@sema-agent/core 7.33.8 → 7.35.0

package/dist/tools/fs/shell-read-judge.js

@@ -2,7 +2,7 @@ import { hasWin32AliasedComponent, normalizeAbsPathLexically, withinAnyRoot } fr
 import { globInWord } from "./bash-readonly-classifier.js";
 import { readOfText } from "./shell-read-word.js";
 export const SHELL_READ_FINDINGS = ["deny_hit", "outside_roots", "unestablishable", "declined", "identity_changed", "none"];
-export const SHELL_READ_SEATS = ["bash_off", "bash_classify", "readonly", "rejudge"];
+export const SHELL_READ_SEATS = ["full_shell", "readonly", "rejudge"];
 export const SHELL_READ_FINDING_RANK = {
     identity_changed: 6,
     deny_hit: 5,
@@ -12,27 +12,36 @@ export const SHELL_READ_FINDING_RANK = {
     none: 0,
 };
 export const SHELL_READ_DECISION = {
-    deny_hit: { bash_off: "refuse", bash_classify: "refuse", readonly: "refuse", rejudge: "refuse" },
-    outside_roots: { bash_off: "mandated", bash_classify: "mandated", readonly: "refuse", rejudge: "refuse" },
-    unestablishable: { bash_off: "mandated", bash_classify: "mandated", readonly: "refuse", rejudge: "refuse" },
-    declined: { bash_off: "mandated", bash_classify: "ordinary", readonly: "refuse", rejudge: "refuse" },
-    identity_changed: { bash_off: "refuse", bash_classify: "refuse", readonly: "refuse", rejudge: "refuse" },
-    none: { bash_off: "vouch", bash_classify: "vouch", readonly: "vouch", rejudge: "vouch" },
+    deny_hit: { full_shell: "refuse", readonly: "refuse", rejudge: "refuse" },
+    outside_roots: { full_shell: "mandated", readonly: "refuse", rejudge: "refuse" },
+    unestablishable: { full_shell: "mandated", readonly: "refuse", rejudge: "refuse" },
+    declined: { full_shell: "ordinary", readonly: "refuse", rejudge: "refuse" },
+    identity_changed: { full_shell: "refuse", readonly: "refuse", rejudge: "refuse" },
+    none: { full_shell: "vouch", readonly: "vouch", rejudge: "vouch" },
 };
 export function decideShellRead(finding, seat) {
-    return SHELL_READ_DECISION[finding][seat];
+    const row = Object.hasOwn(SHELL_READ_DECISION, finding) ? SHELL_READ_DECISION[finding] : undefined;
+    const disposition = row !== undefined && Object.hasOwn(row, seat) ? row[seat] : undefined;
+    if (disposition === undefined) {
+        throw new Error(`shell read decision: no cell for finding ${JSON.stringify(finding)} on seat ${JSON.stringify(seat)} — the seats are ${SHELL_READ_SEATS.map((w) => JSON.stringify(w)).join(", ")} (a seat names the face the command runs on)`);
+    }
+    return disposition;
 }
 export function judgeRead(read, boundary) {
-    const deny = boundary.denyMatch;
+    const writeTarget = read.candidate.face === "write";
+    const deny = writeTarget ? boundary.writeDenyMatch : boundary.denyMatch;
     if (deny !== undefined) {
+        const walked = read.walked === true ? { walked: true } : undefined;
         const views = [...(read.target !== undefined ? [read.target] : []), ...read.spellings];
         for (const view of views) {
             const folded = normalizeAbsPathLexically(view);
-            const pattern = deny(folded);
+            const pattern = writeTarget ? boundary.writeDenyMatch(folded) : boundary.denyMatch(folded, walked);
             if (pattern !== null)
-                return { read, kind: "deny_hit", deny: { pattern, matchedView: folded }, containment: containmentOf(read, boundary) };
+                return { read, kind: "deny_hit", deny: { pattern, matchedView: folded, ...(writeTarget ? { face: "write" } : {}) }, containment: containmentOf(read, boundary) };
         }
     }
+    if (writeTarget)
+        return { read, kind: "none", containment: containmentOf(read, boundary) };
     const containment = containmentOf(read, boundary);
