@sema-agent/core 7.46.0 → 7.48.0

package/dist/core/tool-name-readings.d.ts

@@ -69,6 +69,10 @@ export declare const NAME_READINGS: {
         readonly kind: "wire";
         readonly file: string;
     };
+    readonly "gate.askFace": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
     readonly "fold.readStation": {
         readonly kind: "seat";
         readonly rank: "member";
@@ -251,6 +255,10 @@ export declare const NAME_READINGS: {
         readonly kind: "wire";
         readonly file: string;
     };
+    readonly "inherited.askFace": {
+        readonly kind: "wire";
+        readonly file: string;
+    };
     readonly "park.contentKindProjection": {
         readonly kind: "wire";
         readonly file: string;

package/dist/core/tool-name-readings.js

@@ -19,6 +19,7 @@ export const NAME_READINGS = {
     "gate.sandboxBoundary.egress": any(CHAIN),
     "gate.sandboxBoundary.hand": wire(CHAIN),
     "gate.preToolUse": wire("src/core/hooks.ts"),
+    "gate.askFace": wire("src/core/runner/gate-exit.ts"),
     "fold.readStation": seat("member", "src/tools/fs/shell-read-check.ts"),
     "lanes.contentQuestionClass": any(LANES),
     "lanes.readOnlyShellAllow": wire(LANES),
@@ -63,6 +64,7 @@ export const NAME_READINGS = {
     "activity.sink": spelling(HANDLERS),
     "reconcile.orphanEffect": spelling("src/core/session-reconcile.ts"),
     "inherited.questionFloat": wire(CHAIN),
+    "inherited.askFace": wire(CHAIN),
     "park.contentKindProjection": wire("src/core/checkpoint-store.ts"),
     "resume.contentAskRow": wire("src/core/runner/decide-continuation.ts"),
     "resume.editRecheckQuestionSkip": wire("src/core/runner/resume-apply.ts"),

package/dist/core/tool-policy.d.ts

@@ -977,13 +977,14 @@ export declare function createApprovalPolicy(opts: {
  */
 export declare function combinePolicies(...policies: ToolPolicy[]): ToolPolicy;
 /**
- * The shell tools whose `{ command }` arg a coarse command-name policy parses; other tools are out of scope. `Monitor`
- * belongs here: it runs an arbitrary shell `command` through the same env seam as Bash, so the always-on parity gates
- * keyed on this list reach it too (a list of `Bash` alone let the identical command run ungated as `Monitor`). EXPORTED:
- * a downstream governance layer keeps its own copy of this list so its per-command ask-list gates the same tools core
- * does — the list itself is the fact, and publishing it removes the guess.
+ * The shell tools whose `{ command }` arg a coarse command-name policy parses; other tools are out of scope. It is the
+ * catalog's shell face ({@link shellFaceToolNames} — every definition whose `command` the command grammar judges, `Monitor`
+ * among them: it runs an arbitrary shell `command` through the same env seam as Bash), spelled out for the wire; the
+ * catalog's shell face is the truth, and a lockstep pin keeps the two one (a catalog row added or dropped turns it red):
+ * the always-on parity gates keyed on it, the `Bash(...)` rules and the shell seat reach the same tools. EXPORTED: a
+ * downstream governance layer reads it so its per-command ask-list gates the same tools core does.
  */
-export declare const COARSE_SHELL_TOOLS: string[];
+export declare const COARSE_SHELL_TOOLS: readonly ["Bash", "Monitor"];
 /**
  * design/center §10 — a COARSE allow/deny gate keyed on the LEADING command NAME (`argv[0]`) of a single
  * simple shell command. It reuses the ONE shared simple-command parser
@@ -1033,7 +1034,7 @@ export declare function createCoarseCommandNamePolicy(opts: {
     deny?: string[];
     /** What to do for a command not matched by `allow` (or un-parseable): `"ask"` (default) or `"deny"`. */
     defaultAction?: "ask" | "deny";
-    /** Override the shell tool names this gate parses (default `Bash` — bash + bash_readonly share the CC name). */
+    /** Override the shell tool names this gate parses (default {@link COARSE_SHELL_TOOLS}, the shell face). */
     tools?: string[];
 }): ToolPolicy;
 export declare function findUnverifiableRecursiveDelete(command: string, safeVars?: ReadonlySet<string>): string | undefined;
@@ -1112,7 +1113,7 @@ export declare function createUnverifiableDeletePolicy(opts?: {
      *  the default was `TMPDIR` alone, reading STRICTER than the gate really is; `HOME`/`PWD` are a
      *  registered sema divergence from CC's temp-only carve-out, see the RB-340 note there). */
     safeVars?: readonly string[];
-    /** Override the shell tool names this gate parses (default `Bash`). */
+    /** Override the shell tool names this gate parses (default {@link COARSE_SHELL_TOOLS}, the shell face). */
     tools?: string[];
     removalSeat?: RemovalGuardSeat;
 }): ToolPolicy;
@@ -1121,7 +1122,7 @@ export declare function createTranscriptIntegrityPolicy(opts?: {
     sessionsDirs?: readonly string[];
     /** argv[0] allowlist for read-only access to the transcript dir (default {@link BASH_READONLY_DEFAULT_ALLOW}). */
     readAllow?: readonly string[];
-    /** Override the shell tool names this gate parses (default `Bash`). */
+    /** Override the shell tool names this gate parses (default {@link COARSE_SHELL_TOOLS}, the shell face). */
     tools?: string[];
 }): ToolPolicy;
 /**

