@sema-agent/core 7.48.0 → 7.49.1

package/dist/tools/fs/read-deny-home.js

@@ -1,8 +1,9 @@
 import { userInfo } from "node:os";
-import { canonicalizeTarget, isAbsolutePathForm, joinForFamily, normalizeAbsPathLexically, pathFamilyOf } from "./safety.js";
+import { canonicalizeTarget, isAbsoluteForFamily, joinForFamily, normalizeAbsPathLexically, pathFamilyOf } from "./safety.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, withGateTimeout } from "../../core/gate-bounded-await.js";
 import { thrownText } from "../../core/thrown-value.js";
 import { agentConfigDirTail } from "../../core/agent-config-dir.js";
+import { validatePath } from "../../core/effective-path-target.js";
 import { isRootedReadDenyPattern, readDenyPatternRun, readDenyRunHead } from "./read-deny.js";
 export const AUXILIARY_HOME_PROBE_MS = 2_000;
 const said = new Set();
@@ -36,8 +37,9 @@ function valueText(v) {
 function accountHomeOf() {
     try {
         const home = userInfo().homedir;
-        if (typeof home === "string" && isAbsolutePathForm(home))
-            return { state: "home", home };
+        const valid = validatePath(home, { intent: "validate-coordinate" });
+        if (valid !== undefined)
+            return { state: "home", home: valid };
         sayOnce("bad_value", `read-deny homes: the account home lookup answered ${valueText(home)}, not an absolute path — home-anchored read-deny rows are placed under the environment's declared home only.`);
         return { state: "none" };
     }
@@ -49,8 +51,7 @@ function accountHomeOf() {
     }
 }
 function declaredHomeOf(env) {
-    const home = env.homeDir;
-    return home !== undefined && isAbsolutePathForm(home) ? home : undefined;
+    return validatePath(env.homeDir, { intent: "validate-coordinate" });
 }
 function declaredReadDenyHomesAnswered(env) {
     const home = declaredHomeOf(env);
@@ -105,56 +106,43 @@ function sayAuxiliary(what, subject = "auxiliary") {
     }
     sayOnce("auxiliary", `read-deny homes: a home beside the environment's declared home did not answer its probes within ${AUXILIARY_HOME_PROBE_MS} ms (${what}) — its home-anchored read-deny rows sit at its spelling only, and a path through an alias of it is judged as spelled, until the next placement.`);
 }
-export async function readDenyHomeLinksOf(env, entries, homes, signal, deadline) {
-    const rows = [];
-    for (const { pattern, caseSensitive } of entries) {
-        const { homeAnchored, run } = readDenyPatternRun(pattern);
-        if (!homeAnchored)
-            continue;
-        const head = literalHeadOf(run);
-        if (head.length === 0)
-            continue;
-        const spelled = homes.map((home) => normalizeAbsPathLexically(joinForFamily(pathFamilyOf({ root: home }), home, head)));
-        rows.push({ pattern, caseSensitive: caseSensitive === true, spelled, anchored: spelled });
-    }
-    return await linkedLocationsOf(env, rows, signal, deadline);
+export async function readDenyLinksOf(env, entries, anchor, signal, deadline) {
+    return await linkedLocationsOf(env, anchoredRowsOf(entries, anchor), signal, deadline);
 }
 const ROOT = "/";
-export async function readDenyRootLinksOf(env, entries, signal, deadline) {
-    const rows = [];
-    for (const { pattern, caseSensitive } of entries) {
-        if (!isRootedReadDenyPattern(pattern))
-            continue;
-        const head = literalHeadOf(pattern);
-        if (head.length === 0)
-            continue;
-        const spelled = [normalizeAbsPathLexically(joinForFamily(pathFamilyOf({ root: ROOT }), ROOT, head))];
-        rows.push({ pattern, caseSensitive: caseSensitive === true, spelled, anchored: spelled });
-    }
-    return await linkedLocationsOf(env, rows, signal, deadline);
-}
 function literalHeadOf(run) {
     return run.split("/").filter(Boolean).slice(0, readDenyRunHead(run)).join("/");
 }
