@sema-agent/core 7.44.0 → 7.46.0

package/dist/tools/fs/read-deny-home.d.ts

@@ -38,6 +38,24 @@ export declare function readDenyHomeLinksOf(env: ExecutionEnv, entries: readonly
     readonly linked: Map<string, string[]>;
     readonly whole: boolean;
 }>;
+/**
+ * Where the rows that open with the configuration directory's name (`~/.sema/…`, {@link agentConfigDirTail}) lead when
+ * the host declares the directory's root (`RunnerDeps.agentConfigDir`) — the same `linked` answer
+ * {@link readDenyHomeLinksOf} gives, for the same rows: the row's literal head below the directory name is spelled under
+ * each spelling of the root and resolved the way the read faces mint their keys. A row is not anchored at the root by
+ * its own run (it is anchored at the homes), so every location here — the spelling itself and where it leads — is one the
+ * row is placed at in addition; the home spelling stays placed. The row's name in every refusal is unchanged.
+ *  · a row whose run does not open with the directory's name (`~/.sema.*`, the external tools' files) adds nothing;
+ *  · a row whose head ends at the directory name (`~/.sema/*.json`, `~/.sema`) is placed at the root itself, the rest of
+ *    its run matched below it.
+ */
+export declare function readDenyConfigRootLinksOf(env: ExecutionEnv, entries: readonly {
+    readonly pattern: string;
+    readonly caseSensitive?: boolean;
+}[], roots: readonly string[], signal?: AbortSignal, deadline?: number): Promise<{
+    readonly linked: Map<string, string[]>;
+    readonly whole: boolean;
+}>;
 /** Where an absolute location LEADS in one environment — resolved the way the read and write faces mint their keys
  *  (`canonicalizeTarget`: the longest existing prefix resolved, the rest rejoined). `undefined` when the environment
  *  does not answer (a refused or failed probe, one that throws). The one resolution a deny row's placement reads: a
@@ -122,7 +140,7 @@ export declare function carryHomeViews<T extends object>(judge: T, source: HomeV
  *  · each AUXILIARY home (see the module head) read once under {@link AUXILIARY_HOME_PROBE_MS} — its spellings, its
  *    chain, its rows' heads — at the same time; whatever of it did not answer costs that home alone and never `whole`.
  *  `compile` is the mount's own compile; the rows' patterns are read off its compile at no home. */
-export declare function placeReadDenyAtHome(env: ExecutionEnv, compile: (homes: readonly string[], linked?: ReadonlyMap<string, readonly string[]>) => ReadDenyMatcher, homes?: readonly string[], signal?: AbortSignal): Promise<{
+export declare function placeReadDenyAtHome(env: ExecutionEnv, compile: (homes: readonly string[], linked?: ReadonlyMap<string, readonly string[]>) => ReadDenyMatcher, homes?: readonly string[], signal?: AbortSignal, configRoot?: string): Promise<{
     readonly matcher: PlacedReadDenyMatcher;
     readonly homes: readonly string[];
     readonly linked: ReadonlyMap<string, readonly string[]>;

package/dist/tools/fs/read-deny-home.js

@@ -2,6 +2,7 @@ import { userInfo } from "node:os";
 import { canonicalizeTarget, isAbsolutePathForm, joinForFamily, normalizeAbsPathLexically, pathFamilyOf } from "./safety.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, withGateTimeout } from "../../core/gate-bounded-await.js";
 import { thrownText } from "../../core/thrown-value.js";
+import { agentConfigDirTail } from "../../core/agent-config-dir.js";
 import { readDenyPatternRun, readDenyRunHead } from "./read-deny.js";
 export const AUXILIARY_HOME_PROBE_MS = 2_000;
 const said = new Set();
@@ -97,12 +98,15 @@ export async function readDenyHomesOf(env, signal) {
 async function until(work, deadline, signal) {
     return await withGateTimeout(work, Math.max(0, deadline - Date.now()), signal, "auxiliaryHome").catch(() => undefined);
 }
-function sayAuxiliary(what) {
+function sayAuxiliary(what, subject = "auxiliary") {
+    if (subject === "config_root") {
+        sayOnce("config_root", `read-deny homes: the declared agent configuration root did not answer its probes within ${AUXILIARY_HOME_PROBE_MS} ms (${what}) — the rows that name the configuration directory sit at its spelling only, and a path through an alias of it is judged as spelled, until the next placement.`);
+        return;
+    }
     sayOnce("auxiliary", `read-deny homes: a home beside the environment's declared home did not answer its probes within ${AUXILIARY_HOME_PROBE_MS} ms (${what}) — its home-anchored read-deny rows sit at its spelling only, and a path through an alias of it is judged as spelled, until the next placement.`);
 }