package/dist/core/tool-policy.js

@@ -10,7 +10,7 @@ export { policyCannotAnswer, rowDemandsAPerson } from "./real-approval.js";
 import { sanitizeAutoModeArmingRecipe } from "./auto-mode-arming.js";
 import { join, normalize as normalizePath, sep } from "node:path";
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
-import { protectivePathTargetOf } from "./tool-registry.js";
+import { protectivePathTargetOf, shellFaceToolNames } from "./tool-registry.js";
 import { heldBy } from "./tool-name-readings.js";
 import { boundInputHashOf } from "./canonical-json.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY } from "./untrusted-text.js";
@@ -642,7 +642,7 @@ export function combinePolicies(...policies) {
         },
     };
 }
-export const COARSE_SHELL_TOOLS = ["Bash", "Monitor"];
+export const COARSE_SHELL_TOOLS = Object.freeze(["Bash", "Monitor"]);
 function canonicalToolNameSet(tools) {
     return new Set(tools ?? COARSE_SHELL_TOOLS);
 }
@@ -725,7 +725,7 @@ function assignmentTokenSpan(tokens, i) {
     return 1;
 }
 function valueIsOpaque(value, assigned, safeVars) {
-    const v = value.replace(/["']/g, "");
+    const v = value.replace(/["']/g, "").replace(/\\(.)/g, "$1");
     if (v.includes("$(") || v.includes("`"))
         return true;
     if (/\$[@*#!?0-9-]/.test(v))
@@ -734,11 +734,12 @@ function valueIsOpaque(value, assigned, safeVars) {
         return true;
     for (const vm of v.matchAll(/\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?/g)) {
         const ref = vm[1];
-        if (!assigned.has(ref) && !safeVars.has(ref))
+        if (!assigned.has(ref) && !(safeVars.has(ref) && safeRootBelow(v.slice((vm.index ?? 0) + vm[0].length))))
             return true;
     }
     return false;
 }
+const safeRootBelow = (after) => /^\/[^*?[\]]+$/.test(after) && !after.split("/").includes("..");
 export function findUnverifiableRecursiveDelete(command, safeVars = new Set(UNVERIFIABLE_DELETE_SAFE_VARS)) {
     const assigned = new Set();
     const assignedEscapesRoot = new Set();
@@ -887,9 +888,7 @@ export function findUnverifiableRecursiveDelete(command, safeVars = new Set(UNVE
                     return `\`rm\` recursive+force target ${raw} resolves through ${name}, whose in-window value climbs above a known-safe root (\`..\`) — the deleted path cannot be verified from this command`;
                 }
                 if (safeVars.has(name)) {
-                    const after = targetNorm.slice((vm.index ?? 0) + vm[0].length);
-                    const escapesRoot = after.split("/").includes("..");
-                    if (/^\/[^*?[\]]+$/.test(after) && !escapesRoot)
+                    if (safeRootBelow(targetNorm.slice((vm.index ?? 0) + vm[0].length)))
                         continue;
                 }
                 return `\`rm\` recursive+force target ${raw} references $${name}, which has no assignment in this command — an empty or unexpected value could make this a home-directory or filesystem-root wipe`;