-export async function readDenyConfigRootLinksOf(env, entries, roots, signal, deadline) {
-    return await linkedLocationsOf(env, configRootRowsOf(entries, roots), signal, deadline);
-}
-function configRootRowsOf(entries, roots) {
+function anchoredRowsOf(entries, anchor) {
+    const places = anchor.at === "home" ? anchor.homes : anchor.at === "root" ? [ROOT] : anchor.roots;
     const rows = [];
     for (const { pattern, caseSensitive } of entries) {
-        const { homeAnchored, run } = readDenyPatternRun(pattern);
-        const tail = homeAnchored ? agentConfigDirTail(run, caseSensitive === true) : undefined;
-        if (tail === undefined)
+        const head = rowHeadOf(pattern, caseSensitive === true, anchor);
+        if (head === undefined)
             continue;
-        const head = literalHeadOf(tail);
-        const spelled = roots.map((root) => normalizeAbsPathLexically(head.length === 0 ? root : joinForFamily(pathFamilyOf({ root }), root, head)));
-        rows.push({ pattern, caseSensitive: caseSensitive === true, spelled, anchored: [] });
+        const spelled = places.map((place) => normalizeAbsPathLexically(head.length === 0 ? place : joinForFamily(pathFamilyOf({ root: place }), place, head)));
+        rows.push({ pattern, caseSensitive: caseSensitive === true, spelled, anchored: anchor.at === "unanchored" ? [] : spelled });
     }
     return rows;
 }
+function rowHeadOf(pattern, caseSensitive, anchor) {
+    if (anchor.at === "root") {
+        const head = isRootedReadDenyPattern(pattern) ? literalHeadOf(pattern) : "";
+        return head.length > 0 ? head : undefined;
+    }
+    const { homeAnchored, run } = readDenyPatternRun(pattern);
+    if (!homeAnchored)
+        return undefined;
+    if (anchor.at === "unanchored") {
+        const tail = agentConfigDirTail(run, caseSensitive);
+        return tail === undefined ? undefined : literalHeadOf(tail);
+    }
+    const head = literalHeadOf(run);
+    return head.length > 0 ? head : undefined;
+}
 function configRootSpelledLinks(entries, roots) {
     const out = new Map();
-    for (const { pattern, spelled } of configRootRowsOf(entries, roots))
+    for (const { pattern, spelled } of anchoredRowsOf(entries, { at: "unanchored", roots }))
         out.set(pattern, [...new Set(spelled)]);
     return out;
 }
@@ -259,9 +247,7 @@ async function readAuxiliaryHome(env, home, opts, signal) {
             typeof identity === "function" ? chainAbove(env, identity, spelled.canonical, signal, deadline) : Promise.resolve({ ancestors: [], whole: true }),
             opts.entries === undefined
                 ? Promise.resolve({ linked: new Map(), whole: true })
-                : opts.configRoot === true
-                    ? readDenyConfigRootLinksOf(env, opts.entries, place, signal, deadline)
-                    : readDenyHomeLinksOf(env, opts.entries, place, signal, deadline),
+                : readDenyLinksOf(env, opts.entries, opts.configRoot === true ? { at: "unanchored", roots: place } : { at: "home", homes: place }, signal, deadline),
         ]);
         reading = { place, chain, linked: heads.linked, answered: chain.whole && heads.whole };
     }
@@ -337,7 +323,7 @@ function homeViewSourceOver(env, auxiliary) {
             };
             return {
                 async of(path, opts) {
-                    if (typeof identity !== "function" || (declared === undefined && auxiliary.length === 0) || !isAbsolutePathForm(path))
+                    if (typeof identity !== "function" || (declared === undefined && auxiliary.length === 0) || !isAbsoluteForFamily("own", path))
                         return undefined;
                     const spelled = normalizeAbsPathLexically(path);
                     const view = await viewOf(spelled, opts?.leaf === "file");
@@ -365,7 +351,7 @@ export function sayPlacementLost() {
 }
 function readAuxiliaryHomes(env, homes, opts, signal) {
