@sema-agent/core 7.44.0 → 7.46.0

package/dist/core/runner/stream-steer-verb.js

@@ -3,7 +3,7 @@ import { snapshotActorAssertion } from "../../internal/llm.js";
 import { MAX_STEER_INPUT_ID_CHARS } from "../checkpoint-store.js";
 import { formatHookFeedback, hookSeatExpiredError, runHookSeat } from "../hooks.js";
 import { buildHumanInputEvent, frameMidTurnUserInput, projectHumanInput } from "../human-input-projection.js";
-import { isSystemInjectionPriority, steerPriorityOf, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
+import { injectionLaneOf, isSystemInjectionPriority, steerPriorityOf, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
 import { announceAcceptance, armAcceptance, nextHumanInputSeq } from "./steer-admission.js";
@@ -133,7 +133,7 @@ export function streamSteerVerb(input) {
                 const noteOptions = { provenance: "engine-note", callerAuthored: true, parkRecord, ...(actor !== undefined ? { actor } : {}) };
                 if (mintsAFrame)
                     armAcceptance(parkRecord, () => publishQueued(h));
-                if (priority === "later") {
+                if (injectionLaneOf(priority) === "followUp") {
                     await h.harness.followUp(payload, noteOptions);
                     noteAccepted();
                     return;

package/dist/core/runner/sub-agent-deny-lists.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The sub-agent tool lists of one prepared task: the allow advisory for `TaskSpec.agents` and THE judgment of every denied-tools
+ * list a deployment writes — the task's own definitions (`TaskSpec.agents`), the definitions a mounted delegation tool carries
+ * (the `authored` faces — the engine's built-ins name tools of other vocabularies and are not judged) and its tool-level list.
+ * Universe = the task's assembled roster plus every mounted delegation tool's pool, names and aliases; a pool the engine cannot
+ * list (an `extraTools` factory with no declared roster) turns the refusals that need a roster into host notices. A tool's own lists are judged where
+ * the tool is mounted: only a tool a deployment mounted (depth 0) publishes them (`authored`, `agentToolLevelAllowTools`, `agentToolLevelDenyTools`), the
+ * engine's nested copy for a delegated child carries neither.
+ *
+ * Throws `config.agent.unknown_tool` (`refused`, the one site) — synchronous, like the phase that calls it.
+ */
+import type { AgentTool } from "../../internal/harness.js";
+import type { TaskSpec } from "../types.js";
+import type { AnnounceOnceSink } from "./contracts.js";
+/**
+ * The names a definition's denied-tools entries stand for, for a lane that has neither a roster nor a notice sink at the point
+ * it builds its own policy (a workflow leg's agentType): each entry is read by the one reading, so `Tool(content)` denies the
+ * whole tool there too, and an entry that names no tool is refused by the same refusal. The stale-name and told dispositions
+ * need the leg's roster and a sink; the leg's own policy-name audit is what reads them.
+ */
+export declare function deniedToolNamesOf(where: string, value: unknown): string[];
+export interface SubAgentToolListsInput {
+    /** borrowed-readonly — the REBOUND spec: `agents` (the task's definitions) and `tools` (the mounted delegation tools). */
+    spec: Pick<TaskSpec, "agents" | "tools">;
+    /** borrowed-readonly — the FULLY ASSEMBLED mount array (names + aliases = the roster half of the universe). */
+    tools: ReadonlyArray<AgentTool>;
+    /** borrowed-readonly — the once-per-session ledger whose operator sink carries the notices. */
+    onceLedger: Pick<AnnounceOnceSink, "onError">;
+    /** borrowed-readonly — the acquired session's id (operator-line context). */
+    sessionId: string;
+}
+export declare function auditSubAgentToolLists(input: SubAgentToolListsInput): void;

