@sema-agent/core 7.44.0 → 7.46.0

package/dist/orchestration/run-spec.js

@@ -5,7 +5,8 @@ import { combinePolicies } from "../core/tool-policy.js";
 import { delimitUntrusted } from "../core/untrusted-text.js";
 import { isDurablePause } from "../agents/suspend-guard.js";
 import { terminalProjection } from "../core/runner/terminal-projection.js";
-import { isAbsoluteForFamily, pathFamilyOf, writeTargetPath } from "../tools/fs/safety.js";
+import { writeTargetPath } from "../tools/fs/safety.js";
+import { callTargetViewsOf } from "../core/effective-path-target.js";
 import { captureBaseline, resolveFrozenPaths, restoreFrozenPaths, runOracle, snapshotFrozenPaths, specError, } from "../core/spec-contract.js";
 import { isProtectedWrite } from "../core/tool-registry.js";
 const CASE_INSENSITIVE_FS = process.platform === "darwin" || process.platform === "win32";
@@ -21,13 +22,13 @@ export function frozenDenyPolicy(rootDir, frozenResolved) {
         check(req) {
             if (!isProtectedWrite(req))
                 return { action: "allow" };
-            const raw = writeTargetPath(req);
-            if (typeof raw !== "string" || raw.length === 0)
+            const views = callTargetViewsOf(req, "tighten", { root: rootDir });
+            if (views === undefined || views.spellings.length === 0)
                 return { action: "allow" };
-            const absForm = isAbsoluteForFamily(pathFamilyOf({ root: rootDir, cwd: req.cwd }), raw);
-            const abs = pathKey(absForm ? raw : resolve(req.cwd || rootDir, raw));
-            if (frozen.has(abs)) {
-                return { action: "deny", message: `${raw} is part of the frozen specification surface (read-only).` };
+            const raw = writeTargetPath(req);
+            const hit = views.spellings.some((v) => frozen.has(pathKey(v)));
+            if (hit) {
+                return { action: "deny", message: `${typeof raw === "string" && raw.length > 0 ? raw : views.spellings[0]} is part of the frozen specification surface (read-only).` };
             }
             return { action: "allow" };
         },

package/dist/orchestration/workflow.js

@@ -19,6 +19,7 @@ import { boundInputHashOf } from "../core/canonical-json.js";
 import { boundedRedactedSummary } from "../core/untrusted-egress.js";
 import { delimitUntrusted } from "../core/untrusted-text.js";
 import { OUTPUT_TOOL_NAME } from "../core/runner/synthetic-tools.js";
+import { deniedToolNamesOf } from "../core/runner/sub-agent-deny-lists.js";
 import { compileOutputSchema } from "../core/runner/strict-output-schema.js";
 import { WorkflowBudgetExceededError, WorkflowNestingError, WorkflowAgentBlockedError, WorkflowAgentParkedError, WorkflowAgentSchemaError, WorkflowAgentStalledError, WorkflowMaxAgentsError, WORKFLOW_SPAWN_BLOCKED_ERROR_CODE } from "./workflow-types.js";
 import { WorkflowScriptError } from "./workflow-meta.js";
@@ -118,7 +119,7 @@ export function applyWorkflowAgentType(spec, agentType, registry) {
     if (out.memoryPersistenceCapable === undefined && def.memoryPersistenceCapable !== undefined)
         out.memoryPersistenceCapable = def.memoryPersistenceCapable;
     if (def.allowTools !== undefined || def.denyTools !== undefined) {
-        const perType = createAllowDenyPolicy({ ...(def.allowTools ? { allow: def.allowTools } : {}), ...(def.denyTools ? { deny: def.denyTools } : {}), scope: "narrowing" });
+        const perType = createAllowDenyPolicy({ ...(def.allowTools ? { allow: def.allowTools } : {}), ...(def.denyTools ? { deny: deniedToolNamesOf(`workflow agentType "${def.name}"`, def.denyTools) } : {}), scope: "narrowing" });
         out.toolPolicy = out.toolPolicy ? combinePolicies(out.toolPolicy, perType) : perType;
     }
     return out;
@@ -1578,7 +1579,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                         opts.onForwardEvent(e.type === "task_progress" ? { ...e, workflowRunId: runId, workflowAgentLabel: label } : e);