     if (read.candidate.denyOnly === true)
         return { read, kind: "none", containment };
@@ -43,8 +52,18 @@ export function judgeRead(read, boundary) {
         return { read, kind: "unestablishable", containment };
     return { read, kind: containment === "outside" ? "outside_roots" : "none", containment };
 }
+export function denyRowAtOrBelow(read, boundary, carriesContent) {
+    if (boundary.writeDenyMatch !== undefined)
+        return true;
+    if (!carriesContent)
+        return false;
+    const atOrBelow = boundary.denyAtOrBelow;
+    if (atOrBelow === undefined)
+        return false;
+    return [...(read.target !== undefined ? [read.target] : []), ...read.spellings].some((view) => atOrBelow(normalizeAbsPathLexically(view)) !== null);
+}
 export function denyFloorShadowsOf(candidates) {
-    return candidates.flatMap((c) => (c.floorSpelled === undefined ? [] : [{ spelled: c.floorSpelled, raw: c.raw, provenance: c.provenance, expands: globInWord(readOfText(c.raw).word) ? "glob" : false, bases: [], denyOnly: true }]));
+    return candidates.flatMap((c) => (c.floorSpelled === undefined ? [] : [{ spelled: c.floorSpelled, raw: c.raw, provenance: c.provenance, expands: globInWord(readOfText(c.raw).word) ? "glob" : false, bases: [], denyOnly: true, ...(c.face !== undefined ? { face: c.face } : {}) }]));
 }
 function containmentOf(read, boundary) {
     if (boundary.face === "open")
@@ -55,7 +74,10 @@ function containmentOf(read, boundary) {
 }
 export function foldShellReadFindings(judged) {
     let best = { finding: "none" };
+    let unestablished = false;
     const raise = (next) => {
+        if (next.finding === "unestablishable" || next.finding === "declined")
+            unestablished = true;
         if (SHELL_READ_FINDING_RANK[next.finding] > SHELL_READ_FINDING_RANK[best.finding])
             best = next;
     };
@@ -86,7 +108,7 @@ export function foldShellReadFindings(judged) {
         }
     };
     walk(judged, false);
-    return best;
+    return unestablished ? { ...best, unestablished: true } : best;
 }
 export function judgeEstablishedPlan(plan, established, boundary, nestedOf) {
     return {
@@ -110,7 +132,7 @@ export function allFindings(judged) {
     walk(judged);
     return out;
 }
-function parentDirLexically(p) {
+export function parentDirLexically(p) {
     return normalizeAbsPathLexically(`${p}/..`);
 }
 export function deepestCommonDir(a, b) {
@@ -157,16 +179,19 @@ export function readRootGrantCandidateOf(judged, boundary) {
     }
     if (candidate === undefined)
         return undefined;
-    const tooWide = parentDirLexically(candidate) === candidate ||
-        (boundary.homeDir !== undefined && withinAnyRoot([candidate], boundary.homeDir)) ||
-        boundary.roots.some((root) => withinAnyRoot([candidate], root));
-    const proposed = tooWide ? (paths.length === 1 ? { dir: paths[0], covers: "exact" } : undefined) : { dir: candidate };
+    const proposed = grantOfferFor(candidate, paths.length === 1 ? paths[0] : undefined, boundary);
     if (proposed === undefined)
         return undefined;
     const widened = { ...boundary, roots: [...boundary.roots, proposed.dir] };
     const replay = rejudge(judged, widened);
     return foldShellReadFindings(replay).finding === "none" ? proposed : undefined;
 }
+export function grantOfferFor(candidate, single, bounds) {
+    const tooWide = parentDirLexically(candidate) === candidate ||
+        (bounds.homeDir !== undefined && withinAnyRoot([candidate], bounds.homeDir)) ||
+        bounds.roots.some((root) => withinAnyRoot([candidate], root));
+    return tooWide ? (single !== undefined ? { dir: single, covers: "exact" } : undefined) : { dir: candidate };
+}
 export function rejudge(judged, boundary) {
