@sema-agent/core 7.47.0 → 7.49.0

package/dist/tools/fs/removal-targets.js

@@ -1,8 +1,8 @@
 import { planShellReads } from "./shell-read-plan.js";
 import { literalTextOf } from "../../shell/lex.js";
 import { createShellReadEstablisher, establishShellReadsLexically } from "./shell-read-establish.js";
-import { isAbsolutePathForm, isWinFormPath, normalizeAbsPathLexically } from "./safety.js";
-import { launchedCommands, launchedReadings, reentryText, spellLaunched } from "./shell-reentry-text.js";
+import { isAbsoluteForFamily, isWinFormPath, normalizeAbsPathLexically } from "./safety.js";
+import { launchedCommands, launchedReadings, reentryText, scriptFileAt, spellLaunched } from "./shell-reentry-text.js";
 import { readProgramPosition } from "./bash-program-position.js";
 import { bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
 import { programArgs } from "./shell-read-write-targets.js";
@@ -25,16 +25,16 @@ function driveOf(path, key) {
     return isWinFormPath(path) && key.length >= 2 && key[1] === ":" ? key.slice(0, 2) : "";
 }
 export function dangerousRemovalOf(path, seat) {
-    if (!isAbsolutePathForm(path))
+    if (!isAbsoluteForFamily("own", path))
         return undefined;
     const k = removalKey(path);
     const rest = k.slice(driveOf(path, k).length);
     if (rest === "/" || /^\/\/[^/]+\/[^/]+$/.test(k))
         return "filesystem_root";
-    if (seat.homes.some((h) => isAbsolutePathForm(h) && removalKey(h) === k))
+    if (seat.homes.some((h) => isAbsoluteForFamily("own", h) && removalKey(h) === k))
         return "home";
     const prefix = k.endsWith("/") ? k : `${k}/`;
-    if (seat.workspace.some((w) => isAbsolutePathForm(w) && (removalKey(w) === k || removalKey(w).startsWith(prefix))))
+    if (seat.workspace.some((w) => isAbsoluteForFamily("own", w) && (removalKey(w) === k || removalKey(w).startsWith(prefix))))
         return "workspace";
     if (/^\/[^/]+$/.test(rest))
         return "top_level";
@@ -56,53 +56,17 @@ function removalKindOf(read, seat) {
     }
     return read.established === "unestablishable" && tildeNamesAHome(read.candidate.spelled) ? "home" : undefined;
 }
-const NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-const NAME_BINDERS = new Set(["unset", "local", "declare", "typeset", "readonly", "export", "read"]);
-function bindingsOf(plan) {
-    const out = new Map();
-    const bind = (name, value) => {
-        out.set(name, [...(out.get(name) ?? []), value]);
-    };
-    for (const segment of plan.segments) {
-        for (const w of segment.argv)
-            if (w.assignment !== undefined)
-                bind(w.assignment.name, w.assignment.settlesWholeName ? literalTextOf(w.assignment.value.pieces) : undefined);
-        const [head, name] = segment.argv;
-        if ((head?.folded === "for" || head?.folded === "select") && name !== undefined && NAME.test(name.folded)) {
-            const at = segment.argv.findIndex((w, i) => i > 1 && w.folded === "in");
-            const words = at < 0 ? [undefined] : segment.argv.slice(at + 1).map((w) => literalTextOf(w.pieces));
-            for (const v of words.length > 0 ? words : [undefined])
-                bind(name.folded, v);
-        }
-        if (head !== undefined && NAME_BINDERS.has(head.folded))
-            for (const w of segment.argv.slice(1))
-                if (w.assignment === undefined && NAME.test(w.folded))
-                    bind(w.folded, undefined);
-    }
-    return out;
-}
-const BOUND_SPELLINGS_MAX = 64;
-function boundSpellingsOf(word, bindings) {
-    const named = word.pieces.filter((q) => q.literal === undefined);
-    if (named.length === 0 || !named.some((q) => q.expansion?.kind === "parameter" && q.expansion.name !== undefined && bindings.has(q.expansion.name)))
-        return undefined;
-    let spellings = [""];
-    for (const q of word.pieces) {
-        if (q.literal !== undefined) {
-            spellings = spellings.map((sp) => sp + q.literal);
-            continue;
-        }
-        const name = q.expansion?.kind === "parameter" && (q.expansion.body === undefined || q.expansion.body === q.expansion.name) ? q.expansion.name : undefined;
-        const values = name !== undefined ? bindings.get(name) : undefined;
-        if (name === undefined || values === undefined)
-            return { unreadable: q.expansion?.name ?? word.raw };
-        if (values.some((v) => v === undefined || (q.quotedBy === undefined && /\s/.test(v))))
-            return { unreadable: name };
-        spellings = spellings.flatMap((sp) => values.map((v) => sp + v));
-        if (spellings.length > BOUND_SPELLINGS_MAX)
-            return { unreadable: name };
-    }
-    return { spellings };
+export const KNOWN_SAFE_ROOTS = Object.freeze(["TMPDIR", "HOME"]);
+function belowKnownSafeRoot(word, safe, segment) {
+    const [head, ...rest] = word.pieces;
+    const e = head?.expansion;
+    const name = e?.kind === "parameter" && (e.body === undefined || e.body === e.name) ? e.name : undefined;
+    if (name === undefined || !safe.has(name) || segment.rebound === "all" || segment.rebound.has(name))
+        return false;
+    if (rest.some((p) => p.literal === undefined))
+        return false;
+    const below = rest.map((p) => p.literal).join("");