                     }
                     : undefined;
-                const baseInternals = { ...(agentOpts.isolation ? { isolation: agentOpts.isolation } : {}), ...(opts.parentCwd !== undefined ? { parentCwd: opts.parentCwd } : {}), ...spawnAttribution, ...(await captureFloorSeatsNow()), ...(enrichedForward !== undefined ? { onForwardEvent: enrichedForward } : {}), delegationTaskType: "workflow", agentName: label, onWorkspaceResolved: createWorkspaceObserver(rec) };
+                const baseInternals = { ...(agentOpts.isolation ? { isolation: agentOpts.isolation } : {}), ...(opts.parentCwd !== undefined ? { parentCwd: opts.parentCwd, callerRoot: opts.parentCwd } : {}), ...spawnAttribution, ...(await captureFloorSeatsNow()), ...(enrichedForward !== undefined ? { onForwardEvent: enrichedForward } : {}), delegationTaskType: "workflow", agentName: label, onWorkspaceResolved: createWorkspaceObserver(rec) };
                 let attempts = 0;
                 let throttleRetried = false;
                 let lastAttemptReason;

package/dist/shell/lex.d.ts

@@ -248,6 +248,13 @@ export declare function substitutionsInHeredocBody(body: string): {
     readonly body: string;
     readonly kind: "command" | "arithmetic";
 }[] | undefined;
+/** The text a word's pieces hand the program when every piece is literal; `undefined` when one is an expansion or
+ *  unresolved. */
+export declare function literalTextOf(pieces: readonly WordPiece[]): string | undefined;
+/** The text an UNQUOTED here-document body delivers when the shell expands nothing in it: a backslash before `$`, a
+ *  backquote or a backslash is removed (a line continuation was joined when the body was read), every other character
+ *  stands. `undefined` when an unescaped `$` or backquote stands in it: the program reads what the expansion makes. */
+export declare function literalHeredocBody(body: string): string | undefined;
 /** Lex a command: its segments, or the one reason bash (or this lexer) cannot delimit them. */
 export declare function lexShell(source: string): ShellLex;
 /**

package/dist/shell/lex.js

@@ -319,6 +319,23 @@ export function substitutionsInHeredocBody(body) {
     }
     return out;
 }
+export function literalTextOf(pieces) {
+    return pieces.every((q) => q.literal !== undefined) ? pieces.map((q) => q.literal).join("") : undefined;
+}
+export function literalHeredocBody(body) {
+    let out = "";
+    for (let i = 0; i < body.length; i++) {
+        const ch = body[i];
+        if (ch === "$" || ch === "`")
+            return undefined;
+        if (ch === "\\" && i + 1 < body.length && "$`\\".includes(body[i + 1])) {
+            out += body[++i];
+            continue;
+        }
+        out += ch;
+    }
+    return out;
+}
 const BLANK = /[ \t]/;
 const fail = (reason, at) => ({ parseFailure: { reason, at } });
 const publicPiece = (p) => ({

package/dist/tools/fs/bash-program-position.d.ts

@@ -31,8 +31,6 @@ export declare function writtenAssignmentPrefix(token: string): {
     readonly settlesWholeName: boolean;
 } | undefined;
 export { SHELL_CONTROL_PREFIXES };
-/** Shell block words that name no command of their own (a loop head, a block close, a case head). */
-export declare const SHELL_BLOCK_WORDS: ReadonlySet<string>;
 /** A control word is a keyword only when bash sees it BARE: `'if'` / `"do"` / `\\!` are command names (a program
  *  looked up on PATH, whose failure changes nothing), so a quoted or escaped spelling never counts as one. */
 export declare function isBareControlWord(words: readonly LexedWord[], i: number, set: ReadonlySet<string>): boolean;
@@ -43,88 +41,6 @@ export declare function isBareControlWord(words: readonly LexedWord[], i: number
  * over control words and earlier assignments re-traces). One fact, two readers that must agree.
