@sema-agent/core 7.47.0 → 7.49.0

package/dist/tools/fs/shell-read-judge.js

@@ -1,6 +1,7 @@
 import { hasWin32AliasedComponent, normalizeAbsPathLexically, withinAnyRoot } from "./safety.js";
 import { globInWord } from "./bash-readonly-classifier.js";
 import { readOfText } from "./shell-read-word.js";
+import { skipsRootsContainment } from "./containment-face.js";
 export const SHELL_READ_FINDINGS = Object.freeze(["deny_hit", "outside_roots", "unestablishable", "declined", "identity_changed", "none"]);
 export const SHELL_READ_SEATS = Object.freeze(["full_shell", "readonly", "rejudge"]);
 export const SHELL_READ_FINDING_RANK = {
@@ -37,11 +38,11 @@ export function judgeRead(read, boundary) {
             const folded = normalizeAbsPathLexically(view);
             const pattern = writeTarget ? boundary.writeDenyMatch(folded) : boundary.denyMatch(folded, walked);
             if (pattern !== null)
-                return { read, kind: "deny_hit", deny: { pattern, matchedView: folded, ...(writeTarget ? { face: "write" } : {}) }, containment: containmentOf(read, boundary) };
+                return { read, kind: "deny_hit", deny: { pattern, matchedView: folded, ...(writeTarget ? { face: "write" } : {}) }, containment: writeTarget ? writeContainmentOf(read, boundary) : containmentOf(read, boundary) };
         }
     }
     if (writeTarget)
-        return { read, kind: "none", containment: containmentOf(read, boundary) };
+        return judgeWrite(read, boundary);
     const containment = containmentOf(read, boundary);
     if (read.candidate.denyOnly === true)
         return { read, kind: "none", containment };
@@ -72,19 +73,45 @@ function containmentOf(read, boundary) {
         return "unknown";
     return withinAnyRoot(boundary.roots, read.target) ? "inside" : "outside";
 }
+const NULL_DEVICE = "/dev/null";
+function writeContainmentOf(read, boundary) {
+    const device = read.written?.seat === "landing" && read.candidate.expands === false && read.candidate.spelled === NULL_DEVICE;
+    if (read.written === undefined || read.candidate.denyOnly === true || device)
+        return "open";
+    const roots = boundary.writeRoots;
+    if (roots === undefined || read.target === undefined)
+        return "unknown";
+    return withinAnyRoot(roots, read.target) ? "inside" : "outside";
+}
+function judgeWrite(read, boundary) {
+    const containment = writeContainmentOf(read, boundary);
+    if (containment === "open")
+        return { read, kind: "none", containment };
+    if (read.established === "unestablishable" || boundary.writeRoots === undefined)
+        return { read, kind: "unestablishable", containment };
+    return { read, kind: containment === "outside" && !skipsRootsContainment(boundary.writeFace) ? "outside_roots" : "none", containment };
+}
 export function stationGuards(boundary) {
     return boundary.face !== "open" || boundary.denyMatch !== undefined;
 }
+export function writeFaceGuards(boundary) {
+    return !skipsRootsContainment(boundary.writeFace) || boundary.writeDenyMatch !== undefined;
+}
+export function anyFaceGuards(boundary) {
+    return stationGuards(boundary) || writeFaceGuards(boundary);
+}
 export function foldShellReadFindings(judged) {
     let best = { finding: "none" };
     let unestablished = false;
     const raise = (next) => {
         if (next.finding === "unestablishable" || next.finding === "declined") {
-            if (!judged.guards)
+            const face = next.witness?.read.candidate.face;
+            if (!(next.witness === undefined ? judged.guards || judged.writeGuards : face === "write" ? judged.writeGuards : judged.guards))
                 return;
             unestablished = true;
         }
-        if (SHELL_READ_FINDING_RANK[next.finding] > SHELL_READ_FINDING_RANK[best.finding])
+        const rank = SHELL_READ_FINDING_RANK[next.finding] - SHELL_READ_FINDING_RANK[best.finding];
+        if (rank > 0 || (rank === 0 && next.witness?.read.candidate.face === "write" && best.witness?.read.candidate.face !== "write"))
             best = next;
     };
     const walk = (j, denyOnly) => {
@@ -125,6 +152,7 @@ export function judgeEstablishedPlan(plan, established, boundary, nestedOf) {
             nested: segment.nested.map(nestedOf),
         })),
         guards: stationGuards(boundary),
+        writeGuards: writeFaceGuards(boundary),
     };
 }
 export function allFindings(judged) {
@@ -208,5 +236,6 @@ export function rejudge(judged, boundary) {
             nested: s.nested.map((n) => rejudge(n, boundary)),
         })),
         guards: stationGuards(boundary),
+        writeGuards: writeFaceGuards(boundary),
     };
 }