+    return /^\/[^*?[\]]+$/.test(below) && !below.split("/").includes("..");
 }
 function recursiveForce(row, args) {
     return implementationsOf(row).some((view) => {
@@ -110,9 +74,11 @@ function recursiveForce(row, args) {
         return selected.some((o) => o.selects === "traversal") && selected.some((o) => o.mode === "forced");
     });
 }
-export function removalFindingsOf(established, seat) {
+export function removalFindingsOf(established, seat, safeRoots = KNOWN_SAFE_ROOTS, enclosingRelocated = false) {
+    if (unreadPlan(established.plan))
+        return [{ guard: "unverifiable_shell_text", program: "bash", text: established.plan.unreadable, source: "unread" }];
     const out = [];
-    const bindings = bindingsOf(established.plan);
+    const safe = new Set(safeRoots);
     for (const segment of established.plan.segments) {
         const program = segment.verb?.basename;
         const row = program !== undefined && REMOVAL_COMMAND_SET.has(program) ? programRow(program) : undefined;
@@ -121,45 +87,41 @@ export function removalFindingsOf(established, seat) {
             const spelled = args.map((w) => w.spelled);
             const removed = new Set(writeReadings(row, spelled).flatMap((r) => r.written.map((w) => w.at)));
             const options = new Set(args.filter((_, at) => !removed.has(at)).map((w) => w.raw));
+            const forced = recursiveForce(row, spelled);
+            if (forced && segment.reentry === "argv")
+                out.push({ guard: "unverifiable_delete", program, operand: segment.text.trim(), source: "stream" });
+            const relocated = enclosingRelocated || readProgramPosition(segment.argv).launcherMovesBase;
             for (const read of established.reads.get(segment) ?? []) {
                 if (read.candidate.face !== "write" || options.has(read.candidate.raw))
                     continue;
                 const kind = removalKindOf(read, seat);
                 if (kind !== undefined) {
-                    out.push({ guard: "dangerous_delete", kind, program, operand: read.candidate.raw, target: read.target ?? read.candidate.floorSpelled ?? read.candidate.spelled });
+                    const untracked = read.candidate.bases === "unmodelled" ? established.plan.segments.find((s) => s.bases === "unmodelled")?.text.trim() : undefined;
+                    out.push({ guard: "dangerous_delete", kind, program, operand: read.candidate.raw, target: read.target ?? read.candidate.floorSpelled ?? read.candidate.spelled, ...(untracked !== undefined ? { untrackedFrom: untracked } : {}) });
                     continue;
                 }
-                if (read.established !== "unestablishable")
+                if (!forced || read.established !== "unestablishable" || (read.candidate.expands !== "unresolvable" && !relocated))
                     continue;
                 const word = segment.argv.find((w) => w.raw === read.candidate.raw);
-                const bound = word === undefined ? undefined : boundSpellingsOf(word, bindings);
-                if (bound === undefined)
+                if (word !== undefined && belowKnownSafeRoot(word, safe, segment))
                     continue;
-                if ("unreadable" in bound) {
-                    if (recursiveForce(row, spelled))
-                        out.push({ guard: "unverifiable_delete", program, operand: read.candidate.raw, name: bound.unreadable });
-                    continue;
-                }
-                const bases = segment.bases === "unmodelled" ? (read.candidate.floorBases ?? []) : segment.bases;
-                for (const spelled of bound.spellings) {
-                    const views = isAbsolutePathForm(spelled) ? [spelled] : bases.map((base) => `${base}/${spelled}`);
-                    for (const view of views) {
-                        const hit = dangerousRemovalOf(view, seat);
-                        if (hit === undefined)
-                            continue;
-                        out.push({ guard: "dangerous_delete", kind: hit, program, operand: read.candidate.raw, target: normalizeAbsPathLexically(view) });
-                        break;
-                    }
-                }
+                out.push({ guard: "unverifiable_delete", program, operand: read.candidate.raw, source: read.candidate.expands === "unresolvable" ? "rewritten" : "relocated" });
             }
         }
         const script = runtimeScriptOf(segment);
         if (script !== undefined && program !== undefined)
-            out.push({ guard: "dangerous_delete", kind: "runtime_script", program, operand: script, target: script });
+            out.push({ guard: "unverifiable_shell_text", program, text: script, source: "produced" });
+        if (programUnread(segment))
+            out.push({ guard: "unverifiable_shell_text", program: segment.launcherChain[0] ?? segment.text.trim(), text: segment.text.trim(), source: "unread" });
+        const handedRelocated = enclosingRelocated || readProgramPosition(segment.argv).launcherMovesBase;
         for (const nested of segment.nested) {
+            if (unreadPlan(nested)) {
+                out.push({ guard: "unverifiable_shell_text", program: program ?? segment.text.trim(), text: segment.text.trim(), source: "unread" });
+                continue;
+            }