  */
 export declare function isLeadingAssignmentWord(words: readonly LexedWord[], i: number): boolean;
-/**
- * Programs that turn their STANDARD INPUT into the OPERANDS of another program, and EXEC that program directly.
- *
- * The same class as the shell re-entry programs, one level down: there the unseen text is COMMANDS; here the
- * command's name IS visible and its argv is not — `echo <path> | xargs cat` opens a file no token of this walk
- * ever named, because the operand arrives on a stream. The membership criterion is that behaviour and only that
- * behaviour; a program that consumes stdin as DATA (`sort`, `wc`, a reader the deployment never listed) is NOT a
- * member, because its stdin never becomes a filename. Spelled as a pattern — these are program names, never tool
- * names.
- *
- * "EXECS DIRECTLY" is what separates this class from the shell re-entry class, and it is why GNU `parallel` is
- * NOT a member: parallel BUILDS A COMMAND LINE and hands it to a shell, and with no command word at all it runs
- * each input line as a command — so parallel belongs to the shell re-entry class and is refused whole with no
- * exemption at all. A spelling this file has no name for (an aliased or wrapped `xargs`) is judged as any other
- * unlisted program is — the name-table floor the re-entry class records for itself.
- */
-export declare const ARGV_REENTRY_PROGRAM_RE: RegExp;
-/** The program an {@link ARGV_REENTRY_PROGRAM_RE} launcher runs when the chain names none: `xargs` defaults to
- *  `echo`, which is why a bare one reads nothing. */
-export declare const ARGV_REENTRY_DEFAULT_PROGRAM = "echo";
-/**
- * What a launcher declares about its OWN options: each exact spelling with its ARITY — `0` for a switch, `1` for an
- * option whose value is the next token. Every spelling not in the map falls to the refusal (the conservative side,
- * and the verdict those spellings always had); a `1` with no token left to take is not readable either.
- *
- * THREE SPELLINGS OF ONE DECLARATION, because getopt has three: an arity-1 entry is honoured separated (`-k 5`),
- * fused to its long name (`--signal=TERM`) and fused to its short letter (`-k5`), and an arity-0 short entry inside
- * a cluster of arity-0 letters (`-pv`). Reading only the exact spelling made one program two.
- *
- * WHAT A ROW MAY NOT GET WRONG: declaring an arity-1 option as arity 0 steps onto its VALUE and reads the value as
- * the program — the one direction that turns a refusal into a wrong answer rather than a lost one. A row carries
- * only options whose arity every supported implementation agrees on; a flag no row declares still refuses.
