@sema-agent/core 7.47.0 → 7.48.0

package/dist/tools/fs/shell-read-word.js

@@ -1,13 +1,13 @@
 import { argvOf, lexShell, literalTildeSpelling, UNRESOLVED_SENTENCE } from "../../shell/lex.js";
 import { expansionInWord, extglobOpenerIn, globInWord, homeExpansionOf } from "./bash-readonly-classifier.js";
-import { wordFloorValues, wordValues } from "./shell-read-bindings.js";
-export function readsOf(words, table, homeDir) {
+import { floorOf, judgedSpellingOf, namesIn, wordFloorValues, wordValues } from "./shell-read-bindings.js";
+export function readsOf(words, table, homeDir, split = false) {
     return words.map((word) => {
-        const refersToName = word.pieces.some((p) => p.expansion?.kind === "parameter");
+        const refersToName = word.pieces.some((p) => p.expansion?.kind === "parameter") || namesIn(word).length > 0;
         const asWritten = { word, raw: word.raw, folded: word.folded, ...(word.judged !== undefined ? { pattern: word.judged } : {}) };
         if (!refersToName && table?.homeTouched !== true)
             return { ...asWritten, expands: expandsOf(word) };
-        const values = wordValues(word, table, false);
+        const values = wordValues(word, table, false, undefined, split);
         if (values === undefined)
             return { ...asWritten, expands: expandsOf(word) };
         if (values === "unknown") {
@@ -18,7 +18,7 @@ export function readsOf(words, table, homeDir) {
         const refersToHome = word.pieces.some((p) => p.expansion?.kind === "tilde" || (p.expansion?.kind === "parameter" && p.expansion.name === "HOME"));
         const declared = refersToHome && homeDir !== undefined && table?.homeTouched === true ? wordValues(word, table, false, new Map([["HOME", [{ spelled: homeDir }]]])) : undefined;
         const floor = declared !== undefined && declared !== "unknown" && declared[0] !== undefined ? spellingOf(declared[0]) : undefined;
-        const pattern = patternOf(values[0]);
+        const pattern = judgedSpellingOf(values[0]);
         return {
             word,
             raw: word.raw,
@@ -31,12 +31,88 @@ export function readsOf(words, table, homeDir) {
         };
     });
 }
+const READINGS_MAX = 64;
+export function segmentReadingsOf(argv, targets, table, homeDir) {
+    const several = new Map();
+    for (const word of [...argv, ...targets]) {
+        for (const name of namesReadIn(word, table)) {
+            const state = table.stateOf(name);
+            if (state !== "unknown" && state.length > 1)
+                several.set(name, state);
+        }
+    }
+    let overlays = [new Map()];
+    const past = [];
+    for (const [name, values] of several) {
+        if (past.length > 0 || overlays.length * values.length > READINGS_MAX) {
+            past.push(name);
+            continue;
+        }
+        overlays = overlays.flatMap((o) => values.map((v) => new Map(o).set(name, [v])));
+    }
+    for (const o of overlays)
+        for (const name of past)
+            o.set(name, "unknown");
+    return overlays.map((overlay) => {
+        const reading = overlay.size === 0 ? table : overlaidTable(table, overlay);
+        const fielded = readsOf(argv, reading, homeDir, true).flatMap((r) => {
+            const fields = r.values?.length === 1 ? r.values[0].fields : undefined;
+            return fields === undefined ? [r] : fields.map((f) => ({ word: argumentWordOf(f, f) ?? r.word, raw: f, folded: spellingOf({ spelled: f }), expands: false, settled: true, values: [{ spelled: f }] }));
+        });
+        const floors = new Map();
+        for (const r of fielded) {
+            if (r.settled === true)
+                continue;
+            for (const p of r.word.pieces) {
+                const name = p.expansion?.kind === "parameter" ? p.expansion.name : undefined;
+                if (name === undefined)
+                    continue;
+                const held = reading.stateOf(name);
+                const floor = [...(held === "unknown" ? [] : held.map(floorOf)), ...reading.floorOf(name)];