package/dist/core/runner/sub-agent-deny-lists.js

@@ -0,0 +1,121 @@
+import { notAListSentence, notAStringSentence, readDeniedEntry, readToolNameList, valueTypeLabel } from "../../agents/tool-filter.js";
+import { compileAllowList, inertEntryPhrase, renderListEntry } from "../allow-entry.js";
+import { inlineUntrusted } from "../untrusted-text.js";
+const DENY_LIST_NAMES_ONLY = "To block by path or command, write a deny rule in the caller's permission policy: a denied-tools list only takes tool names (it narrows which tools the agent is handed).";
+function refused(message) {
+    const e = new Error(message);
+    e.code = "config.agent.unknown_tool";
+    return e;
+}
+function refusal(where, flaw) {
+    return refused(`${where} declares tool ${inertEntryPhrase(flaw)} in its denied tools, but no tool of that spelling exists in this deployment — fix the entry or mount the tool.${flaw.reason === "grammar" ? ` ${DENY_LIST_NAMES_ONLY}` : ""}`);
+}
+function refusalNotAString(where, side, index, type) {
+    return refused(notAStringSentence(where, side, index, type));
+}
+function refusalNotAList(where, side, list) {
+    return refused(notAListSentence(where, side, list));
+}
+export function deniedToolNamesOf(where, value) {
+    const list = readToolNameList(value);
+    if (list.kind !== "entries")
+        throw refusalNotAList(where, "denied", list);
+    return list.entries.map((entry, index) => {
+        if (entry === "*")
+            return entry;
+        const read = readDeniedEntry(entry);
+        if (read.kind === "not_a_string")
+            throw refusalNotAString(where, "denied", index, read.type);
+        const flaw = compileAllowList([read.name], "deny").inert[0];
+        if (flaw !== undefined && flaw.reason === "grammar")
+            throw refusal(where, { ...flaw, entry: read.name });
+        return read.name;
+    });
+}
+function judgeDeniedToolNames(where, value, universe, advise) {
+    if (value === undefined || value === null)
+        return;
+    const list = readToolNameList(value);
+    if (list.kind !== "entries")
+        throw refusalNotAList(where, "denied", list);
+    let index = -1;
+    for (const entry of list.entries) {
+        index += 1;
+        if (entry === "*")
+            continue;
+        const read = readDeniedEntry(entry);
+        if (read.kind === "not_a_string")
+            throw refusalNotAString(where, "denied", index, read.type);
+        const { name, content } = read;
+        const raw = entry;
+        const { rows, inert } = compileAllowList([name], "deny", universe.known);
+        const flaw = inert[0] === undefined ? undefined : { ...inert[0], entry: raw };
+        const stale = flaw !== undefined && (flaw.reason === "tool_name" || flaw.reason === "near_miss");
+        if (flaw !== undefined && (flaw.reason === "grammar" || (stale && universe.complete)))
+            throw refusal(where, flaw);
+        if (flaw === undefined && universe.known.has(name)) {
+            if (content)
+                advise(new Error(`${where} declares ${renderListEntry(raw)} in its denied tools: this list reads tool names, not content, so the whole tool "${inlineUntrusted(name, 80)}" is denied to the agent. ${DENY_LIST_NAMES_ONLY}`));
+            continue;
+        }
+        advise(new Error(`${where} declares tool ${flaw !== undefined ? inertEntryPhrase(flaw) : renderListEntry(raw)} in its denied tools, a name this task's roster and delegation pools do not carry — the entry hides nothing here. Advisory only: a list shared across deployments is not wrong because one lacks a tool, but a misspelling guards nothing.` +