             const sub = established.nested.get(nested);
             if (sub !== undefined)
-                out.push(...removalFindingsOf(sub, seat));
+                out.push(...removalFindingsOf(sub, seat, safeRoots, handedRelocated));
         }
     }
     return out;
@@ -175,41 +137,66 @@ function runtimeScriptOf(segment) {
         return literal !== undefined ? literal.slice(from) : `${MARK}${w.raw.slice(from)}`;
     };
     const pos = readProgramPosition(segment.argv);
+    if (pos.program !== undefined && pos.refusal === undefined) {
+        const argv = segment.argv.slice(pos.program.index + 1);
+        const file = scriptFileAt(program.basename, argv.map((w) => w.folded));
+        const source = file === undefined ? undefined : argv[file];
+        if (source !== undefined && source.pieces.length === 1 && source.pieces[0].expansion?.kind === "process")
+            return source.raw;
+        if (pos.argvFromStdin)
+            return segment.text.trim();
+    }
     const named = pos.program !== undefined && pos.refusal === undefined ? [{ shell: program.basename, words: segment.argv.slice(pos.program.index + 1).map((_, k) => spell(pos.program.index + 1 + k)) }] : [];
     const launched = launchedCommands(segment.argv, pos).flatMap((c) => {
         const shell = launchedReadings(segment.argv, c).shell;
-        return shell === undefined ? [] : spellLaunched(segment.argv, c.args, { word: spell }).map((words) => ({ shell, words }));
+        return shell === undefined ? [] : [{ shell, words: spellLaunched(segment.argv, c.args, { word: spell }) }];
     });
     const texts = [...named, ...launched].flatMap(({ shell, words }) => [reentryText(shell, words), ...(segment.stdin ?? []).map((s) => reentryText(shell, words, s.literal ?? `${MARK}${s.from}`))]);
     const text = texts.find((t) => t?.includes(MARK) === true);
     return text === undefined ? undefined : text.split(MARK).join("");
 }
+const unreadPlan = (plan) => plan.unreadable !== undefined && plan.segments.length === 0;
+const programUnread = (s) => s.declines.includes("unreadable_program_position");
 export function planRunsRemoval(plan) {
-    return plan.segments.some((s) => (s.verb !== undefined && REMOVAL_COMMAND_SET.has(s.verb.basename)) || runtimeScriptOf(s) !== undefined || s.nested.some(planRunsRemoval));
+    return unreadPlan(plan) || plan.segments.some((s) => (s.verb !== undefined && REMOVAL_COMMAND_SET.has(s.verb.basename)) || runtimeScriptOf(s) !== undefined || programUnread(s) || s.nested.some(planRunsRemoval));
 }
 const DANGEROUS_REMOVAL_SENTENCE = {
     filesystem_root: (p, t) => `\`${p}\` would remove the filesystem root (${t})`,
     home: (p, t) => `\`${p}\` would remove a home directory (${t})`,
     workspace: (p, t) => `\`${p}\` would remove a workspace directory — the task root, the working directory or an additional working directory — or one of its ancestors (${t})`,
     top_level: (p, t) => `\`${p}\` would remove a top-level system directory (${t})`,
-    runtime_script: (p, t) => `\`${p}\` runs a script built only when the command runs (${t}), and it may remove the filesystem root, a home directory or the task's directories before anyone can read it`,
+};
+const UNVERIFIABLE_REMOVAL_SENTENCE = {
+    rewritten: (p, o) => `\`${p}\` recursive+force target ${o} is rewritten by the shell from a value this command does not settle (a name with no value here or one it sets in a form the guard cannot read, a substitution, a parameter operator) — the deleted path cannot be verified from this command`,
+    stream: (p, o) => `\`${p}\` recursive+force takes its targets from the stream it is fed (${o}) — the deleted paths cannot be verified from this command`,
+    relocated: (p, o) => `\`${p}\` recursive+force target ${o} is relative to a directory a launcher option moved the program into, which this command does not settle — the deleted path cannot be verified from this command`,
+};
+const UNREADABLE_TEXT_SENTENCE = {
+    produced: (p, t) => `\`${p}\` runs shell text that is built only when the command runs (${t}) — the text this shell will run cannot be read by the engine, so whether it removes anything is unknown`,
+    unread: (p, t) => `\`${p}\` runs shell text this guard cannot read (${t}) — the text this shell will run cannot be read by the engine, so whether it removes anything is unknown`,
 };
 function verdictOf(findings) {
-    for (const f of findings)
-        if (f.guard === "dangerous_delete")
-            return { guard: f.guard, text: DANGEROUS_REMOVAL_SENTENCE[f.kind](f.program, inlineUntrusted(f.target, 200)) };
+    for (const f of findings) {
+        if (f.guard !== "dangerous_delete")
+            continue;
+        const untracked = f.untrackedFrom === undefined ? "" : ` — the working directory is not tracked from \`${inlineUntrusted(f.untrackedFrom, 120)}\` on (a directory change before it cannot be followed), so this target was judged where the command stood when tracking stopped`;
+        return { guard: f.guard, text: `${DANGEROUS_REMOVAL_SENTENCE[f.kind](f.program, inlineUntrusted(f.target, 200))}${untracked}` };
+    }
     for (const f of findings)
         if (f.guard === "unverifiable_delete")
