
+ * one candidate's targets hide another's move — `head linkx` retargeted onto a path some other word's pattern already
+ * matched, or onto a home shadow's target, left the pool unchanged and the call was admitted unjudged.
+ */
+import type { EstablishedPlan } from "./shell-read-establish.js";
+import type { EstablishedRead } from "./shell-read-judge.js";
+/** Every read of either establishment whose candidate's settled target set differs between the two. */
+export declare function movedReads(previous: EstablishedPlan, again: EstablishedPlan): EstablishedRead[];

package/dist/tools/fs/shell-read-identity.js

@@ -0,0 +1,39 @@
+export function movedReads(previous, again) {
+    const before = targetsByCandidate(previous);
+    const after = targetsByCandidate(again);
+    const changed = [];
+    for (const key of new Set([...before.keys(), ...after.keys()])) {
+        const b = before.get(key);
+        const a = after.get(key);
+        if (b !== undefined && a !== undefined && sameTargets(b.targets, a.targets))
+            continue;
+        changed.push(...(b?.reads ?? []), ...(a?.reads ?? []));
+    }
+    return changed.filter((r) => r.target !== undefined);
+}
+function targetsByCandidate(e) {
+    const out = new Map();
+    const walk = (p, at) => {
+        p.plan.segments.forEach((segment, si) => {
+            for (const r of p.reads.get(segment) ?? []) {
+                const c = r.candidate;
+                const key = [at, si, c.denyOnly === true ? "floor" : "read", c.provenance, c.spelled, String(c.expands), c.raw].join("\0");
+                const landing = out.get(key) ?? { targets: new Set(), reads: [] };
+                out.set(key, landing);
+                landing.reads.push(r);
+                if ((r.established === "canonical" || r.established === "expansion") && r.target !== undefined)
+                    landing.targets.add(r.target);
+            }
+            segment.nested.forEach((n, ni) => {
+                const nested = p.nested.get(n);
+                if (nested !== undefined)
+                    walk(nested, `${at}/${si}.${ni}`);
+            });
+        });
+    };
+    walk(e, "");
+    return out;
+}
+function sameTargets(a, b) {
+    return a.size === b.size && [...a].every((t) => b.has(t));
+}

package/dist/tools/fs/shell-read-judge.d.ts

@@ -173,6 +173,14 @@ export interface ReadFinding {
  * neither is a containment candidate — both still meet the deny judge, on every spelling.
  */
 export declare function judgeRead(read: EstablishedRead, boundary: ShellReadBoundary): ReadFinding;
+/**
+ * The deny floor of every home word the plan does not place: each candidate carrying a `floorSpelled` (the word
+ * spelled with the DECLARED home) gets a SHADOW candidate at that spelling, established exactly as a read is — the
+ * canonical target, a pattern's matches (a glob the word carries unquoted), a traversal root's tree — and judged for
+ * deny rows only (`denyOnly`). A deny row is a floor the text's rebinding may never reach past; the shadow adds no
+ * other finding, so a read that is not a deny row still asks through its own unplaced candidate.
+ */
+export declare function denyFloorShadowsOf(candidates: readonly ReadCandidate[]): ReadCandidate[];
 /** One segment's judged reads and declines, with its nested plans judged the same way. */
 export interface JudgedSegment {
     readonly segment: ShellReadSegment;

package/dist/tools/fs/shell-read-judge.js

@@ -1,4 +1,6 @@
 import { hasWin32AliasedComponent, normalizeAbsPathLexically, withinAnyRoot } from "./safety.js";
+import { globInWord } from "./bash-readonly-classifier.js";
+import { readOfText } from "./shell-read-word.js";
 export const SHELL_READ_FINDINGS = ["deny_hit", "outside_roots", "unestablishable", "declined", "identity_changed", "none"];
 export const SHELL_READ_SEATS = ["bash_off", "bash_classify", "readonly", "rejudge"];
 export const SHELL_READ_FINDING_RANK = {
@@ -32,6 +34,8 @@ export function judgeRead(read, boundary) {
         }
     }
     const containment = containmentOf(read, boundary);
+    if (read.candidate.denyOnly === true)
+        return { read, kind: "none", containment };
     const provenance = read.candidate.provenance;
     if (provenance === "env_assignment" || (provenance === "program_path" && read.candidate.expands !== "unresolvable"))
         return { read, kind: "none", containment };
@@ -39,6 +43,9 @@ export function judgeRead(read, boundary) {
         return { read, kind: "unestablishable", containment };
     return { read, kind: containment === "outside" ? "outside_roots" : "none", containment };
 }
+export function denyFloorShadowsOf(candidates) {
+    return candidates.flatMap((c) => (c.floorSpelled === undefined ? [] : [{ spelled: c.floorSpelled, raw: c.raw, provenance: c.provenance, expands: globInWord(readOfText(c.raw).word) ? "glob" : false, bases: [], denyOnly: true }]));
+}
 function containmentOf(read, boundary) {
     if (boundary.face === "open")
         return "open";

