@sema-agent/core 7.48.0 → 7.49.1

package/dist/tools/fs/removal-targets.d.ts

@@ -5,17 +5,15 @@ import type { ToolCallRequest } from "../../core/tool-policy.js";
  *  recursive option (removing an empty home or the task root is still removing it). */
 export declare const SHELL_REMOVAL_COMMANDS: readonly ["rm", "rmdir"];
 export type ShellRemovalCommand = (typeof SHELL_REMOVAL_COMMANDS)[number];
-/** What makes a removal target dangerous, in the order a card names it. `runtime_script`: a shell's script text is built
- *  only when the command runs, and what it may run includes a removal nobody can read before it does. */
-export type DangerousRemovalKind = "filesystem_root" | "home" | "workspace" | "top_level" | "runtime_script";
+/** What makes a removal target dangerous, in the order a card names it. */
+export type DangerousRemovalKind = "filesystem_root" | "home" | "workspace" | "top_level";
 /** The protected locations a removal is judged against. `homes`: the environment's declared home and every other spelling
  *  of it (its canonical one); `workspace`: the task root, the working directory, the additional working directories. */
 export interface RemovalSeat {
     readonly homes: readonly string[];
     readonly workspace: readonly string[];
 }
-/** One dangerous removal a command makes: the program (the removal program, or the shell a runtime-built script is handed
- *  to), the operand as written, the target as established (the script word as written, for `runtime_script`). */
+/** One dangerous removal a command makes: the removal program, the operand as written, the target as established. */
 export interface DangerousRemoval {
     readonly kind: DangerousRemovalKind;
     readonly program: string;
@@ -30,33 +28,64 @@ export interface DangerousRemoval {
  * directory (one segment below the root). `undefined` for a relative path or any other target.
  */
 export declare function dangerousRemovalOf(path: string, seat: RemovalSeat): DangerousRemovalKind | undefined;
-/** What one removal finding asks: a protected location (`dangerous_delete`), or a target the command builds from a value
- *  of its own that the guard cannot read (`unverifiable_delete`). */
+/** What one removal finding asks: a protected location (`dangerous_delete`; `untrackedFrom` — the segment the working
+ *  directory stops being tracked at, where the target is relative and was judged where the text stood then); a recursive
+ *  forced removal whose target the
+ *  guard cannot verify (`unverifiable_delete`) — an operand the shell rewrites from a value the plan does not settle
+ *  (`rewritten`), the operands of a removal its argv stream fills in (`stream`), or an operand relative to the directory a
+ *  launcher option moved the removal into (`relocated`); or a shell handed text the engine cannot read
+ *  (`unverifiable_shell_text`) — a text a program produces (`produced`: what a pipe or a `<(…)` carries, an argv a stream
+ *  fills in, a substitution), or a text nobody read (`unread`: one the lexer could not read at all, {@link unreadPlan}, or a
+ *  segment whose program the walk could not name, {@link programUnread}). */
 export type RemovalFinding = (DangerousRemoval & {
     readonly guard: "dangerous_delete";
+    readonly untrackedFrom?: string;
 }) | {
     readonly guard: "unverifiable_delete";
     readonly program: string;
     readonly operand: string;
-    readonly name: string;
+    readonly source: "rewritten" | "stream" | "relocated";
+} | {
+    readonly guard: "unverifiable_shell_text";
+    readonly program: string;
+    readonly text: string;
+    readonly source: "produced" | "unread";
 };
+/**
+ * The names a removal target may be built on and still be verified: a root the SHELL provides, never one a command's
+ * output fed — `rm -rf "$TMPDIR"/<literal path below it>` is not asked about. `TMPDIR` is the reference's carve-out (its
+ * rule exempts "a well-known-safe temp pattern"); `HOME` is sema's (a registered divergence, looser than the reference,
+ * whose rule names `$HOME` as the blast radius: it is a root the shell provides too). A declared home is read by the
+ * value table itself — `$HOME` is then its value, and the target is judged where it lands; `PWD` is no root of this kind:
+ * its value is where the working-directory thread says the command stands.
+ */
+export declare const KNOWN_SAFE_ROOTS: readonly string[];
 /**
  * The removal findings of an established plan — ONE walk, nested plans included (a `bash -c` / `sh -c` text, a substitution
  * body), two words. For every `rm` / `rmdir` segment, each of its OPERANDS (every write target that is not one of its
  * option words: a word some implementation's reading of the program's row writes, {@link writeReadings}) as the plan
  * established it on the WRITE face (the entry the program unlinks, and the deny-floor shadow of a home word the plan did
- * not place) is judged by {@link dangerousRemovalOf}; an operand the plan could not place that expands a name the command
- * itself binds is judged in every spelling those bindings give it ({@link boundSpellingsOf}), and one with a binding this
- * reading cannot read is an unverifiable target (a recursive forced removal, {@link recursiveForce}). A shell handed a
- * script built only when the command runs is a dangerous removal of its own ({@link runtimeScriptOf}). The read-face copy
- * of an operand is not judged: it follows a link the removal does not follow.