     const declared = declaredHomeOf(env);
-    return [...new Set(homes.filter((h) => isAbsolutePathForm(h) && !isDeclared(declared, h)))].map((home) => readAuxiliaryHome(env, home, opts, signal));
+    return [...new Set(homes.filter((h) => isAbsoluteForFamily("own", h) && !isDeclared(declared, h)))].map((home) => readAuxiliaryHome(env, home, opts, signal));
 }
 export function homeViewsAt(env, homes) {
     return homeViewSourceOver(env, readAuxiliaryHomes(env, homes, {}));
@@ -380,7 +366,7 @@ export async function placeReadDenyAtHome(env, compile, homes, signal, configRoo
     const entries = compile([]).entries;
     const declared = declaredHomeOf(env);
     const relocated = configRoot === undefined ? undefined : readAuxiliaryHome(env, configRoot, { entries, configRoot: true }, signal);
-    const rooted = readDenyRootLinksOf(env, entries, signal);
+    const rooted = readDenyLinksOf(env, entries, { at: "root" }, signal);
     const heldAnywhere = async (whole) => {
         const linked = new Map();
         for (const map of [(await relocated)?.linked, (await rooted).linked])
@@ -400,7 +386,7 @@ export async function placeReadDenyAtHome(env, compile, homes, signal, configRoo
         declaredAt = [...new Set([...own, ...ownSpellings.spellings])];
     }
     const auxiliary = readAuxiliaryHomes(env, listed.homes, { entries }, signal);
-    const [heads, readings, root, rootedHeads] = await Promise.all([readDenyHomeLinksOf(env, entries, declaredAt, signal), Promise.all(auxiliary), relocated, rooted]);
+    const [heads, readings, root, rootedHeads] = await Promise.all([readDenyLinksOf(env, entries, { at: "home", homes: declaredAt }, signal), Promise.all(auxiliary), relocated, rooted]);
     const at = [...new Set([...declaredAt, ...readings.flatMap((r) => r.place)])];
     const linked = new Map();
     for (const map of [heads.linked, ...readings.map((r) => r.linked), ...(root === undefined ? [] : [root.linked]), rootedHeads.linked]) {

package/dist/tools/fs/read-deny.d.ts

@@ -1,3 +1,4 @@
+import { type PathGuardFold, type PathGuardRow, type PathRowsHit, type TargetViews } from "../../core/path-guard-rows.js";
 /**
  * One deny entry: a `/`-separated run of path SEGMENTS. `*` matches any run of non-separator
  * characters within one segment and is the ONLY metacharacter (everything else is literal). The run
@@ -86,28 +87,12 @@ export type PathRowReach = {
 export interface JudgedPathRow extends PathRuleDenyRow {
     readonly reach?: (absolutePath: string) => PathRowReach;
 }
-/** A call's target as a judgment reads it: the absolute spellings of its views (lexical, canonical, the leaf chain's hops —
- *  any order the caller holds), or `unreadable` when the call names a target this reading cannot locate. */
-export interface TargetViews {
-    readonly spellings: readonly string[];
-    readonly unreadable?: string;
-}
-/** What {@link pathRowsReach} found: the row, the view it met there (absent on an unreadable hold), and — when nothing was
- *  reached and some row could not be judged — the reason of the first such row. */
-export interface PathRowsHit<R> {
-    readonly row: R;
-    readonly view?: string;
-    readonly unreadable?: string;
-}
 /**
- * THE one judgment of path rule rows over a call's target, for the gate's rule lanes and the tool's deny table alike: rows
- * outer, views inner — the first row (in the caller's order) that some view reaches is the answer, so the rule a refusal
- * names does not depend on which view happened to meet it. `tighten` (deny / ask): any view reaching the row reaches it; a
- * row that cannot be judged (or a target that cannot be read) is held and answered only when no row reaches. `allow`: a
- * row admits the call only when it admits EVERY view (a link out of an allowed directory is not admitted through its
- * spelling); an unreadable target is admitted by nothing.
