@sema-agent/core 7.37.1 → 7.38.1

package/dist/tools/fs/read-deny-home.js

@@ -1,23 +1,106 @@
+import { userInfo } from "node:os";
 import { canonicalizeTarget, isAbsolutePathForm, joinForFamily, normalizeAbsPathLexically, pathFamilyOf } from "./safety.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, withGateTimeout } from "../../core/gate-bounded-await.js";
+import { thrownText } from "../../core/thrown-value.js";
 import { readDenyPatternRun, readDenyRunHead } from "./read-deny.js";
-export function declaredReadDenyHomes(env) {
-    const home = env.homeDir;
-    return home !== undefined && isAbsolutePathForm(home) ? [home] : [];
+export const AUXILIARY_HOME_PROBE_MS = 2_000;
+const said = new Set();
+function sayOnce(kind, line) {
+    if (said.has(kind))
+        return;
+    said.add(kind);
+    try {
+        console.warn(line);
+    }
+    catch {
+    }
 }
-export async function readDenyHomesOf(env, signal) {
-    return (await readDenyHomesAnswered(env, signal)).homes;
+function isNoAccountRow(e) {
+    try {
+        const info = typeof e === "object" && e !== null ? e.info : undefined;
+        return typeof info === "object" && info !== null && info.code === "ENOENT";
+    }
+    catch {
+        return false;
+    }
 }
-async function readDenyHomesAnswered(env, signal) {
-    const home = declaredReadDenyHomes(env)[0];
+function valueText(v) {
+    try {
+        return JSON.stringify(v) ?? String(v);
+    }
+    catch {
+        return typeof v;
+    }
+}
+function accountHomeOf() {
+    try {
+        const home = userInfo().homedir;
+        if (typeof home === "string" && isAbsolutePathForm(home))
+            return { state: "home", home };
+        sayOnce("bad_value", `read-deny homes: the account home lookup answered ${valueText(home)}, not an absolute path — home-anchored read-deny rows are placed under the environment's declared home only.`);
+        return { state: "none" };
+    }
+    catch (e) {
+        if (isNoAccountRow(e))
+            return { state: "none" };
+        sayOnce("unanswered", `read-deny homes: the account home could not be read (${thrownText(e)}) — home-anchored read-deny rows hold their run at every location until the lookup answers.`);
+        return { state: "unanswered" };
+    }
+}
+function declaredHomeOf(env) {
+    const home = env.homeDir;
+    return home !== undefined && isAbsolutePathForm(home) ? home : undefined;
+}
+function declaredReadDenyHomesAnswered(env) {
+    const home = declaredHomeOf(env);
     if (home === undefined)
         return { homes: [], whole: true };
-    const canonical = await env.canonicalPath(home, signal);
-    if (canonical.ok)
-        return { homes: canonical.value !== home ? [home, canonical.value] : [home], whole: true };
-    return { homes: [home], whole: canonical.error.code === "not_found" || canonical.error.code === "not_directory" };
+    const account = accountHomeOf();
+    if (account.state === "unanswered")
+        return { homes: [], whole: false };
+    if (account.state === "none" || normalizeAbsPathLexically(account.home) === normalizeAbsPathLexically(home))
+        return { homes: [home], whole: true };
+    return { homes: [home, account.home], whole: true };
+}
+export function declaredReadDenyHomes(env) {
+    return declaredReadDenyHomesAnswered(env).homes;
+}
+function isDeclared(declared, home) {
+    return declared !== undefined && normalizeAbsPathLexically(home) === normalizeAbsPathLexically(declared);
 }
-export async function readDenyHomeLinksOf(env, entries, homes, signal) {
+async function homeSpellingsOf(env, home, signal) {
+    try {
+        const canonical = await env.canonicalPath(home, signal);
+        if (canonical.ok)
+            return { spellings: canonical.value !== home ? [home, canonical.value] : [home], canonical: canonical.value, answered: true };
+        return { spellings: [home], answered: canonical.error.code === "not_found" || canonical.error.code === "not_directory" };
+    }
+    catch {
+        return { spellings: [home], answered: false };
+    }
+}
+export async function readDenyHomesOf(env, signal) {
+    const listed = declaredReadDenyHomesAnswered(env);
+    const [declared, ...auxiliary] = listed.homes;
+    if (!listed.whole || declared === undefined)
+        return [];
+    const [own, ...others] = await Promise.all([