+                if (floor.length > 0)
+                    floors.set(name, floor);
+            }
+        }
+        return { table: reading, reads: fielded, argv: fielded.map((r) => valuedWord(r.word, r)), floors };
+    });
+}
+function namesReadIn(word, table) {
+    return [...namesIn(word), ...(table.homeTouched && word.pieces.some((p) => p.expansion?.kind === "tilde" && p.expansion.body === "~") ? ["HOME"] : [])];
+}
+function overlaidTable(table, overlay) {
+    return {
+        stateOf: (name) => overlay.get(name) ?? table.stateOf(name),
+        isInteger: (name) => table.isInteger(name),
+        ifsTouched: table.ifsTouched,
+        homeTouched: table.homeTouched,
+        floorOf: (name) => {
+            const held = table.stateOf(name);
+            return overlay.get(name) !== "unknown" || held === "unknown" ? table.floorOf(name) : [...table.floorOf(name), ...held.map(floorOf)];
+        },
+        inherited: table.inherited,
+    };
+}
+function valuedWord(word, r) {
+    const v = r.values?.length === 1 ? r.values[0] : undefined;
+    if (word.assignment !== undefined || v === undefined || v.glob === true || v.spelled === word.folded)
+        return word;
+    return argumentWordOf(v.spelled, r.raw) ?? word;
+}
+function argumentWordOf(text, raw) {
+    const quoted = text.replace(/[^A-Za-z0-9_./+@:%=,-]/g, (c) => (c === "'" ? "\\'" : `'${c}'`));
+    const lexed = lexShell(`: ${quoted === "" ? "''" : quoted}`);
+    const words = "parseFailure" in lexed || lexed.segments.length !== 1 ? undefined : argvOf(lexed.segments[0]);
+    return words?.length === 2 ? { ...words[1], raw } : undefined;
+}
 export const spellingOf = (v) => literalTildeSpelling(v.spelled);
-export function patternOf(v) {
-    if (v.glob !== true)
+export function partPattern(word, part) {
+    if (word.pattern === undefined || part === word.folded || !word.folded.endsWith(part))
+        return undefined;
+    const front = word.folded.slice(0, word.folded.length - part.length);
+    if (!word.pattern.startsWith(front))
         return undefined;
-    const judged = literalTildeSpelling(v.parts.map((p) => (p.pattern ? p.judged : p.text)).join(""));
-    return judged === spellingOf(v) ? undefined : judged;
+    const judged = word.pattern.slice(front.length);
+    return judged === part ? undefined : judged;
 }
 export function renamed(c, spelled) {
     const { pattern: _matched, ...rest } = c;

package/dist/tools/fs/shell-reentry-text.d.ts

@@ -6,6 +6,7 @@
  */
 import { type LexedSegment, type LexedWord } from "../../shell/lex.js";
 import { type ProgramPosition } from "./bash-program-position.js";
+import { type TargetUser } from "./program-read-model.js";
 import type { BoundValue } from "./shell-read-bindings.js";
 /**
  * The code bodies a builtin keeps among its operands, one per body; empty for every other program. The program read
@@ -52,6 +53,8 @@ export interface LaunchedCommand {
         readonly spelled: string;
     };
     readonly args: readonly LaunchedArg[];
+    /** The user the launcher runs it as, where its row says it runs another ({@link targetUserOf}). */
+    readonly as?: TargetUser;
 }
 /**
  * What a launcher that runs a program named by no word of its own runs ({@link readProgramPosition}'s `runsShell`: the
@@ -79,11 +82,11 @@ export declare function launchedReadings(argv: readonly LexedWord[], command: La
     readonly shell?: string;
     readonly line?: string;
 };
-/** What a launcher runs ({@link launchedCommands}, {@link launchedReadings}), as a reader of the command line reads it:
- *  each shell's argv in two spellings — `texts` (a word's literal value, else `spell.text`) and `args` (`spell.folded`) —
- *  with the argv index each position stands for (`words`), one argv per reading of the values its words may take
- *  (`spell.values`, {@link spellLaunched}); the word naming a shell (`su -s /bin/bash`, `programWords`); and each command