- */
-export interface LauncherRow {
-    /** Consulted ONLY for the launcher the command line itself names — a bare keyword in front of the command
-     *  (`time -p …`) or the written command word (`"time" -p …`, `X=1 time -p …`, `/usr/bin/time -p …`). A launcher
-     *  nested behind another (`env time -p …`) is that launcher's operand, and its options refuse: resolving past
-     *  them would turn a whole refusal into an ordinary walked segment — a widening, where every other read of this
-     *  table only ever finds MORE program to judge. */
-    readonly optionArity: ReadonlyMap<string, 0 | 1>;
-    /** A bare NEGATIVE integer in this launcher's option section is its OWN argument (`nice -5 <cmd>`), not a flag
-     *  the table cannot read. Per row: elsewhere a dash-leading token is an option, and reading one as a number
-     *  would step over a flag whose meaning this table does not know. */
-    readonly negativeIntegerIsOwnArgument?: true;
-    /** Positional operands the launcher takes BEFORE the program, consumed whatever they spell (`timeout DURATION
-     *  COMMAND`); a spelling-based reading under-accepted, and every spelling it missed became the program word. */
-    readonly requiredOperands?: number;
-    /** The launcher reads NAME=VALUE operands with ITS OWN name grammar (`env 1=x …`), wider than the shell's. */
-    readonly assignmentOperands?: true;
-    /** The launcher hands its operands to a SHELL as text (`watch "cat /x"` runs `sh -c`): no program word to read. */
-    readonly shellText?: true;
-    /** With no program word the launcher runs a SHELL: piped text would reach it, so an empty program position refuses. */
-    readonly whenNoProgram?: "shell";
-    /** Options whose value is a WHOLE COMMAND LINE the launcher splits and runs (`env -S "cmd arg"`,
-     *  `--split-string=…`). Not an arity this reader steps over — the program is inside the value, so the
-     *  program-position walk still refuses here — but the candidate extraction reads the value as nested shell
-     *  text instead of as one opaque word. */
-    readonly commandString?: readonly string[];
-}
-/**
- * The ONE launcher truth: programs that RUN ANOTHER PROGRAM named in ordinary argv tokens, so a declared reader can
- * sit behind one (`env cat <path>`, `sudo cat <path>`, `timeout 5 cat <path>`), each with the option grammar this
- * file reads for it.
- *
- * Membership is the key set. A row with no declared options means every option-shaped word after that launcher
- * refuses ("which program runs is not readable without the launcher's option table") — the answer every launcher
- * but `time` has always had, now stated per row rather than by omission. Declaring a row's options is a behaviour
- * decision with its own criteria; adding a launcher is a row.
- *
- * `time` carries both spellings a deployment can meet: the shell builtin takes `-p` alone, and the standalone
- * program adds a format, an output file, and three switches.
- *
- * A deliberate SUBSET of the rule lane's own `BARE_INTERPRETER_NAMES`, mirrored rather than imported because that
- * module imports the classifier — the dependency runs that way, and a cycle is a worse problem than a mirror whose
- * subset relation is pinned by test. GNU `parallel` is absent for the reason the shells are absent: it does not run
- * a program named in token-visible argv — it BUILDS a command line and hands it to a shell — so it is a shell
- * re-entry member instead. Language interpreters and shells are excluded as a scope statement: their program
- * argument is a script path or a quoted code string, not a token-visible program with token-visible operands.
- */
-export declare const LAUNCHER_TABLE: ReadonlyMap<string, LauncherRow>;
-/** The launcher names — derived from the table, never kept beside it. */
-export declare const COMMAND_LAUNCHERS: ReadonlySet<string>;