-            return { guard: f.guard, text: `\`${f.program}\` recursive+force target ${inlineUntrusted(f.operand, 200)} takes ${f.name}'s value, which this command sets in a form the guard cannot read (an expansion, an unset or bare declaration, a \`read\`, a loop over unread words) — the deleted path cannot be verified from this command` };
+            return { guard: f.guard, text: UNVERIFIABLE_REMOVAL_SENTENCE[f.source](f.program, inlineUntrusted(f.operand, 200)) };
+    for (const f of findings)
+        if (f.guard === "unverifiable_shell_text")
+            return { guard: f.guard, text: UNREADABLE_TEXT_SENTENCE[f.source](f.program, inlineUntrusted(f.text, 200)) };
     return undefined;
 }
 const REMOVAL_RESOLVE_TIMEOUT_MS = 10_000;
-export function removalReadingOf(command, req, seat) {
+export function removalReadingOf(command, req, seat, safeRoots = KNOWN_SAFE_ROOTS) {
     const homeDir = seat?.env?.homeDir;
     const cwd = req.cwd ?? req.root ?? "";
     const roots = req.root !== undefined ? [req.root] : cwd !== "" ? [cwd] : [];
     const boundary = { roots, ...(cwd !== "" ? { cwd } : {}), ...(homeDir !== undefined ? { homeDir } : {}) };
-    const plan = planShellReads(command, { readers: new Set(bashClassifyDefaultAllow()), cwd, roots, ...(homeDir !== undefined ? { homeDir } : {}) });
+    const plan = planShellReads(command, { readers: new Set(bashClassifyDefaultAllow()), cwd, roots, cdPath: seat?.env?.cdPath ?? "unknown", ...(homeDir !== undefined ? { homeDir } : {}) });
     if (!planRunsRemoval(plan))
         return undefined;
     return {
@@ -220,11 +207,11 @@ export function removalReadingOf(command, req, seat) {
                 homes: [...(homeDir !== undefined ? [homeDir] : []), ...(resolved !== undefined && resolved.ok ? [resolved.value] : [])],
                 workspace: [...(req.root !== undefined ? [req.root] : []), ...(req.cwd !== undefined ? [req.cwd] : []), ...(seat?.additionalRoots?.() ?? [])],
             };
-            const lexical = removalFindingsOf(establishShellReadsLexically(plan, boundary), removalSeat);
+            const lexical = removalFindingsOf(establishShellReadsLexically(plan, boundary), removalSeat, safeRoots);
             if (lexical.some((f) => f.guard === "dangerous_delete") || env === undefined || roots.length === 0)
                 return verdictOf(lexical);
             const established = await resolvedOrUndefined(createShellReadEstablisher(env, roots, { rootsCanonical: true }).establish(plan, boundary, signal), signal);
-            return verdictOf(established === undefined ? lexical : [...removalFindingsOf(established, removalSeat), ...lexical]);
+            return verdictOf(established === undefined ? lexical : [...removalFindingsOf(established, removalSeat, safeRoots), ...lexical]);
         },
     };
 }

package/dist/tools/fs/safety.d.ts

@@ -10,7 +10,8 @@ import { protectivePathTargetOf, type ToolCallLike } from "../../core/tool-regis
  * hole) or fail-closed (deny a legitimate write). Single source.
  *
  * The `path` arm is deliberately BROADER than what Read/Edit/Write accept: their schema requires
- * `file_path` and rejects the retired `path` alias outright (fs-shared.ts FILE_PATH_PARAMS), but this reader is
+ * `file_path` (fs-shared.ts FILE_PATH_PARAMS; Write alone repairs the `path` spelling onto it BEFORE validation,
+ * `coerceWriteArguments`, so a gate never sees the alias there), but this reader is
  * shared with gates that judge OTHER tool vocabularies — Glob's real `path` parameter, deployment-authored tools —
  * and a gate must never see LESS than the tool it is confining might act on. So the asymmetry is the design: the
  * schema decides what a caller may send, this decides what gets judged, and this side over-reads on purpose.
@@ -114,21 +115,12 @@ export interface FsViolation {
     message: string;
 }
 /**
- * Absolute in EITHER family: POSIX `/…` or drive-letter `C:\…`/`C:/…`.
- *
- * This is the ONE definition of "already absolute, therefore do not prepend a base". The failure mode
- * of a private re-typing is not the duplication but the drift it invites: a family added at one
- * coordinate leaves every other copy judging the same string differently, and this predicate gates a
- * security fence (frozen-path deny, readonly-boundary containment) as well as URI key minting.
- * Callers that need a family the predicate does not cover must widen it HERE, not locally.
- *
- * The UNC arm (`\\host\share\…`) is the shape that drift produced: held privately in one consumer, it
- * made that consumer resolve a UNC path as absolute while a sibling prefixed it with the task root —
- * two URI keys for one file. Folding it in here settles the disagreement in the direction the rest of
- * this file takes: a literal `\\host\share\…` is win-form (see {@link isWinFormPath}) and `within()`
- * lands it outside every POSIX/drive root, i.e. a location the working directory does not contain.
+ * Is a spelling relative in EVERY family — neither `/`- nor `\`-rooted and carrying no drive letter (not even the
+ * drive-relative `C:x`)? The tamper check of a recorded relative key reads this (a record that is absolute, rooted or
+ * drive-bearing in ANY family is refused there): the opposite stance from {@link isAbsoluteForFamily}, which answers
+ * one family's question, so it is a separate, named predicate rather than a mode of that one.