 export async function readDenyHomeLinksOf(env, entries, homes, signal, deadline) {
     const rows = [];
-    const familyOf = new Map();
     for (const { pattern, caseSensitive } of entries) {
         const { homeAnchored, run } = readDenyPatternRun(pattern);
         if (!homeAnchored)
@@ -110,26 +114,51 @@ export async function readDenyHomeLinksOf(env, entries, homes, signal, deadline)
         const head = run.split("/").filter(Boolean).slice(0, readDenyRunHead(run)).join("/");
         if (head.length === 0)
             continue;
-        const spelled = homes.map((home) => {
-            const family = pathFamilyOf({ root: home });
-            const at = normalizeAbsPathLexically(joinForFamily(family, home, head));
-            familyOf.set(at, family);
-            return at;
-        });
-        rows.push({ pattern, caseSensitive: caseSensitive === true, spelled });
+        const spelled = homes.map((home) => normalizeAbsPathLexically(joinForFamily(pathFamilyOf({ root: home }), home, head)));
+        rows.push({ pattern, caseSensitive: caseSensitive === true, spelled, anchored: spelled });
     }
+    return await linkedLocationsOf(env, rows, signal, deadline);
+}
+export async function readDenyConfigRootLinksOf(env, entries, roots, signal, deadline) {
+    return await linkedLocationsOf(env, configRootRowsOf(entries, roots), signal, deadline);
+}
+function configRootRowsOf(entries, roots) {
+    const rows = [];
+    for (const { pattern, caseSensitive } of entries) {
+        const { homeAnchored, run } = readDenyPatternRun(pattern);
+        const tail = homeAnchored ? agentConfigDirTail(run, caseSensitive === true) : undefined;
+        if (tail === undefined)
+            continue;
+        const head = tail.split("/").filter(Boolean).slice(0, readDenyRunHead(tail)).join("/");
+        const spelled = roots.map((root) => normalizeAbsPathLexically(head.length === 0 ? root : joinForFamily(pathFamilyOf({ root }), root, head)));
+        rows.push({ pattern, caseSensitive: caseSensitive === true, spelled, anchored: [] });
+    }
+    return rows;
+}
+function configRootSpelledLinks(entries, roots) {
+    const out = new Map();
+    for (const { pattern, spelled } of configRootRowsOf(entries, roots))
+        out.set(pattern, [...new Set(spelled)]);
+    return out;
+}
+async function linkedLocationsOf(env, rows, signal, deadline) {
+    const familyOf = new Map();
+    for (const { spelled } of rows)
+        for (const at of spelled)
+            familyOf.set(at, pathFamilyOf({ root: at }));
     const leadOf = async (at, family) => (await whereItLeads(env, at, family, signal)) ?? ((await holdsNothingBelow(env, at, signal)) ? at : undefined);
     const resolved = new Map(await Promise.all([...familyOf].map(async ([at, family]) => [at, deadline === undefined ? await leadOf(at, family) : await until(leadOf(at, family), deadline, signal)])));
     const out = new Map();
     const whole = [...resolved.values()].every((location) => location !== undefined);
-    for (const { pattern, caseSensitive, spelled } of rows) {
+    for (const { pattern, caseSensitive, spelled, anchored } of rows) {
         const fold = (p) => (caseSensitive ? p : p.replace(/[A-Z]/g, (c) => c.toLowerCase()));
-        const own = new Set(spelled.map(fold));
+        const own = new Set(anchored.map(fold));
         const locations = [];
         for (const at of spelled) {
-            const location = resolved.get(at);
-            if (location !== undefined && !own.has(fold(location)) && !locations.includes(location))
-                locations.push(location);
+            for (const location of [at, resolved.get(at)]) {
+                if (location !== undefined && !own.has(fold(location)) && !locations.includes(location))
+                    locations.push(location);
+            }
         }
         if (locations.length > 0)
             out.set(pattern, locations);
@@ -203,19 +232,24 @@ async function readAuxiliaryHome(env, home, opts, signal) {
     let reading;
     if (spelled?.canonical === undefined) {
         const answered = spelled?.answered === true;
-        reading = { place: [home], chain: answered ? { ancestors: [], whole: true } : NO_CHAIN, linked: new Map(), answered };
+        const linked = opts.configRoot === true && opts.entries !== undefined ? configRootSpelledLinks(opts.entries, [home]) : new Map();
+        reading = { place: [home], chain: answered ? { ancestors: [], whole: true } : NO_CHAIN, linked, answered };
     }
     else {
         const place = spelled.spellings;
         const identity = env.fileIdentity;
         const [chain, heads] = await Promise.all([