package/dist/tools/fs/shell-read-plan.d.ts

@@ -65,6 +65,8 @@ export interface ReadCandidate {
     /** A home word the plan does not place (the text may rebind `HOME`, or it sits in a value): spelled with the DECLARED
      *  home. A deny row is a floor: the judge reads it for deny rows ONLY, never to establish a read. */
     readonly floorSpelled?: string;
+    /** A deny-floor shadow of a `floorSpelled` spelling, established as a read and judged for deny rows only. */
+    readonly denyOnly?: true;
 }
 /** How the shell reached one segment — what the base-candidate walk needs from the connectors. */
 export interface SegmentReach {
@@ -123,4 +125,6 @@ export interface ShellReadPlan {
         readonly strayRedirection: boolean;
     };
 }
-export declare function planShellReads(command: string, decl: ShellReadDeclarations, depth?: number, homeRebound?: boolean): ShellReadPlan;
+/** Plan every read candidate of one command (the contract is this module's header). `arithmetic` = the text is an
+ *  `$((…))` body, which bash evaluates and never globs (no extended-glob floor). */
+export declare function planShellReads(command: string, decl: ShellReadDeclarations, depth?: number, homeRebound?: boolean, arithmetic?: boolean): ShellReadPlan;

package/dist/tools/fs/shell-read-plan.js

@@ -1,5 +1,5 @@
-import { lexShell, PARSE_FAILURE_SENTENCE, UNRESOLVED_SENTENCE, substitutionsInHeredocBody, literalTildeSpelling, } from "../../shell/lex.js";
-import { compoundArrayElements, dropDefinitionHeads, expandsOf, readOfText, readsOf, rewritten, spelledWithHome } from "./shell-read-word.js";
+import { lexShell, PARSE_FAILURE_SENTENCE, substitutionsInHeredocBody, literalTildeSpelling, } from "../../shell/lex.js";
+import { compoundArrayElements, dropDefinitionHeads, expandsOf, readOfText, readsOf, rewritten, spelledWithHome, isArithmeticBody, unreadableSentenceOf } from "./shell-read-word.js";
 import { LAUNCHER_TABLE, SHELL_BLOCK_WORDS, programBasename, programPositionRunsShell, readProgramPosition, shellScanDeclineOf, } from "./bash-program-position.js";
 import { ASSIGNMENT_VALUE_NOT_PATHS, INTERPRETER_INLINE_PROGRAMS, NO_PATH_OPERAND_COMMANDS, POLL_LOOP_MAX_BEATS, RECURSIVE_READ_FORMS, SHELL_REENTRY_PROGRAM_RE, UNMODELLED_BASE_MOVERS, argvProgramOf, homeMayBeRebound, attachedOptionPayloads, resolveOperandLexically, inlineProgramClause, interpreterKey, isPathShapedToken, readVerbOptionSlot, sedScriptSlotFiles, segmentSelectsRecursiveRead, slotValueCandidates, suppliesFirstOperandSlot, verbFirstOperandSlot, verbOptionsArePositionIndependent, } from "./bash-readonly-classifier.js";
 import { isAbsolutePathForm } from "./safety.js";
@@ -18,17 +18,7 @@ export const READ_CANDIDATE_PROVENANCES = [
 ];
 const NESTING_MAX = 4;
 const BASE_CANDIDATE_MAX = 256;
-function firstUnresolvedSentence(lexed) {
-    for (const segment of lexed.segments) {
-        for (const token of segment.tokens) {
-            const word = token.kind === "word" ? token : token.kind === "redirect" ? token.target : undefined;
-            if (word?.unresolved !== undefined)
-                return UNRESOLVED_SENTENCE[word.unresolved];
-        }
-    }
-    return undefined;
-}
-export function planShellReads(command, decl, depth = 0, homeRebound = false) {
+export function planShellReads(command, decl, depth = 0, homeRebound = false, arithmetic = false) {
     const shape = { grouped: false, backgrounded: false, strayRedirection: false };
     if (depth > NESTING_MAX)
         return { segments: [], unreadable: `command text nested more than ${NESTING_MAX} levels deep`, shape };
@@ -36,8 +26,8 @@ export function planShellReads(command, decl, depth = 0, homeRebound = false) {
     if ("parseFailure" in lexed)
         return { segments: [], unreadable: PARSE_FAILURE_SENTENCE[lexed.parseFailure.reason], shape };