+ * Rule rows judged by THE one judgment ({@link judgePathRows}): each rule row read as a guarded row whose reach over a view
+ * is the rule's own reach over the view's spelling (never exemptible — a rule says exactly where it reaches). Same rows
+ * outer, views inner, same tighten / allow law as every other row; the hit names the rule row itself.
  */
-export declare function pathRowsReach<R extends JudgedPathRow>(rows: readonly R[], views: TargetViews, direction: "tighten" | "allow"): PathRowsHit<R> | undefined;
+export declare function judgeRuleRows<R extends JudgedPathRow>(rows: readonly R[], views: TargetViews, direction: "tighten" | "allow"): PathRowsHit<R> | undefined;
 /** The locations a row is also judged at (each leading part of its HEAD: the anchor's children down to the head itself,
  *  a share's root for a UNC head) — what a leg resolves once, for every row whose head it holds. */
 export declare function ruleHeadParts(rows: readonly Pick<PathRuleDenyRow, "head">[]): string[];
@@ -129,10 +114,23 @@ export declare function rowsWhereTheyLead<R extends JudgedPathRow>(rows: readonl
 export declare function locationLeadsTo(path: string, leads: ReadonlyMap<string, string | undefined>): string | undefined;
 /** {@link rowsWhereTheyLead} with each part resolved by `leadsTo` (the leg's resolution; each part once). */
 export declare function withRuleRowsWhereTheyLead<R extends JudgedPathRow>(rows: readonly R[], leadsTo: (head: string) => Promise<string | undefined>): Promise<R[]>;
+/** A rule row as a row of the one table: its name is the rule text, its reach the rule's own over a view's spelling. */
+export declare function ruleGuardRow<R extends JudgedPathRow>(rule: R): PathGuardRow & {
+    readonly rule: R;
+};
+/** A compiled segment-glob row as a row of the one table (`faces`, `polarity`, `exemptible` and `origin` are the table's). */
+export declare function segmentGuardRow(pat: CompiledSegmentPattern, columns: {
+    readonly faces: readonly DenyFace[];
+    readonly polarity: "deny" | "ask";
+    readonly exemptible: boolean;
+    readonly fold: PathGuardFold;
+    readonly origin: PathGuardRow["origin"];
+    readonly tier?: string;
+}): PathGuardRow;
 /**
  * The WRITE face of the deny table: the rule rows whose faces include `write` — the judge the shell station reads for a
  * command's write targets (a redirection, `tee`, `sed -i`, `cp` / `mv` / `touch` / `mkdir` / `rm` operands). Same row
- * type, same judgment ({@link pathRowsReach}) as the read face's rule rows; a hit names the row by its rule text.
+ * type, same judgment ({@link judgePathRows}) as the read face's rows; a hit names the row by its rule text.
  */
 export interface WriteDenyMatcher {
     /** Which face this judge is — the write tools' path resolution reads it to word and code the refusal as a write. */
@@ -412,6 +410,9 @@ export declare function compileSegmentPattern(raw: string, fold: "none" | "ascii
 export declare function matchSegmentPatterns(path: string, compiled: readonly CompiledSegmentPattern[], opts?: {
     readonly aliasResolved?: boolean;
 }): string | null;
+/** One entry's refusal under the deny list's entry law ({@link normalizeEntry}, the compiler's own), or `undefined` when the
+ *  entry is lawful — the law read without compiling, for a door that judges a list before anything folds it. */
+export declare function readDenyEntryProblem(entry: unknown, layer: string): string | undefined;
 /** Is a canonical pattern ROOTED — placed at the filesystem root ({@link ReadDenyEntry})? Only {@link canonicalReadDenyPattern}
  *  puts a leading `/` on a canonical pattern, so the text is the whole answer. */
 export declare function isRootedReadDenyPattern(canonical: string): boolean;
@@ -445,7 +446,7 @@ export declare function checkedReadDenyHomes(homes: unknown, seat?: string): rea
  * home: a home-anchored entry then matches its run anywhere — a row that cannot be placed holds wider, never narrower.