package/dist/tools/fs/shell-read-plan.d.ts

@@ -24,15 +24,15 @@
  *    and here-strings are data (an UNQUOTED here-document body's substitutions are nested plans) — except to a shell
  *    whose argv names no script: what arrives on its standard input is its script, a nested plan where the text spells it;
  *  · `$(…)`, backticks and `<(…)` bodies are nested plans; a word carrying one cannot be resolved from the text;
- *  · `cd` moves the base the LATER segments resolve against, as a candidate SET (`&&` proves a move, nothing
- *    else does); `pushd`/`popd` lose the base; a loop body with a base move is replayed per LITERAL beat and
- *    otherwise loses the base for what follows.
+ *  · the working-directory thread (`shell-read-workdir.ts`) moves the base the LATER segments resolve against, as a
+ *    candidate SET (`&&` proves a move, nothing else does), and gives `PWD` / `OLDPWD` their values; a loop body with
+ *    a base move is replayed per LITERAL beat and otherwise loses the base for what follows.
  * Every ambiguity resolves toward MORE candidates, never fewer.
  */
 import { type LenientConnector, type LexedRedirect, type LexedWord } from "../../shell/lex.js";
-import { type BindingTable, type NameReader } from "./shell-read-bindings.js";
 import { type ShellScanDecline } from "./bash-program-position.js";
 import { type StdinText } from "./shell-reentry-text.js";
+import { type PlanStart } from "./shell-read-start.js";
 /** WHY a word is a read candidate — a closed set, registered in `docs/CLOSED-SETS.md`. */
 export declare const READ_CANDIDATE_PROVENANCES: readonly ["operand", "option_value", "stdin_redirect", "write_redirect_target", "env_assignment", "unlisted_word", "traversal_root", "cd_target", "program_path", "script_slot_file", "mount_source", "object_path"];
 export type ReadCandidateProvenance = (typeof READ_CANDIDATE_PROVENANCES)[number];
@@ -47,6 +47,9 @@ export interface ShellReadDeclarations {
     readonly cwd: string;
     readonly roots: readonly string[];
     readonly face?: "open" | "roots";
+    /** The `CDPATH` the shell starts with (the environment's declared one, `ExecutionEnv.cdPath`; a bare relative `cd` is
+     *  searched through it): absent ⇒ none declared, read as unset; `unknown` ⇒ the text cannot know it. */
+    readonly cdPath?: readonly string[] | "unknown";
 }
 export interface ReadCandidate {
     /** The folded word (quotes removed, a literal leading tilde spelled `./~`) — a pattern's name where nothing matches. */
@@ -70,10 +73,10 @@ export interface ReadCandidate {
     /** A home word the plan does not place (the text may rebind `HOME`, it sits in a value, or it is a literal tilde the
      *  program may expand itself): spelled with the DECLARED home. The judge reads it for deny rows ONLY. */
     readonly floorSpelled?: string;
-    /** A deny-floor shadow of a `floorSpelled` spelling, established as a read and judged for deny rows only. */
+    /** Deny rows only (never containment): a `floorSpelled` shadow, or the read copy of a word the program only writes. */
     readonly denyOnly?: true;
-    /** A WRITE target of the command (a `>`-family redirection, a `sed` `w` file, the operands of a file-writing command):
-     *  established like a read and judged against the deny table's WRITE face only — never for containment, never a read. */
+    /** A WRITE target (a `>`-family redirection, a `sed` `w` file, a file-writing command's operand): established like a
+     *  read, judged on the WRITE face — the write deny rows, then the write roots where written — never as a read. */
     readonly face?: "write";
     /** A reading the station takes where no row says the program opens the word — a word of a program with no row, a
      *  role only another implementation reads — so the filesystem decides it: `containment` = the spelling always meets
@@ -129,6 +132,9 @@ export interface ShellReadSegment {
     /** Substitution bodies, unquoted here-document substitutions, and re-entered shell text, each its own plan. */
     readonly nested: readonly ShellReadPlan[];
     readonly reach: SegmentReach;
+    /** The names a change that can reach this segment touched (`BindingTable.rebound`): any other name still holds what the
+     *  shell provides here. `all`: any name may have changed. */
+    readonly rebound: ReadonlySet<string> | "all";
 }
 export interface ShellReadPlan {
     readonly segments: readonly ShellReadSegment[];
@@ -142,18 +148,5 @@ export interface ShellReadPlan {
         readonly strayRedirection: boolean;
     };
 }
-/** Where a nested text starts its names: a substitution body inherits the table of the segment it sits in (a subshell
- *  holds every variable); a text the shell runs later or elsewhere (a code body, `eval`'s text, a child shell's `-c`)
- *  starts from the text's own start — every name unknown, `HOME` the declared home unless the enclosing text binds it
- *  anywhere. `boundAnywhere` answers for the enclosing texts. */
-interface PlanStart {
-    readonly initial: NameReader;
-    readonly boundAnywhere: (name: string) => boolean;
-    /** `HOME` may already hold something other than the declared home where the nested text starts. */
-    readonly homeTouched: boolean;
-    /** The attributes and name references in force where the nested text starts. */
-    readonly inherited: BindingTable["inherited"];
-}
 /** Plan every read candidate of one command (the contract is this module's header). */
 export declare function planShellReads(command: string, decl: ShellReadDeclarations, depth?: number, start?: PlanStart): ShellReadPlan;
-export {};