+        homeSpellingsOf(env, declared, signal),
+        ...auxiliary.map((home) => until(homeSpellingsOf(env, home, signal), Date.now() + AUXILIARY_HOME_PROBE_MS, signal).then((r) => r ?? { spellings: [home], answered: false })),
+    ]);
+    if (!own.answered)
+        return [];
+    if (others.some((r) => !r.answered))
+        sayAuxiliary("its path probe did not answer");
+    return [...new Set([...own.spellings, ...others.flatMap((r) => r.spellings)])];
+}
+async function until(work, deadline, signal) {
+    return await withGateTimeout(work, Math.max(0, deadline - Date.now()), signal, "auxiliaryHome").catch(() => undefined);
+}
+function sayAuxiliary(what) {
+    sayOnce("auxiliary", `read-deny homes: a home beside the environment's declared home did not answer its probes within ${AUXILIARY_HOME_PROBE_MS} ms (${what}) — its home-anchored read-deny rows sit at its spelling only, and a path through an alias of it is judged as spelled, until the next placement.`);
+}
+export async function readDenyHomeLinksOf(env, entries, homes, signal, deadline) {
     const rows = [];
     const familyOf = new Map();
     for (const { pattern, caseSensitive } of entries) {
@@ -35,7 +118,8 @@ export async function readDenyHomeLinksOf(env, entries, homes, signal) {
         });
         rows.push({ pattern, caseSensitive: caseSensitive === true, spelled });
     }
-    const resolved = new Map(await Promise.all([...familyOf].map(async ([at, family]) => [at, await whereItLeads(env, at, family, signal)])));
+    const leadOf = async (at, family) => (await whereItLeads(env, at, family, signal)) ?? ((await holdsNothingBelow(env, at, signal)) ? at : undefined);
+    const resolved = new Map(await Promise.all([...familyOf].map(async ([at, family]) => [at, deadline === undefined ? await leadOf(at, family) : await until(leadOf(at, family), deadline, signal)])));
     const out = new Map();
     const whole = [...resolved.values()].every((location) => location !== undefined);
     for (const { pattern, caseSensitive, spelled } of rows) {
@@ -52,6 +136,10 @@ export async function readDenyHomeLinksOf(env, entries, homes, signal) {
     }
     return { linked: out, whole };
 }
+async function holdsNothingBelow(env, at, signal) {
+    const probe = await withGateTimeout(Promise.resolve().then(() => env.canonicalPath(at, signal)), DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "readDenyHead").catch(() => undefined);
+    return probe !== undefined && !probe.ok && probe.error.code === "not_directory";
+}
 export async function whereItLeads(env, at, family = pathFamilyOf({ root: at }), signal) {
     try {
         const key = await canonicalizeTarget(env, at, signal, family);
@@ -77,17 +165,189 @@ export async function whereItsAnsweredPrefixLeads(env, at, family = pathFamilyOf
     };
     return await withGateTimeout(walk(), DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "ruleRowHead").catch(() => undefined);
 }
+const NO_CHAIN = { ancestors: [], whole: false };
+async function chainAbove(env, identity, canonical, signal, deadline) {
+    let own;
+    const ancestors = [];
+    let whole = true;
+    for (let dir = normalizeAbsPathLexically(canonical), first = true;; first = false) {
+        const id = deadline === undefined ? await identityOf(env, identity, dir, signal) : await until(identityOf(env, identity, dir, signal), deadline, signal);
+        if (id === undefined && deadline !== undefined && Date.now() >= deadline) {
+            whole = false;
+            break;
+        }
+        if (id?.ok !== true)
+            whole = false;
+        else if (first)
+            own = { dir, id: id.value };
+        else
+            ancestors.push({ dir, id: id.value });
+        const parent = normalizeAbsPathLexically(`${dir}/..`);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return { ...(own !== undefined ? { own } : {}), ancestors, whole };
+}
+async function identityOf(env, identity, path, signal) {
+    try {
+        return await identity.call(env, path, signal);
+    }
+    catch {
+        return undefined;
+    }
+}
+async function readAuxiliaryHome(env, home, opts, signal) {
+    const deadline = Date.now() + AUXILIARY_HOME_PROBE_MS;
+    const spelled = await until(homeSpellingsOf(env, home, signal), deadline, signal);
+    let reading;