  *
  * `linked` — where a home-anchored or a rooted row's LITERAL HEAD ({@link readDenyRunHead}) really leads, keyed by the row's
- * pattern: the canonical locations a mount resolved (`readDenyHomeLinksOf` / `readDenyRootLinksOf`, read-deny-home.ts) where
+ * pattern: the canonical locations a mount resolved (`readDenyLinksOf`, read-deny-home.ts) where
  * one of the head's segments is a link (`~/.sema` linked into a dotfiles directory; `/app` a link to `/data/app`). The row is placed at each location too —
  * the same row, the same name in every refusal — with the rest of its run matched below it. The read faces judge
  * canonical keys, so every spelling that reaches the linked file meets the row there. Absolute locations only.

package/dist/tools/fs/read-deny.js

@@ -1,6 +1,8 @@
 import { sliceHeadSafe, sliceTailSafe } from "../../core/surrogate-safe-slice.js";
-import { isAbsolutePathForm, normalizeAbsPathLexically, pathFamilyOf, pathIdentityOf, spellingOfIdentity } from "./safety.js";
+import { isAbsoluteForFamily, normalizeAbsPathLexically, pathFamilyOf, pathIdentityOf, spellingOfIdentity } from "./safety.js";
 import { PROBE_REASON_MAX } from "../../core/untrusted-text.js";
+import { validatePath } from "../../core/effective-path-target.js";
+import { judgePathRows } from "../../core/path-guard-rows.js";
 export const READ_DENY_HOME_WORD = "~";
 export function readDenyPatternRun(pattern) {
     const segments = pattern.split("/").filter(Boolean);
@@ -15,28 +17,12 @@ export const DENY_FACES = Object.freeze(["read", "write"]);
 const REACHED = { reach: "reached" };
 const NOT_REACHED = { reach: "not_reached" };
 const reachOf = (row, spelled) => row.reach?.(spelled) ?? (row.reaches(spelled) ? REACHED : NOT_REACHED);
-export function pathRowsReach(rows, views, direction) {
-    if (direction === "allow") {
-        if (views.unreadable !== undefined || views.spellings.length === 0)
-            return undefined;
-        for (const row of rows)
-            if (views.spellings.every((v) => reachOf(row, v).reach === "reached"))
-                return { row };
-        return undefined;
-    }
-    let held;
-    for (const row of rows) {
-        if (views.unreadable !== undefined)
-            held ??= { row, unreadable: views.unreadable };
-        for (const view of views.spellings) {
-            const r = reachOf(row, view);
-            if (r.reach === "reached")
-                return { row, view };
-            if (r.reach === "unreadable")
-                held ??= { row, unreadable: r.reason };
-        }
-    }
-    return held;
+export function judgeRuleRows(rows, views, direction) {
+    const hit = judgePathRows(rows.map(ruleGuard), views, direction);
+    return hit === undefined ? undefined : { ...hit, row: hit.row.rule };
+}
+function ruleGuard(rule) {
+    return { rule, reach: (view) => reachOf(rule, view.path) };
 }
 export function ruleHeadParts(rows) {
     const out = new Set();
@@ -130,34 +116,42 @@ function rowLedTo(row, head, at) {
             : {}),
     };
 }
-function ruleRowsHit(rows, face, spellings) {
-    const onFace = rows.filter((r) => r.faces.includes(face));
-    return onFace.length === 0 ? undefined : pathRowsReach(onFace, { spellings }, "tighten");
+export function ruleGuardRow(rule) {
+    return { rule, name: rule.rule, grammar: { kind: "rule", rule: rule.rule }, polarity: "deny", faces: rule.faces, placement: "anywhere", fold: "exact", exemptible: false, origin: "rule", reach: (view) => reachOf(rule, view.path) };
+}
+export function segmentGuardRow(pat, columns) {
+    const placement = pat.anchors === undefined ? "anywhere" : pat.rootedOnly !== true ? "home" : pat.anchors.length === 1 && pat.anchors[0].length === 0 ? "rooted" : { below: `/${(pat.anchors[0] ?? []).join("/")}` };