             typeof identity === "function" ? chainAbove(env, identity, spelled.canonical, signal, deadline) : Promise.resolve({ ancestors: [], whole: true }),
-            opts.entries !== undefined ? readDenyHomeLinksOf(env, opts.entries, place, signal, deadline) : Promise.resolve({ linked: new Map(), whole: true }),
+            opts.entries === undefined
+                ? Promise.resolve({ linked: new Map(), whole: true })
+                : opts.configRoot === true
+                    ? readDenyConfigRootLinksOf(env, opts.entries, place, signal, deadline)
+                    : readDenyHomeLinksOf(env, opts.entries, place, signal, deadline),
         ]);
         reading = { place, chain, linked: heads.linked, answered: chain.whole && heads.whole };
     }
     if (!reading.answered)
-        sayAuxiliary("a probe did not answer");
+        sayAuxiliary("a probe did not answer", opts.configRoot === true ? "config_root" : "auxiliary");
     return reading;
 }
 function homeViewSourceOver(env, auxiliary) {
@@ -325,31 +359,35 @@ export function homeViewsOf(env, judge, signal) {
 export function carryHomeViews(judge, source) {
     return { ...judge, homeViews: source };
 }
-export async function placeReadDenyAtHome(env, compile, homes, signal) {
+export async function placeReadDenyAtHome(env, compile, homes, signal, configRoot) {
     const entries = compile([]).entries;
     const declared = declaredHomeOf(env);
-    const heldAnywhere = (whole) => placementOf(carryHomeViews(compile([]), homeViewSourceOver(env, [])), [], new Map(), whole);
+    const relocated = configRoot === undefined ? undefined : readAuxiliaryHome(env, configRoot, { entries, configRoot: true }, signal);
+    const heldAnywhere = async (whole) => {
+        const linked = (await relocated)?.linked ?? new Map();
+        return placementOf(carryHomeViews(linked.size === 0 ? compile([]) : compile([], linked), homeViewSourceOver(env, relocated === undefined ? [] : [relocated])), [], linked, whole);
+    };
     const listed = homes === undefined ? declaredReadDenyHomesAnswered(env) : { homes, whole: true };
     if (!listed.whole)
-        return heldAnywhere(false);
+        return await heldAnywhere(false);
     const own = listed.homes.filter((h) => isDeclared(declared, h));
     let declaredAt = [];
     if (own.length > 0) {
         const ownSpellings = await withGateTimeout(homeSpellingsOf(env, own[0], signal), DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "readDenyHomes");
         if (!ownSpellings.answered)
-            return heldAnywhere(false);
+            return await heldAnywhere(false);
         declaredAt = [...new Set([...own, ...ownSpellings.spellings])];
     }
     const auxiliary = readAuxiliaryHomes(env, listed.homes, { entries }, signal);
-    const [heads, readings] = await Promise.all([readDenyHomeLinksOf(env, entries, declaredAt, signal), Promise.all(auxiliary)]);
+    const [heads, readings, root] = await Promise.all([readDenyHomeLinksOf(env, entries, declaredAt, signal), Promise.all(auxiliary), relocated]);
     const at = [...new Set([...declaredAt, ...readings.flatMap((r) => r.place)])];
     const linked = new Map();
-    for (const map of [heads.linked, ...readings.map((r) => r.linked)]) {
+    for (const map of [heads.linked, ...readings.map((r) => r.linked), ...(root === undefined ? [] : [root.linked])]) {
         for (const [pattern, locations] of map)
             linked.set(pattern, [...new Set([...(linked.get(pattern) ?? []), ...locations])]);
     }
     const matcher = linked.size === 0 ? compile(at) : compile(at, linked);
-    return placementOf(carryHomeViews(matcher, homeViewSourceOver(env, auxiliary)), at, linked, heads.whole);
+    return placementOf(carryHomeViews(matcher, homeViewSourceOver(env, relocated === undefined ? auxiliary : [...auxiliary, relocated])), at, linked, heads.whole);
 }
 export function readDenyPlacedLater(unplaced, place) {
     let current = unplaced;

package/dist/tools/fs/read-deny.d.ts

@@ -70,26 +70,66 @@ export interface PathRuleDenyRow {
      *  row, or one whose head cannot be read: it is judged as spelled. */
     readonly head?: string;
 }
+/** A row's reach over ONE absolute spelling, three-valued: `unreadable` = the row cannot be judged there (a base its anchor
+ *  lacks) — a tightening judgment holds on it, an allow grants nothing on it. */
+export type PathRowReach = {
+    readonly reach: "reached" | "not_reached";
+} | {
+    readonly reach: "unreadable";
+    readonly reason: string;
+};
+/** A rule row as the one judgment reads it: the deny-table row, and — on a row a rule binding produced — its three-valued