  */
-export declare function isAbsolutePathForm(p: string): boolean;
+export declare function relativeInEveryFamily(p: string): boolean;
 /** Does this absolute spelling name the opening process's STANDARD INPUT (`/dev/stdin`, `/dev/fd/0`, `/proc/<pid>/fd/0`),
  *  folded lexically first (`/dev/./stdin`, `/dev//fd/0`)? */
 export declare function namesStandardInput(path: string): boolean;
@@ -306,13 +298,19 @@ export declare function pathFamilyOf(bases: {
  *  reads it. The ONE UNC recognizer behind {@link isAbsoluteForFamily}, {@link pathIdentityOf} and
  *  {@link joinForFamily}. */
 export declare function isUncSpelling(p: string): boolean;
-/**
- * FULLY QUALIFIED under the family. win: drive-rooted (`C:\`/`C:/`) or UNC — a `/x` / `\x` is rooted-not-
- * qualified and joins the base's drive or share root ({@link joinForFamily}), a `C:rel` is drive-relative.
- * posix: `/`-rooted. `undefined` (a treeless call): only the anchor-free `/`-rooted form, the one spelling
- * that names a file without a tree.
- */
-export declare function isAbsoluteForFamily(family: PathFamily | undefined, p: string): boolean;
+/** Where a reading takes its family from: a tree's ({@link PathFamily}), or `"own"` — an address with no tree to place
+ *  it reads its OWN spelling as the family source (the {@link pathFamilyOf} of that spelling), so a treeless `C:\x` and a
+ *  treeless `/x` are each read in their own family rather than one of them being declared relative. */
+export type PathFamilySource = PathFamily | "own";
+/** The family a {@link PathFamilySource} names for one spelling. */
+export declare function familyFor(source: PathFamilySource, p: string): PathFamily;
+/**
+ * FULLY QUALIFIED under the family — the ONE absoluteness predicate. win: drive-rooted (`C:\`/`C:/`) or UNC (a host AND a
+ * share: a bare `\\x` names no share and is no address) — a `/x` / `\x` is rooted-not-qualified and joins the base's drive
+ * or share root ({@link joinForFamily}), a `C:rel` is drive-relative. posix: `/`-rooted. `"own"`: the spelling's own
+ * family ({@link familyFor}) — the reading of an address no tree places.
+ */
+export declare function isAbsoluteForFamily(family: PathFamilySource, p: string): boolean;
 /** The refusal words of {@link win32NamespaceScreen} — a closed set (docs/CLOSED-SETS.md). */
 export declare const WIN32_NAMESPACE_REFUSALS: readonly ["device_namespace", "unmappable_namespace", "unc_on_posix_tree", "drive_relative"];
 export type Win32NamespaceRefusal = (typeof WIN32_NAMESPACE_REFUSALS)[number];
@@ -436,6 +434,14 @@ export declare function foldTrailingSeparators(spelled: string, family: PathFami
  * share root, anything else under the base with the base's own separator. posix = `/`-join.
  */
 export declare function joinForFamily(family: PathFamily, base: string, rel: string): string;
+/**
+ * THE anchor step of every path reading: a spelling fully qualified under the family stands as spelled; any other is joined
+ * to `base` ({@link joinForFamily}, unfolded). One definition, so "already absolute, therefore do not prepend a base" is
+ * decided in one place for every reader — the path prelude (`readPath`, effective-path-target.ts), the canonicalizer, a
+ * link's target against its parent, a search tool's root-relative output. Callers that need the namespace screen or an
+ * identity read the prelude; this is only its anchor.
+ */
+export declare function anchorSpelling(family: PathFamily, base: string, spelled: string): string;
 /** The family-aware LEXICAL view of a possibly-relative spelling against a resolution base (no I/O,
  *  `.`/`..` folded via {@link normalizeAbsPathLexically}): the SECOND deny-judgment view. It asks
  *  "does the NAME land on a guarded path", complementing the canonical
@@ -456,6 +462,7 @@ export declare function resolveKey(env: ExecutionEnv, rootCanonical: string, pat
     readonly homeViews?: HomeViewSource;
     matchTarget(canonicalKey: string, lexicalView?: string, opts?: {
         readonly aliasResolved?: boolean;
+        readonly hops?: readonly string[];
     }): {
         pattern: string;
         matchedView?: string;

package/dist/tools/fs/safety.js

@@ -1,9 +1,10 @@
 import { createHash } from "node:crypto";
 import { readDenySentence } from "./read-deny.js";
 import { homeViewsOf } from "./read-deny-home.js";
+import { skipsRootsContainment } from "./containment-face.js";
 import { sliceHeadSafe } from "../../core/surrogate-safe-slice.js";
 import { pathTargetValue, protectivePathTargetOf } from "../../core/tool-registry.js";
-import { readPathViews } from "../../core/effective-path-target.js";
+import { readPath } from "../../core/effective-path-target.js";
 import { withGateTimeout, DEFAULT_GATE_AWAIT_TIMEOUT_MS } from "../../core/gate-bounded-await.js";
 import { thrownText } from "../../core/thrown-value.js";
 export function fileArgPath(args) {
@@ -25,8 +26,8 @@ export function sha256(content) {
     return createHash("sha256").update(content, "utf8").digest("hex");
 }