- *  line a program that is no shell runs (`lines`, once each). */
+/** What a launcher runs ({@link launchedCommands}, {@link launchedReadings}), as a reader of the command line reads it in
+ *  one reading of its names: each shell's argv in two spellings — `texts` (a word's literal value, else `spell.text`) and
+ *  `args` (`spell.folded`) — with the argv index each position stands for (`words`), its words' fields read off
+ *  `spell.values` ({@link spellLaunched}) and the user it runs as (`as`); the word naming a shell (`su -s /bin/bash`,
+ *  `programWords`); and each command line a program that is no shell runs (`lines`, once each). */
 export declare function launchedInput(argv: readonly LexedWord[], pos: ProgramPosition, spell: {
     readonly text: (k: number) => string;
     readonly folded: (k: number) => string;
@@ -94,6 +97,7 @@ export declare function launchedInput(argv: readonly LexedWord[], pos: ProgramPo
         readonly texts: readonly string[];
         readonly args: readonly string[];
         readonly words: readonly (number | undefined)[];
+        readonly as?: TargetUser;
     }[];
     readonly programWords: readonly number[];
     readonly lines: readonly string[];
@@ -107,19 +111,16 @@ export interface LaunchedSpelling {
     readonly values?: (at: number) => readonly BoundValue[] | undefined;
 }
 /**
- * The argv a launched shell is handed ({@link launchedCommands}), spelled as `spell` spells the command line's words — one
- * argv per reading of the values its words may take. A word an escaping launcher joins (`sudo -s CMD…`) is handed as the
- * launcher hands it: each FIELD the command line's shell gives the launcher, escaped ({@link sudoEscaped}) — the field a
- * literal word spells, or each field the shell established for a word it rewrites first (`X='#'; sudo -s rm -r "$X" d`
- * hands `rm -r \# d`: the value is an operand, never a comment), a pattern's literal characters escaped and its pattern
- * characters bare ({@link launchedSpellingOf}). A word whose fields the reader does not know is handed AS WRITTEN: the
- * launched shell re-reads the expansion with the command line's quoting, so the word stays one argument (an unknown there)
- * and its neighbours stay theirs (`"#$Y" d` is never `#$Y d`). A reading gives each distinct word spelling one value — the
- * same word spelled twice expands alike — and words with several values are read in every combination of them (a value in
- * the program's position meets each operand); past {@link LAUNCHED_READINGS_MAX}
- * combinations reading `i` hands each word its `i`-th value (its last where it holds fewer) — every value of every word is
- * still read, the same word spelled twice takes one value per reading as the shell expands it, and the readings stay as
- * many as one word's values: their cost is linear in the command, whatever its length.
+ * The argv a launched shell is handed ({@link launchedCommands}), spelled as `spell` spells the command line's words in ONE
+ * reading of their names (the plan reads a segment once per combination of its names' values, `segmentReadingsOf` in
+ * shell-read-word.ts — a word's value here is its value in that reading). A word an escaping launcher joins (`sudo -s
+ * CMD…`) is handed as the launcher hands it: the FIELD the command line's shell gives the launcher, escaped
+ * ({@link sudoEscaped}) — the field a literal word spells, or the field the shell established for a word it rewrites first
+ * (`X='#'; sudo -s rm -r "$X" d` hands `rm -r \# d`: the value is an operand, never a comment), a pattern's literal
+ * characters escaped and its pattern characters bare ({@link launchedSpellingOf}). A word whose field the reader does not
+ * know is handed AS WRITTEN: the launched shell re-reads the expansion with the command line's quoting, so the word stays
+ * one argument (an unknown there) and its neighbours stay theirs (`"#$Y" d` is never `#$Y d`). Any other launcher hands a
+ * word's text as `spell.word` spells it. One argv, as a list of the one.