+    if (spelled?.canonical === undefined) {
+        const answered = spelled?.answered === true;
+        reading = { place: [home], chain: answered ? { ancestors: [], whole: true } : NO_CHAIN, linked: new Map(), answered };
+    }
+    else {
+        const place = spelled.spellings;
+        const identity = env.fileIdentity;
+        const [chain, heads] = await Promise.all([
+            typeof identity === "function" ? chainAbove(env, identity, spelled.canonical, signal, deadline) : Promise.resolve({ ancestors: [], whole: true }),
+            opts.entries !== undefined ? readDenyHomeLinksOf(env, opts.entries, place, signal, deadline) : Promise.resolve({ linked: new Map(), whole: true }),
+        ]);
+        reading = { place, chain, linked: heads.linked, answered: chain.whole && heads.whole };
+    }
+    if (!reading.answered)
+        sayAuxiliary("a probe did not answer");
+    return reading;
+}
+function homeViewSourceOver(env, auxiliary) {
+    const declared = declaredHomeOf(env);
+    const identity = env.fileIdentity;
+    let declaredChain;
+    const readDeclared = () => {
+        if (declared === undefined || typeof identity !== "function")
+            return Promise.resolve(NO_CHAIN);
+        if (declaredChain === undefined) {
+            const reading = withGateTimeout((async () => {
+                const spelled = await homeSpellingsOf(env, declared);
+                return spelled.canonical === undefined ? NO_CHAIN : await chainAbove(env, identity, spelled.canonical);
+            })(), DEFAULT_GATE_AWAIT_TIMEOUT_MS, undefined, "homeChain").catch(() => NO_CHAIN);
+            declaredChain = reading;
+            void reading.then((c) => {
+                if (!c.whole && declaredChain === reading)
+                    declaredChain = undefined;
+            });
+        }
+        return declaredChain;
+    };
+    return {
+        views(signal) {
+            let index;
+            const indexOf = () => (index ??= (async () => {
+                const chains = [await readDeclared(), ...(await Promise.all(auxiliary)).map((a) => a.chain)];
+                const out = new Map();
+                for (const { own } of chains)
+                    if (own !== undefined && !out.has(own.id))
+                        out.set(own.id, own.dir);
+                for (const { ancestors } of chains)
+                    for (const { dir, id } of ancestors)
+                        if (!out.has(id))
+                            out.set(id, dir);
+                return out.size > 0 ? out : undefined;
+            })());
+            const views = new Map();
+            const viewOf = (path, leafIsFile) => {
+                const key = `${leafIsFile ? "f" : "d"}:${path}`;
+                let v = views.get(key);
+                if (v === undefined) {
+                    v = (async () => {
+                        const index = await indexOf();
+                        if (index === undefined || typeof identity !== "function")
+                            return undefined;
+                        if (!leafIsFile) {
+                            const id = await identityOf(env, identity, path, signal);
+                            if (id === undefined)
+                                return undefined;
+                            if (id.ok) {
+                                const at = index.get(id.value);
+                                if (at !== undefined)
+                                    return at;
+                            }
+                            else if (id.error.code !== "not_found" && id.error.code !== "not_directory")
+                                return undefined;
+                        }
+                        const parent = normalizeAbsPathLexically(`${path}/..`);
+                        if (parent === path)
+                            return undefined;
+                        const up = await viewOf(parent, false);
+                        return up === undefined ? undefined : joinForFamily(pathFamilyOf({ root: path }), up, path.slice(parent.length).replace(/^[\\/]+/, ""));
+                    })();
+                    views.set(key, v);
+                }
+                return v;
+            };
+            return {
+                async of(path, opts) {