+ *  reach (a row built by hand answers through `reaches` alone: reached or not). */
+export interface JudgedPathRow extends PathRuleDenyRow {
+    readonly reach?: (absolutePath: string) => PathRowReach;
+}
+/** A call's target as a judgment reads it: the absolute spellings of its views (lexical, canonical, the leaf chain's hops —
+ *  any order the caller holds), or `unreadable` when the call names a target this reading cannot locate. */
+export interface TargetViews {
+    readonly spellings: readonly string[];
+    readonly unreadable?: string;
+}
+/** What {@link pathRowsReach} found: the row, the view it met there (absent on an unreadable hold), and — when nothing was
+ *  reached and some row could not be judged — the reason of the first such row. */
+export interface PathRowsHit<R> {
+    readonly row: R;
+    readonly view?: string;
+    readonly unreadable?: string;
+}
+/**
+ * THE one judgment of path rule rows over a call's target, for the gate's rule lanes and the tool's deny table alike: rows
+ * outer, views inner — the first row (in the caller's order) that some view reaches is the answer, so the rule a refusal
+ * names does not depend on which view happened to meet it. `tighten` (deny / ask): any view reaching the row reaches it; a
+ * row that cannot be judged (or a target that cannot be read) is held and answered only when no row reaches. `allow`: a
+ * row admits the call only when it admits EVERY view (a link out of an allowed directory is not admitted through its
+ * spelling); an unreadable target is admitted by nothing.
+ */
+export declare function pathRowsReach<R extends JudgedPathRow>(rows: readonly R[], views: TargetViews, direction: "tighten" | "allow"): PathRowsHit<R> | undefined;
+/** The locations a row is also judged at (each leading part of its HEAD: the anchor's children down to the head itself,
+ *  a share's root for a UNC head) — what a leg resolves once, for every row whose head it holds. */
+export declare function ruleHeadParts(rows: readonly Pick<PathRuleDenyRow, "head">[]): string[];
 /**
  * The rule rows as a leg judges them: each row as spelled, and — for every location on the way to the row's HEAD (each
- * leading part of it: the anchor's children down to the head itself) that the environment resolves to another spelling
- * (a link or firmlink: `/tmp` → `/private/tmp`, `/var` → `/private/var`, a project root, a home entry or a directory
- * inside the rule reached through a symlink) — the same row at that spelling: a path at or below the resolved location
- * is judged as its spelling at or below that part. Every read and write face judges the CANONICAL key of a target beside
- * its spelled view, so a row whose head is spelled through a link would otherwise never meet a target named by its real
- * location — whether the row was written with the short spelling and the call with the long one, or the reverse. Every
- * part, not the head alone: a link inside the rule's literal prefix that is re-pointed after the rows were placed still
- * meets the row through the parts above it (`<real root>/alias/**` holds when `alias` moves). One rule for every row
- * form (absolute, home, root, working directory, directory): the reference compiles the same "physical twin" of every
- * deny / ask rule's literal prefix (cli280.js `ei` 9766583, compiled in `mt` 9767083). `leadsTo` is the leg's resolution,
- * the one the faces mint their keys with (`undefined` = could not resolve: no twin there); each location is resolved
- * once, and a part that only extends its parent's resolution adds no row.
+ * leading part of it) that the environment resolves to another spelling (a link or firmlink: `/tmp` → `/private/tmp`,
+ * `/var` → `/private/var`, a project root, a home entry or a directory inside the rule reached through a symlink) — the
+ * same row at that spelling, right after it: a path at or below the resolved location is judged as its spelling at or
+ * below that part. Every part, not the head alone: a link inside the rule's literal prefix that is re-pointed after the
+ * rows were placed still meets the row through the parts above it. One rule for every row form and every judge (the
+ * gate's lanes and the deny tables): the reference compiles the same "physical twin" of every deny / ask rule's literal
+ * prefix (cli280.js `ei` 9766583, compiled in `mt` 9767083). `leads` is the leg's resolution of each part (absent or
+ * `undefined` = no twin there); a part that only extends its parent's resolution adds no row. A twin is the row's own
+ * kind (it keeps every member but the head), so a judgment reports the rule the twin stands for.