     return {
         plan: judged.plan,

package/dist/tools/fs/shell-read-plan.d.ts

@@ -13,6 +13,7 @@
  *  · a LISTED reader hands its positional operands and the declared option-value slots (the verb tables of
  *    `bash-readonly-classifier.ts`, read here through their exported readers, never copied);
  *  · an UNLISTED program hands every word of its argv (a program declared to open no path operand hands none);
+ *  · an ASSIGNMENT's value is a candidate only in a text that runs a program able to open a file;
  *  · a LAUNCHER chain is peeled to its program and the chain's own words are never candidates; a launcher
  *    option the row cannot read is recorded as a decline and every word after it is handed over;
  *  · a SHELL re-entry (`sh -c S`, `eval S`, a launcher handing text to a shell, `env -S S`, a builtin's code-body
@@ -67,6 +68,9 @@ export interface ReadCandidate {
     readonly floorSpelled?: string;
     /** A deny-floor shadow of a `floorSpelled` spelling, established as a read and judged for deny rows only. */
     readonly denyOnly?: true;
+    /** A WRITE target of the command (a `>`-family redirection, a `sed` `w` file, the operands of a file-writing command):
+     *  established like a read and judged against the deny table's WRITE face only — never for containment, never a read. */
+    readonly face?: "write";
 }
 /** How the shell reached one segment — what the base-candidate walk needs from the connectors. */
 export interface SegmentReach {

package/dist/tools/fs/shell-read-plan.js

@@ -1,7 +1,7 @@
 import { lexShell, PARSE_FAILURE_SENTENCE, substitutionsInHeredocBody, literalTildeSpelling, } from "../../shell/lex.js";
 import { compoundArrayElements, dropDefinitionHeads, expandsOf, readOfText, readsOf, rewritten, spelledWithHome, isArithmeticBody, unreadableSentenceOf } from "./shell-read-word.js";
 import { LAUNCHER_TABLE, SHELL_BLOCK_WORDS, programBasename, programPositionRunsShell, readProgramPosition, shellScanDeclineOf, } from "./bash-program-position.js";
-import { ASSIGNMENT_VALUE_NOT_PATHS, INTERPRETER_INLINE_PROGRAMS, NO_PATH_OPERAND_COMMANDS, POLL_LOOP_MAX_BEATS, RECURSIVE_READ_FORMS, SHELL_REENTRY_PROGRAM_RE, UNMODELLED_BASE_MOVERS, argvProgramOf, homeMayBeRebound, attachedOptionPayloads, resolveOperandLexically, inlineProgramClause, interpreterKey, isPathShapedToken, readVerbOptionSlot, sedScriptSlotFiles, segmentSelectsRecursiveRead, slotValueCandidates, suppliesFirstOperandSlot, verbFirstOperandSlot, verbOptionsArePositionIndependent, } from "./bash-readonly-classifier.js";
+import { ASSIGNMENT_VALUE_NOT_PATHS, DECLARATION_BUILTINS, INERT_BUILTINS, INTERPRETER_INLINE_PROGRAMS, NO_PATH_OPERAND_COMMANDS, NO_PATH_OPERAND_EVALUATORS, POLL_LOOP_MAX_BEATS, RECURSIVE_READ_FORMS, SHELL_REENTRY_PROGRAM_RE, UNMODELLED_BASE_MOVERS, argvProgramOf, homeMayBeRebound, attachedOptionPayloads, resolveOperandLexically, inlineProgramClause, interpreterKey, isPathShapedToken, messageSlotWords, readVerbOptionSlot, sedScriptSlotFiles, segmentSelectsRecursiveRead, slotValueCandidates, suppliesFirstOperandSlot, verbFirstOperandSlot, verbOptionsArePositionIndependent, } from "./bash-readonly-classifier.js";
 import { isAbsolutePathForm } from "./safety.js";
 import { codeBodies, reentryText } from "./shell-reentry-text.js";
 export const READ_CANDIDATE_PROVENANCES = [
@@ -29,7 +29,9 @@ export function planShellReads(command, decl, depth = 0, homeRebound = false, ar
     const unreadable = unreadableSentenceOf(lexed, command, !arithmetic);
     const nestedPlan = (text, arithmetic = false) => planShellReads(text, decl, depth + 1, home === undefined, arithmetic);
     const projected = lexed.segments.map((segment) => projectSegment(segment));