 const SEP = "/";
-export function isAbsolutePathForm(p) {
-    return p.startsWith("/") || /^[A-Za-z]:[\\/]/.test(p) || p.startsWith("\\\\");
+export function relativeInEveryFamily(p) {
+    return !(p.startsWith("/") || p.startsWith("\\") || /^[A-Za-z]:/.test(p));
 }
 function nativeSepOf(p) {
     return isWinFormPath(p) && p.includes("\\") ? "\\" : "/";
@@ -314,8 +315,11 @@ export function pathFamilyOf(bases) {
 export function isUncSpelling(p) {
     return /^[\\/]{2}[^\\/]+[\\/]+[^\\/]/.test(p);
 }
+export function familyFor(source, p) {
+    return source === "own" ? (isWinFormPath(p) ? "win" : "posix") : source;
+}
 export function isAbsoluteForFamily(family, p) {
-    return family === "win" ? /^[A-Za-z]:[\\/]/.test(p) || isUncSpelling(p) : p.startsWith("/");
+    return familyFor(family, p) === "win" ? /^[A-Za-z]:[\\/]/.test(p) || isUncSpelling(p) : p.startsWith("/");
 }
 export const WIN32_NAMESPACE_REFUSALS = Object.freeze(["device_namespace", "unmappable_namespace", "unc_on_posix_tree", "drive_relative"]);
 export const WIN32_NAMESPACE_REFUSAL_TEXT = {
@@ -445,9 +449,11 @@ export function joinForFamily(family, base, rel) {
     }
     return `${base.replace(/[\\/]+$/, "")}${base.includes("\\") ? "\\" : "/"}${rel}`;
 }
+export function anchorSpelling(family, base, spelled) {
+    return isAbsoluteForFamily(family, spelled) ? spelled : joinForFamily(family, base, spelled);
+}
 export function lexicalViewOf(spelled, base) {
-    const family = pathFamilyOf({ root: base });
-    return normalizeAbsPathLexically(isAbsoluteForFamily(family, spelled) ? spelled : joinForFamily(family, base, spelled));
+    return normalizeAbsPathLexically(anchorSpelling(pathFamilyOf({ root: base }), base, spelled));
 }
 function within(rootCanonical, p) {
     if (!rootCanonical)
@@ -462,7 +468,7 @@ function within(rootCanonical, p) {
     return pN.identity.startsWith(rootN.identity.endsWith(SEP) ? rootN.identity : rootN.identity + SEP);
 }
 export async function resolveKey(env, rootCanonical, path, signal, baseCwd, additionalRoots, exactFileReadExemption, readDeny, containmentFace) {
-    const views = await readPathViews(env, path, baseCwd ?? rootCanonical, { root: rootCanonical, ...(baseCwd !== undefined ? { cwd: baseCwd } : {}) }, signal, { hops: readDeny !== undefined });
+    const views = await readPath(env, path, baseCwd ?? rootCanonical, { root: rootCanonical, ...(baseCwd !== undefined ? { cwd: baseCwd } : {}) }, { intent: "resolve", views: readDeny !== undefined ? "chain" : "canonical" }, signal);
     const canon = views.canonical ?? (await canonicalizeTarget(env, path, signal, pathFamilyOf({ root: rootCanonical }), baseCwd));
     if (!canon.ok)
         return { ok: false, violation: { code: "invalid", message: canon.message } };
@@ -473,7 +479,7 @@ export async function resolveKey(env, rootCanonical, path, signal, baseCwd, addi
     }
     if (readDeny !== undefined) {
         const judged = { aliasResolved: canon.aliasResolved === true, hops: views.hops };
-        const lexical = views.lexical?.kind === "path" ? spellingOfIdentity(views.lexical.identity, pathFamilyOf({ root: rootCanonical })) : undefined;
+        const lexical = views.lexical?.kind === "path" ? spellingOfIdentity(views.lexical.identity, views.lexical.family) : undefined;
         let hit = readDeny.matchTarget(key, lexical, judged);
         if (hit === null) {
             const homeView = await homeViewsOf(env, readDeny, signal).of(key);
@@ -493,7 +499,7 @@ export async function resolveKey(env, rootCanonical, path, signal, baseCwd, addi
             };
         }
     }
-    if (containmentFace === "open") {
+    if (skipsRootsContainment(containmentFace)) {
         if (isUncPath(key) && isWinFormPath(key) && !within(rootCanonical, key) && !additionalRootsCanonical?.some((r) => within(r, key))) {
             return {
                 ok: false,
@@ -528,7 +534,7 @@ export async function canonicalizeTarget(env, path, signal, family, baseCwd) {
     }
     const unprefixed = nativeUncSpellingOf(family, screened.spelled);
     const spelled = family === "posix" && unprefixed.startsWith("//") ? unprefixed.replace(/^\/+/, "/") : unprefixed;
-    const target = baseCwd && !isAbsoluteForFamily(family, spelled) ? joinForFamily(family, baseCwd, spelled) : spelled;
+    const target = baseCwd ? anchorSpelling(family, baseCwd, spelled) : spelled;
     let thrownByProbe;
     let seenThrow = false;
     const probe = probeRealTarget(env, path, target, family, signal).catch((e) => {
@@ -593,7 +599,7 @@ async function probeRealTarget(env, path, target, family, signal) {
             };
         }
         const hopSpelling = family === "win" ? screenedTarget.spelled : link.value;
-        const linkTarget = isAbsoluteForFamily(family, hopSpelling) ? hopSpelling : joinForFamily(family, parentDir(abs), hopSpelling);
+        const linkTarget = anchorSpelling(family, parentDir(abs), hopSpelling);
         const reabs = await env.absolutePath(linkTarget, signal);