+ * not place) is judged by {@link dangerousRemovalOf}. In a recursive forced removal ({@link recursiveForce}), an operand
+ * the shell rewrites from a value the plan's table does not settle — a name with no value here or one set in a form the
+ * table cannot read, a substitution, a parameter operator, a positional parameter — is an unverifiable target, save a
+ * literal path below a known-safe root the shell still provides there ({@link belowKnownSafeRoot}); so are the operands
+ * of a removal its argv stream fills in (`… | xargs rm -rf`), and an operand the plan cannot place — in a removal a
+ * launcher moved into another base, or in text such a removal hands a shell (`env -C <dir> rm -rf build`). A relative
+ * operand past a directory move the working-directory thread cannot follow is judged where the text stood when it lost
+ * track (the reference resolves it against the original working directory: KL-1403-b), and a card it earns says so. A `read` fills its name from the input: a value
+ * the table does not settle (stricter than the reference, whose rule counts `read VAR` as an in-window assignment). A
+ * name the table settles is its value, so `D=./build; rm -rf "$D/../build"` is judged
+ * where it lands, as `rm -rf ./build` is. A shell handed a text the engine cannot read — one a program produces
+ * ({@link runtimeScriptOf}), or one nobody read ({@link unreadPlan}, {@link programUnread}) — is an unreadable text of its
+ * own. The read-face copy of an operand is not judged: it follows a link the removal does not follow.
  */
-export declare function removalFindingsOf(established: EstablishedPlan, seat: RemovalSeat): RemovalFinding[];
-/** Does any segment of this plan (nested plans included) run a removal program, or hand a shell a script built when it
- *  runs? The guard establishes nothing for a command that does neither. */
+export declare function removalFindingsOf(established: EstablishedPlan, seat: RemovalSeat, safeRoots?: readonly string[], enclosingRelocated?: boolean): RemovalFinding[];
+/** Does this plan (nested plans included) run a removal program, hand a shell a script built when it runs, or hold text
+ *  nobody could read ({@link unreadPlan}, {@link programUnread})? The guard establishes nothing for a command that does none. */
 export declare function planRunsRemoval(plan: EstablishedPlan["plan"]): boolean;
 /** What the removal guard asks for one command: the guard word and its sentence's account — the first protected location
- *  (the program, the location, the target), else the first bound value the guard cannot read; `undefined` when neither. */
+ *  (the program, the location, the target), else the first target the guard cannot verify, else the first shell text the
+ *  engine cannot read; `undefined` when none. */
 export interface RemovalVerdict {
     readonly guard: RemovalFinding["guard"];
     readonly text: string;
@@ -72,12 +101,16 @@ export interface RemovalGuardSeat {
     readonly additionalRoots?: () => readonly string[];
 }
 /**
- * The dangerous-removal READING of one command — undefined when no segment of it (nested shell text included) runs a
- * removal program, so a command that removes nothing costs the gate no suspension. Otherwise `judge` establishes the plan
- * the read station plans (the same planner, the same write-target reading) lexically against the request's `cwd` and the
- * seat's home, and — where an environment is seated — through its resolver too, and returns what either establishment
- * finds ({@link removalFindingsOf}: the protected-location word first, then the unverifiable one).
+ * The removal guard's READING of one command — undefined when no segment of it (nested shell text included) runs a
+ * removal program or hands a shell a script built when it runs, and every text in it was read, so a command that removes
+ * nothing costs the gate no suspension (a text the lexer could not read is not one: bash may run the lines before its
+ * syntax error, and the guard reads no prefix of it). Otherwise `judge` establishes the plan the read
+ * station plans (the same planner, the same value table, the same write-target reading) lexically against the request's
+ * `cwd` and the seat's home, and — where an environment is seated — through its resolver too, and returns what either
+ * establishment finds ({@link removalFindingsOf}: the protected-location word first, then the unverifiable target, then the
+ * unreadable text).
+ * `safeRoots`: the known-safe roots ({@link KNOWN_SAFE_ROOTS}, with a deployment's own added by the policy).