+                    if (typeof identity !== "function" || (declared === undefined && auxiliary.length === 0) || !isAbsolutePathForm(path))
+                        return undefined;
+                    const spelled = normalizeAbsPathLexically(path);
+                    const view = await viewOf(spelled, opts?.leaf === "file");
+                    return view === undefined || view === spelled ? undefined : view;
+                },
+            };
+        },
+    };
+}
+const PLACEMENT_VIEWS = new WeakMap();
+function placementOf(matcher, homes, linked, whole) {
+    const list = Object.freeze([...homes]);
+    PLACEMENT_VIEWS.set(list, matcher.homeViews);
+    return { matcher, homes: list, linked, whole };
+}
+export function placementViewsOf(homes) {
+    return PLACEMENT_VIEWS.get(homes);
+}
+export function sayPlacementLost() {
+    try {
+        console.warn("read-deny homes: this tool band was handed a home list that is not the placement's own (an engine defect) — its home-anchored read-deny rows hold their run at every location, and only the declared home's views are read.");
+    }
+    catch {
+    }
+}
+export function homeViewsAt(env, homes) {
+    const declared = declaredHomeOf(env);
+    const auxiliary = [...new Set(homes.filter((h) => isAbsolutePathForm(h) && !isDeclared(declared, h)))];
+    return homeViewSourceOver(env, auxiliary.map((home) => readAuxiliaryHome(env, home, {})));
+}
+export function homeViewsOf(env, judge, signal) {
+    return (judge?.homeViews ?? homeViewsAt(env, [])).views(signal);
+}
+export function carryHomeViews(judge, source) {
+    return { ...judge, homeViews: source };
+}
 export async function placeReadDenyAtHome(env, compile, homes, signal) {
-    let at = homes;
-    if (at === undefined) {
-        const answer = await withGateTimeout(readDenyHomesAnswered(env, signal), DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "readDenyHomes");
-        if (!answer.whole)
-            return { matcher: compile([]), homes: [], linked: new Map(), whole: false };
-        at = answer.homes;
+    const entries = compile([]).entries;
+    const declared = declaredHomeOf(env);
+    const heldAnywhere = (whole) => placementOf(carryHomeViews(compile([]), homeViewSourceOver(env, [])), [], new Map(), whole);
+    const listed = homes === undefined ? declaredReadDenyHomesAnswered(env) : { homes, whole: true };
+    if (!listed.whole)
+        return heldAnywhere(false);
+    const own = listed.homes.filter((h) => isDeclared(declared, h));
+    let declaredAt = [];
+    if (own.length > 0) {
+        const ownSpellings = await withGateTimeout(homeSpellingsOf(env, own[0], signal), DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "readDenyHomes");
+        if (!ownSpellings.answered)
+            return heldAnywhere(false);
+        declaredAt = [...new Set([...own, ...ownSpellings.spellings])];
+    }
+    const auxiliary = listed.homes.filter((h) => !isDeclared(declared, h)).map((home) => readAuxiliaryHome(env, home, { entries }, signal));
+    const [heads, readings] = await Promise.all([readDenyHomeLinksOf(env, entries, declaredAt, signal), Promise.all(auxiliary)]);
+    const at = [...new Set([...declaredAt, ...readings.flatMap((r) => r.place)])];
+    const linked = new Map();
+    for (const map of [heads.linked, ...readings.map((r) => r.linked)]) {
+        for (const [pattern, locations] of map)
+            linked.set(pattern, [...new Set([...(linked.get(pattern) ?? []), ...locations])]);
     }
-    const atHomes = compile(at);
-    const { linked, whole } = await readDenyHomeLinksOf(env, atHomes.entries, at, signal);
-    return { matcher: linked.size === 0 ? atHomes : compile(at, linked), homes: at, linked, whole };
+    const matcher = linked.size === 0 ? compile(at) : compile(at, linked);
+    return placementOf(carryHomeViews(matcher, homeViewSourceOver(env, auxiliary)), at, linked, heads.whole);
 }
 export function readDenyPlacedLater(unplaced, place) {
     let current = unplaced;
@@ -108,6 +368,17 @@ export function readDenyPlacedLater(unplaced, place) {
         if (!whole)
             await again();
     };
+    const settled = async () => {
+        if (pending !== undefined)
+            await pending;
+        return current;
+    };
+    const homeViews = {
+        views(signal) {
+            let views;