         if (!reabs.ok) {
             return { ok: false, message: `cannot resolve symlink target "${linkTarget}" for "${path}": ${reabs.error.message}`, unresolvedSymlink: true };

package/dist/tools/fs/search.js

@@ -1,6 +1,6 @@
 import { delimitUntrusted } from "../../core/untrusted-text.js";
 import { MAX_EXEC_OUTPUT_BYTES } from "../../core/exec-output-tail.js";
-import { hasBinaryExtension, isAbsoluteForFamily, isWinFormPath, joinForFamily, pathFamilyOf } from "./safety.js";
+import { anchorSpelling, hasBinaryExtension, isWinFormPath, pathFamilyOf } from "./safety.js";
 import { homeViewsOf } from "./read-deny-home.js";
 import { createEntryDenyJudge } from "./dir-entries.js";
 import { thrownText } from "../../core/thrown-value.js";
@@ -781,7 +781,7 @@ export async function jsGrepDetailed(env, root, p, signal, guards, deny, denyOut
     const ignore = await buildIgnore(env, root, signal);
     const rootPrefix = root.replace(/[\\/]+$/, "") + (root.includes("\\") ? "\\" : "/");
     const family = pathFamilyOf({ root });
-    const start = p.path ? (isAbsoluteForFamily(family, p.path) ? p.path : joinForFamily(family, root, p.path)) : root;
+    const start = p.path ? anchorSpelling(family, root, p.path) : root;
     let walked;
     if (p.path) {
         const info = await env.fileInfo(start, signal);
@@ -1062,7 +1062,7 @@ async function sortRgFilesByMtime(env, root, records, signal) {
     const family = pathFamilyOf({ root });
     const toAbs = (p) => {
         const stripped = p.startsWith("./") ? p.slice(2) : p;
-        return isAbsoluteForFamily(family, stripped) ? stripped : joinForFamily(family, root, stripped);
+        return anchorSpelling(family, root, stripped);
     };
     const paths = records.map((r) => r.path ?? r.text);
     const infos = await Promise.all(paths.map((p) => env.fileInfo(toAbs(p), signal)));
@@ -1148,8 +1148,10 @@ export function rgOutputDenyTripwire(stdout, mode, judge, opts = {}) {
     return { trip: false };
 }
 function rgRecordAbsolute(base) {
-    const family = base !== undefined ? pathFamilyOf({ root: base }) : undefined;
-    return (p) => (base === undefined || family === undefined || isAbsoluteForFamily(family, p) ? p : joinForFamily(family, base, p.replace(/^\.[\\/]/, "")));
+    if (base === undefined)
+        return (p) => p;
+    const family = pathFamilyOf({ root: base });
+    return (p) => anchorSpelling(family, base, p.replace(/^\.[\\/]/, ""));
 }
 async function rgOutputDenyTripwireAt(env, stdout, mode, deny, opts, signal) {
     const views = homeViewsOf(env, deny, signal);
@@ -1258,7 +1260,7 @@ export async function rgGrepDetailed(env, root, p, signal, deny) {
         if (deny === undefined || deny.rgExclusionGlobs.length === 0)
             return { note: "" };
         if (p.path) {
-            const startPath = isAbsoluteForFamily(pathFamilyOf({ root }), p.path) ? p.path : joinForFamily(pathFamilyOf({ root }), root, p.path);
+            const startPath = anchorSpelling(pathFamilyOf({ root }), root, p.path);
             const info = await env.fileInfo(startPath, signal);
             if (info.ok && info.value.kind === "file")
                 return { note: "" };
@@ -1333,7 +1335,7 @@ async function rgDenyExistenceProbe(env, root, deny, target, signal) {
     }
 }
 export async function runGrepDetailed(env, root, p, signal, deny) {
-    const scope = p.path ? (isAbsoluteForFamily(pathFamilyOf({ root }), p.path) ? p.path : joinForFamily(pathFamilyOf({ root }), root, p.path)) : root;
+    const scope = p.path ? anchorSpelling(pathFamilyOf({ root }), root, p.path) : root;
     const unexcludableUnder = async () => {
         if (deny?.unexcludableUnder === undefined)
             return false;
@@ -1359,7 +1361,7 @@ export async function runGlobDetailed(env, root, pattern, opts = {}, signal) {
     const baseIgnore = await buildIgnore(env, root, signal);
     const rootPrefix = root.replace(/[\\/]+$/, "") + (root.includes("\\") ? "\\" : "/");
     const family = pathFamilyOf({ root });
-    const start = opts.path ? (isAbsoluteForFamily(family, opts.path) ? opts.path : joinForFamily(family, root, opts.path)) : root;
+    const start = opts.path ? anchorSpelling(family, root, opts.path) : root;
     if (opts.path !== undefined) {
         const probe = await env.fileInfo(start, signal);
         if (!probe.ok && probe.error.code === "not_found") {

package/dist/tools/fs/shell-read-argv.d.ts

@@ -10,11 +10,9 @@ import { type Read } from "./shell-read-word.js";
 import { type BindingTable, type FloorValue } from "./shell-read-bindings.js";
 import { subcommandOf, type ArgRole, type ProgramRow } from "./program-read-model.js";
 import type { ReadCandidate, ReadCandidateProvenance } from "./shell-read-plan.js";
-/** A candidate before the threading fills its bases. `alternatives`: the other spellings its word may expand to (a name
- *  bound to several values), each with the pattern its names are matched by — one candidate each once the segment's reads
- *  are read. */