  */
-export declare function removalReadingOf(command: string, req: Pick<ToolCallRequest, "cwd" | "root">, seat: RemovalGuardSeat | undefined): {
+export declare function removalReadingOf(command: string, req: Pick<ToolCallRequest, "cwd" | "root">, seat: RemovalGuardSeat | undefined, safeRoots?: readonly string[]): {
     judge(signal?: AbortSignal): Promise<RemovalVerdict | undefined>;
 } | undefined;

package/dist/tools/fs/removal-targets.js

@@ -1,9 +1,9 @@
 import { planShellReads } from "./shell-read-plan.js";
 import { literalTextOf } from "../../shell/lex.js";
 import { createShellReadEstablisher, establishShellReadsLexically } from "./shell-read-establish.js";
-import { isAbsolutePathForm, isWinFormPath, normalizeAbsPathLexically } from "./safety.js";
+import { isAbsoluteForFamily, isWinFormPath, normalizeAbsPathLexically } from "./safety.js";
 import { launchedCommands, launchedReadings, reentryText, scriptFileAt, spellLaunched } from "./shell-reentry-text.js";
-import { isShellSyntaxWord, LOOP_LIST_HEADS, readProgramPosition } from "./bash-program-position.js";
+import { readProgramPosition } from "./bash-program-position.js";
 import { bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
 import { programArgs } from "./shell-read-write-targets.js";
 import { implementationsOf, programRow, runsShellText, selectedOptions, writeReadings } from "./program-read-model.js";
@@ -25,16 +25,16 @@ function driveOf(path, key) {
     return isWinFormPath(path) && key.length >= 2 && key[1] === ":" ? key.slice(0, 2) : "";
 }
 export function dangerousRemovalOf(path, seat) {
-    if (!isAbsolutePathForm(path))
+    if (!isAbsoluteForFamily("own", path))
         return undefined;
     const k = removalKey(path);
     const rest = k.slice(driveOf(path, k).length);
     if (rest === "/" || /^\/\/[^/]+\/[^/]+$/.test(k))
         return "filesystem_root";
-    if (seat.homes.some((h) => isAbsolutePathForm(h) && removalKey(h) === k))
+    if (seat.homes.some((h) => isAbsoluteForFamily("own", h) && removalKey(h) === k))
         return "home";
     const prefix = k.endsWith("/") ? k : `${k}/`;
-    if (seat.workspace.some((w) => isAbsolutePathForm(w) && (removalKey(w) === k || removalKey(w).startsWith(prefix))))
+    if (seat.workspace.some((w) => isAbsoluteForFamily("own", w) && (removalKey(w) === k || removalKey(w).startsWith(prefix))))
         return "workspace";
     if (/^\/[^/]+$/.test(rest))
         return "top_level";
@@ -56,53 +56,17 @@ function removalKindOf(read, seat) {
     }
     return read.established === "unestablishable" && tildeNamesAHome(read.candidate.spelled) ? "home" : undefined;
 }
-const NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-const NAME_BINDERS = new Set(["unset", "local", "declare", "typeset", "readonly", "export", "read"]);
-function bindingsOf(plan) {
-    const out = new Map();
-    const bind = (name, value) => {
-        out.set(name, [...(out.get(name) ?? []), value]);
-    };
-    for (const segment of plan.segments) {
-        for (const w of segment.argv)
-            if (w.assignment !== undefined)
-                bind(w.assignment.name, w.assignment.settlesWholeName ? literalTextOf(w.assignment.value.pieces) : undefined);
-        const [head, name] = segment.argv;
-        if (isShellSyntaxWord(head, LOOP_LIST_HEADS) && name !== undefined && NAME.test(name.folded)) {
-            const at = segment.argv.findIndex((w, i) => i > 1 && w.folded === "in");
-            const words = at < 0 ? [undefined] : segment.argv.slice(at + 1).map((w) => literalTextOf(w.pieces));
-            for (const v of words.length > 0 ? words : [undefined])
-                bind(name.folded, v);
-        }
-        if (head !== undefined && NAME_BINDERS.has(head.folded))
-            for (const w of segment.argv.slice(1))
-                if (w.assignment === undefined && NAME.test(w.folded))
-                    bind(w.folded, undefined);
-    }
-    return out;
-}
-const BOUND_SPELLINGS_MAX = 64;
-function boundSpellingsOf(word, bindings) {
-    const named = word.pieces.filter((q) => q.literal === undefined);
-    if (named.length === 0 || !named.some((q) => q.expansion?.kind === "parameter" && q.expansion.name !== undefined && bindings.has(q.expansion.name)))
-        return undefined;
-    let spellings = [""];
-    for (const q of word.pieces) {
-        if (q.literal !== undefined) {
-            spellings = spellings.map((sp) => sp + q.literal);
-            continue;
-        }
-        const name = q.expansion?.kind === "parameter" && (q.expansion.body === undefined || q.expansion.body === q.expansion.name) ? q.expansion.name : undefined;
-        const values = name !== undefined ? bindings.get(name) : undefined;
-        if (name === undefined || values === undefined)
-            return { unreadable: q.expansion?.name ?? word.raw };
-        if (values.some((v) => v === undefined || (q.quotedBy === undefined && /\s/.test(v))))
-            return { unreadable: name };
-        spellings = spellings.flatMap((sp) => values.map((v) => sp + v));
-        if (spellings.length > BOUND_SPELLINGS_MAX)
-            return { unreadable: name };
-    }
-    return { spellings };
+export const KNOWN_SAFE_ROOTS = Object.freeze(["TMPDIR", "HOME"]);
+function belowKnownSafeRoot(word, safe, segment) {
+    const [head, ...rest] = word.pieces;
+    const e = head?.expansion;
+    const name = e?.kind === "parameter" && (e.body === undefined || e.body === e.name) ? e.name : undefined;