  */
-export declare function withRuleRowsWhereTheyLead(rows: readonly PathRuleDenyRow[], leadsTo: (head: string) => Promise<string | undefined>): Promise<PathRuleDenyRow[]>;
+export declare function rowsWhereTheyLead<R extends JudgedPathRow>(rows: readonly R[], leads: ReadonlyMap<string, string | undefined>): R[];
+/** Where the location `path` itself leads in a leg's resolution (`leads`, keyed by each leading part — the parts
+ *  {@link ruleHeadParts} names): `undefined` when the leg did not resolve it or it leads to its own spelling. */
+export declare function locationLeadsTo(path: string, leads: ReadonlyMap<string, string | undefined>): string | undefined;
+/** {@link rowsWhereTheyLead} with each part resolved by `leadsTo` (the leg's resolution; each part once). */
+export declare function withRuleRowsWhereTheyLead<R extends JudgedPathRow>(rows: readonly R[], leadsTo: (head: string) => Promise<string | undefined>): Promise<R[]>;
 /**
  * The WRITE face of the deny table: the rule rows whose faces include `write` — the judge the shell station reads for a
  * command's write targets (a redirection, `tee`, `sed -i`, `cp` / `mv` / `touch` / `mkdir` / `rm` operands). Same row
- * type, same judgment (`ruleRowHit`) as the read face's rule rows; a hit names the row by its rule text.
+ * type, same judgment ({@link pathRowsReach}) as the read face's rule rows; a hit names the row by its rule text.
  */
 export interface WriteDenyMatcher {
     /** Which face this judge is — the write tools' path resolution reads it to word and code the refusal as a write. */

package/dist/tools/fs/read-deny.js

@@ -12,32 +12,62 @@ export function readDenyRunHead(run) {
     return wild === -1 ? segments.length : wild;
 }
 export const DENY_FACES = Object.freeze(["read", "write"]);
-export async function withRuleRowsWhereTheyLead(rows, leadsTo) {
-    const leads = new Map();
-    const partsOf = (head) => {
-        const family = pathFamilyOf({ root: head });
-        const id = pathIdentityOf(head, family, head);
-        if (!id.ok)
-            return [head];
-        const unc = id.identity.startsWith("//");
-        const segments = id.identity.split("/").filter((seg) => seg !== "");
-        const parts = [];
-        for (let k = unc ? 2 : 1; k <= segments.length; k++)
-            parts.push(spellingOfIdentity(`${unc ? "//" : "/"}${segments.slice(0, k).join("/")}`, family));
-        return parts.length > 0 ? parts : [head];
-    };
-    const partsByRow = rows.map((row) => (row.head === undefined ? [] : partsOf(row.head)));
-    for (const parts of partsByRow)
-        for (const part of parts)
-            if (!leads.has(part))
-                leads.set(part, leadsTo(part).catch(() => undefined));
+const REACHED = { reach: "reached" };
+const NOT_REACHED = { reach: "not_reached" };
+const reachOf = (row, spelled) => row.reach?.(spelled) ?? (row.reaches(spelled) ? REACHED : NOT_REACHED);
+export function pathRowsReach(rows, views, direction) {
+    if (direction === "allow") {
+        if (views.unreadable !== undefined || views.spellings.length === 0)
+            return undefined;
+        for (const row of rows)
+            if (views.spellings.every((v) => reachOf(row, v).reach === "reached"))
+                return { row };
+        return undefined;
+    }
+    let held;
+    for (const row of rows) {
+        if (views.unreadable !== undefined)
+            held ??= { row, unreadable: views.unreadable };
+        for (const view of views.spellings) {
+            const r = reachOf(row, view);
+            if (r.reach === "reached")
+                return { row, view };
+            if (r.reach === "unreadable")
+                held ??= { row, unreadable: r.reason };
+        }
+    }
+    return held;
+}
+export function ruleHeadParts(rows) {
+    const out = new Set();
+    for (const row of rows)
+        if (row.head !== undefined)
+            for (const part of partsOf(row.head))
+                out.add(part);
+    return [...out];
+}
+function partsOf(head) {
+    const family = pathFamilyOf({ root: head });
+    const id = pathIdentityOf(head, family, head);
+    if (!id.ok)
+        return [head];
+    const unc = id.identity.startsWith("//");
+    const segments = id.identity.split("/").filter((seg) => seg !== "");
+    const parts = [];
+    for (let k = unc ? 2 : 1; k <= segments.length; k++)
+        parts.push(spellingOfIdentity(`${unc ? "//" : "/"}${segments.slice(0, k).join("/")}`, family));
+    return parts.length > 0 ? parts : [head];
+}
+export function rowsWhereTheyLead(rows, leads) {
     const out = [];
-    for (const [i, row] of rows.entries()) {
+    for (const row of rows) {
         out.push(row);
+        if (row.head === undefined || leads.size === 0)