 export declare const PROGRAM_POSITION_REFUSAL_KINDS: readonly ["option_at_program_position", "control_syntax_at_program_position"];
 export type ProgramPositionRefusalKind = (typeof PROGRAM_POSITION_REFUSAL_KINDS)[number];
 /** Why the program could not be read — a closed set, each member minted into one sentence. `owner` is the word
@@ -140,6 +56,9 @@ export type ProgramPositionRefusal = {
     /** Not a DECLINE ({@link programPositionRunsShell}): the row WAS read and a SHELL stands at the program
      *  position. Absent ⇒ genuine control syntax, which IS one. */
     readonly runsShell?: true;
+    /** The launcher hands the shell its operands as text (`watch "S"`); absent beside `runsShell`, the shell is handed
+     *  nothing (`sudo -s`, `chroot DIR`) and runs its standard input. */
+    readonly handsText?: true;
 };
 export interface ProgramPosition {
     /** Indices of the bare control words stripped in front (`!`, `if`, `time`, …), in order; their declared options
@@ -159,6 +78,8 @@ export interface ProgramPosition {
     readonly argvFromStdin: boolean;
     /** The chain ends ON the re-entry program (nothing follows it), so it runs its default program. */
     readonly runsDefaultProgram: boolean;
+    /** The program the stream-fed chain member runs when the chain names none (`xargs` runs `echo`). */
+    readonly defaultProgram?: string;
     /** The program bash RUNS: the first word past the chain. `name` is the folded word as written, `basename` what
      *  bash resolves (`/usr/bin/cat` is `cat`). `undefined` when the chain names none or the read was refused. */
     readonly program: {
@@ -184,7 +105,7 @@ export declare function readProgramPosition(words: readonly LexedWord[]): Progra
 /** Does this program position hand a program operands the walk cannot see? True when the chain re-enters through
  *  stdin AND the program it runs is not one the caller accepts as a stream target. ONE reading, shared by every
  *  consumer; WHICH targets are accepted is the caller's declaration, not this reader's. */
-export declare function argvReentryUnjudged(pos: ProgramPosition, acceptedTargets: ReadonlySet<string>): boolean;
+export declare function argvReentryUnjudged(pos: ProgramPosition, acceptsTarget: (basename: string) => boolean): boolean;
 /**
  * The two ways this reader DECLINES rather than judges — a CLOSED set (`docs/CLOSED-SETS.md`), because what a
  * seat does with a declined segment is a ROW of the shell read decision table (`shell-read-judge.ts`, the
@@ -197,9 +118,9 @@ export type ShellScanDecline = (typeof SHELL_SCAN_DECLINES)[number];
 /** Does a SHELL stand where this segment's program would be — as the program itself (`sh -c`), or as a launcher
  *  ROW handing its operands to one (`watch "…"`)? ONE predicate for the re-entry class, so the two spellings
  *  cannot be answered differently; which names are shells is the caller's declaration. Not a decline. */
-export declare function programPositionRunsShell(pos: ProgramPosition, shellProgram: RegExp): boolean;
+export declare function programPositionRunsShell(pos: ProgramPosition, runsShell: (basename: string) => boolean): boolean;
 /** Which decline, if any, this program position raises — ONE reading of the two facts above, so no consumer
  *  re-derives either. A refusal that says a SHELL runs is NOT one: it names what runs. */
-export declare function shellScanDeclineOf(pos: ProgramPosition, acceptedStreamTargets: ReadonlySet<string>): ShellScanDecline | undefined;
+export declare function shellScanDeclineOf(pos: ProgramPosition, acceptsStreamTarget: (basename: string) => boolean): ShellScanDecline | undefined;
 /** ONE sentence per refusal kind, minted here and nowhere else. */
 export declare function programPositionRefusalSentence(refusal: ProgramPositionRefusal): string;