+            (rows[0]?.compiled.kind === "namespace" ? " This list matches tool names exactly: a server-level entry hides none of that server's tools; name them, or write a deny rule in the caller's permission policy." : "") +
+            (universe.complete ? "" : " A delegation tool this task mounts injects tools the engine cannot enumerate (extraTools), so the name cannot be checked here.")));
+    }
+}
+function judgeAllowedToolList(where, value, known, advise) {
+    if (value === undefined || value === null)
+        return;
+    const list = readToolNameList(value);
+    if (list.kind !== "entries")
+        throw refusalNotAList(where, "allowed", list);
+    const unknownNames = [];
+    let index = -1;
+    for (const entry of list.entries) {
+        index += 1;
+        if (typeof entry !== "string")
+            throw refusalNotAString(where, "allowed", index, valueTypeLabel(entry));
+        if (known !== undefined && entry !== "*" && !known.has(entry))
+            unknownNames.push(entry);
+    }
+    if (unknownNames.length === 0)
+        return;
+    advise(new Error(`${where} allows tool(s) ${unknownNames.map(renderListEntry).join(", ")} not present in this task's assembled roster — likely a typo (the entry would be item-filtered at spawn; the agent stays usable). Advisory only: the delegation pool can differ from this roster, so a tool mounted only on the delegation tool or produced by per-spawn extraTools makes this spurious.`));
+}
+export function auditSubAgentToolLists(input) {
+    const { spec, tools, onceLedger, sessionId } = input;
+    const advise = (err) => {
+        try {
+            onceLedger.onError(err, { phase: "config", sessionId });
+        }
+        catch {
+        }
+    };
+    const delegationTools = (spec.tools ?? []).filter((t) => t.agentToolFaces !== undefined);
+    const taskAgents = spec.agents ?? [];
+    if (taskAgents.length === 0 && delegationTools.length === 0)
+        return;
+    const known = new Set(tools.flatMap((t) => [t.name, ...(t.aliases ?? [])]));
+    const denyKnown = new Set(known);
+    for (const t of delegationTools)
+        for (const p of t.agentToolPool ?? [])
+            for (const n of [p.name, ...(p.aliases ?? [])])
+                denyKnown.add(n);
+    const universe = { known: denyKnown, complete: delegationTools.every((t) => t.agentToolPool !== undefined) };
+    for (const def of taskAgents) {
+        judgeAllowedToolList(`TaskSpec.agents: agent "${def.name}"`, def.allowTools, known, advise);
+        judgeDeniedToolNames(`TaskSpec.agents: agent "${def.name}"`, def.denyTools, universe, advise);
+    }
+    const replaced = new Set(taskAgents.map((d) => d.name));
+    for (const t of delegationTools) {
+        for (const face of t.agentToolFaces ?? []) {
+            if (face.authored === true && !replaced.has(face.name)) {
+                const faceWhere = `delegation tool "${t.name}": agent definition "${face.name}"`;
+                judgeAllowedToolList(faceWhere, face.allowTools, undefined, advise);
+                judgeDeniedToolNames(faceWhere, face.denyTools, universe, advise);
+            }
+        }
+        judgeAllowedToolList(`delegation tool "${t.name}": the tool-level list`, t.agentToolLevelAllowTools, undefined, advise);
+        judgeDeniedToolNames(`delegation tool "${t.name}": the tool-level list`, t.agentToolLevelDenyTools, universe, advise);
+    }
+}