  */
 export declare function spellLaunched(argv: readonly LexedWord[], args: readonly LaunchedArg[], spell: LaunchedSpelling): string[][];
 /** The argv index of the SCRIPT FILE a shell runs where its argv carries no text ({@link scriptSourceOf}). */
@@ -132,9 +133,10 @@ export interface StdinText {
 }
 /** What may arrive on a segment's standard input: each here-document (its descriptor is not read: every one counts) —
  *  its body, literal when quoted or when nothing in it expands — each here-string (literal when its word is), `<` file
- *  or `<&` descriptor written to no other descriptor, and the pipe it is reached through (`piped`) unless one of those
- *  three replaces it. */
-export declare function stdinTextsOf(segment: LexedSegment, piped: StdinText | undefined): StdinText[];
+ *  or `<&` descriptor written to no other descriptor, and what it inherits (`fed`: the pipe it is reached through, the
+ *  pipe or the input of the group it stands in, the input of the shell running its text) unless one of those three
+ *  replaces it. */
+export declare function stdinTextsOf(segment: LexedSegment, fed: readonly StdinText[]): StdinText[];
 /** What one segment (its argv) writes into the pipe after it: the text a printer spells ({@link printedText}) when its
  *  program word and every argument are literal, else only the segment as written. */
 export declare function pipedTextOf(segment: LexedSegment, argv: readonly LexedWord[]): StdinText;

package/dist/tools/fs/shell-reentry-text.js

@@ -1,6 +1,6 @@
 import { literalHeredocBody, literalTextOf } from "../../shell/lex.js";
 import { programBasename, readProgramPosition } from "./bash-program-position.js";
-import { implementationsOf, printedText, programRow, readArgRoles, selectedOptions } from "./program-read-model.js";
+import { implementationRejects, implementationsOf, printedText, programRow, readArgRoles, selectedOptions, targetUserOf } from "./program-read-model.js";
 import { namesStandardInput } from "./safety.js";
 export function codeBodies(basename, args) {
     const row = programRow(basename);
@@ -77,17 +77,27 @@ export function launchedCommands(argv, pos = readProgramPosition(argv)) {
     const row = programRow(programBasename(argv[runs.launcher].folded));
     const words = argv.slice(runs.from).map((w) => w.folded);
     const at = (k) => runs.from + k;
-    if (words.length === 0 || row?.launcher === undefined)
-        return [{ args: [] }];
-    if (row.launcher.shellText === "user")
+    if (row?.launcher?.shellText === "user")
         return userCommands(row, words, at);
+    const user = row === undefined ? undefined : targetUserOf(row, argv.slice(runs.launcher + 1, runs.from).map((w) => w.folded));
+    const as = user !== undefined ? { as: user } : {};
+    if (words.length === 0 || row?.launcher === undefined)
+        return [{ args: [], ...as }];
     if (row.launcher.shellText === "joined") {
-        const joined = words.flatMap((w, k) => (w.startsWith("-") ? [] : [at(k)]));
-        const attached = readArgRoles(row, words).flatMap((e) => (e.kind === "option" ? roleValue(e, "shell-text", words, at) ?? [] : []));
-        const texts = [...(joined.length === 0 ? [] : [{ joined }]), ...attached];
-        return texts.length === 0 ? [{ args: [] }] : texts.map((t) => ({ args: [{ fixed: "-c" }, t] }));
+        const texts = new Map();
+        for (const view of implementationsOf(row)) {
+            const events = readArgRoles(view, words);
+            const first = events.find((e) => e.kind === "operand" || e.kind === "dash-word-operand")?.at ?? words.length;
+            if (implementationRejects(row, view, words.slice(0, first)))
+                continue;
+            const joined = words.slice(first).map((_, k) => at(first + k));