package/dist/core/tool-registry.d.ts

@@ -25,6 +25,15 @@ export declare function catalogToolNames(): ReadonlySet<string>;
 export declare function pathConfinableWriteToolNames(): ReadonlySet<string>;
 /** A-8 — every definition that names a path target at all (read or write): the file-tool glob lane. */
 export declare function pathTargetingToolNames(): ReadonlySet<string>;
+/**
+ * The SHELL FACE: every definition whose `command` argument is a shell command line the command grammar judges (today the two
+ * `Bash` definitions and `Monitor`). A `Bash(<command>)` rule reaches a call that answers to any of these names; the coarse
+ * command-name gate's default list, the shell read station and the shell seat are this set. Derived from the rows' rule faces,
+ * never a list of its own.
+ */
+export declare function shellFaceToolNames(): ReadonlySet<string>;
+/** {@link shellFaceToolNames}' membership for one name — any definition under the name on the shell face. */
+export declare function isShellFaceToolName(name: string): boolean;
 /** The tools whose declared path target is a READ (a file read, a search root): the file read station's membership. */
 export declare function readTargetToolNames(): ReadonlySet<string>;
 /** A-10 — the micro-compaction whitelist (`compactable: true`). */

package/dist/core/tool-registry.js

@@ -29,6 +29,16 @@ export function pathConfinableWriteToolNames() {
 export function pathTargetingToolNames() {
     return names((e) => e.face.pathTarget !== undefined);
 }
+const onShellFace = (e) => e.face.ruleFace?.grammar === "command";
+export function shellFaceToolNames() {
+    return names(onShellFace);
+}
+export function isShellFaceToolName(name) {
+    for (const e of TOOL_CATALOG_ENTRIES)
+        if (e.name === name && onShellFace(e))
+            return true;
+    return false;
+}
 export function readTargetToolNames() {
     return names((e) => e.face.pathTarget?.access === "read");
 }

package/dist/core/write-protect.d.ts

@@ -1,5 +1,6 @@
 import type { ExecutionEnv } from "../internal/harness-types.js";
 import type { PermissionResult } from "./tool-policy.js";
+import { type AskFace } from "./ask-origin.js";
 import { type ToolCallLike } from "./tool-registry.js";
 /**
  * How one table row matches the judged path:
@@ -209,11 +210,17 @@ export declare function compileWriteProtection(entries?: readonly WriteProtected
  *    message (table names are deployment-validated vocabulary); the model-authored target path deliberately
  *    does not — `message` is the classifier's `askMessage`, and the approval card already shows the args. The
  *    spelling form's sentence is the historical one byte for byte; the target form says the target RESOLVED.
- *  · `unresolvable` ⇒ `deny` naming the cause: an unjudged target is never vouched, and an ask would be a
- *    question about a file nobody can name — the rule the canonicalizing deny set follows for the same reason.
+ *  · `unresolvable` ⇒ read by the call's FACE (`face`, {@link releasableAskClassesFor}): where no permission mode releases
+ *    `write_protection_unresolved` (the file face) — `deny` naming the cause: an unjudged target is never vouched (the rule
+ *    the canonicalizing deny set follows for the same reason), so there a standing allow is refused while a standing ask
+ *    carrying the record stays a person's question in the modes that ask (dontAsk and bypassPermissions refuse it); where
+ *    a mode may release the class (the shell face) — `ask` (`safety`)
+ *    naming the cause, which the mode arbitration answers exactly as it answers that record over a standing ask
+ *    (bypassPermissions releases it, default puts it to a person, dontAsk refuses): on that face alone a standing allow
+ *    reads as a standing ask.
  *  · `clear` ⇒ `undefined`: the surviving decision stands.
  */
-export declare function writeProtectionTightenDecision(toolName: string, verdict: WriteProtectionVerdict): PermissionResult | undefined;
+export declare function writeProtectionTightenDecision(toolName: string, verdict: WriteProtectionVerdict, face: AskFace): PermissionResult | undefined;
 /**
  * @contract write_protection.verdict_is_the_mandate — the judge's two non-clear verdicts are the two facts
  * a standing allow rule may not retire, and `clear` is neither: a MATCHED row is the mandate a live decider