+    if (name === undefined || !safe.has(name) || segment.rebound === "all" || segment.rebound.has(name))
+        return false;
+    if (rest.some((p) => p.literal === undefined))
+        return false;
+    const below = rest.map((p) => p.literal).join("");
+    return /^\/[^*?[\]]+$/.test(below) && !below.split("/").includes("..");
 }
 function recursiveForce(row, args) {
     return implementationsOf(row).some((view) => {
@@ -110,9 +74,11 @@ function recursiveForce(row, args) {
         return selected.some((o) => o.selects === "traversal") && selected.some((o) => o.mode === "forced");
     });
 }
-export function removalFindingsOf(established, seat) {
+export function removalFindingsOf(established, seat, safeRoots = KNOWN_SAFE_ROOTS, enclosingRelocated = false) {
+    if (unreadPlan(established.plan))
+        return [{ guard: "unverifiable_shell_text", program: "bash", text: established.plan.unreadable, source: "unread" }];
     const out = [];
-    const bindings = bindingsOf(established.plan);
+    const safe = new Set(safeRoots);
     for (const segment of established.plan.segments) {
         const program = segment.verb?.basename;
         const row = program !== undefined && REMOVAL_COMMAND_SET.has(program) ? programRow(program) : undefined;
@@ -121,45 +87,41 @@ export function removalFindingsOf(established, seat) {
             const spelled = args.map((w) => w.spelled);
             const removed = new Set(writeReadings(row, spelled).flatMap((r) => r.written.map((w) => w.at)));
             const options = new Set(args.filter((_, at) => !removed.has(at)).map((w) => w.raw));
+            const forced = recursiveForce(row, spelled);
+            if (forced && segment.reentry === "argv")
+                out.push({ guard: "unverifiable_delete", program, operand: segment.text.trim(), source: "stream" });
+            const relocated = enclosingRelocated || readProgramPosition(segment.argv).launcherMovesBase;
             for (const read of established.reads.get(segment) ?? []) {
                 if (read.candidate.face !== "write" || options.has(read.candidate.raw))
                     continue;
                 const kind = removalKindOf(read, seat);
                 if (kind !== undefined) {
-                    out.push({ guard: "dangerous_delete", kind, program, operand: read.candidate.raw, target: read.target ?? read.candidate.floorSpelled ?? read.candidate.spelled });
+                    const untracked = read.candidate.bases === "unmodelled" ? established.plan.segments.find((s) => s.bases === "unmodelled")?.text.trim() : undefined;
+                    out.push({ guard: "dangerous_delete", kind, program, operand: read.candidate.raw, target: read.target ?? read.candidate.floorSpelled ?? read.candidate.spelled, ...(untracked !== undefined ? { untrackedFrom: untracked } : {}) });
                     continue;
                 }
-                if (read.established !== "unestablishable")
+                if (!forced || read.established !== "unestablishable" || (read.candidate.expands !== "unresolvable" && !relocated))
                     continue;
                 const word = segment.argv.find((w) => w.raw === read.candidate.raw);
-                const bound = word === undefined ? undefined : boundSpellingsOf(word, bindings);
-                if (bound === undefined)
+                if (word !== undefined && belowKnownSafeRoot(word, safe, segment))
                     continue;
-                if ("unreadable" in bound) {
-                    if (recursiveForce(row, spelled))
-                        out.push({ guard: "unverifiable_delete", program, operand: read.candidate.raw, name: bound.unreadable });
-                    continue;
-                }
-                const bases = segment.bases === "unmodelled" ? (read.candidate.floorBases ?? []) : segment.bases;
-                for (const spelled of bound.spellings) {
-                    const views = isAbsolutePathForm(spelled) ? [spelled] : bases.map((base) => `${base}/${spelled}`);
-                    for (const view of views) {
-                        const hit = dangerousRemovalOf(view, seat);
-                        if (hit === undefined)
-                            continue;
-                        out.push({ guard: "dangerous_delete", kind: hit, program, operand: read.candidate.raw, target: normalizeAbsPathLexically(view) });
-                        break;
-                    }
-                }
+                out.push({ guard: "unverifiable_delete", program, operand: read.candidate.raw, source: read.candidate.expands === "unresolvable" ? "rewritten" : "relocated" });
             }
         }
         const script = runtimeScriptOf(segment);
         if (script !== undefined && program !== undefined)
-            out.push({ guard: "dangerous_delete", kind: "runtime_script", program, operand: script, target: script });
+            out.push({ guard: "unverifiable_shell_text", program, text: script, source: "produced" });
+        if (programUnread(segment))
+            out.push({ guard: "unverifiable_shell_text", program: segment.launcherChain[0] ?? segment.text.trim(), text: segment.text.trim(), source: "unread" });
+        const handedRelocated = enclosingRelocated || readProgramPosition(segment.argv).launcherMovesBase;
         for (const nested of segment.nested) {
+            if (unreadPlan(nested)) {