-    const facts = projected.map((p, si) => segmentFacts(lexed.segments[si], p, decl, home, nestedPlan));
+    const planned = projected.map((p, si) => segmentFacts(lexed.segments[si], p, decl, home, nestedPlan));
+    const inert = depth === 0 && unreadable === undefined && planned.every(segmentOpensNothing);
+    const facts = inert ? planned.map((f) => ({ ...f, reads: f.reads.filter((c) => c.provenance !== "env_assignment") })) : planned;
     shape.grouped = projected.some((p) => p.grouped);
     shape.backgrounded = lexed.segments.some((s) => s.connector === "&") || facts.some((f) => f.backgrounds === true);
     shape.strayRedirection = projected.some((p) => p.argv.length === 0 && p.redirects.length > 0);
@@ -165,6 +167,14 @@ export function planShellReads(command, decl, depth = 0, homeRebound = false, ar
     }
     return { segments, shape, ...(unreadable !== undefined ? { unreadable } : {}) };
 }
+function segmentOpensNothing(f) {
+    if (f.empty)
+        return true;
+    const program = f.verb;
+    const at = program === undefined ? -1 : f.argv.findIndex((w) => w.folded === program.name);
+    const inertProgram = program === undefined || (program.name === program.basename && INERT_BUILTINS.has(program.basename) && !(DECLARATION_BUILTINS.has(program.basename) && f.argv.slice(at + 1).some((w) => /^[-+]/.test(w.folded))));
+    return inertProgram && f.argv.every((w) => !/[[\]$`]/.test(w.raw)) && f.nested.length === 0 && f.reentry === undefined && f.declines.length === 0 && f.launcherChain.length === 0 && f.redirects.every((r) => r.direction !== "in") && f.reads.every((c) => c.provenance === "env_assignment");
+}
 function projectSegment(segment) {
     const tokens = [...segment.tokens];
     let grouped = tokens.some((t) => t.kind === "group");
@@ -389,6 +399,17 @@ function segmentFactsRead(segment, p, decl, home, nestedPlan) {
     else if (listed) {
         listedVerbCandidates(basename, argReads, reads);
     }
+    else if (DECLARATION_BUILTINS.has(basename) && program.name === basename) {
+        for (const r of argReads) {
+            const a = r.word.assignment;
+            if (a !== undefined && (r.expands !== "unresolvable" || a.value.expansions.length > 0))
+                pushAssignment(reads, r.word, "env_assignment");
+            else if (r.expands === "unresolvable") {
+                reads.push(bare(r, "unlisted_word"));
+                pushAssignment(reads, r.word, "unlisted_word");
+            }
+        }
+    }
     else {
         unlistedWords(reads, toks, program.index, launcherIndices, "unlisted_word", program);
     }
@@ -518,6 +539,7 @@ function unlistedWords(reads, toks, from, launcherIndices, provenance, program)
     const argv = program !== undefined ? { program: program.basename, from: program.index } : argvProgramOf(toks.map((r) => r.word));
     const argvStart = argv?.from ?? toks.length;
     const slotVerb = argv?.program;
+    const message = slotVerb === undefined || argv === undefined ? new Set() : messageSlotWords(slotVerb, toks, argvStart);
     const declaredNotPaths = ASSIGNMENT_VALUE_NOT_PATHS.has(slotVerb ?? "");
     const noPathOperands = slotVerb !== undefined && NO_PATH_OPERAND_COMMANDS.has(slotVerb);
     const permutes = slotVerb === undefined || !verbOptionsArePositionIndependent(slotVerb);
@@ -525,7 +547,7 @@ function unlistedWords(reads, toks, from, launcherIndices, provenance, program)
     for (let j = from; j < toks.length; j++) {
         if (launcherIndices.has(j))
             continue;
-        if (noPathOperands && j > argvStart)
+        if (noPathOperands && j > argvStart && !NO_PATH_OPERAND_EVALUATORS.has(slotVerb))
             break;
         if (toks[j].expands !== "unresolvable")
             continue;