+            const values = events.flatMap((e) => (e.kind === "option" || (e.kind === "value" && e.at < first) ? roleValue(e, "shell-text", words, at) ?? [] : []));
+            for (const t of [...(joined.length === 0 ? [] : [{ joined }]), ...values])
+                texts.set(JSON.stringify(t), t);
+        }
+        return texts.size === 0 ? [{ args: [], ...as }] : [...texts.values()].map((t) => ({ args: [{ fixed: "-c" }, t], ...as }));
     }
-    return [{ args: [{ fixed: "-c" }, { joined: words.map((_, k) => at(k)), escaped: true }] }];
+    return [{ args: [{ fixed: "-c" }, { joined: words.map((_, k) => at(k)), escaped: true }], ...as }];
 }
 function roleValue(e, kind, words, at) {
     if (e.kind === "value" && e.role?.kind === kind)
@@ -109,16 +119,18 @@ function userCommands(row, words, at) {
         const named = own.flatMap((e) => valued(e, "command") ?? []).at(-1);
         const fromEnvironment = selectedOptions(view, stops ? words.slice(0, end) : words, "one-implementation").some((o) => o.mode === "names-program");
         const program = named !== undefined ? { program: named } : fromEnvironment ? { program: { spelled: "\"$SHELL\"" } } : {};
+        const target = targetUserOf(view, stops ? words.slice(0, end) : words.filter((_, k) => k !== user), { name: user === undefined ? "root" : words[user], dash: operands[0]?.dash !== undefined });
+        const runs = { ...program, ...(target !== undefined ? { as: target } : {}) };
         if (stops) {
-            out.push({ ...program, args: user === undefined ? [] : words.slice(user + 1).map((_, k) => ({ at: at(user + 1 + k) })) });
+            out.push({ ...runs, args: user === undefined ? [] : words.slice(user + 1).map((_, k) => ({ at: at(user + 1 + k) })) });
             continue;
         }
         const rest = operands.filter((e) => user !== undefined && e.at > user).map((e) => ({ at: at(e.at) }));
         const texts = own.flatMap((e) => valued(e, "shell-text") ?? []);
         if (texts.length === 0)
-            out.push({ ...program, args: rest });
+            out.push({ ...runs, args: rest });
         for (const text of texts)
-            out.push({ ...program, args: [{ fixed: "-c" }, text, ...rest] });
+            out.push({ ...runs, args: [{ fixed: "-c" }, text, ...rest] });
     }
     return out;
 }
@@ -156,11 +168,10 @@ export function launchedInput(argv, pos, spell) {
             programWords.push(c.program.at);
         const words = c.args.map((x) => ("at" in x && x.from === undefined ? x.at : undefined));
         const args = asArgs(c.args);
-        return asTexts(c.args).map((texts, i) => ({ shell, texts, args: args[i], words }));
+        return asTexts(c.args).map((texts, i) => ({ shell, texts, args: args[i], words, ...(c.as !== undefined ? { as: c.as } : {}) }));
     });
     return { shells, programWords, lines: [...lines] };
 }
-const LAUNCHED_READINGS_MAX = 64;
 function sudoEscaped(field) {
     return field.replace(/[^A-Za-z0-9_$-]/gu, (c) => `\\${c}`);
 }
@@ -168,20 +179,14 @@ function launchedSpellingOf(v) {
     return v.glob === true ? v.parts.map((p) => (p.pattern ? p.text : sudoEscaped(p.text))).join("") : sudoEscaped(v.spelled);
 }
 export function spellLaunched(argv, args, spell) {
-    const choicesOf = (k) => {
+    const field = (k) => {
         const literal = literalTextOf(argv[k].pieces);
         if (literal !== undefined)
-            return [sudoEscaped(literal)];
+            return sudoEscaped(literal);
         const values = spell.values?.(k);
-        return values === undefined ? [argv[k].raw] : values.map(launchedSpellingOf);
+        return values?.length === 1 ? launchedSpellingOf(values[0]) : argv[k].raw;
     };
-    const choices = new Map(args.flatMap((a) => ("joined" in a && a.escaped === true ? a.joined : [])).map((k) => [k, choicesOf(k)]));