+/** A candidate before the threading fills its bases. `floors`: the spellings its word's names left for the deny judge
+ *  alone (a word whose names are unknown here). */
 export type Bare = Omit<ReadCandidate, "bases"> & {
-    readonly alternatives?: readonly Pick<ReadCandidate, "spelled" | "pattern">[];
     readonly floors?: readonly FloorValue[];
 };
 /** What reading a segment's words found beside its candidates. */
@@ -36,9 +34,8 @@ export declare function pathSubcommandOf(row: ProgramRow | undefined, args: read
 /** The sentence of inline program text the station does not read. */
 export declare const programTextSentence: (language: string) => string;
 /** One candidate without its bases (filled by the threading pass): the word's spelling — or `spelled`, a caller's
- *  reading of PART of it (an option payload, a `key=value` value) — with the word's own expansion facts. A word whose
- *  names may hold several values offers each as its whole spelling; a PART of such a word is not followed through them
- *  (it is unresolvable). */
+ *  reading of PART of it (an option payload, a `key=value` value) — with the word's own expansion facts. The word is read
+ *  in one reading of the segment's names (`segmentReadingsOf`): its names hold one value each, or are unknown. */
 export declare function bare(r: Read, provenance: ReadCandidateProvenance, spelled?: string): Bare;
 /** The reads one value of a declared role hands over: a candidate per file it names, or — a value the program expands
  *  past the listed bound — the word itself, unresolvable. A mount source is a read the daemon makes of the whole tree

package/dist/tools/fs/shell-read-argv.js

@@ -1,5 +1,5 @@
 import { literalTildeSpelling } from "../../shell/lex.js";
-import { expandsOf, patternOf, readOfText, rewritten, spellingOf } from "./shell-read-word.js";
+import { expandsOf, partPattern, readOfText, rewritten } from "./shell-read-word.js";
 import { arithmeticSubstitutions } from "./shell-read-bindings.js";
 import { argvProgramOf, attachedOptionPayloads, isPathShapedToken } from "./bash-readonly-classifier.js";
 import { assignmentArgumentsAreNotPaths, evaluatesOperands, messageWords, moduleTailOf, objectPathsOf, opensNoOperand, programRow, programTextMayOpen, programTextOpensOf, readArgs, selectsContentsTraversal, slotValueCandidates, subcommandOf, valuesAreLiteral, walksCwdWithoutOperand, wordsReadBySomeImplementations, } from "./program-read-model.js";
@@ -10,16 +10,13 @@ export function pathSubcommandOf(row, args) {
 export const programTextSentence = (language) => `runs inline ${language} program text, which may open files this station does not read`;
 export function bare(r, provenance, spelled = r.folded) {
     const whole = spelled === r.folded;
-    const alternatives = r.values !== undefined && r.values.length > 1 ? r.values.slice(1).map((v) => { const pattern = patternOf(v); return { spelled: spellingOf(v), ...(pattern !== undefined ? { pattern } : {}) }; }) : undefined;
-    if (!whole && alternatives !== undefined)
-        return { spelled, raw: r.raw, provenance, expands: "unresolvable" };
+    const pattern = whole ? r.pattern : partPattern(r, spelled);
     return {
         spelled,
         raw: r.raw,
         provenance,
         expands: r.expands,
-        ...(whole && r.pattern !== undefined ? { pattern: r.pattern } : {}),
-        ...(whole && alternatives !== undefined ? { alternatives } : {}),
+        ...(pattern !== undefined ? { pattern } : {}),
         ...(whole && r.homeFloor !== undefined ? { floorSpelled: r.homeFloor } : {}),
         ...(whole && r.floorValues !== undefined ? { floors: r.floorValues } : {}),
     };
@@ -64,8 +61,9 @@ export function pushAssignment(reads, w, provenance) {
     if (!settled && unsettled !== undefined)
         reads.push(unsettled);
     const substitutes = a.value.expansions.some((p) => p.expansion?.kind === "command" || p.expansion?.kind === "process" || p.expansion?.kind === "arithmetic");
+    const pattern = named === undefined ? undefined : partPattern({ folded: w.folded, ...(w.judged !== undefined ? { pattern: w.judged } : {}) }, named);
     if (named !== undefined && !substitutes)
-        reads.push({ spelled: named, raw: w.raw, provenance, expands: expandsOf(w) });
+        reads.push({ spelled: named, raw: w.raw, provenance, expands: expandsOf(w), ...(pattern !== undefined ? { pattern } : {}) });
     if (a.value.folded.includes(":"))
         for (const m of a.value.folded.split(":"))
             if (m !== "") {
@@ -94,7 +92,7 @@ export function unlistedWords(reads, toks, from, launcherIndices, provenance, ct
     const noPathOperands = slotVerb !== undefined && opensNoOperand(slotVerb);
     const expanding = new Set();
     for (let j = from; j < toks.length; j++) {
-        if (launcherIndices.has(j))
+        if (launcherIndices.has(j) || message.has(j))
             continue;
         if (noPathOperands && j > argvStart && !evaluatesOperands(slotVerb))
             break;