+            return { of: async (path, opts) => await (await (views ??= settled().then((m) => m.homeViews.views(signal)))).of(path, opts) };
+        },
+    };
     const matcher = {
         get entries() {
             return current.entries;
@@ -125,101 +396,7 @@ export function readDenyPlacedLater(unplaced, place) {
         },
         unexcludableUnder: (scope) => current.unexcludableUnder?.(scope) ?? false,
         rowAtOrBelow: (path) => current.rowAtOrBelow?.(path) ?? null,
+        homeViews,
     };
     return { matcher, ready };
 }
-const HOME_CHAINS = new WeakMap();
-function homeChainOf(env) {
-    const identity = env.fileIdentity;
-    const home = declaredReadDenyHomes(env)[0];
-    if (typeof identity !== "function" || home === undefined)
-        return undefined;
-    let perEnv = HOME_CHAINS.get(env);
-    if (perEnv === undefined)
-        HOME_CHAINS.set(env, (perEnv = new Map()));
-    const known = perEnv;
-    let chain = known.get(home);
-    if (chain === undefined) {
-        const reading = withGateTimeout((async () => {
-            const canonical = await env.canonicalPath(home);
-            if (!canonical.ok)
-                return { index: undefined, whole: false };
-            const out = new Map();
-            let whole = true;
-            for (let dir = normalizeAbsPathLexically(canonical.value);;) {
-                const id = await identityOf(env, identity, dir);
-                if (id?.ok === true) {
-                    if (!out.has(id.value))
-                        out.set(id.value, dir);
-                }
-                else
-                    whole = false;
-                const parent = normalizeAbsPathLexically(`${dir}/..`);
-                if (parent === dir)
-                    break;
-                dir = parent;
-            }
-            return { index: out.size > 0 ? out : undefined, whole };
-        })(), DEFAULT_GATE_AWAIT_TIMEOUT_MS, undefined, "homeChain").catch(() => ({ index: undefined, whole: false }));
-        chain = reading;
-        known.set(home, reading);
-        const drop = () => {
-            if (known.get(home) === reading)
-                known.delete(home);
-        };
-        void reading.then((c) => (c.whole ? undefined : drop()));
-    }
-    return chain.then((c) => c.index);
-}
-async function identityOf(env, identity, path, signal) {
-    try {
-        return await identity.call(env, path, signal);
-    }
-    catch {
-        return undefined;
-    }
-}
-export function homeViewsOf(env, signal) {
-    const chain = homeChainOf(env);
-    const identity = env.fileIdentity;
-    const views = new Map();
-    const viewOf = (path, leafIsFile) => {
-        const key = `${leafIsFile ? "f" : "d"}:${path}`;
-        let v = views.get(key);
-        if (v === undefined) {
-            v = (async () => {
-                const index = await chain;
-                if (index === undefined || typeof identity !== "function")
-                    return undefined;
-                if (!leafIsFile) {
-                    const id = await identityOf(env, identity, path, signal);
-                    if (id === undefined)
-                        return undefined;
-                    if (id.ok) {
-                        const at = index.get(id.value);
-                        if (at !== undefined)
-                            return at;
-                    }
-                    else if (id.error.code !== "not_found" && id.error.code !== "not_directory")
-                        return undefined;
-                }
-                const parent = normalizeAbsPathLexically(`${path}/..`);
-                if (parent === path)
-                    return undefined;
-                const up = await viewOf(parent, false);
-                return up === undefined ? undefined : joinForFamily(pathFamilyOf({ root: path }), up, path.slice(parent.length).replace(/^[\\/]+/, ""));
-            })();
-            views.set(key, v);
-        }
-        return v;
-    };
-    return {
-        async of(path, opts) {
-            if (chain === undefined || !isAbsolutePathForm(path))
-                return undefined;
-            const spelled = normalizeAbsPathLexically(path);
-            const view = await viewOf(spelled, opts?.leaf === "file");
-            return view === undefined || view === spelled ? undefined : view;
-        },
-    };
-}