package/dist/tools/fs/bash-program-position.js

@@ -1,4 +1,5 @@
 import { SHELL_CONTROL_PREFIXES } from "../../shell/lex.js";
+import { BLOCK_WORD_NAMES, LAUNCHER_NAMES, feedsArgvFromStdin, launcherOptionStep, programRow, selectedOptions, streamDefaultProgram } from "./program-read-model.js";
 export const NOT_AUTO_ALLOWED = "— not auto-allowed";
 export function programBasename(word) {
     return word.includes("/") ? (word.split("/").pop() ?? word) : word;
@@ -14,7 +15,6 @@ export function writtenAssignmentPrefix(token) {
     return { prefix, name: bracket < 0 ? written : written.slice(0, bracket), appends, settlesWholeName: !appends && bracket < 0 };
 }
 export { SHELL_CONTROL_PREFIXES };
-export const SHELL_BLOCK_WORDS = new Set(["for", "select", "case", "esac", "fi", "done", "function", "coproc", "[[", "]]", "in"]);
 export function isBareControlWord(words, i, set) {
     const w = words[i];
     return w !== undefined && w.raw === w.folded && set.has(w.folded);
@@ -23,48 +23,19 @@ export function isLeadingAssignmentWord(words, i) {
     const w = words[i];
     return w !== undefined && w.assignment !== undefined && w.assignment.bare && w.atCommandPosition;
 }
-export const ARGV_REENTRY_PROGRAM_RE = /^xargs$/;
-export const ARGV_REENTRY_DEFAULT_PROGRAM = "echo";
-const NO_DECLARED_OPTIONS = { optionArity: new Map() };
-const launcherRow = (pairs, extra = {}) => ({ optionArity: new Map(pairs), ...extra });
-export const LAUNCHER_TABLE = new Map([
-    ["env", launcherRow([["-i", 0], ["-0", 0], ["-v", 0], ["--ignore-environment", 0], ["--null", 0], ["--debug", 0], ["-u", 1], ["--unset", 1]], { assignmentOperands: true, commandString: ["-S", "--split-string"] })],
-    ["command", launcherRow([["-p", 0]])],
-    ["builtin", NO_DECLARED_OPTIONS], ["exec", NO_DECLARED_OPTIONS],
-    ["noglob", NO_DECLARED_OPTIONS], ["xargs", NO_DECLARED_OPTIONS], ["busybox", NO_DECLARED_OPTIONS],
-    ["sudo", { optionArity: new Map(), assignmentOperands: true }], ["doas", NO_DECLARED_OPTIONS], ["pkexec", { optionArity: new Map(), whenNoProgram: "shell" }],
-    ["su", { optionArity: new Map(), shellText: true }], ["runuser", { optionArity: new Map(), shellText: true }],
-    ["chroot", { optionArity: new Map(), requiredOperands: 1, whenNoProgram: "shell" }], ["setpriv", NO_DECLARED_OPTIONS],
-    ["nohup", NO_DECLARED_OPTIONS],
-    ["nice", launcherRow([["-n", 1], ["--adjustment", 1]], { negativeIntegerIsOwnArgument: true })],
-    ["ionice", NO_DECLARED_OPTIONS], ["chrt", { optionArity: new Map(), requiredOperands: 1 }], ["taskset", { optionArity: new Map(), requiredOperands: 1 }],
-    ["stdbuf", launcherRow([["-i", 1], ["-o", 1], ["-e", 1], ["--input", 1], ["--output", 1], ["--error", 1]])],
-    ["timeout", launcherRow([
-            ["--foreground", 0], ["--preserve-status", 0], ["--verbose", 0], ["-v", 0],
-            ["-k", 1], ["-s", 1], ["--kill-after", 1], ["--signal", 1],
-        ], { requiredOperands: 1 })],
-    ["time", {
-            optionArity: new Map([
-                ["-p", 0], ["-a", 0], ["-v", 0], ["-q", 0], ["--portability", 0], ["--append", 0], ["--verbose", 0], ["--quiet", 0], ["--help", 0], ["--version", 0], ["--", 0],
-                ["-f", 1], ["-o", 1], ["--format", 1], ["--output", 1],
-            ]),
-        }],
-    ["watch", { optionArity: new Map(), shellText: true }], ["setsid", NO_DECLARED_OPTIONS], ["flock", { optionArity: new Map(), requiredOperands: 1 }], ["unshare", { optionArity: new Map(), whenNoProgram: "shell" }],
-    ["nsenter", { optionArity: new Map(), whenNoProgram: "shell" }], ["script", { optionArity: new Map(), shellText: true }], ["numactl", NO_DECLARED_OPTIONS], ["prlimit", NO_DECLARED_OPTIONS],
-    ["systemd-run", NO_DECLARED_OPTIONS],
-    ["strace", NO_DECLARED_OPTIONS], ["ltrace", NO_DECLARED_OPTIONS], ["valgrind", NO_DECLARED_OPTIONS], ["firejail", { optionArity: new Map(), whenNoProgram: "shell" }],