@@ -541,7 +563,7 @@ function unlistedWords(reads, toks, from, launcherIndices, provenance, program)
     let endOfOptions = false;
     let sawArgvOperand = false;
     for (let j = from; j < toks.length; j++) {
-        if (launcherIndices.has(j) || expanding.has(j))
+        if (launcherIndices.has(j) || expanding.has(j) || message.has(j))
             continue;
         const r = toks[j];
         const word = r.folded;

package/dist/tools/fs/shell-read-write-targets.d.ts

@@ -0,0 +1,73 @@
+/**
+ * WRITE TARGETS — which words of a shell segment a program writes, under which names, and at which seat, read off the
+ * plan's text alone (no filesystem): the `>`-family redirections and a `sed` script's `w` files, the operands of the
+ * write commands ({@link SHELL_WRITE_COMMANDS}), a copy's or a move's destination children (GNU's argument grammar), an
+ * in-place `sed`'s backups, and the seat each is written at ({@link WriteSeat}: the directory entry, or where the path
+ * lands). The establisher (`shell-read-establish.ts`) places what this module names; the judge reads the result on the
+ * deny table's write face; the station's `writesPlaced` fact reads the option readers exported here.
+ */
+import type { ReadCandidate, ShellReadSegment } from "./shell-read-plan.js";
+/**
+ * The commands whose operands are WRITE targets — the reference implementation's path-checked commands whose operation
+ * is a write or a create (`mkdir` / `touch` create; `rm` / `rmdir` / `mv` / `cp` / `tee` write; `sed` writes when it
+ * edits in place). Every operand counts (a `cp` source is judged as a write too, as the reference judges it): the write
+ * face only ever REFUSES, so a word read as a target it is not costs a refusal of a command that names a denied path.
+ */
+export declare const SHELL_WRITE_COMMANDS: readonly ["mkdir", "touch", "rm", "rmdir", "mv", "cp", "tee", "sed"];
+/**
+ * Does an option WORD spell this option — the long name or any abbreviation of it GNU getopt accepts (`--in-p`, `--fi`,
+ * `--par`: an unambiguous prefix, `=value` allowed), or the short letter alone or inside a bundle (`-i`, `-ni`, `-i.bak`)?
+ * Read in the tightening direction: a prefix that another long option shares still counts (the program would refuse it).
+ */
+export declare function spellsOption(word: string, long: string, short: string): boolean;
+/** A word of a program's argv: its raw spelling (the plan's candidates are keyed by it) and its folded spelling. */
+export interface ArgWord {
+    readonly raw: string;
+    readonly spelled: string;
+}
+/** The words a segment hands its program — the argv after the program word (a launcher's own words are not the program's). */
+export declare function programArgs(segment: ShellReadSegment): ArgWord[];
+/** What a `sed` invocation's option words say about writing, under either grammar ({@link SED_GRAMMARS}): whether it edits
+ *  in place (`-i` / `-I` / `--in-place`), the backup suffixes it is given (their values; an empty value keeps no backup),
+ *  and whether GNU `--follow-symlinks` is on. */
+export interface SedOptions {
+    readonly inPlace: boolean;
+    readonly suffixes: readonly string[];
+    readonly followsLinks: boolean;
+}
+export declare function sedOptionsOf(segment: ShellReadSegment): SedOptions;
+/**
+ * The BACKUP names an in-place `sed` gives the file it knows as `name` — both readings a suffix has: GNU sed replaces every
+ * `*` in the suffix with the name (`bak/*` on `d/f` is `bak/d/f`, `/elsewhere/*` is `/elsewhere/d/f`) and appends a suffix
+ * without one (`d/f.bak`); the BSD and BusyBox seds append the suffix literally (`d/f` + `bak/*`). A name resolves against
+ * the working directory like the operand itself, so a suffix carrying a separator places the backup wherever it points.