package/dist/tools/fs/read-deny.d.ts

@@ -392,8 +392,8 @@ export declare function checkedReadDenyHomes(homes: unknown, seat?: string): rea
  * layer or knob.
  *
  * `homes` — the spellings of the execution environment's home directory a home-anchored entry
- * ({@link READ_DENY_HOME_WORD}) is placed under: the declared home and, where the environment's canonical
- * spelling differs, that one too (the faces judge canonical keys beside the spelled views). Absolute
+ * ({@link READ_DENY_HOME_WORD}) is placed under: the declared home, the account home and, where the environment's
+ * canonical spelling of one differs, that one too (the faces judge canonical keys beside the spelled views). Absolute
  * spellings only — any other shape refuses loudly, naming `readDenyHomes`. EMPTY = the environment declares no
  * home: a home-anchored entry then matches its run anywhere — a row that cannot be placed holds wider, never narrower.
  *

package/dist/tools/fs/read-deny.js

@@ -11,7 +11,7 @@ export function readDenyRunHead(run) {
     const wild = segments.findIndex((seg) => seg.includes("*"));
     return wild === -1 ? segments.length : wild;
 }
-export const DENY_FACES = ["read", "write"];
+export const DENY_FACES = Object.freeze(["read", "write"]);
 export async function withRuleRowsWhereTheyLead(rows, leadsTo) {
     const leads = new Map();
     const partsOf = (head) => {
@@ -144,7 +144,7 @@ export function elideMiddle(s, budget) {
     const head = Math.ceil(keep / 2);
     return `${sliceHeadSafe(s, head)}\u2026${sliceTailSafe(s, keep - head)}`;
 }
-export const READ_DENY_BUILTIN_TIERS = ["credentials", "shell-history", "browser", "wallet", "agent-config"];
+export const READ_DENY_BUILTIN_TIERS = Object.freeze(["credentials", "shell-history", "browser", "wallet", "agent-config"]);
 export const READ_FACE_BUILTIN_DENY_TABLE = [
     { pattern: ".ssh", tier: "credentials" },
     { pattern: "id_rsa*", tier: "credentials" },

package/dist/tools/fs/safety.d.ts

@@ -1,3 +1,4 @@
+import { type HomeViewSource } from "./read-deny-home.js";
 import type { AssertAllKeysHandled } from "../../core/ask-origin.js";
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { protectivePathTargetOf, type ToolCallLike } from "../../core/tool-registry.js";
@@ -449,6 +450,7 @@ export type RootsSeat = readonly string[] | (() => readonly string[] | undefined
  */
 export declare function resolveKey(env: ExecutionEnv, rootCanonical: string, path: string, signal?: AbortSignal, baseCwd?: string, additionalRoots?: RootsSeat, exactFileReadExemption?: (canonicalKey: string) => boolean, readDeny?: {
     readonly face?: "write";
+    readonly homeViews?: HomeViewSource;
     matchTarget(canonicalKey: string, lexicalView?: string, opts?: {
         readonly aliasResolved?: boolean;
     }): {

package/dist/tools/fs/safety.js

@@ -312,7 +312,7 @@ export function isUncSpelling(p) {
 export function isAbsoluteForFamily(family, p) {
     return family === "win" ? /^[A-Za-z]:[\\/]/.test(p) || isUncSpelling(p) : p.startsWith("/");
 }
-export const WIN32_NAMESPACE_REFUSALS = ["device_namespace", "unmappable_namespace", "unc_on_posix_tree", "drive_relative"];
+export const WIN32_NAMESPACE_REFUSALS = Object.freeze(["device_namespace", "unmappable_namespace", "unc_on_posix_tree", "drive_relative"]);
 export const WIN32_NAMESPACE_REFUSAL_TEXT = {
     device_namespace: "is a Win32 device-namespace path (\\\\.\\ names a raw device object, not a file)",
     unmappable_namespace: "is a Win32 extended-length namespace path with no DOS-path equivalent (only \\\\?\\<drive>: and \\\\?\\UNC\\ forms name files)",
@@ -469,7 +469,7 @@ export async function resolveKey(env, rootCanonical, path, signal, baseCwd, addi
         const judged = { aliasResolved: canon.aliasResolved === true };
         let hit = readDeny.matchTarget(key, lexicalViewOf(path, baseCwd ?? rootCanonical), judged);
         if (hit === null) {
-            const homeView = await homeViewsOf(env, signal).of(key);
+            const homeView = await homeViewsOf(env, readDeny, signal).of(key);
             if (homeView !== undefined)
                 hit = readDeny.matchTarget(key, homeView, judged);
         }