package/dist/core/write-protect.js

@@ -1,3 +1,4 @@
+import { releasableAskClassesFor } from "./ask-origin.js";
 import { canonicalizeTarget, isWinFormPath, writeTargetPath, isUncPath, isAbsoluteForFamily, joinForFamily, pathFamilyOf } from "../tools/fs/safety.js";
 import { protectivePathTargetOf } from "./tool-registry.js";
 import { pathTargetBaseOf } from "./effective-path-target.js";
@@ -346,7 +347,7 @@ export function compileWriteProtection(entries, opts) {
         },
     };
 }
-export function writeProtectionTightenDecision(toolName, verdict) {
+export function writeProtectionTightenDecision(toolName, verdict, face) {
     if (verdict.kind === "hit") {
         return {
             action: "ask",
@@ -359,6 +360,15 @@ export function writeProtectionTightenDecision(toolName, verdict) {
         };
     }
     if (verdict.kind === "unresolvable") {
+        if (releasableAskClassesFor(face).includes("write_protection_unresolved")) {
+            return {
+                action: "ask",
+                message: verdict.unresolvedSymlink
+                    ? `tool "${toolName}" writes to a symlink whose real target could not be resolved, so the write-protection judge cannot tell whether it lands on a protected path (${verdict.cause}) — explicit approval required`
+                    : `tool "${toolName}" writes to a target that could not be resolved on this tree, so the write-protection judge cannot tell whether it lands on a protected path (${verdict.cause}) — explicit approval required`,
+                decisionReason: "safety",
+            };
+        }
         return {
             action: "deny",
             message: verdict.unresolvedSymlink

package/dist/index.d.ts

@@ -197,7 +197,7 @@ export { createAllowDenyPolicy, createApprovalPolicy,
 type ApprovalSeatOutcome, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, abortedSeatDeny, receiveHookResult, isEngineRefusal, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathRules, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export { type ReadRootGrantScreen } from "./core/read-root-grant-screen.js";
 export { type AskOrigin, ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL, PERSISTED_RULE_MANDATES, type PersistedRuleMandate, isPersistedRuleMandate, screenAskClassMembers } from "./core/ask-origin.js";
-export { PERMISSION_MODES, type PermissionMode, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, type AskClass, isAskClass, MODE_ARBITRATION, type ModeArbitrationRow, RELEASABLE_ASK_CLASSES, MODE_RELEASE_REASONS, type ModeReleaseReason, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, type AskClassification, type AskClassFacts, type ToolMarkSource, arbitrateByMode, type Arbitration, fileCommandOptionsSentence } from "./core/ask-origin.js";
+export { PERMISSION_MODES, type PermissionMode, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, type AskClass, isAskClass, MODE_ARBITRATION, type ModeArbitrationRow, ASK_FACES, type AskFace, askFaceOf, releasableAskClassesFor, MODE_RELEASE_REASONS, type ModeReleaseReason, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, type AskClassification, type AskClassFacts, type ToolMarkSource, arbitrateByMode, type Arbitration, fileCommandOptionsSentence } from "./core/ask-origin.js";
 export { modePolicyOf, type ModePolicy, PERMISSION_MODE_FOLD_REASONS, type PermissionModeFoldReason, type PermissionModeReceipt, ACCEPT_EDITS_FILE_COMMANDS, modeAcceptsFileCommand } from "./core/mode-policy.js";
 export type { PermissionSeatInputs, PermissionSeatReading } from "./core/mode-policy.js";
 export type { SkillGateSeats, SkillGrantHit, SkillGrantLane, SkillGrantOrigin, SkillGrantRecord } from "./core/skill-grant.js";