-    const distinct = new Map([...choices].map(([k, c]) => [argv[k].raw, c]));
-    const combinations = [...distinct.values()].reduce((n, c) => n * c.length, 1);
-    const readings = combinations <= LAUNCHED_READINGS_MAX
-        ? [...distinct].reduce((acc, [w, c]) => acc.flatMap((r) => c.map((x) => new Map(r).set(w, x))), [new Map()]).map((r) => new Map([...choices.keys()].map((k) => [k, r.get(argv[k].raw)])))
-        : Array.from({ length: [...choices.values()].reduce((n, c) => Math.max(n, c.length), 1) }, (_, i) => new Map([...choices].map(([k, c]) => [k, c[Math.min(i, c.length - 1)]])));
-    return readings.map((reading) => args.map((a) => ("fixed" in a ? a.fixed : "at" in a ? spell.word(a.at, a.from ?? 0) : a.joined.map((k) => (a.escaped === true ? reading.get(k) : spell.word(k, 0))).join(" "))));
+    return [args.map((a) => ("fixed" in a ? a.fixed : "at" in a ? spell.word(a.at, a.from ?? 0) : a.joined.map((k) => (a.escaped === true ? field(k) : spell.word(k, 0))).join(" ")))];
 }
 export function scriptFileAt(basename, args) {
     const row = programRow(basename);
@@ -198,7 +203,7 @@ function scriptSourceOf(row, args) {
         return { stdin: true };
     return { file: first.at, stdin: options.some((e) => e.kind === "option" && e.reading === "speculative") };
 }
-export function stdinTextsOf(segment, piped) {
+export function stdinTextsOf(segment, fed) {
     const out = [];
     let replacesPipe = false;
     for (const t of segment.tokens) {
@@ -212,7 +217,7 @@ export function stdinTextsOf(segment, piped) {
             replacesPipe = true;
         }
     }
-    return piped === undefined || replacesPipe ? out : [piped, ...out];
+    return replacesPipe ? out : [...fed, ...out];
 }
 export function pipedTextOf(segment, argv) {
     const from = `${segment.text.trim()} |`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.47.0",
+  "version": "7.48.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.48.0.json

@@ -0,0 +1,252 @@
+{
+  "repo": "core",
+  "version": "7.48.0",
+  "from": "b29642cbf7daa459e48226114b2ac2132e855036",
+  "to": "7161f2a278ed51f0154de745fd7f6a4f8d349039",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "BEHAVIOR NARROWING, open to veto (#1461): a word that a name's established value spells is read as that value at the program position and as an operand — a `Bash` allow no longer runs `P=rm; $P -rf <root>` without a card."
+    },
+    {
+      "id": "F2",
+      "source": "behaviorFlips.summary",
+      "text": "BEHAVIOR NARROWING, open to veto (#1461, completed): each field of a split unquoted value is a word of its own — named by its text, its `NAME=value` shape kept — for every reader, the removal guard included."
+    },
+    {
+      "id": "F7",
+      "source": "behaviorFlips.summary",
+      "text": "BEHAVIOR NARROWING (#1459): every launcher field asks the one value table — `su -c` / `runuser -c` / `watch` / `bash -c` hand every established value of a name, as `sudo -s` already did."
+    },
+    {
+      "id": "F8",
+      "source": "behaviorFlips.summary",
+      "text": "BEHAVIOR NARROWING (#1460): the combination bound counts distinct names and nothing is sampled past it — the words past the bound are handed on as written with their values as deny floors."
+    },
+    {
+      "id": "F9",
+      "source": "behaviorFlips.summary",
+      "text": "BEHAVIOR NARROWING (#1446): a launcher option cluster is read as getopt reads it, its command-line letter included."
+    },
+    {
+      "id": "F10",
+      "source": "behaviorFlips.summary",
+      "text": "BEHAVIOR NARROWING (#1452): `watch` declares its options (procps and BusyBox) and the words from its first operand on are the shell text; the exported `SHELL_WRAPPER_TABLE` `watch` row gains its option sets."