package/dist/core/runner/synthetic-tools.d.ts

@@ -110,7 +110,7 @@ export interface SkillListingEntry {
  *  and the tool, so what the prompt promises is exactly what the tool serves. Each field is READ ONCE, BY NAME, and
  *  both consumers see the copy: the gate screens this list while the invoke substitutes from it, so a `get baseDir()`
  *  answering those two reads differently passed a screen that measured a value the model never received — and a rest
- *  copy would silently drop an INHERITED or non-enumerable list, i.e. lose a skill's grant or its refusals. */
+ *  copy would silently drop an INHERITED or non-enumerable list. The two tables are read by {@link readSkillTable}. */
 export declare function normalizeSkills(skills: SkillLike[] | undefined): SkillLike[];
 /** [c209-C] The skills listing's lead line — single-sourced so the run loop's durable-resume
  *  transcript probe (MED-3② skills arm, runtask) matches EXACTLY what the initial frame carries

package/dist/core/runner/synthetic-tools.js

@@ -2,7 +2,7 @@ import { Type } from "typebox";
 import { defineTool } from "../tools.js";
 import { sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
 import { SKILL_LISTING_DEFAULT_BUDGET, SKILL_LISTING_DESC_MAX_CHARS_DEFAULT } from "../skill-listing-budget.js";
-import { skillNamedBy } from "../skill-grant.js";
+import { readSkillTable, skillNamedBy } from "../skill-grant.js";
 import { toolFace } from "../tool-catalog-entries.js";
 import { substituteSkillRoot, substituteSkillRootBounded } from "./skill-base-dir.js";
 import { foldListingWithin } from "./listing-fold.js";
@@ -116,7 +116,8 @@ export function normalizeSkills(skills) {
             seen.add(s.name);
             const { name, description, content, allowedTools, disallowedTools, files, baseDir, ...rest } = s;
             void rest;
-            out.push({ name, description, content, ...(allowedTools !== undefined ? { allowedTools: [...allowedTools] } : {}), ...(disallowedTools !== undefined ? { disallowedTools: [...disallowedTools] } : {}), ...(files !== undefined ? { files } : {}), ...(baseDir !== undefined ? { baseDir } : {}) });
+            const [allowed, denied] = [readSkillTable(allowedTools), readSkillTable(disallowedTools)];
+            out.push({ name, description, content, ...(allowed !== undefined ? { allowedTools: allowed } : {}), ...(denied !== undefined ? { disallowedTools: denied } : {}), ...(files !== undefined ? { files } : {}), ...(baseDir !== undefined ? { baseDir } : {}) });
         }
     }
     return out.toSorted((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));

package/dist/core/runner/write-protection-station.d.ts

@@ -33,8 +33,9 @@ export interface LegWriteProtection extends WriteProtectionMount {
 export declare function mountWriteProtection(input: {
     /** borrowed-readonly — the deployment seats: the table (`writeProtectedPaths`; absent ⇒ the default
      *  table, `[]` ⇒ opted out), the data root the memory library is materialized under
-     *  (`memoryEngineDir`; absent ⇒ the resolver's env/default chain) and the operator sink. */
-    deps: Pick<RunnerDeps, "writeProtectedPaths" | "memoryEngineDir" | "onNotice">;
+     *  (`memoryEngineDir`; absent ⇒ the resolver's env/default chain), the configuration root the host
+     *  declared (`agentConfigDir`) and the operator sink. */
+    deps: Pick<RunnerDeps, "writeProtectedPaths" | "memoryEngineDir" | "agentConfigDir" | "onNotice">;
     /** The HANDS' environment, or `undefined` with no hands — the driver's own predicate, not a second
      *  reading of the env seats, so the judge sees exactly the environment the write tools do. */
     env: ExecutionEnv | undefined;

package/dist/core/runner/write-protection-station.js

@@ -6,6 +6,7 @@ export function mountWriteProtection(input) {
     const announced = new Set();
     const matcher = compileWriteProtection(input.deps.writeProtectedPaths, {
         ...(input.deps.memoryEngineDir !== undefined ? { dataRoot: input.deps.memoryEngineDir } : {}),
+        ...(input.deps.agentConfigDir !== undefined ? { agentConfigDir: input.deps.agentConfigDir } : {}),
         ...(input.env !== undefined ? { env: input.env } : {}),
         rootPath: input.rootPath,
         onViewAbsent: (absence) => {

package/dist/core/runner-deps.d.ts

@@ -227,6 +227,20 @@ export interface RunnerDeps {
      * ignored). Same deployment-only seat, clamp argument and checkpoint posture as the tiers key.
      */
     readDenyBuiltinExclude?: readonly string[];
+    /**
+     * Where the host keeps the agent's configuration directory when it is not `<home>/.sema` — an ABSOLUTE path of an
+     * existing directory, resolved by the host (the engine reads no environment variable for it). The rows of the
+     * `agent-config` tier that name that directory (`~/.sema/settings.json`, `~/.sema/settings.local.json`,
+     * `~/.sema/engine-data/.env`, `~/.sema/config-lkg-*.json`) are then ALSO placed at the same files below this root, so the model can neither read
+     * nor (through the write-protection table and a wired `createSensitivePathPolicy({ agentConfigDir })`) rewrite the
+     * relocated settings; the default `~/.sema` location stays refused. Rows of the home's dotted family (`~/.sema.*`)
+     * and the external tools' files are not part of the directory and stay anchored at the home. A symlink the root is
+     * reached through is followed (the target is guarded too). ABSENT = today's behaviour, the literal `~/.sema` under
+     * the declared and account homes. A value that is not a string, is empty or relative, or names no existing directory
+     * refuses `new Runner` with `config.agent_config_dir_invalid` — never read as absent. DEPLOYMENT seat only (no
+     * TaskSpec twin) and fixed at construction: `swapDeps` does not carry it.
+     */
+    agentConfigDir?: string;
     /**
      * backlog #286 (#279 — CC 2.1.233 `DANGEROUS_FILES`/`DANGEROUS_DIRECTORIES`/
      * `DANGEROUS_DIRECTORY_PATHS` parity): the WRITE-protection table. DEFAULT-ON: a path-confinable