-    ["bwrap", NO_DECLARED_OPTIONS],
-]);
-export const COMMAND_LAUNCHERS = new Set(LAUNCHER_TABLE.keys());
+function launcherRowOf(name) {
+    const row = programRow(name);
+    return row?.launcher !== undefined ? row : undefined;
+}
 function pastLauncherOptions(launcher, folded, i) {
-    const row = LAUNCHER_TABLE.get(launcher);
+    const row = launcherRowOf(launcher);
     if (row === undefined)
         return i;
     for (;;) {
         const tok = folded[i];
         if (tok === undefined)
             return i;
-        if (row.negativeIntegerIsOwnArgument === true && /^-\d+$/.test(tok)) {
+        if (row.launcher?.negativeIntegerIsOwnArgument === true && /^-\d+$/.test(tok)) {
             i += 1;
             continue;
         }
@@ -76,19 +47,6 @@ function pastLauncherOptions(launcher, folded, i) {
         i += step;
     }
 }
-function launcherOptionStep(row, tok) {
-    const exact = row.optionArity.get(tok);
-    if (exact !== undefined)
-        return exact === 1 ? 2 : 1;
-    const eq = tok.startsWith("--") ? tok.indexOf("=") : -1;
-    if (eq > 2 && row.optionArity.get(tok.slice(0, eq)) === 1)
-        return 1;
-    if (/^-[A-Za-z]./.test(tok) && row.optionArity.get(tok.slice(0, 2)) === 1)
-        return 1;
-    if (/^-[A-Za-z]+$/.test(tok) && [...tok.slice(1)].every((ch) => row.optionArity.get(`-${ch}`) === 0))
-        return 1;
-    return undefined;
-}
 export const PROGRAM_POSITION_REFUSAL_KINDS = Object.freeze(["option_at_program_position", "control_syntax_at_program_position"]);
 export function readProgramPosition(words) {
     const folded = words.map((w) => w.folded);
@@ -116,20 +74,24 @@ export function readProgramPosition(words) {
         const owner = controlWords.length > 0 ? folded[controlWords[controlWords.length - 1]] : head;
         return none(written, assignments, { kind: "option_at_program_position", owner, option: head });
     }
-    if (!COMMAND_LAUNCHERS.has(basename)) {
+    if (!LAUNCHER_NAMES.has(basename)) {
         return { controlWords, written, assignments, launchers: [], argvFromStdin: false, runsDefaultProgram: false, program: { index: i, name: head, basename }, refusal: undefined };
     }
     const launchers = [{ index: i, name: basename }];
     const owner = head;
-    const shellRefusal = () => ({ kind: "control_syntax_at_program_position", owner, word: "sh", runsShell: true });
-    let owedOperands = LAUNCHER_TABLE.get(basename)?.requiredOperands ?? 0;
-    let lastRow = LAUNCHER_TABLE.get(basename);
+    const shellRefusal = (handsText) => ({ kind: "control_syntax_at_program_position", owner, word: "sh", runsShell: true, ...(handsText !== undefined ? { handsText } : {}) });
+    let lastRow = launcherRowOf(basename)?.launcher;
+    let owedOperands = lastRow?.requiredOperands ?? 0;
     const chain0 = (program, refusal) => ({ controlWords, written, assignments, launchers, argvFromStdin: false, runsDefaultProgram: false, program, refusal });
     if (lastRow?.shellText === true)
-        return chain0(undefined, shellRefusal());
-    let argvFromStdin = ARGV_REENTRY_PROGRAM_RE.test(basename);
+        return chain0(undefined, shellRefusal(true));
+    let argvFromStdin = feedsArgvFromStdin(basename);
     let lastReentry = argvFromStdin ? i : -1;
-    const chain = (program, refusal) => ({ controlWords, written, assignments, launchers, argvFromStdin, runsDefaultProgram: lastReentry === folded.length - 1, program, refusal });
+    let reentryDefault = argvFromStdin ? streamDefaultProgram(basename) : undefined;
+    const chain = (program, refusal) => {
+        const runsDefaultProgram = lastReentry === folded.length - 1;
+        return { controlWords, written, assignments, launchers, argvFromStdin, runsDefaultProgram, ...(runsDefaultProgram && reentryDefault !== undefined ? { defaultProgram: reentryDefault } : {}), program, refusal };