+ */
+export declare function sedBackupNames(name: string, suffix: string): string[];
+/**
+ * WHERE a write reaches a path it names. `landing` — the path followed through every link to where it lands: the program
+ * opens the path and writes through it. `entry` — the directory entry itself, the canonical parent joined with the last
+ * name: the program renames over the entry, unlinks it or replaces it, and a link there is not followed (a name ending in
+ * a separator, `.` or `..` resolves itself, so it lands).
+ */
+export type WriteSeat = "landing" | "entry";
+/** One candidate handed to the judge. `seats`: where a write target is established ({@link WriteSeat}; absent ⇒ it lands —
+ *  every read does). `written`: the seats among `seats` the program itself WRITES the target at (absent ⇒ all of them;
+ *  `[]` ⇒ none — a copy's source, judged on the write face as a write path and read by the program); the write guards are
+ *  asked about these alone. `child`: a copy's or a move's destination child, written only where the destination is a
+ *  directory when the program runs. `followed`: a GNU sed `--follow-symlinks` backup — its names are {@link sedBackupNames}
+ *  of the operand's FOLLOWED name, which only the filesystem answers (the candidate's own spelling is the operand's as
+ *  written, the identity the pre-spawn re-check compares). */
+export interface JudgedCandidate {
+    readonly candidate: ReadCandidate;
+    readonly seats?: readonly WriteSeat[];
+    readonly written?: readonly WriteSeat[];
+    readonly child?: true;
+    readonly followed?: {
+        readonly operand: ReadCandidate;
+        readonly suffix: string;
+    };
+}
+/** Every candidate a segment hands the judge: its reads minus the write targets, plus its `cd` target (the plan already
+ *  lists it among the reads), plus its WRITE targets for the write face ({@link writeTargetsOf}), plus the deny-floor
+ *  shadow of every unplaced home word ({@link denyFloorShadowsOf}) on both faces. */
+export declare function judgedCandidatesOf(segment: ShellReadSegment): readonly JudgedCandidate[];

package/dist/tools/fs/shell-read-write-targets.js

@@ -0,0 +1,173 @@
+import { denyFloorShadowsOf } from "./shell-read-judge.js";
+export const SHELL_WRITE_COMMANDS = ["mkdir", "touch", "rm", "rmdir", "mv", "cp", "tee", "sed"];
+const WRITE_COMMAND_SET = new Set(SHELL_WRITE_COMMANDS);
+export function spellsOption(word, long, short) {
+    if (word.startsWith("--")) {
+        const name = word.slice(2).split("=")[0];
+        return name.length > 0 && long.startsWith(name);
+    }
+    return new RegExp(`^-[A-Za-z]*${short}`).test(word);
+}
+export function programArgs(segment) {
+    const words = segment.argv.map((w) => ({ raw: w.raw, spelled: w.folded }));
+    const at = words.findIndex((w) => w.spelled === segment.verb?.name);
+    return at < 0 ? [] : words.slice(at + 1);
+}
+const SED_GRAMMARS = [
+    { required: "efl", optional: "i", longRequired: ["expression", "file", "line-length"] },
+    { required: "efiI", optional: "" },
+];
+const COPY_GRAMMARS = [
+    { required: "St", optional: "", longRequired: ["target-directory", "suffix", "no-preserve", "sparse"] },
+    { required: "", optional: "" },
+];
+function readArgv(words, grammar) {
+    const options = [];
+    const operands = [];
+    let endOfOptions = false;
+    for (let k = 0; k < words.length; k++) {
+        const w = words[k];
+        const s = w.spelled;
+        if (endOfOptions || !s.startsWith("-") || s === "-") {
+            operands.push(w);
+            continue;
+        }
+        if (s === "--") {
+            endOfOptions = true;