package/dist/core/sensitive-path-policy.d.ts

@@ -155,6 +155,14 @@ export declare function createSensitivePathPolicy(opts: {
      * gate and the transcript gate keep speaking about the same directory.
      */
     dataRoot?: string;
+    /**
+     * The host's configuration root when it keeps the agent's configuration directory somewhere other than the home's
+     * `.sema` — the same absolute directory it hands the Runner (`RunnerDeps.agentConfigDir`). Every pattern that opens with
+     * the `.sema` segment (`.sema/settings.json`, `.sema/hooks`, …) then also guards the same tail below this root; the
+     * patterns themselves keep guarding every `.sema` anywhere. Absent ⇒ the list is judged as it stands. A value that is not
+     * the absolute path of an existing directory throws (`config.agent_config_dir_invalid`).
+     */
+    agentConfigDir?: string;
     /** Override the guarded tool set (default: `Write`, `Edit`, `MultiEdit`-legacy → Edit, `NotebookEdit`). */
     tools?: string[];
 }): ToolPolicy;

package/dist/core/sensitive-path-policy.js

@@ -2,6 +2,7 @@ import { homedir } from "node:os";
 import { isAbsolute, join, resolve } from "node:path";
 import { canonicalizeTarget, expandHomeTilde, isAbsoluteForFamily, isWinFormPath, pathFamilyOf, writeTargetPath } from "../tools/fs/safety.js";
 import { compileSegmentPattern, matchSegmentPatterns, READ_FACE_BUILTIN_DENY_TABLE, readDenyPatternRun } from "../tools/fs/read-deny.js";
+import { agentConfigDirSegments, agentConfigDirTail, checkedAgentConfigDir } from "./agent-config-dir.js";
 import { isProtectedWrite, protectivePathTargetOf } from "./tool-registry.js";
 import { pathTargetBaseOf } from "./effective-path-target.js";
 import { symlinkChainHops } from "./path-identity.js";
@@ -32,6 +33,7 @@ export const RECOMMENDED_SENSITIVE_PATTERNS = [
     ".mcp.json",
     ".ai-agent/.env",
     ".sema/engine-data/.env",
+    ".sema/config-lkg-*.json",
     ".codex/config.toml",
     ".cursor/mcp.json",
     ".continue/config.json",
@@ -115,6 +117,19 @@ function matchSensitive(canonicalKey, compiled, aliasResolved) {
 }
 export function createSensitivePathPolicy(opts) {
     const compiled = compilePatterns(opts.patterns);
+    const configRoot = checkedAgentConfigDir(opts.agentConfigDir, "createSensitivePathPolicy agentConfigDir");
+    const configRows = configRoot === undefined ? [] : opts.patterns.flatMap((raw) => {
+        const tail = agentConfigDirTail(raw, !CASE_INSENSITIVE_FS);
+        return tail === undefined ? [] : [{ raw, tail }];
+    });
+    const configTwins = async (signal) => {
+        if (configRoot === undefined || configRows.length === 0)
+            return [];
+        const fold = CASE_INSENSITIVE_FS ? "ascii" : "none";
+        const lower = (segs) => (CASE_INSENSITIVE_FS ? segs.map((seg) => seg.replace(/[A-Z]/g, (c) => c.toLowerCase())) : segs);
+        const anchors = [configRoot, ...(await canonicalDataRootKeys(opts.env, [configRoot], signal))].map((root) => lower(agentConfigDirSegments(root)));
+        return configRows.map(({ raw, tail }) => ({ ...(compileSegmentPattern(tail, fold) ?? { raw, segments: [], foldAscii: CASE_INSENSITIVE_FS }), raw, anchors, rootedOnly: true }));
+    };
     const dataRootPaths = dataRootSpellings(opts.dataRoot);
     const guardedByName = opts.tools !== undefined ? new Set(opts.tools) : undefined;
     const family = (cwd) => pathFamilyOf({ root: opts.rootPath, cwd: cwd ?? opts.env.cwd });
@@ -130,12 +145,13 @@ export function createSensitivePathPolicy(opts) {
         }
         if (relative === "")
             return { kind: "clear" };
-        const hit = matchSensitive(relative ?? canon.key, compiled, canon.aliasResolved === true);
+        const twins = await configTwins(signal);
+        const hit = matchSensitive(relative ?? canon.key, [...compiled, ...twins], canon.aliasResolved === true);
         if (hit)
             return { kind: "hit", pattern: hit, via: "target" };
         if (relative === null) {
             for (const hop of await symlinkChainHops(opts.env, path, signal, fam, base)) {
-                const viaHop = matchSensitive(hop, compiled, false);
+                const viaHop = matchSensitive(hop, [...compiled, ...twins], false);
                 if (viaHop)
                     return { kind: "hit", pattern: viaHop, via: "chain" };
             }