+    return {
+        name: pat.raw,
+        grammar: { kind: "segment-glob", run: pat.raw },
+        placement,
+        ...columns,
+        reach: (view) => (segmentRowMeets(pat, segmentReadingsOf(view.path, view.aliasResolved === true)) ? REACHED : NOT_REACHED),
+    };
+}
+function denyTableHit(rows, views) {
+    const hit = judgePathRows(rows, views, "tighten");
+    if (hit === undefined)
+        return null;
+    const view = hit.view ?? views.views[0]?.path;
+    return { pattern: hit.row.name, ...(view !== undefined ? { matchedView: view } : {}) };
+}
+function denyTargetViews(canonicalKey, lexicalView, opts) {
+    const views = [{ path: canonicalKey, kind: "canonical", ...(opts?.aliasResolved === true ? { aliasResolved: true } : {}) }];
+    if (lexicalView !== undefined)
+        views.push({ path: lexicalView, kind: "lexical" });
+    for (const hop of opts?.hops ?? [])
+        views.push({ path: hop, kind: "hop" });
+    return { views };
 }
 export function compileWriteDeny(rules = []) {
     const ruleRows = rules.filter((r) => r.faces.includes("write"));
+    const rows = ruleRows.map(ruleGuardRow);
     const matchPath = (path) => {
-        const hit = ruleRowsHit(ruleRows, "write", [path]);
-        return hit === undefined ? null : { pattern: hit.row.rule };
+        const hit = denyTableHit(rows, { views: [{ path, kind: "lexical" }] });
+        return hit === null ? null : { pattern: hit.pattern };
     };
-    return { face: "write", ruleRows, matchPath, matchTarget: (canonicalKey, lexicalView, opts) => matchTargetOver(() => null, ruleRows, "write", canonicalKey, lexicalView, opts) };
-}
-function matchTargetOver(segmentPath, ruleRows, face, canonicalKey, lexicalView, opts) {
-    const canonical = segmentPath(canonicalKey, opts);
-    if (canonical !== null)
-        return { ...canonical, matchedView: canonicalKey };
-    if (lexicalView !== undefined) {
-        const lexical = segmentPath(lexicalView);
-        if (lexical !== null)
-            return { ...lexical, matchedView: lexicalView };
-    }
-    for (const hop of opts?.hops ?? []) {
-        const viaHop = segmentPath(hop);
-        if (viaHop !== null)
-            return { ...viaHop, matchedView: hop };
-    }
-    const hit = ruleRowsHit(ruleRows, face, [canonicalKey, ...(lexicalView !== undefined ? [lexicalView] : []), ...(opts?.hops ?? [])]);
-    return hit === undefined ? null : { pattern: hit.row.rule, matchedView: hit.view ?? canonicalKey };
+    return { face: "write", ruleRows, matchPath, matchTarget: (canonicalKey, lexicalView, opts) => denyTableHit(rows, denyTargetViews(canonicalKey, lexicalView, opts)) };
 }
 export function readDenySeat(matcher) {
     const entries = [...(matcher?.entries ?? []).map((e) => e.pattern), ...(matcher?.ruleRows ?? []).map((r) => r.rule)];
@@ -320,28 +314,43 @@ export function compileSegmentPattern(raw, fold) {
     return { raw, segments, foldAscii: fold === "ascii" };
 }
 export function matchSegmentPatterns(path, compiled, opts) {
-    const views = segmentViewsOf(path, opts);
-    const rooted = isAbsolutePathForm(path);
-    const lowered = new Map();
-    for (const pat of compiled) {
-        for (const view of views) {
-            const segs = pat.foldAscii ? (lowered.get(view) ?? lowered.set(view, view.map(asciiLower)).get(view)) : view;
-            const n = pat.segments.length;
-            const runAt = (i) => i + n <= segs.length && pat.segments.every((re, j) => re.test(segs[i + j] ?? ""));
-            if (pat.anchors !== undefined && rooted) {
-                for (const anchor of pat.anchors)
-                    if (anchor.every((a, j) => segs[j] === a) && runAt(anchor.length))
-                        return pat.raw;
-                continue;
-            }