+            continue;
+        }
+        if (s.startsWith("--")) {
+            const eq = s.indexOf("=");
+            const name = s.slice(2, eq < 0 ? undefined : eq);
+            if (grammar.longRequired === undefined || name.length === 0)
+                continue;
+            const value = eq >= 0 ? { raw: w.raw, spelled: s.slice(eq + 1) } : grammar.longRequired.some((long) => long.startsWith(name)) ? words[++k] : undefined;
+            options.push({ name, long: true, ...(value !== undefined ? { value } : {}) });
+            continue;
+        }
+        for (let c = 1; c < s.length; c++) {
+            const letter = s[c];
+            const rest = s.slice(c + 1);
+            if (grammar.required.includes(letter)) {
+                const value = rest.length > 0 ? { raw: w.raw, spelled: rest } : words[++k];
+                options.push({ name: letter, long: false, ...(value !== undefined ? { value } : {}) });
+                break;
+            }
+            if (grammar.optional.includes(letter)) {
+                options.push({ name: letter, long: false, ...(rest.length > 0 ? { value: { raw: w.raw, spelled: rest } } : {}) });
+                break;
+            }
+            options.push({ name: letter, long: false });
+        }
+    }
+    return { options, operands };
+}
+export function sedOptionsOf(segment) {
+    const words = programArgs(segment);
+    let inPlace = false;
+    let followsLinks = false;
+    const suffixes = new Set();
+    for (const grammar of SED_GRAMMARS) {
+        for (const o of readArgv(words, grammar).options) {
+            if (o.long ? "in-place".startsWith(o.name) : o.name === "i" || o.name === "I") {
+                inPlace = true;
+                if (o.value !== undefined && o.value.spelled.length > 0)
+                    suffixes.add(o.value.spelled);
+            }
+            if (o.long && "follow-symlinks".startsWith(o.name))
+                followsLinks = true;
+        }
+    }
+    return { inPlace, suffixes: [...suffixes], followsLinks };
+}
+export function sedBackupNames(name, suffix) {
+    const appended = `${name}${suffix}`;
+    return suffix.includes("*") ? [suffix.replace(/\*/g, () => name), appended] : [appended];
+}
+const OPERAND_SEATS = {
+    touch: (s) => (programArgs(s).some((w) => w.spelled.startsWith("-") && spellsOption(w.spelled, "no-dereference", "h")) ? ["landing", "entry"] : ["landing"]),
+    rm: () => ["entry"],
+    rmdir: () => ["entry"],
+    sed: (s) => (sedOptionsOf(s).followsLinks ? ["landing"] : ["entry"]),
+    mv: () => ["landing", "entry"],
+    cp: () => ["landing", "entry"],
+};
+const SOURCE_WRITTEN = { cp: [], mv: ["entry"] };
+function sedBackupTargets(segment) {
+    const { suffixes, followsLinks } = sedOptionsOf(segment);
+    if (suffixes.length === 0)
+        return [];
+    const files = segment.reads.filter((c) => c.provenance === "operand" && c.expands === false);
+    return files.flatMap((f) => suffixes.flatMap((suffix) => followsLinks
+        ? [{ candidate: { ...f, spelled: `${f.spelled}${suffix}`, face: "write" }, seats: ["entry"], followed: { operand: f, suffix } }]
+        : sedBackupNames(f.spelled, suffix).map((spelled) => ({ candidate: { ...f, spelled, face: "write" }, seats: ["entry"] }))));
+}
+function copyReadingsOf(segment) {
+    const out = [];
+    for (const grammar of COPY_GRAMMARS) {
+        const { options, operands } = readArgv(programArgs(segment), grammar);
+        const sources = [...operands];
+        const dest = options.findLast((o) => o.value !== undefined && (o.long ? "target-directory".startsWith(o.name) : o.name === "t"))?.value ?? sources.pop();