+                out.push({ guard: "unverifiable_shell_text", program: program ?? segment.text.trim(), text: segment.text.trim(), source: "unread" });
+                continue;
+            }
             const sub = established.nested.get(nested);
             if (sub !== undefined)
-                out.push(...removalFindingsOf(sub, seat));
+                out.push(...removalFindingsOf(sub, seat, safeRoots, handedRelocated));
         }
     }
     return out;
@@ -187,38 +149,54 @@ function runtimeScriptOf(segment) {
     const named = pos.program !== undefined && pos.refusal === undefined ? [{ shell: program.basename, words: segment.argv.slice(pos.program.index + 1).map((_, k) => spell(pos.program.index + 1 + k)) }] : [];
     const launched = launchedCommands(segment.argv, pos).flatMap((c) => {
         const shell = launchedReadings(segment.argv, c).shell;
-        return shell === undefined ? [] : spellLaunched(segment.argv, c.args, { word: spell }).map((words) => ({ shell, words }));
+        return shell === undefined ? [] : [{ shell, words: spellLaunched(segment.argv, c.args, { word: spell }) }];
     });
     const texts = [...named, ...launched].flatMap(({ shell, words }) => [reentryText(shell, words), ...(segment.stdin ?? []).map((s) => reentryText(shell, words, s.literal ?? `${MARK}${s.from}`))]);
     const text = texts.find((t) => t?.includes(MARK) === true);
     return text === undefined ? undefined : text.split(MARK).join("");
 }
+const unreadPlan = (plan) => plan.unreadable !== undefined && plan.segments.length === 0;
+const programUnread = (s) => s.declines.includes("unreadable_program_position");
 export function planRunsRemoval(plan) {
-    return plan.segments.some((s) => (s.verb !== undefined && REMOVAL_COMMAND_SET.has(s.verb.basename)) || runtimeScriptOf(s) !== undefined || s.nested.some(planRunsRemoval));
+    return unreadPlan(plan) || plan.segments.some((s) => (s.verb !== undefined && REMOVAL_COMMAND_SET.has(s.verb.basename)) || runtimeScriptOf(s) !== undefined || programUnread(s) || s.nested.some(planRunsRemoval));
 }
 const DANGEROUS_REMOVAL_SENTENCE = {
     filesystem_root: (p, t) => `\`${p}\` would remove the filesystem root (${t})`,
     home: (p, t) => `\`${p}\` would remove a home directory (${t})`,
     workspace: (p, t) => `\`${p}\` would remove a workspace directory — the task root, the working directory or an additional working directory — or one of its ancestors (${t})`,
     top_level: (p, t) => `\`${p}\` would remove a top-level system directory (${t})`,
-    runtime_script: (p, t) => `\`${p}\` runs a script built only when the command runs (${t}), and it may remove the filesystem root, a home directory or the task's directories before anyone can read it`,
+};
+const UNVERIFIABLE_REMOVAL_SENTENCE = {
+    rewritten: (p, o) => `\`${p}\` recursive+force target ${o} is rewritten by the shell from a value this command does not settle (a name with no value here or one it sets in a form the guard cannot read, a substitution, a parameter operator) — the deleted path cannot be verified from this command`,
+    stream: (p, o) => `\`${p}\` recursive+force takes its targets from the stream it is fed (${o}) — the deleted paths cannot be verified from this command`,
+    relocated: (p, o) => `\`${p}\` recursive+force target ${o} is relative to a directory a launcher option moved the program into, which this command does not settle — the deleted path cannot be verified from this command`,
+};
+const UNREADABLE_TEXT_SENTENCE = {
+    produced: (p, t) => `\`${p}\` runs shell text that is built only when the command runs (${t}) — the text this shell will run cannot be read by the engine, so whether it removes anything is unknown`,
+    unread: (p, t) => `\`${p}\` runs shell text this guard cannot read (${t}) — the text this shell will run cannot be read by the engine, so whether it removes anything is unknown`,
 };
 function verdictOf(findings) {
-    for (const f of findings)
-        if (f.guard === "dangerous_delete")
-            return { guard: f.guard, text: DANGEROUS_REMOVAL_SENTENCE[f.kind](f.program, inlineUntrusted(f.target, 200)) };
+    for (const f of findings) {
+        if (f.guard !== "dangerous_delete")
+            continue;
+        const untracked = f.untrackedFrom === undefined ? "" : ` — the working directory is not tracked from \`${inlineUntrusted(f.untrackedFrom, 120)}\` on (a directory change before it cannot be followed), so this target was judged where the command stood when tracking stopped`;
+        return { guard: f.guard, text: `${DANGEROUS_REMOVAL_SENTENCE[f.kind](f.program, inlineUntrusted(f.target, 200))}${untracked}` };
+    }
     for (const f of findings)
         if (f.guard === "unverifiable_delete")
-            return { guard: f.guard, text: `\`${f.program}\` recursive+force target ${inlineUntrusted(f.operand, 200)} takes ${f.name}'s value, which this command sets in a form the guard cannot read (an expansion, an unset or bare declaration, a \`read\`, a loop over unread words) — the deleted path cannot be verified from this command` };
+            return { guard: f.guard, text: UNVERIFIABLE_REMOVAL_SENTENCE[f.source](f.program, inlineUntrusted(f.operand, 200)) };
+    for (const f of findings)
+        if (f.guard === "unverifiable_shell_text")
+            return { guard: f.guard, text: UNREADABLE_TEXT_SENTENCE[f.source](f.program, inlineUntrusted(f.text, 200)) };
     return undefined;
 }
 const REMOVAL_RESOLVE_TIMEOUT_MS = 10_000;
-export function removalReadingOf(command, req, seat) {