package/dist/index.js

@@ -162,7 +162,7 @@ export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.
 export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, abortedSeatDeny, receiveHookResult, isEngineRefusal, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathRules, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export {} from "./core/read-root-grant-screen.js";
 export { ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL, PERSISTED_RULE_MANDATES, isPersistedRuleMandate, screenAskClassMembers } from "./core/ask-origin.js";
-export { PERMISSION_MODES, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, isAskClass, MODE_ARBITRATION, RELEASABLE_ASK_CLASSES, MODE_RELEASE_REASONS, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, arbitrateByMode, fileCommandOptionsSentence } from "./core/ask-origin.js";
+export { PERMISSION_MODES, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, isAskClass, MODE_ARBITRATION, ASK_FACES, askFaceOf, releasableAskClassesFor, MODE_RELEASE_REASONS, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, arbitrateByMode, fileCommandOptionsSentence } from "./core/ask-origin.js";
 export { modePolicyOf, PERMISSION_MODE_FOLD_REASONS, ACCEPT_EDITS_FILE_COMMANDS, modeAcceptsFileCommand } from "./core/mode-policy.js";
 export { SKILL_GRANT_ORIGINS } from "./core/skill-grant.js";
 export { ALLOW_ENTRY_INERT_REASONS, compileAllowEntry, compileAllowList, renderListEntry } from "./core/allow-entry.js";

package/dist/orchestration/workflow.js

@@ -16,7 +16,7 @@ import { isWorkflowRunActive, closeWorkflowChannel, markWorkflowActive, publishW
 import { isDurablePause } from "../agents/suspend-guard.js";
 import { RUNNING_AGENT_OBSERVE_EVERY_BEATS } from "../config/defaults.js";
 import { boundInputHashOf } from "../core/canonical-json.js";
-import { boundedRedactedSummary } from "../core/untrusted-egress.js";
+import { boundedRedactedSummary, redactSecrets } from "../core/untrusted-egress.js";
 import { delimitUntrusted } from "../core/untrusted-text.js";
 import { OUTPUT_TOOL_NAME } from "../core/runner/synthetic-tools.js";
 import { deniedToolNamesOf } from "../core/runner/sub-agent-deny-lists.js";
@@ -2420,7 +2420,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
             run.endedAt = now();
             if (parkedLeg !== undefined && !thrownIs(err, WorkflowAgentParkedError))
                 err = parkedError();
-            run.error = thrownText(err);
+            run.error = redactSecrets(thrownText(err));
             closeAbandonedAgents(run.endedAt);
             {
                 let thrownCode;

package/dist/prompt-assembly/types.d.ts

@@ -146,7 +146,7 @@ export interface PackSectionDeclaration {
     /**
      * design/147 epoch declaration axis (ruling a): `"provider"` marks a section whose text came
      * from the typed `stableBlocks` lane (incl. the provider-assembled pass-through role) — the SELECTOR
-     * for the epoch artifactDigest's declaration input, so a config-center publish (declaration bytes
+     * for the epoch artifactDigest's declaration input, so a web-admin publish (declaration bytes
      * change) re-pins sessions at the next legal boundary. NOT a digest-disclosure gate
      * (that stays {@link declaredContentHash}-only): epoch digests are one-way hashes over the payload.
      */

package/dist/shell/lex.d.ts

@@ -103,6 +103,17 @@ export interface WordExpansion {
     readonly body?: string;
     /** The parameter name, where the expansion names one. */
     readonly name?: string;
+    /** A glob's pattern — absent where an expansion stands inside it (its text is not the pattern): `folded`, what the
+     *  program receives where it matches nothing — quotes removed, the spelling {@link LexedWord.folded} carries at its place
+     *  (`[^.]`); `written`, as written, quoting kept (`[^\.]`, `["!"a]`) — the text a shell re-reading it matches by;
+     *  `judged`, the spelling a reader judges the names it matches by — `folded`, save a class the judge reads as any one
+     *  character: one holding a quoted or escaped character (its quote-removed text reads another class: `["!"a]` is not
+     *  the negation `[!a]`) or a `[:…:]` / `[=…=]` / `[.….]` unit — spelled `?`, a superset of its members. */
+    readonly pattern?: {
+        readonly folded: string;
+        readonly written: string;
+        readonly judged: string;
+    };
 }
 export interface QuotedSpan {
     /** Offsets into {@link LexedWord.raw}, `[start, end)`; the quote characters belong to their span. */
@@ -143,6 +154,10 @@ export interface LexedWord {
     readonly kind: "word";
     readonly raw: string;
     readonly folded: string;
+    /** The spelling a reader judges the word's names by, where it is not `folded`: each bracket class holding a quoted or
+     *  escaped character or a `[:…:]` / `[=…=]` / `[.….]` unit spelled `?` (`["!"a]*`, `[[:alpha:]]*` ⇒ `?*`,
+     *  {@link WordExpansion.pattern}). */
+    readonly judged?: string;
     readonly pieces: readonly WordPiece[];
     readonly quotedSpans: readonly QuotedSpan[];
     /** The pieces that carry an expansion, in order. */