+        if (dest !== undefined)
+            out.push({ dest, sources });
+    }
+    return out;
+}
+function copySourceWordsOf(segment) {
+    const readings = copyReadingsOf(segment);
+    if (readings.length < COPY_GRAMMARS.length || programArgs(segment).some((w) => w.spelled.startsWith("-")))
+        return new Set();
+    const [first, ...rest] = readings.map((r) => new Set(r.sources.map((w) => w.raw)));
+    const dests = new Set(readings.map((r) => r.dest.raw));
+    return new Set([...first].filter((raw) => !dests.has(raw) && rest.every((s) => s.has(raw))));
+}
+function copyDestinationChildren(segment) {
+    const candidateOf = (raw) => segment.reads.find((c) => c.raw === raw && (c.provenance === "unlisted_word" || c.provenance === "operand"));
+    const children = new Map();
+    for (const { dest, sources } of copyReadingsOf(segment)) {
+        const destCandidate = candidateOf(dest.raw);
+        if (destCandidate !== undefined && destCandidate.expands !== false)
+            continue;
+        for (const src of sources) {
+            const source = candidateOf(src.raw);
+            if (source !== undefined && source.expands !== false)
+                continue;
+            const child = `${dest.spelled.replace(/\/+$/, "")}/${src.spelled.replace(/\/+$/, "").split("/").pop() ?? ""}`;
+            if (child.endsWith("/") || children.has(child))
+                continue;
+            children.set(child, destCandidate !== undefined && source !== undefined ? { ...destCandidate, spelled: child } : { spelled: child, raw: src.raw, provenance: "unlisted_word", expands: "unresolvable", bases: [] });
+        }
+    }
+    return [...children.values()];
+}
+function writeTargetsOf(segment) {
+    const out = [];
+    const write = (c, seats, written, child) => void out.push({ candidate: { ...c, face: "write" }, ...(seats !== undefined ? { seats } : {}), ...(written !== undefined ? { written } : {}), ...(child === true ? { child } : {}) });
+    for (const r of segment.redirects)
+        if (r.direction === "out" && r.target !== undefined)
+            write(r.target);
+    for (const c of segment.reads)
+        if (c.provenance === "write_redirect_target")
+            write(c);
+    const verb = segment.verb?.basename;
+    if (verb !== undefined && WRITE_COMMAND_SET.has(verb) && (verb !== "sed" || sedOptionsOf(segment).inPlace)) {
+        const seats = OPERAND_SEATS[verb]?.(segment);
+        const sourceWritten = SOURCE_WRITTEN[verb];
+        const sources = sourceWritten !== undefined ? copySourceWordsOf(segment) : undefined;
+        for (const c of segment.reads)
+            if (c.provenance === "operand" || c.provenance === "unlisted_word" || c.provenance === "option_value")
+                write(c, seats, sources?.has(c.raw) === true ? sourceWritten : undefined);
+        if (verb === "cp" || verb === "mv")
+            for (const c of copyDestinationChildren(segment))
+                write(c, seats, undefined, true);
+        if (verb === "sed")
+            out.push(...sedBackupTargets(segment));
+    }
+    return out;
+}
+export function judgedCandidatesOf(segment) {
+    const reads = segment.reads.filter((c) => c.provenance !== "write_redirect_target");
+    const writes = writeTargetsOf(segment);
+    const plain = (cs) => cs.map((candidate) => ({ candidate }));
+    return [...plain(reads), ...plain(denyFloorShadowsOf(reads)), ...writes, ...plain(denyFloorShadowsOf(writes.map((w) => w.candidate)))];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.33.8",
+  "version": "7.35.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",