package/dist/tools/fs/search.d.ts

@@ -1,4 +1,5 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
+import { type HomeViewsCarrier } from "./read-deny-home.js";
 /** The JS scanner's own output ceiling, in bytes of emitted content rows. Pinned to the
  *  ripgrep leg's figure ({@link MAX_EXEC_OUTPUT_BYTES}, the exec pipe's rolling-tail bound) so the two
  *  legs cannot disagree about how much one search may return; see the collection site in {@link jsGrep}
@@ -130,7 +131,7 @@ export declare function walk(env: ExecutionEnv, root: string, start: string, ign
     matchPath(path: string): {
         pattern: string;
     } | null;
-}): Promise<WalkResult>;
+} & HomeViewsCarrier): Promise<WalkResult>;
 /** The JS-leg withholding disclosure: an empty result must stay distinguishable from
  *  searched-and-empty, so this note rides EVERY output shape when something was pruned. Distinct from
  *  {@link walkCaveat}: pruning is deliberate withholding, not incompleteness.
@@ -157,8 +158,8 @@ export interface ReadDenyWithheld {
     count?: number;
     patterns?: readonly string[];
 }
-/** The deny judge seam every search leg shares (structural subset of ReadDenyMatcher). */
-export interface ReadDenyJudge {
+/** The deny judge seam every search leg shares (structural subset of ReadDenyMatcher), with its placement's home views. */
+export interface ReadDenyJudge extends HomeViewsCarrier {
     matchPath(path: string): {
         pattern: string;
     } | null;

package/dist/tools/fs/search.js

@@ -228,7 +228,7 @@ export async function walk(env, root, start, ignore, signal, deny) {
     let aborted = false;
     let denyPruned = 0;
     const denyPatterns = [];
-    const views = deny !== undefined ? homeViewsOf(env, signal) : undefined;
+    const views = deny !== undefined ? homeViewsOf(env, deny, signal) : undefined;
     const denyHit = async (path, leaf) => {
         let hit = deny?.matchPath(path);
         if (!hit && views !== undefined) {
@@ -1156,7 +1156,7 @@ function rgRecordAbsolute(base) {
     return (p) => (base === undefined || family === undefined || isAbsoluteForFamily(family, p) ? p : joinForFamily(family, base, p.replace(/^\.[\\/]/, "")));
 }
 async function rgOutputDenyTripwireAt(env, stdout, mode, deny, opts, signal) {
-    const views = homeViewsOf(env, signal);
+    const views = homeViewsOf(env, deny, signal);
     const absolute = rgRecordAbsolute(opts.base);
     const placed = new Map();
     for (const record of parseRgRecords(stdout, mode, opts.dropIncompleteTail === true)) {
@@ -1343,7 +1343,7 @@ export async function runGrepDetailed(env, root, p, signal, deny) {
             return false;
         if (deny.unexcludableUnder(scope))
             return true;
-        const view = await homeViewsOf(env, signal).of(scope);
+        const view = await homeViewsOf(env, deny, signal).of(scope);
         return view !== undefined && deny.unexcludableUnder(view);
     };
     if (!(await unexcludableUnder()) && (await detectRipgrep(env)))

package/dist/tools/fs/shell-read-check.d.ts

@@ -20,6 +20,7 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { violationDetails } from "./safety.js";
 import { type ShellReadPlan } from "./shell-read-plan.js";
+import { type HomeViewSource } from "./read-deny-home.js";
 import { type EstablishedRead, type ShellReadBoundary, type ShellReadDisposition, type ShellReadFinding, type ShellReadSeat } from "./shell-read-judge.js";
 import type { ReadRootGrantCandidate } from "../../core/tool-spec.js";
 import type { ToolCallLike } from "../../core/tool-registry.js";
@@ -145,6 +146,9 @@ export interface ShellReadStationOptions {
     /** `true` ⇔ every root `boundaryOf` returns is already a canonical identity (the Runner's): the station never
      *  re-resolves one, so a root swapped for a link after it was declared or granted cannot bring in the link's target. */
     readonly rootsCanonical?: boolean;
+    /** The home views of the placement the boundary's deny seats were compiled at (read-deny-home.ts) — the Runner's. Absent,
+     *  the declared home alone. */
+    readonly homeViews?: HomeViewSource;
 }
 /** What a consumer hands {@link judgeShellRead}: the command as written, the environment whose filesystem
  *  answers where its words land (symlinks resolved, patterns expanded — a `NodeExecutionEnv` over a real
@@ -191,6 +195,11 @@ export interface ShellReadJudgment {
  * LAXER where only a filesystem sees the escape (an in-root symlink pointing out vouches) and answers a
  * pattern on its spelling alone, so the two diverge in both directions.
  *
+ * A read target is also judged at its HOME VIEW (a path spelled through a firmlink or a bind mount of a home, respelled
+ * at the home): this judgment is its own placement — the views read the environment's declared home and the account
+ * home the account database answers once, for this call (`readDenyHomesOf`'s homes); the account home's probes wait at
+ * most a short bound of their own.
+ *
  * It carries NO deadline. Bounding an environment-facing wait and substituting a fail-closed verdict is the
  * gate FOLD's policy on the gate's one deadline seat; the station has never held one on either entry, and a
  * second default here would decide the same number twice and turn a slow-but-correct filesystem's true