package/dist/core/session-policy-store.d.ts

@@ -52,12 +52,16 @@ export interface PutRulesOptions {
      *  this from a verified, role-checked principal (mirrors `steer.trusted`). */
     operator?: boolean;
 }
-/** The {@link SessionPolicyError.detail} of a tool-name refusal: which bucket, which entry, the judgment's word, and the
- *  spelling to write instead when the judgment has one (a retired name's 1:1 successor, an unmintable segment's minted name). */
+/** The {@link SessionPolicyError.detail} of a tool-name refusal: which bucket, which entry, the judgment's word, the judgment's
+ *  one-line sentence when it has one, and the spelling to write instead when the judgment has one (a retired name's 1:1
+ *  successor, an unmintable segment's minted name). */
 export interface SessionRuleNameRefusal {
     field: SessionRuleToolNameField;
     name: string;
     verdict: Exclude<RuleToolNameVerdict["kind"], "current">;
+    /** The `guidance` of the judgment ({@link judgeRuleToolName}), byte for byte — the same string the refusal's sentence quotes. Present for
+     *  `retired` and `unmintable_segment`, the two verdicts that carry one; absent for `unprefixed_namespace`, whose judgment has no sentence of its own. */
+    guidance?: string;
     currentName?: string;
 }
 /** Typed error from {@link SessionPolicyStore.putRules}. `conflict` = stale `expectedRev`; `loosen_forbidden`

package/dist/core/session-policy-store.js

@@ -41,6 +41,7 @@ export function assertSessionRuleNamesCurrent(rules, mountedToolNames = NO_DECLA
                 continue;
             const quoted = JSON.stringify(name);
             const successor = verdict.kind === "unprefixed_namespace" ? undefined : verdict.currentName;
+            const guidance = verdict.kind === "unprefixed_namespace" ? undefined : verdict.guidance;
             let message;
             switch (verdict.kind) {
                 case "retired":
@@ -57,7 +58,7 @@ export function assertSessionRuleNamesCurrent(rules, mountedToolNames = NO_DECLA
                     return exhaustive;
                 }
             }
-            throw new SessionPolicyError("legacy_tool_name", message, { field, name, verdict: verdict.kind, ...(successor !== undefined ? { currentName: successor } : {}) });
+            throw new SessionPolicyError("legacy_tool_name", message, { field, name, verdict: verdict.kind, ...(guidance !== undefined ? { guidance } : {}), ...(successor !== undefined ? { currentName: successor } : {}) });
         }
     }
 }