+    };
     for (let j = pastLauncherOptions(basename, folded, i + 1); j < folded.length; j++) {
         const t = folded[j];
         if (owedOperands > 0 && !t.startsWith("-")) {
@@ -139,50 +101,52 @@ export function readProgramPosition(words) {
         if (lastRow?.assignmentOperands === true && !t.startsWith("-") && t.includes("="))
             continue;
         const wordBasename = programBasename(t);
-        if (ARGV_REENTRY_PROGRAM_RE.test(wordBasename)) {
+        if (feedsArgvFromStdin(wordBasename)) {
             argvFromStdin = true;
             lastReentry = j;
+            reentryDefault = streamDefaultProgram(wordBasename);
             lastRow = undefined;
             owedOperands = 0;
             continue;
         }
-        if (COMMAND_LAUNCHERS.has(wordBasename)) {
+        if (LAUNCHER_NAMES.has(wordBasename)) {
             launchers.push({ index: j, name: wordBasename });
-            lastRow = LAUNCHER_TABLE.get(wordBasename);
+            lastRow = launcherRowOf(wordBasename)?.launcher;
             if (lastRow?.shellText === true)
-                return chain(undefined, shellRefusal());
+                return chain(undefined, shellRefusal(true));
             owedOperands = lastRow?.requiredOperands ?? 0;
             j = pastLauncherOptions(wordBasename, folded, j + 1) - 1;
             continue;
         }
         if (t.startsWith("-"))
             return chain(undefined, { kind: "option_at_program_position", owner, option: t });
-        if (SHELL_CONTROL_PREFIXES.has(wordBasename) || SHELL_BLOCK_WORDS.has(wordBasename)) {
+        if (SHELL_CONTROL_PREFIXES.has(wordBasename) || BLOCK_WORD_NAMES.has(wordBasename)) {
             return chain(undefined, { kind: "control_syntax_at_program_position", owner, word: wordBasename });
         }
         return chain({ index: j, name: t, basename: wordBasename });
     }
-    if (lastRow?.whenNoProgram === "shell")
+    const last = launchers[launchers.length - 1];
+    if (lastRow?.whenNoProgram === "shell" || selectedOptions(launcherRowOf(last.name), folded.slice(last.index + 1)).some((o) => o.mode === "interactive"))
         return chain(undefined, shellRefusal());
     return chain(undefined);
 }
-export function argvReentryUnjudged(pos, acceptedTargets) {
+export function argvReentryUnjudged(pos, acceptsTarget) {
     if (!pos.argvFromStdin)
         return false;
-    const runs = pos.program?.basename ?? (pos.runsDefaultProgram ? ARGV_REENTRY_DEFAULT_PROGRAM : undefined);
-    return runs === undefined || !acceptedTargets.has(runs);
+    const runs = pos.program?.basename ?? pos.defaultProgram;
+    return runs === undefined || !acceptsTarget(runs);
 }
 export const SHELL_SCAN_DECLINES = Object.freeze(["unreadable_program_position", "stream_fed_operands"]);
-export function programPositionRunsShell(pos, shellProgram) {
+export function programPositionRunsShell(pos, runsShell) {
     if (pos.refusal !== undefined)
         return pos.refusal.kind === "control_syntax_at_program_position" && pos.refusal.runsShell === true;
-    return pos.program !== undefined && shellProgram.test(pos.program.basename);
+    return pos.program !== undefined && runsShell(pos.program.basename);
 }
-export function shellScanDeclineOf(pos, acceptedStreamTargets) {
+export function shellScanDeclineOf(pos, acceptsStreamTarget) {
     if (pos.refusal !== undefined) {
         return pos.refusal.kind === "control_syntax_at_program_position" && pos.refusal.runsShell === true ? undefined : "unreadable_program_position";
     }
-    return argvReentryUnjudged(pos, acceptedStreamTargets) ? "stream_fed_operands" : undefined;
+    return argvReentryUnjudged(pos, acceptsStreamTarget) ? "stream_fed_operands" : undefined;
 }
 export function programPositionRefusalSentence(refusal) {
     switch (refusal.kind) {