package/dist/tools/fs/shell-read-check.js

@@ -6,6 +6,7 @@ import { NOT_AUTO_ALLOWED, programPositionRefusalSentence, readProgramPosition }
 import { bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
 import { planShellReads } from "./shell-read-plan.js";
 import { createShellReadEstablisher, establishShellReadsLexically } from "./shell-read-establish.js";
+import { declaredReadDenyHomes, homeViewsAt } from "./read-deny-home.js";
 import { programArgs, spellsOption } from "./shell-read-write-targets.js";
 import { allFindings, decideShellRead, denyRowAtOrBelow, foldShellReadFindings, judgeEstablishedPlan, readRootGrantCandidateOf, } from "./shell-read-judge.js";
 import { seatOf } from "../../core/tool-name-readings.js";
@@ -326,7 +327,7 @@ async function runShellReadStation(tool, command, declared, seat, readers, estab
 }
 export async function judgeShellRead(input) {
     const readers = input.readers ?? new Set(bashClassifyDefaultAllow());
-    const run = await runShellReadStation(input.tool ?? "Bash", input.command, input.boundary, input.seat, readers, createShellReadEstablisher(input.env, input.boundary.roots), input.env, input.signal);
+    const run = await runShellReadStation(input.tool ?? "Bash", input.command, input.boundary, input.seat, readers, createShellReadEstablisher(input.env, input.boundary.roots, { homeViews: homeViewsAt(input.env, declaredReadDenyHomes(input.env)) }), input.env, input.signal);
     const offer = normalizeReadRootCandidate(run.verdict.readRootCandidate);
     return {
         plan: run.plan,
@@ -349,7 +350,7 @@ export function createShellReadStation(opts) {
         const key = roots.join("\0");
         let e = establishers.get(key);
         if (e === undefined) {
-            e = createShellReadEstablisher(opts.env, roots, { rootsCanonical: opts.rootsCanonical === true });
+            e = createShellReadEstablisher(opts.env, roots, { rootsCanonical: opts.rootsCanonical === true, ...(opts.homeViews !== undefined ? { homeViews: opts.homeViews } : {}) });
             establishers.set(key, e);
         }
         return e;

package/dist/tools/fs/shell-read-establish.d.ts

@@ -40,6 +40,7 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { ShellReadPlan, ShellReadSegment } from "./shell-read-plan.js";
 import type { EstablishedRead, ShellReadBoundary } from "./shell-read-judge.js";
+import type { HomeViewSource } from "./read-deny-home.js";
 /**
  * How many directories one glob operand (or one traversal root) may enumerate, and how many names it may
  * match, before the leg gives up and answers `unestablishable`.
@@ -82,7 +83,9 @@ export declare function establishShellReadsLexically(plan: ShellReadPlan, bounda
  * The filesystem-resolving establisher for one environment and one root set. `readRoots` are the roots
  * as declared (canonical by contract); they are resolved once more per instance because the comparison is
  * against `realpath` output on both sides — an aliased root would otherwise refuse every read under itself.
+ * `homeViews`: the home views of the placement the deny seats were compiled at (read-deny-home.ts); absent, the declared home's.
  */
 export declare function createShellReadEstablisher(env: ExecutionEnv, readRoots: readonly string[], opts?: {
     readonly rootsCanonical?: boolean;
+    readonly homeViews?: HomeViewSource;
 }): ShellReadEstablisher;

package/dist/tools/fs/shell-read-establish.js

@@ -534,7 +534,7 @@ export function createShellReadEstablisher(env, readRoots, opts) {
             if (lexicalOnly)
                 return establishShellReadsLexically(plan, boundary);
             const roots = await canonicalRoots(signal);
-            return await withHomeViews(env, await establishPlan(plan, { ...boundary, roots }, roots, signal), signal);
+            return await withHomeViews(env, opts, await establishPlan(plan, { ...boundary, roots }, roots, signal), signal);
         },
         reestablish: async (previous, boundary, signal) => {
             if (lexicalOnly)