+    },
+    {
+      "id": "F11",
+      "source": "behaviorFlips.summary",
+      "text": "BEHAVIOR NARROWING (#1463): a shell run as another user starts with that user's home — a login shell stands in it, `HOME` there is the target's."
+    },
+    {
+      "id": "F12",
+      "source": "behaviorFlips.summary",
+      "text": "BEHAVIOR NARROWING, open to veto (#1424): standard input flows into a group and into an inner shell; a process-substitution script and a stream-fed shell are scripts built when the command runs — also for a harmless text."
+    },
+    {
+      "id": "F13",
+      "source": "behaviorFlips.summary",
+      "text": "BEHAVIOR NARROWING (#1466): the judge sees every name bash opens — a part of a pattern word carries the word's widened pattern, a malformed bracket unit is a member as bash reads it, a field forms its pattern once it has fully expanded."
+    },
+    {
+      "id": "F14",
+      "source": "behaviorFlips.summary",
+      "text": "BEHAVIOR NARROWING (#1471): session rules with a bucket that is not a list of strings are refused — a bare `\"rm\"` was stored as `[\"r\",\"m\"]`."
+    },
+    {
+      "id": "F15",
+      "source": "behaviorFlips.summary",
+      "text": "BEHAVIOR NARROWING (#1400): a protocol name with an empty tool segment (`mcp__srv__`) is judged `unmintable_segment`, not `current` — a rule that guarded nothing in silence is refused or announced."
+    },
+    {
+      "id": "F17",
+      "source": "behaviorFlips.summary",
+      "text": "BEHAVIOR NARROWING (#1442): a `readDenyPatterns` row that opens with `/` is rooted — it names that one absolute location (placed where its literal head leads through a link), not that tail at any depth."
+    }
+  ],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 228,
+  "signatures": [],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.gate",
+      "assertions": [
+        "G1.a",
+        "G2.a",
+        "G2.c",
+        "G4.a",
+        "G4.b",
+        "G5.a",
+        "G5.c",
+        "G6.a",
+        "G7.a",
+        "G8.a",
+        "G8.b"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.isError",
+      "assertions": [
+        "G12.a",
+        "G12.b"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.output",
+      "assertions": [
+        "G12.a",
+        "G12.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.askClass",
+      "assertions": [
+        "G1.a",
+        "G1.b",
+        "G1.c",
+        "G1.d",
+        "G2.a",
+        "G3.a",
+        "G3.b",
+        "G3.c",
+        "G3.d",
+        "G4.a",
+        "G4.c",
+        "G5.a",
+        "G5.b",
+        "G5.c",
+        "G5.d",
+        "G6.a",
+        "G6.b",
+        "G6.c",
+        "G7.a",
+        "G7.b",
+        "G8.c"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.classes",
+      "assertions": [
+        "G2.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.message",
+      "assertions": [
+        "G1.c",
+        "G3.b",
+        "G6.b",
+        "G7.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "GateOutcome.disposition",
+      "assertions": [
+        "G1.b",
+        "G2.b",
+        "G2.c",
+        "G3.a",
+        "G3.c",
+        "G3.d",
+        "G4.b",
+        "G4.c",
+        "G5.b",
+        "G5.d",
+        "G6.c",
+        "G8.a",
+        "G8.b",
+        "G8.c"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SessionPolicyError.code",
+      "assertions": [
+        "G9.b",
+        "G10.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SessionPolicyError.detail.verdict",
+      "assertions": [
+        "G10.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SessionPolicyStore.getRules",
+      "assertions": [
+        "G9.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SessionPolicyStore.putRules",
+      "assertions": [
+        "G9.a",
+        "G9.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "TaskResult.terminal.code",
+      "assertions": [
+        "G10.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "TaskResult.terminal.message",
+      "assertions": [
+        "G10.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "WorkflowRun.error",
+      "assertions": [
+        "G11.a",
+        "G11.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "WorkflowRun.result",
+      "assertions": [
+        "G11.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "WorkflowRun.status",
+      "assertions": [
+        "G11.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@bad8fa4b server@a49a0616 sdk@ae10bec — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}