+export function removalReadingOf(command, req, seat, safeRoots = KNOWN_SAFE_ROOTS) {
     const homeDir = seat?.env?.homeDir;
     const cwd = req.cwd ?? req.root ?? "";
     const roots = req.root !== undefined ? [req.root] : cwd !== "" ? [cwd] : [];
     const boundary = { roots, ...(cwd !== "" ? { cwd } : {}), ...(homeDir !== undefined ? { homeDir } : {}) };
-    const plan = planShellReads(command, { readers: new Set(bashClassifyDefaultAllow()), cwd, roots, ...(homeDir !== undefined ? { homeDir } : {}) });
+    const plan = planShellReads(command, { readers: new Set(bashClassifyDefaultAllow()), cwd, roots, cdPath: seat?.env?.cdPath ?? "unknown", ...(homeDir !== undefined ? { homeDir } : {}) });
     if (!planRunsRemoval(plan))
         return undefined;
     return {
@@ -229,11 +207,11 @@ export function removalReadingOf(command, req, seat) {
                 homes: [...(homeDir !== undefined ? [homeDir] : []), ...(resolved !== undefined && resolved.ok ? [resolved.value] : [])],
                 workspace: [...(req.root !== undefined ? [req.root] : []), ...(req.cwd !== undefined ? [req.cwd] : []), ...(seat?.additionalRoots?.() ?? [])],
             };
-            const lexical = removalFindingsOf(establishShellReadsLexically(plan, boundary), removalSeat);
+            const lexical = removalFindingsOf(establishShellReadsLexically(plan, boundary), removalSeat, safeRoots);
             if (lexical.some((f) => f.guard === "dangerous_delete") || env === undefined || roots.length === 0)
                 return verdictOf(lexical);
             const established = await resolvedOrUndefined(createShellReadEstablisher(env, roots, { rootsCanonical: true }).establish(plan, boundary, signal), signal);
-            return verdictOf(established === undefined ? lexical : [...removalFindingsOf(established, removalSeat), ...lexical]);
+            return verdictOf(established === undefined ? lexical : [...removalFindingsOf(established, removalSeat, safeRoots), ...lexical]);
         },
     };
 }

package/dist/tools/fs/safety.d.ts

@@ -10,7 +10,8 @@ import { protectivePathTargetOf, type ToolCallLike } from "../../core/tool-regis
  * hole) or fail-closed (deny a legitimate write). Single source.
  *
  * The `path` arm is deliberately BROADER than what Read/Edit/Write accept: their schema requires
- * `file_path` and rejects the retired `path` alias outright (fs-shared.ts FILE_PATH_PARAMS), but this reader is
+ * `file_path` (fs-shared.ts FILE_PATH_PARAMS; Write alone repairs the `path` spelling onto it BEFORE validation,
+ * `coerceWriteArguments`, so a gate never sees the alias there), but this reader is
  * shared with gates that judge OTHER tool vocabularies — Glob's real `path` parameter, deployment-authored tools —
  * and a gate must never see LESS than the tool it is confining might act on. So the asymmetry is the design: the
  * schema decides what a caller may send, this decides what gets judged, and this side over-reads on purpose.
@@ -114,21 +115,12 @@ export interface FsViolation {
     message: string;
 }
 /**
- * Absolute in EITHER family: POSIX `/…` or drive-letter `C:\…`/`C:/…`.
- *
- * This is the ONE definition of "already absolute, therefore do not prepend a base". The failure mode
- * of a private re-typing is not the duplication but the drift it invites: a family added at one
- * coordinate leaves every other copy judging the same string differently, and this predicate gates a
- * security fence (frozen-path deny, readonly-boundary containment) as well as URI key minting.
- * Callers that need a family the predicate does not cover must widen it HERE, not locally.
- *
- * The UNC arm (`\\host\share\…`) is the shape that drift produced: held privately in one consumer, it
- * made that consumer resolve a UNC path as absolute while a sibling prefixed it with the task root —
- * two URI keys for one file. Folding it in here settles the disagreement in the direction the rest of
- * this file takes: a literal `\\host\share\…` is win-form (see {@link isWinFormPath}) and `within()`
- * lands it outside every POSIX/drive root, i.e. a location the working directory does not contain.
+ * Is a spelling relative in EVERY family — neither `/`- nor `\`-rooted and carrying no drive letter (not even the
+ * drive-relative `C:x`)? The tamper check of a recorded relative key reads this (a record that is absolute, rooted or
+ * drive-bearing in ANY family is refused there): the opposite stance from {@link isAbsoluteForFamily}, which answers
+ * one family's question, so it is a separate, named predicate rather than a mode of that one.
  */
-export declare function isAbsolutePathForm(p: string): boolean;
+export declare function relativeInEveryFamily(p: string): boolean;
 /** Does this absolute spelling name the opening process's STANDARD INPUT (`/dev/stdin`, `/dev/fd/0`, `/proc/<pid>/fd/0`),
  *  folded lexically first (`/dev/./stdin`, `/dev//fd/0`)? */
 export declare function namesStandardInput(path: string): boolean;
@@ -306,13 +298,19 @@ export declare function pathFamilyOf(bases: {
  *  reads it. The ONE UNC recognizer behind {@link isAbsoluteForFamily}, {@link pathIdentityOf} and
  *  {@link joinForFamily}. */
 export declare function isUncSpelling(p: string): boolean;
-/**
- * FULLY QUALIFIED under the family. win: drive-rooted (`C:\`/`C:/`) or UNC — a `/x` / `\x` is rooted-not-
- * qualified and joins the base's drive or share root ({@link joinForFamily}), a `C:rel` is drive-relative.