-            if (pat.rootedOnly === true)
-                continue;
-            for (let i = 0; i + n <= segs.length; i++)
-                if (runAt(i))
-                    return pat.raw;
+    const readings = segmentReadingsOf(path, opts?.aliasResolved === true);
+    for (const pat of compiled)
+        if (segmentRowMeets(pat, readings))
+            return pat.raw;
+    return null;
+}
+const SEGMENT_READINGS = new Map();
+function segmentReadingsOf(path, aliasResolved) {
+    const key = `${aliasResolved ? "1" : "0"}${path}`;
+    const known = SEGMENT_READINGS.get(key);
+    if (known !== undefined)
+        return known;
+    const views = segmentViewsOf(path, aliasResolved ? { aliasResolved } : undefined);
+    const readings = { views, lowered: views.map((v) => v.map(asciiLower)), rooted: isAbsoluteForFamily("own", path) };
+    if (SEGMENT_READINGS.size >= 512)
+        SEGMENT_READINGS.clear();
+    SEGMENT_READINGS.set(key, readings);
+    return readings;
+}
+function segmentRowMeets(pat, readings) {
+    const n = pat.segments.length;
+    const views = pat.foldAscii ? readings.lowered : readings.views;
+    for (const segs of views) {
+        const runAt = (i) => i + n <= segs.length && pat.segments.every((re, j) => re.test(segs[i + j] ?? ""));
+        if (pat.anchors !== undefined && readings.rooted) {
+            for (const anchor of pat.anchors)
+                if (anchor.every((a, j) => segs[j] === a) && runAt(anchor.length))
+                    return true;
+            continue;
         }
+        if (pat.rootedOnly === true)
+            continue;
+        for (let i = 0; i + n <= segs.length; i++)
+            if (runAt(i))
+                return true;
     }
-    return null;
+    return false;
 }
 function segmentViewsOf(path, opts) {
     const literalSegs = path.split(/[\\/]/).filter(Boolean);
@@ -386,7 +395,7 @@ function rowMeetsPath(pat, segs, rooted) {
     return false;
 }
 function rowAtOrBelowOf(rows, path) {
-    const rooted = isAbsolutePathForm(path);
+    const rooted = isAbsoluteForFamily("own", path);
     const views = segmentViewsOf(path);
     for (const pat of rows) {
         for (const view of views)
@@ -401,6 +410,15 @@ function homeAnchorSegments(home) {
 function rgGlobEscape(pattern) {
     return pattern.replace(/[?[\]{}]/g, (c) => `[${c}]`);
 }
+export function readDenyEntryProblem(entry, layer) {
+    try {
+        normalizeEntry(entry, layer);
+        return undefined;
+    }
+    catch (e) {
+        return e.message;
+    }
+}
 function normalizeEntry(entry, layer) {
     const shape = typeof entry === "string" ? { pattern: entry, caseSensitive: false } : entry;
     if (typeof shape !== "object" || shape === null || typeof shape.pattern !== "string") {
@@ -446,7 +464,7 @@ export function persistedReadDenyEntryProblem(e) {
     return null;
 }
 export function checkedReadDenyHomes(homes, seat = "readDenyHomes") {
-    if (!Array.isArray(homes) || !homes.every((h) => typeof h === "string" && isAbsolutePathForm(h))) {
+    if (!Array.isArray(homes) || !homes.every((h) => validatePath(h, { intent: "validate-coordinate" }) !== undefined)) {
         let shown;
         try {
             shown = JSON.stringify(homes) ?? String(homes);
@@ -469,10 +487,19 @@ export function compileReadDeny(additions = [], layer = "additions", builtin, ru
         seen.add(key);
         normalized.push(e);
     };
-    for (const row of resolveReadDenyBuiltins(builtin))
-        push(normalizeEntry(row.pattern, "built-in"));
-    for (const entry of additions)
-        push(normalizeEntry(entry, layer));
+    const columns = new Map();
+    for (const row of resolveReadDenyBuiltins(builtin)) {
+        const e = normalizeEntry(row.pattern, "built-in");
+        push(e);
+        if (!columns.has(e.pattern))