+            continue;
         let parentLed;
         let parentPart;
-        for (const part of partsByRow[i]) {
-            const led = await leads.get(part);
+        for (const part of partsOf(row.head)) {
+            const led = leads.get(part);
             const extendsParent = led !== undefined && parentLed !== undefined && parentPart !== undefined && sameLocation(led, `${parentLed.replace(/[\\/]+$/, "")}/${part.slice(parentPart.replace(/[\\/]+$/, "").length).replace(/^[\\/]+/, "")}`);
             const twin = extendsParent ? undefined : rowLedTo(row, part, led);
             if (twin !== undefined)
@@ -48,6 +78,15 @@ export async function withRuleRowsWhereTheyLead(rows, leadsTo) {
     }
     return out;
 }
+export function locationLeadsTo(path, leads) {
+    const parts = partsOf(path);
+    return leads.get(parts[parts.length - 1]);
+}
+export async function withRuleRowsWhereTheyLead(rows, leadsTo) {
+    const parts = ruleHeadParts(rows);
+    const led = await Promise.all(parts.map((part) => leadsTo(part).catch(() => undefined)));
+    return rowsWhereTheyLead(rows, new Map(parts.map((part, i) => [part, led[i]])));
+}
 function sameLocation(a, b) {
     const family = pathFamilyOf({ root: a });
     const x = pathIdentityOf(a, family, a);
@@ -65,50 +104,60 @@ function rowLedTo(row, head, at) {
     const base = from.identity;
     const under = base.endsWith("/") ? base : `${base}/`;
     const onto = to.identity.endsWith("/") ? to.identity.slice(0, -1) : to.identity;
+    const mapped = (absolutePath) => {
+        const id = pathIdentityOf(absolutePath, family, head);
+        if (!id.ok)
+            return undefined;
+        if (id.identity === base)
+            return to.identity;
+        return id.identity.startsWith(under) ? `${onto}/${id.identity.slice(under.length)}` : undefined;
+    };
+    const { head: _head, ...rest } = row;
+    const reach = row.reach;
     return {
-        rule: row.rule,
-        tool: row.tool,
-        pattern: row.pattern,
-        faces: row.faces,
+        ...rest,
         reaches: (absolutePath) => {
-            const id = pathIdentityOf(absolutePath, family, head);
-            if (!id.ok)
-                return false;
-            if (id.identity === base)
-                return row.reaches(to.identity);
-            return id.identity.startsWith(under) && row.reaches(`${onto}/${id.identity.slice(under.length)}`);
+            const m = mapped(absolutePath);
+            return m !== undefined && row.reaches(m);
         },
+        ...(reach !== undefined
+            ? {
+                reach: (absolutePath) => {
+                    const m = mapped(absolutePath);
+                    return m === undefined ? NOT_REACHED : reach(m);
+                },
+            }
+            : {}),
     };
 }
-function ruleRowHit(rows, face, path) {
-    for (const r of rows)
-        if (r.faces.includes(face) && r.reaches(path))
-            return r;
-    return undefined;
+function ruleRowsHit(rows, face, spellings) {
+    const onFace = rows.filter((r) => r.faces.includes(face));
+    return onFace.length === 0 ? undefined : pathRowsReach(onFace, { spellings }, "tighten");
 }
 export function compileWriteDeny(rules = []) {
     const ruleRows = rules.filter((r) => r.faces.includes("write"));
     const matchPath = (path) => {
-        const hit = ruleRowHit(ruleRows, "write", path);
-        return hit === undefined ? null : { pattern: hit.rule };
+        const hit = ruleRowsHit(ruleRows, "write", [path]);
+        return hit === undefined ? null : { pattern: hit.row.rule };
     };
-    return { face: "write", ruleRows, matchPath, matchTarget: (canonicalKey, lexicalView, opts) => matchTargetOver(matchPath, canonicalKey, lexicalView, opts) };
+    return { face: "write", ruleRows, matchPath, matchTarget: (canonicalKey, lexicalView, opts) => matchTargetOver(() => null, ruleRows, "write", canonicalKey, lexicalView, opts) };
 }
-function matchTargetOver(matchPath, canonicalKey, lexicalView, opts) {
-    const canonical = matchPath(canonicalKey, opts);
+function matchTargetOver(segmentPath, ruleRows, face, canonicalKey, lexicalView, opts) {
+    const canonical = segmentPath(canonicalKey, opts);
     if (canonical !== null)
         return { ...canonical, matchedView: canonicalKey };
     if (lexicalView !== undefined) {
-        const lexical = matchPath(lexicalView);
+        const lexical = segmentPath(lexicalView);
         if (lexical !== null)
             return { ...lexical, matchedView: lexicalView };
     }
     for (const hop of opts?.hops ?? []) {
-        const viaHop = matchPath(hop);
+        const viaHop = segmentPath(hop);
         if (viaHop !== null)
             return { ...viaHop, matchedView: hop };