- * posix: `/`-rooted. `undefined` (a treeless call): only the anchor-free `/`-rooted form, the one spelling
- * that names a file without a tree.
- */
-export declare function isAbsoluteForFamily(family: PathFamily | undefined, p: string): boolean;
+/** Where a reading takes its family from: a tree's ({@link PathFamily}), or `"own"` — an address with no tree to place
+ *  it reads its OWN spelling as the family source (the {@link pathFamilyOf} of that spelling), so a treeless `C:\x` and a
+ *  treeless `/x` are each read in their own family rather than one of them being declared relative. */
+export type PathFamilySource = PathFamily | "own";
+/** The family a {@link PathFamilySource} names for one spelling. */
+export declare function familyFor(source: PathFamilySource, p: string): PathFamily;
+/**
+ * FULLY QUALIFIED under the family — the ONE absoluteness predicate. win: drive-rooted (`C:\`/`C:/`) or UNC (a host AND a
+ * share: a bare `\\x` names no share and is no address) — a `/x` / `\x` is rooted-not-qualified and joins the base's drive
+ * or share root ({@link joinForFamily}), a `C:rel` is drive-relative. posix: `/`-rooted. `"own"`: the spelling's own
+ * family ({@link familyFor}) — the reading of an address no tree places.
+ */
+export declare function isAbsoluteForFamily(family: PathFamilySource, p: string): boolean;
 /** The refusal words of {@link win32NamespaceScreen} — a closed set (docs/CLOSED-SETS.md). */
 export declare const WIN32_NAMESPACE_REFUSALS: readonly ["device_namespace", "unmappable_namespace", "unc_on_posix_tree", "drive_relative"];
 export type Win32NamespaceRefusal = (typeof WIN32_NAMESPACE_REFUSALS)[number];
@@ -436,6 +434,14 @@ export declare function foldTrailingSeparators(spelled: string, family: PathFami
  * share root, anything else under the base with the base's own separator. posix = `/`-join.
  */
 export declare function joinForFamily(family: PathFamily, base: string, rel: string): string;
+/**
+ * THE anchor step of every path reading: a spelling fully qualified under the family stands as spelled; any other is joined
+ * to `base` ({@link joinForFamily}, unfolded). One definition, so "already absolute, therefore do not prepend a base" is
+ * decided in one place for every reader — the path prelude (`readPath`, effective-path-target.ts), the canonicalizer, a
+ * link's target against its parent, a search tool's root-relative output. Callers that need the namespace screen or an
+ * identity read the prelude; this is only its anchor.
+ */
+export declare function anchorSpelling(family: PathFamily, base: string, spelled: string): string;
 /** The family-aware LEXICAL view of a possibly-relative spelling against a resolution base (no I/O,
  *  `.`/`..` folded via {@link normalizeAbsPathLexically}): the SECOND deny-judgment view. It asks
  *  "does the NAME land on a guarded path", complementing the canonical
@@ -456,6 +462,7 @@ export declare function resolveKey(env: ExecutionEnv, rootCanonical: string, pat
     readonly homeViews?: HomeViewSource;
     matchTarget(canonicalKey: string, lexicalView?: string, opts?: {
         readonly aliasResolved?: boolean;
+        readonly hops?: readonly string[];
     }): {
         pattern: string;
         matchedView?: string;

package/dist/tools/fs/safety.js

@@ -1,9 +1,10 @@
 import { createHash } from "node:crypto";
 import { readDenySentence } from "./read-deny.js";
 import { homeViewsOf } from "./read-deny-home.js";
+import { skipsRootsContainment } from "./containment-face.js";
 import { sliceHeadSafe } from "../../core/surrogate-safe-slice.js";
 import { pathTargetValue, protectivePathTargetOf } from "../../core/tool-registry.js";
-import { readPathViews } from "../../core/effective-path-target.js";
+import { readPath } from "../../core/effective-path-target.js";
 import { withGateTimeout, DEFAULT_GATE_AWAIT_TIMEOUT_MS } from "../../core/gate-bounded-await.js";
 import { thrownText } from "../../core/thrown-value.js";
 export function fileArgPath(args) {
@@ -25,8 +26,8 @@ export function sha256(content) {
     return createHash("sha256").update(content, "utf8").digest("hex");
 }
 const SEP = "/";
-export function isAbsolutePathForm(p) {
-    return p.startsWith("/") || /^[A-Za-z]:[\\/]/.test(p) || p.startsWith("\\\\");
+export function relativeInEveryFamily(p) {
+    return !(p.startsWith("/") || p.startsWith("\\") || /^[A-Za-z]:/.test(p));
 }
 function nativeSepOf(p) {
     return isWinFormPath(p) && p.includes("\\") ? "\\" : "/";
@@ -314,8 +315,11 @@ export function pathFamilyOf(bases) {
 export function isUncSpelling(p) {
     return /^[\\/]{2}[^\\/]+[\\/]+[^\\/]/.test(p);
 }