+            columns.set(e.pattern, { origin: "builtin", tier: row.tier });
+    }
+    for (const entry of additions) {
+        const e = normalizeEntry(entry, layer);
+        push(e);
+        if (!columns.has(e.pattern))
+            columns.set(e.pattern, { origin: "addition" });
+    }
     const homeSegments = [...new Set(checkedReadDenyHomes(homes))].map(homeAnchorSegments);
     const compiled = normalized.map((e) => {
         const { homeAnchored, run } = readDenyPatternRun(e.pattern);
@@ -502,40 +529,38 @@ export function compileReadDeny(additions = [], layer = "additions", builtin, ru
         }
     });
     const judged = linkedPlacements.length === 0 ? compiled : [...compiled, ...linkedPlacements];
+    const segmentRows = judged.map((c) => {
+        const col = columns.get(c.raw);
+        return segmentGuardRow(c, { faces: ["read"], polarity: "deny", exemptible: false, fold: c.foldAscii ? "ascii" : "exact", origin: col?.origin ?? "addition", ...(col?.tier !== undefined ? { tier: col.tier } : {}) });
+    });
+    const tableRows = [...segmentRows, ...ruleRows.map(ruleGuardRow)];
     const rgExclusionGlobs = [];
     const rgProbeGlobs = [];
-    normalized.forEach((e, i) => {
-        if (compiled[i].anchors !== undefined)
-            return;
-        const flag = e.caseSensitive ? "--glob" : "--iglob";
-        const g = rgGlobEscape(readDenyPatternRun(e.pattern).run);
+    for (const row of segmentRows) {
+        if (row.placement !== "anywhere" || !row.faces.includes("read") || row.grammar.kind !== "segment-glob")
+            continue;
+        const flag = row.fold === "exact" ? "--glob" : "--iglob";
+        const g = rgGlobEscape(readDenyPatternRun(row.grammar.run).run);
         rgExclusionGlobs.push({ flag, glob: `!**/${g}` }, { flag, glob: `!**/${g}/**` });
         rgProbeGlobs.push({ flag, glob: `**/${g}` }, { flag, glob: `**/${g}/**` });
-    });
+    }
     const placed = judged.filter((c) => c.anchors !== undefined);
-    const unexcludableUnder = (scope) => placed.length > 0 && (!isAbsolutePathForm(scope) || rowAtOrBelowOf(placed, normalizeAbsPathLexically(scope)) !== null);
+    const unexcludableUnder = (scope) => placed.length > 0 && (!isAbsoluteForFamily("own", scope) || rowAtOrBelowOf(placed, normalizeAbsPathLexically(scope)) !== null);
     const rowAtOrBelow = (path) => {
         const hit = rowAtOrBelowOf(judged, path);
         if (hit !== null)
             return { pattern: hit };
         return ruleRows.length === 0 ? null : { pattern: ruleRows[0].rule };
     };
-    const segmentPath = (path, opts) => {
-        const hit = matchSegmentPatterns(path, judged, opts);
-        return hit === null ? null : { pattern: hit };
-    };
     const matchPath = (path, opts) => {
-        const hit = segmentPath(path, opts);
-        if (hit !== null)
-            return hit;
-        const rule = ruleRows.length === 0 || opts?.walked === true ? undefined : ruleRowsHit(ruleRows, "read", [path]);
-        return rule === undefined ? null : { pattern: rule.row.rule };
+        const hit = denyTableHit(opts?.walked === true ? segmentRows : tableRows, { views: [{ path, kind: "lexical", ...(opts?.aliasResolved === true ? { aliasResolved: true } : {}) }] });
+        return hit === null ? null : { pattern: hit.pattern };
     };
     return {
         entries: normalized,
         ...(ruleRows.length > 0 ? { ruleRows } : {}),
         matchPath,
-        matchTarget: (canonicalKey, lexicalView, opts) => matchTargetOver(segmentPath, ruleRows, "read", canonicalKey, lexicalView, opts),
+        matchTarget: (canonicalKey, lexicalView, opts) => denyTableHit(tableRows, denyTargetViews(canonicalKey, lexicalView, opts)),
         rgExclusionGlobs,
         rgProbeGlobs,
         unexcludableUnder,