     }
-    return null;
+    const hit = ruleRowsHit(ruleRows, face, [canonicalKey, ...(lexicalView !== undefined ? [lexicalView] : []), ...(opts?.hops ?? [])]);
+    return hit === undefined ? null : { pattern: hit.row.rule, matchedView: hit.view ?? canonicalKey };
 }
 export function readDenySeat(matcher) {
     const entries = [...(matcher?.entries ?? []).map((e) => e.pattern), ...(matcher?.ruleRows ?? []).map((r) => r.rule)];
@@ -195,6 +244,7 @@ export const READ_FACE_BUILTIN_DENY_TABLE = [
     { pattern: "~/.mcp.json", tier: "agent-config" },
     { pattern: "~/.ai-agent/.env", tier: "agent-config" },
     { pattern: "~/.sema/engine-data/.env", tier: "agent-config" },
+    { pattern: "~/.sema/config-lkg-*.json", tier: "agent-config" },
     { pattern: "~/.codex/config.toml", tier: "agent-config" },
     { pattern: "~/.cursor/mcp.json", tier: "agent-config" },
     { pattern: "~/.continue/config.json", tier: "agent-config" },
@@ -461,18 +511,22 @@ export function compileReadDeny(additions = [], layer = "additions", builtin, ru
             return { pattern: hit };
         return ruleRows.length === 0 ? null : { pattern: ruleRows[0].rule };
     };
-    const matchPath = (path, opts) => {
+    const segmentPath = (path, opts) => {
         const hit = matchSegmentPatterns(path, judged, opts);
+        return hit === null ? null : { pattern: hit };
+    };
+    const matchPath = (path, opts) => {
+        const hit = segmentPath(path, opts);
         if (hit !== null)
-            return { pattern: hit };
-        const rule = ruleRows.length === 0 || opts?.walked === true ? undefined : ruleRowHit(ruleRows, "read", path);
-        return rule === undefined ? null : { pattern: rule.rule };
+            return hit;
+        const rule = ruleRows.length === 0 || opts?.walked === true ? undefined : ruleRowsHit(ruleRows, "read", [path]);
+        return rule === undefined ? null : { pattern: rule.row.rule };
     };
     return {
         entries: normalized,
         ...(ruleRows.length > 0 ? { ruleRows } : {}),
         matchPath,
-        matchTarget: (canonicalKey, lexicalView, opts) => matchTargetOver(matchPath, canonicalKey, lexicalView, opts),
+        matchTarget: (canonicalKey, lexicalView, opts) => matchTargetOver(segmentPath, ruleRows, "read", canonicalKey, lexicalView, opts),
         rgExclusionGlobs,
         rgProbeGlobs,
         unexcludableUnder,

package/dist/tools/fs/removal-targets.d.ts

@@ -0,0 +1,83 @@
+import { type EstablishedPlan } from "./shell-read-establish.js";
+import type { ExecutionEnv } from "../../internal/harness-types.js";
+import type { ToolCallRequest } from "../../core/tool-policy.js";
+/** The REMOVAL programs — the reference implementation's dangerous-removal arm reads `rm` and `rmdir`, with or without a
+ *  recursive option (removing an empty home or the task root is still removing it). */
+export declare const SHELL_REMOVAL_COMMANDS: readonly ["rm", "rmdir"];
+export type ShellRemovalCommand = (typeof SHELL_REMOVAL_COMMANDS)[number];
+/** What makes a removal target dangerous, in the order a card names it. `runtime_script`: a shell's script text is built
+ *  only when the command runs, and what it may run includes a removal nobody can read before it does. */
+export type DangerousRemovalKind = "filesystem_root" | "home" | "workspace" | "top_level" | "runtime_script";
+/** The protected locations a removal is judged against. `homes`: the environment's declared home and every other spelling
+ *  of it (its canonical one); `workspace`: the task root, the working directory, the additional working directories. */
+export interface RemovalSeat {
+    readonly homes: readonly string[];
+    readonly workspace: readonly string[];
+}
+/** One dangerous removal a command makes: the program (the removal program, or the shell a runtime-built script is handed
+ *  to), the operand as written, the target as established (the script word as written, for `runtime_script`). */
+export interface DangerousRemoval {
+    readonly kind: DangerousRemovalKind;
+    readonly program: string;
+    readonly operand: string;
+    readonly target: string;
+}
+/**
+ * The ONE dangerous-removal predicate: is removing this absolute path removing a protected location? The reference
+ * implementation's set (cli 2.1.291 `dme` / `xW`) — the filesystem root (a drive root, a UNC share root), a home directory
+ * (every spelling the seat holds), a workspace directory or any of its ANCESTORS (the task root, the working directory, an
+ * additional working directory — whether the home lies inside the task root or the task root inside the home), a top-level
+ * directory (one segment below the root). `undefined` for a relative path or any other target.