     const home = homeRebound || homeMayBeRebound(command) ? undefined : decl.homeDir;
-    const unreadable = firstUnresolvedSentence(lexed);
-    const nestedPlan = (text) => planShellReads(text, decl, depth + 1, home === undefined);
+    const unreadable = unreadableSentenceOf(lexed, command, !arithmetic);
+    const nestedPlan = (text, arithmetic = false) => planShellReads(text, decl, depth + 1, home === undefined, arithmetic);
     const projected = lexed.segments.map((segment) => projectSegment(segment));
     const facts = projected.map((p, si) => segmentFacts(lexed.segments[si], p, decl, home, nestedPlan));
     shape.grouped = projected.some((p) => p.grouped);
@@ -86,7 +76,7 @@ export function planShellReads(command, decl, depth = 0, homeRebound = false) {
         if (move === undefined || baseLost)
             return;
         if (typeof move.target === "string" || move.target.expands !== false) {
-            loseBase(reachable, typeof move.target === "string" ? undefined : move.target.floorSpelled);
+            loseBase(reachable, typeof move.target !== "string" ? move.target.floorSpelled : move.target === "home" ? decl.homeDir : undefined);
             return;
         }
         const target = move.target.spelled;
@@ -214,8 +204,10 @@ function segmentFacts(segment, p, decl, home, nestedPlan) {
 }
 function segmentFactsRead(segment, p, decl, home, nestedPlan) {
     const nested = [];
+    const arithmetic = segment.tokens.flatMap((t) => (t.kind === "word" ? t : t.kind === "redirect" ? t.target : undefined)?.pieces ?? []).flatMap((q) => (q.expansion?.kind === "arithmetic" && q.expansion.body !== undefined && isArithmeticBody(q.expansion.body) ? [q.expansion.body] : []));
+    const count = (list, body) => list.filter((b) => b === body).length;
     for (const body of segment.substitutions)
-        nested.push(nestedPlan(body));
+        nested.push(nestedPlan(body, count(arithmetic, body) === count(segment.substitutions, body)));
     let unreadableHeredoc = false;
     for (const t of segment.tokens) {
         if (t.kind !== "heredoc" || t.quoted)
@@ -225,8 +217,8 @@ function segmentFactsRead(segment, p, decl, home, nestedPlan) {
             unreadableHeredoc = true;
             continue;
         }
-        for (const body of inner)
-            nested.push(nestedPlan(body));
+        for (const s of inner)
+            nested.push(nestedPlan(s.body, s.kind === "arithmetic" && isArithmeticBody(s.body)));
     }
     if (unreadableHeredoc)
         nested.push({ segments: [], unreadable: "a here-document body carries a substitution this lexer cannot delimit", shape: { grouped: false, backgrounded: false, strayRedirection: false } });
@@ -470,7 +462,7 @@ function dedupe(reads) {
     const seen = new Set();
     const out = [];
     for (const c of reads) {
-        const key = `${c.provenance}\u0000${c.spelled}\u0000${c.expands}`;
+        const key = `${c.provenance}\u0000${c.spelled}\u0000${c.expands}\u0000${c.denyOnly === true}`;
         if (seen.has(key))
             continue;
         seen.add(key);
@@ -515,7 +507,7 @@ function pushAssignment(reads, w, provenance, opensValue = true) {
         reads.push({ spelled: named, raw: w.raw, provenance, expands: expandsOf(w) });
     if (a.form === "compound")
         for (const e of compoundArrayElements(a.value))
-            reads.push({ spelled: e.folded, raw: e.raw, provenance, expands: e.expands });
+            reads.push({ spelled: e.folded, raw: e.raw, provenance, expands: e.expands, ...(e.denyOnly === true ? { denyOnly: true } : {}) });
 }
 function unlistedWords(reads, toks, from, launcherIndices, provenance, program) {
     const argv = program !== undefined ? { program: program.basename, from: program.index } : argvProgramOf(toks.map((r) => r.word));