package/dist/shell/lex.js

@@ -357,6 +357,7 @@ class WordBuilder {
     marks = [];
     subscript;
     compound = false;
+    widenedClasses = [];
     begin(src) { if (!this.started)
         this.at = src; }
     push(w, f, by, src) {
@@ -402,6 +403,17 @@ class WordBuilder {
     mark(reason, rawAt) { this.marks.push({ at: rawAt, reason }); }
     inSubscript() { return this.subscript !== undefined && this.subscript.rawEnd === undefined; }
     foldedOf(r) { return r >= this.foldedAt.length ? this.folded.length : this.foldedAt[r]; }
+    classSpelled(from, to) {
+        let out = "";
+        let at = from;
+        for (const [a, b] of this.widenedClasses) {
+            if (a < at || b > to)
+                continue;
+            out += `${this.folded.slice(at, a)}?`;
+            at = b;
+        }
+        return out + this.folded.slice(at, to);
+    }
     slice(from, to) {
         const out = [];
         for (const p of this.pieces) {
@@ -519,9 +531,37 @@ class WordBuilder {
             else if (stack.length > 0 && (d === "," || (d === "." && this.raw[j + 1] === ".")))
                 stack[stack.length - 1].listed = true;
         }
-        const nextBracketClose = new Array(n + 1).fill(-1);
-        for (let j = n - 1; j >= 0; j--)
-            nextBracketClose[j] = readable(j) && this.raw[j] === "]" ? j : nextBracketClose[j + 1];
+        const text = this.folded;
+        const nf = text.length;
+        const readableAt = (f) => f < nf && readable(this.rawOfFolded[f]);
+        const unitClose = (d) => {
+            const at = new Array(nf + 2).fill(-1);
+            for (let f = nf - 2; f >= 0; f--)
+                at[f] = readableAt(f) && readableAt(f + 1) && text[f] === d && text[f + 1] === "]" ? f : at[f + 1];
+            return at;
+        };
+        const unitCloses = new Map([":", "=", "."].map((d) => [d, unitClose(d)]));
+        const lettersEnd = new Array(nf + 1).fill(nf);
+        for (let f = nf - 1; f >= 0; f--) {
+            const lower = text.charCodeAt(f) | 0x20;
+            lettersEnd[f] = lower >= 0x61 && lower <= 0x7a && readableAt(f) ? lettersEnd[f + 1] : f;
+        }
+        const unitEndAt = (f) => {
+            if (!(readableAt(f) && text[f] === "[" && readableAt(f + 1)))
+                return -1;
+            const d = text[f + 1];
+            const end = unitCloses.get(d)?.[f + 2] ?? -1;
+            if (end < 0)
+                return -1;
+            return d === ":" ? (end > f + 2 && lettersEnd[f + 2] === end ? end : -1) : end === f + 3 ? end : -1;
+        };
+        const nextBracketClose = new Array(nf + 2).fill(-1);
+        const nextSlash = new Array(nf + 1).fill(nf);
+        for (let f = nf - 1; f >= 0; f--) {
+            const unitEnd = unitEndAt(f);
+            nextBracketClose[f] = readableAt(f) && text[f] === "]" ? f : unitEnd >= 0 ? nextBracketClose[unitEnd + 2] : nextBracketClose[f + 1];
+            nextSlash[f] = text[f] === "/" ? f : nextSlash[f + 1];
+        }
         const ranges = [];
         for (let k = 0; k < n; k++) {
             if (!readable(k))
@@ -536,19 +576,35 @@ class WordBuilder {
                 continue;
             }
             if (c === "*" || c === "?") {
-                ranges.push({ from: k, to: k + 1, exp: { kind: "glob", yields: "many" } });
+                ranges.push({ from: k, to: k + 1, exp: { kind: "glob", yields: "many", pattern: { folded: c, written: c, judged: c } } });
                 continue;
             }
             if (c === "[") {
-                let j = k + 1;
-                if (this.raw[j] === "!" || this.raw[j] === "^")
+                if (this.rawOfFolded[this.foldedOf(k)] !== k)
+                    continue;
+                let j = this.foldedOf(k) + 1;
+                if ((text[j] === "!" || text[j] === "^") && readableAt(j))
                     j++;
-                if (this.raw[j] === "]")
+                if (text[j] === "]" && readableAt(j))
                     j++;
-                const close = j < n ? nextBracketClose[j] : -1;
-                if (close < 0)
+                const closeAt = j < nf ? nextBracketClose[j] : -1;
+                if (closeAt < 0 || nextSlash[j] < closeAt)
                     continue;
-                ranges.push({ from: k, to: close + 1, exp: { kind: "glob", yields: "many", body: this.raw.slice(k + 1, close) } });
+                const close = this.rawOfFolded[closeAt];
+                let expands = false;
+                for (let m = k + 1; m < close && !expands; m++)
+                    expands = inExp[m] || braceClose.get(m)?.listed === true;
+                let widened = false;
+                for (let m = k + 1; m < close && !widened; m++)