package/dist/core/shell-wrapper-projection.d.ts

@@ -0,0 +1,11 @@
+import type { ShellWrapperRow } from "./shell-wrapper-table.js";
+/**
+ * The PROJECTION {@link import("./shell-wrapper-table.js").SHELL_WRAPPER_TABLE} is: the second lexer's view of the program read model's rows (`program-read-model.ts`
+ * — one table of program facts, read through the binary gate). A launcher row's options by arity (a value word, a
+ * switch or an attached-only value, a command string), its required operand (a duration, or the spelling it must have),
+ * its bare-dash switch and its `NAME=value` operands; a row that runs its operands, or a code body, as shell input
+ * (`viaShell`); an option that runs a command (`executes`). The table is this projection written out (its
+ * literal type is the export's), and `test/shell-wrapper-table-projection.test.ts` pins it equal — a launcher fact is
+ * edited in its row, never here.
+ */
+export declare function shellWrapperProjection(): Record<string, ShellWrapperRow>;

package/dist/core/shell-wrapper-projection.js

@@ -0,0 +1,56 @@
+import { programRows } from "../tools/fs/program-read-model.js";
+import { DURATION_SPELLING } from "../tools/fs/program-read-model.rows.js";
+export function shellWrapperProjection() {
+    const out = {};
+    for (const row of programRows()) {
+        const projected = projectRow(row);
+        if (projected !== undefined)
+            out[row.key] = projected;
+    }
+    return out;
+}
+function spellings(row) {
+    const out = new Map();
+    for (const g of row.grammars) {
+        const add = (spelling, spec) => {
+            const e = out.get(spelling) ?? { spec, arities: new Set() };
+            e.arities.add(spec.arity);
+            out.set(spelling, e);
+        };
+        for (const [l, spec] of Object.entries(g.short))
+            add(`-${l}`, spec);
+        for (const [n, spec] of Object.entries(g.long))
+            add(`--${n}`, spec);
+        for (const [n, spec] of Object.entries(g.dashWords ?? {}))
+            add(`-${n}`, spec);
+    }
+    return [...out].map(([spelling, e]) => ({ spelling, spec: e.spec, arity: e.arities.size === 1 ? [...e.arities][0] : "disputed" }));
+}
+const runsCommand = (spec) => spec.effect === "executes" || spec.value?.kind === "shell-text" || spec.value?.kind === "command";
+function projectRow(row) {
+    const sorted = (xs) => [...new Set(xs)].sort();
+    const all = spellings(row);
+    const viaShell = row.reentry?.kind === "shell" || row.launcher?.shellText === true || row.body === "first-operand" || row.body === "assignment-values" || (row.operands?.rest?.kind === "program-text" && row.operands.rest.language === "arithmetic");
+    if (row.launcher === undefined) {
+        if (viaShell)
+            return { valueFlags: [], flags: [], commandString: [], viaShell: true };
+        const executes = sorted(all.filter((o) => runsCommand(o.spec)).map((o) => o.spelling));
+        return executes.length > 0 ? { valueFlags: [], flags: [], commandString: [], executes } : undefined;
+    }
+    const commandString = sorted(all.filter((o) => o.spec.value?.kind === "shell-text").map((o) => o.spelling));
+    const values = all.filter((o) => o.spec.value?.kind !== "shell-text");
+    const attached = sorted(values.filter((o) => o.arity === "attached" && !o.spelling.startsWith("--")).map((o) => o.spelling));
+    const required = row.launcher.requiredOperands ?? 0;
+    const duration = required > 0 && row.launcher.requiredOperandSpelling === DURATION_SPELLING;
+    return {
+        valueFlags: sorted(values.filter((o) => o.arity === 1).map((o) => o.spelling)),
+        flags: sorted(values.filter((o) => o.arity === 0 || (o.arity === "attached" && o.spelling.startsWith("--"))).map((o) => o.spelling)),
+        ...(attached.length > 0 ? { attached } : {}),
+        commandString,
+        ...(required > 0 && !duration ? { positional: row.launcher.requiredOperandSpelling ?? /^/ } : {}),
+        ...(duration ? { duration: true } : {}),
+        ...(row.launcher.bareDash === true ? { bareDash: true } : {}),
+        ...(row.launcher.assignmentOperands === true ? { assignments: true } : {}),
+        ...(viaShell ? { viaShell: true } : {}),
+    };
+}