+ */
+export declare function dangerousRemovalOf(path: string, seat: RemovalSeat): DangerousRemovalKind | undefined;
+/** What one removal finding asks: a protected location (`dangerous_delete`), or a target the command builds from a value
+ *  of its own that the guard cannot read (`unverifiable_delete`). */
+export type RemovalFinding = (DangerousRemoval & {
+    readonly guard: "dangerous_delete";
+}) | {
+    readonly guard: "unverifiable_delete";
+    readonly program: string;
+    readonly operand: string;
+    readonly name: string;
+};
+/**
+ * The removal findings of an established plan — ONE walk, nested plans included (a `bash -c` / `sh -c` text, a substitution
+ * body), two words. For every `rm` / `rmdir` segment, each of its OPERANDS (every write target that is not one of its
+ * option words: a word some implementation's reading of the program's row writes, {@link writeReadings}) as the plan
+ * established it on the WRITE face (the entry the program unlinks, and the deny-floor shadow of a home word the plan did
+ * not place) is judged by {@link dangerousRemovalOf}; an operand the plan could not place that expands a name the command
+ * itself binds is judged in every spelling those bindings give it ({@link boundSpellingsOf}), and one with a binding this
+ * reading cannot read is an unverifiable target (a recursive forced removal, {@link recursiveForce}). A shell handed a
+ * script built only when the command runs is a dangerous removal of its own ({@link runtimeScriptOf}). The read-face copy
+ * of an operand is not judged: it follows a link the removal does not follow.
+ */
+export declare function removalFindingsOf(established: EstablishedPlan, seat: RemovalSeat): RemovalFinding[];
+/** Does any segment of this plan (nested plans included) run a removal program, or hand a shell a script built when it
+ *  runs? The guard establishes nothing for a command that does neither. */
+export declare function planRunsRemoval(plan: EstablishedPlan["plan"]): boolean;
+/** What the removal guard asks for one command: the guard word and its sentence's account — the first protected location
+ *  (the program, the location, the target), else the first bound value the guard cannot read; `undefined` when neither. */
+export interface RemovalVerdict {
+    readonly guard: RemovalFinding["guard"];
+    readonly text: string;
+}
+/**
+ * The seat the dangerous-removal arm of the removal guard (`createUnverifiableDeletePolicy`, tool-policy.ts) reads, beside the request's own `root` /
+ * `cwd` (the task root and the live working directory): the execution environment (its declared home — the `HOME` the
+ * shell child receives, the same seat the read station folds `~` / `$HOME` with — and its resolver, so a target that
+ * resolves through a link is judged where it lands), and the leg's additional working directories.
+ */
+export interface RemovalGuardSeat {
+    readonly env?: ExecutionEnv;
+    readonly additionalRoots?: () => readonly string[];
+}
+/**
+ * The dangerous-removal READING of one command — undefined when no segment of it (nested shell text included) runs a
+ * removal program, so a command that removes nothing costs the gate no suspension. Otherwise `judge` establishes the plan
+ * the read station plans (the same planner, the same write-target reading) lexically against the request's `cwd` and the
+ * seat's home, and — where an environment is seated — through its resolver too, and returns what either establishment
+ * finds ({@link removalFindingsOf}: the protected-location word first, then the unverifiable one).
+ */
+export declare function removalReadingOf(command: string, req: Pick<ToolCallRequest, "cwd" | "root">, seat: RemovalGuardSeat | undefined): {
+    judge(signal?: AbortSignal): Promise<RemovalVerdict | undefined>;
+} | undefined;