+                    widened = this.rawQuoted[m] !== undefined;
+                for (let f = j; f < closeAt && !widened; f++)
+                    widened = readableAt(f) && text[f] === "[" && readableAt(f + 1) && (text[f + 1] === ":" || text[f + 1] === "=" || text[f + 1] === ".");
+                const from = this.foldedOf(k);
+                const to = this.foldedOf(close + 1);
+                if (!expands && widened)
+                    this.widenedClasses.push([from, to]);
+                const pattern = expands ? {} : { pattern: { folded: this.folded.slice(from, to), written: this.raw.slice(k, close + 1), judged: widened ? "?" : this.folded.slice(from, to) } };
+                ranges.push({ from: k, to: close + 1, exp: { kind: "glob", yields: "many", body: this.raw.slice(k + 1, close), ...pattern } });
                 k = close;
             }
         }
@@ -647,18 +703,20 @@ class WordBuilder {
     }
     finish(atCommandPosition, tildeSpelling = true) {
         const rawText = this.raw;
-        let foldedText = this.folded;
+        let literalTilde = false;
         let assignment;
         const tildeEnd = this.tildePrefixEnd(0, false);
         if (tildeEnd !== undefined)
             this.carveTilde(0, tildeEnd);
         else {
-            if (tildeSpelling)
-                foldedText = literalTildeSpelling(foldedText);
+            literalTilde = tildeSpelling;
             assignment = this.readAssignment();
         }
         if (!(assignment !== undefined && assignment.bare && atCommandPosition))
             this.carveBraceAndGlob();
+        const spelled = (text) => (literalTilde ? literalTildeSpelling(text) : text);
+        const foldedText = spelled(this.folded);
+        const judged = this.widenedClasses.length > 0 ? spelled(this.classSpelled(0, this.folded.length)) : undefined;
         if (assignment !== undefined && this.subscript?.text)
             this.mark("subscript_text", this.subscript.rawStart);
         const marks = this.marks.filter((m) => m.reason !== "subscript_text" || assignment?.subscript !== undefined).sort((a, b) => a.at - b.at);
@@ -679,6 +737,7 @@ class WordBuilder {
             kind: "word",
             raw: rawText,
             folded: foldedText,
+            ...(judged !== undefined ? { judged } : {}),
             pieces,
             quotedSpans: spans,
             expansions: pieces.filter((p) => p.expansion !== undefined),
@@ -703,6 +762,7 @@ function scan(source, connectorsAreText) {
     let acceptable = true;
     let timeGrammar;
     let definitionName = false;
+    let coprocWord;
     let afterLeadingRedirect = false;
     let assignmentSeen = false;
     let subscriptsClosed = false;
@@ -716,7 +776,7 @@ function scan(source, connectorsAreText) {
         w.opaque(source.slice(from, to), SUBSTITUTION_PLACEHOLDER, by, from, to, { kind, yields: kind === "command" && by === undefined ? "many" : "one", body });
         current().substitutions.push(body);
     };
-    const resetPosition = () => { acceptable = true; commandWord = undefined; afterLeadingRedirect = false; assignmentSeen = false; subscriptsClosed = false; timeGrammar = undefined; definitionName = false; };
+    const resetPosition = () => { acceptable = true; commandWord = undefined; afterLeadingRedirect = false; assignmentSeen = false; subscriptsClosed = false; timeGrammar = undefined; definitionName = false; coprocWord = undefined; };
     const endWord = () => {
         if (!w.started)
             return undefined;
@@ -771,6 +831,11 @@ function scan(source, connectorsAreText) {
         }
         if (acceptable && bare && (SHELL_CONTROL_PREFIXES.has(word.folded) || GROUP_WORDS.has(word.folded))) {
             timeGrammar = word.folded === "time" ? "opt" : undefined;
+            coprocWord = undefined;
+            return undefined;
+        }
+        if (acceptable && bare && word.folded === "coproc") {
+            coprocWord = "head";
             return undefined;
         }
         if (acceptable && bare && timeGrammar === "opt" && word.folded === "-p") {
@@ -784,10 +849,16 @@ function scan(source, connectorsAreText) {
         timeGrammar = undefined;
         if (word.assignment !== undefined && word.assignment.bare && acceptable) {
             assignmentSeen = true;
+            coprocWord = undefined;
             return undefined;
         }
-        if (acceptable)
+        if (acceptable && coprocWord !== "name")
             commandWord = bare ? word.folded : undefined;
+        if (coprocWord === "head") {
+            coprocWord = "name";
+            return undefined;
+        }
+        coprocWord = undefined;
         acceptable = false;
         return undefined;
     };