+export function familyFor(source, p) {
+    return source === "own" ? (isWinFormPath(p) ? "win" : "posix") : source;
+}
 export function isAbsoluteForFamily(family, p) {
-    return family === "win" ? /^[A-Za-z]:[\\/]/.test(p) || isUncSpelling(p) : p.startsWith("/");
+    return familyFor(family, p) === "win" ? /^[A-Za-z]:[\\/]/.test(p) || isUncSpelling(p) : p.startsWith("/");
 }
 export const WIN32_NAMESPACE_REFUSALS = Object.freeze(["device_namespace", "unmappable_namespace", "unc_on_posix_tree", "drive_relative"]);
 export const WIN32_NAMESPACE_REFUSAL_TEXT = {
@@ -445,9 +449,11 @@ export function joinForFamily(family, base, rel) {
     }
     return `${base.replace(/[\\/]+$/, "")}${base.includes("\\") ? "\\" : "/"}${rel}`;
 }
+export function anchorSpelling(family, base, spelled) {
+    return isAbsoluteForFamily(family, spelled) ? spelled : joinForFamily(family, base, spelled);
+}
 export function lexicalViewOf(spelled, base) {
-    const family = pathFamilyOf({ root: base });
-    return normalizeAbsPathLexically(isAbsoluteForFamily(family, spelled) ? spelled : joinForFamily(family, base, spelled));
+    return normalizeAbsPathLexically(anchorSpelling(pathFamilyOf({ root: base }), base, spelled));
 }
 function within(rootCanonical, p) {
     if (!rootCanonical)
@@ -462,7 +468,7 @@ function within(rootCanonical, p) {
     return pN.identity.startsWith(rootN.identity.endsWith(SEP) ? rootN.identity : rootN.identity + SEP);
 }
 export async function resolveKey(env, rootCanonical, path, signal, baseCwd, additionalRoots, exactFileReadExemption, readDeny, containmentFace) {
-    const views = await readPathViews(env, path, baseCwd ?? rootCanonical, { root: rootCanonical, ...(baseCwd !== undefined ? { cwd: baseCwd } : {}) }, signal, { hops: readDeny !== undefined });
+    const views = await readPath(env, path, baseCwd ?? rootCanonical, { root: rootCanonical, ...(baseCwd !== undefined ? { cwd: baseCwd } : {}) }, { intent: "resolve", views: readDeny !== undefined ? "chain" : "canonical" }, signal);
     const canon = views.canonical ?? (await canonicalizeTarget(env, path, signal, pathFamilyOf({ root: rootCanonical }), baseCwd));
     if (!canon.ok)
         return { ok: false, violation: { code: "invalid", message: canon.message } };
@@ -473,7 +479,7 @@ export async function resolveKey(env, rootCanonical, path, signal, baseCwd, addi
     }
     if (readDeny !== undefined) {
         const judged = { aliasResolved: canon.aliasResolved === true, hops: views.hops };
-        const lexical = views.lexical?.kind === "path" ? spellingOfIdentity(views.lexical.identity, pathFamilyOf({ root: rootCanonical })) : undefined;
+        const lexical = views.lexical?.kind === "path" ? spellingOfIdentity(views.lexical.identity, views.lexical.family) : undefined;
         let hit = readDeny.matchTarget(key, lexical, judged);
         if (hit === null) {
             const homeView = await homeViewsOf(env, readDeny, signal).of(key);
@@ -493,7 +499,7 @@ export async function resolveKey(env, rootCanonical, path, signal, baseCwd, addi
             };
         }
     }
-    if (containmentFace === "open") {
+    if (skipsRootsContainment(containmentFace)) {
         if (isUncPath(key) && isWinFormPath(key) && !within(rootCanonical, key) && !additionalRootsCanonical?.some((r) => within(r, key))) {
             return {
                 ok: false,
@@ -528,7 +534,7 @@ export async function canonicalizeTarget(env, path, signal, family, baseCwd) {
     }
     const unprefixed = nativeUncSpellingOf(family, screened.spelled);
     const spelled = family === "posix" && unprefixed.startsWith("//") ? unprefixed.replace(/^\/+/, "/") : unprefixed;
-    const target = baseCwd && !isAbsoluteForFamily(family, spelled) ? joinForFamily(family, baseCwd, spelled) : spelled;
+    const target = baseCwd ? anchorSpelling(family, baseCwd, spelled) : spelled;
     let thrownByProbe;
     let seenThrow = false;
     const probe = probeRealTarget(env, path, target, family, signal).catch((e) => {
@@ -593,7 +599,7 @@ async function probeRealTarget(env, path, target, family, signal) {
             };
         }
         const hopSpelling = family === "win" ? screenedTarget.spelled : link.value;
-        const linkTarget = isAbsoluteForFamily(family, hopSpelling) ? hopSpelling : joinForFamily(family, parentDir(abs), hopSpelling);
+        const linkTarget = anchorSpelling(family, parentDir(abs), hopSpelling);
         const reabs = await env.absolutePath(linkTarget, signal);
         if (!reabs.ok) {
             return { ok: false, message: `cannot resolve symlink target "${linkTarget}" for "${path}": ${reabs.error.message}`, unresolvedSymlink: true };