package/dist/tools/fs/bash-program-position.d.ts

@@ -34,6 +34,13 @@ export { SHELL_CONTROL_PREFIXES };
 /** A control word is a keyword only when bash sees it BARE: `'if'` / `"do"` / `\\!` are command names (a program
  *  looked up on PATH, whose failure changes nothing), so a quoted or escaped spelling never counts as one. */
 export declare function isBareControlWord(words: readonly LexedWord[], i: number, set: ReadonlySet<string>): boolean;
+/** Does the shell read this word as syntax — a reserved word, a control word, `{`, `coproc` — of `set`? Only a word
+ *  written BARE where bash reads a command's first word (the lexer's {@link LexedWord.atCommandPosition}): a quoted or
+ *  escaped spelling is a command name, and a word an expansion produced (a value, a split field) is never syntax —
+ *  bash parses the line before it expands it. The one reading every syntax reader of a command's words asks. */
+export declare function isShellSyntaxWord(w: LexedWord | undefined, set: ReadonlySet<string>): boolean;
+/** The words that head a loop over a list (`for NAME in …`, `select NAME in …`). */
+export declare const LOOP_LIST_HEADS: ReadonlySet<string>;
 /**
  * A word bash strips as an ASSIGNMENT before it chooses the program: the lexer's assignment fact, written BARE
  * (the name, the brackets and the operator unquoted — a quoted VALUE still assigns, a quoted operator is a
@@ -53,12 +60,15 @@ export type ProgramPositionRefusal = {
     readonly kind: "control_syntax_at_program_position";
     readonly owner: string;
     readonly word: string;
-    /** Not a DECLINE ({@link programPositionRunsShell}): the row WAS read and a SHELL stands at the program
-     *  position. Absent ⇒ genuine control syntax, which IS one. */
-    readonly runsShell?: true;
-    /** The launcher hands the shell its operands as text (`watch "S"`); absent beside `runsShell`, the shell is handed
-     *  nothing (`sudo -s`, `chroot DIR`) and runs its standard input. */
-    readonly handsText?: true;
+    /** Not a DECLINE ({@link programPositionRunsShell}): the row WAS read and a SHELL — or a program the launcher
+     *  names by an option of its own (`su -s PROGRAM`) — stands at the program position, run by the launcher at argv
+     *  index `launcher` and handed the words from index `from` on (none where `from` is the argv's end: `sudo -s`,
+     *  `chroot DIR`), as that launcher's row composes them (`launchedCommands`, shell-reentry-text.ts). Absent ⇒
+     *  genuine control syntax, which IS one. */
+    readonly runsShell?: {
+        readonly launcher: number;
+        readonly from: number;
+    };
 };
 export interface ProgramPosition {
     /** Indices of the bare control words stripped in front (`!`, `if`, `time`, …), in order; their declared options