@sema-agent/core 7.49.0 → 7.49.1

package/CHANGELOG.md

@@ -1,3 +1,42 @@
+## 7.49.1 — 2026-10-12
+
+**Hard-breaking changes:** none. **Closed sets:** `OptionMode` +1 (`queries`; internal to the program read model, not exported). **Package exports:** +0 / −0 names, no member changes (`SHELL_WRAPPER_TABLE` is byte-equal: a lookup switch is no peel flag; the two types #1583 / #1640 add live in a runner-internal module). **Behavior:** #1583 removes a value that was left in clear next to a credential-shaped name and #1640 makes a line say what already happened — nothing a run could do before is refused; #1643 and #1644 restore two readings 7.49.0 made too strict to the shell's and the reference's own — both are loosenings of 7.49.0 toward 7.48.0 and the reference implementation (CC 2.1.296), each open to veto. **Known limits added** (`docs/KNOWN-LIMITS.md`): KL-1643-a / -b, KL-1644-a / -b / -c (and the rows #1583 / #1640 carry).
+
+### A name an earlier cut swallowed no longer frees its value (#1583; fix) (@server @cli @client-core @test)
+
+- **Before (7.49.0).** The vendor-prefixed pass runs before the keyword pass, and a prefixed token's body takes `_` and `-` (a GitLab token does by construction): `glpat-<22>_password=<value>` read `[redacted]=<value>` — the cut took the name `password` with the token, and the keyword pass, reading the text the cut left, found no name for the value. 7.48.0 had no `glpat-` row, so the keyword pass saw the name and removed the value (its `ghp_` and `sk-` rows swallowed the name the same way). On a 2 700-case constructed probe (seeded: five prefixes × nine names × five value separators × six wrappers) 7.49.0 left at least 6 characters of the value visible in 416 cases where 7.48.0 did not — all of them `glpat-`; the token itself was cut better (7.48.0 left it visible in 1 080 cases, 7.49.0 in none).
+- **Now.** The pass engine (`runRedactionPasses`, behind `scrubSecrets`, `redactSecrets`, `redactHostLeaks` and the activity summary) reads every pass's hits on the original text as well, and adds every hit the sequential run did not remove whole to what it removes: a value that holds another pass's hit (a bearer value, a URL, a host path — the former "strictly encloses another pass's hit" rule) and an assignment whose name an earlier cut took are one reading, not two. The name of a hit is read on the original text, never on what a cut left. No token row, character class or vendor case changed. The added hit is reported beside the token's (kind `keyword-value`, span in the original text). The union is rendered from the replacements' templates — a label a replacement keeps is the template's group, never characters it happens to share with the match — so a marker is never cut or doubled; the format-character path uses the same disjoint rendering for the view and for every boundary scan (an overlapping scan is no longer dropped, so a token a format character hid from the view is still found; a format character a matched value ran over goes with it instead of being left after the marker) and merges the scans' spans in one pass. On the probe the value axis goes 1 192 (7.48.0) / 1 608 (7.49.0) → 360 and the token axis stays at 0; the 360 left are one shape — a name behind an escaped quote inside a JSON string (`\"password\":\"…\"`) — which 7.48.0 reads the same way and which prefixes that never take a name (`AKIA`, `ASIA`) leak on identically (KL-958-a).
+- **Who is hurt.** Nobody who relied on a value surviving: text that holds a prefixed token glued to a credential name by `_` or `-` and then `=` or `:` loses the value too — over-redaction is this face's cheap direction. A host that counts redaction findings sees one more `keyword-value` finding on those texts.
+- **Consumers.** None needs to act.
+- Pins: `test/backlog1583-prefix-adjacent-value.test.ts` (four prefixes × name separators `_` `-` `.` × value separators `=` `: ` JSON key × bare / nested, on four faces, each row beside its recorded v7.48.0 reading; the engine rule on synthetic passes, with the three shapes the union path made reachable — a kept label read from the template not from shared characters, format-character boundary scans that keep what they found, a linear merge of their spans; the seeded probe against 7.48.0's recorded counts); `test/backlog958-credential-vocabulary.test.ts` D5 unchanged and green.
+
+### The dropped-call line says what became of the turn (#1640; fix; +1 optional detail key) (@cli @server @client-core @test)
+
+- **Before (7.49.0).** `task.tool_turn_incomplete` ended every dropped-call sentence (`truncated`, `unnamed`) with "the model was asked to re-issue them". On a turn whose only content was the dropped call (a call cut at the output cap, no text, no valid call) the lane fails the turn and the run ends with `terminal.detail.kind` `model_output_invalid` after one request; a provider refusal / content filter ends the run the same way, and a turn that completed with text and nothing to run ends it with the text — in none of them was anything asked.
+- **Now.** The line says what became of the run only where the turn's own message states it, and is silent everywhere else. (1) Where the lane's dropped-calls account is on the failed turn (`modelOutputInvalid`, built once by `modelOutputInvalidOf` and read back by `modelOutputInvalidOfMessage`, the admission the terminal's `detail` is minted from) the run did end: "…so they did not run; the run ended with this turn (model_output_invalid)", `outcome: "terminal"`. (2) Where the turn goes on by the loop's own turn rules — it did not fail, and it carries a tool call (a tool-calling turn guarantees a next request), or stopped to call a tool (the malformed-tool-use retry asks again), or stopped at the output cap (the truncated-output continue asks again) — the sentence is unchanged, "…so they did not run; the model was asked to re-issue them", `outcome: "reissued"`. (3) Any other turn — a provider refusal / content filter, an abort, a turn that completed with text and nothing to run, a torn stream the loop may resume — says only "…so they did not run" and carries no `outcome`: whether a request follows is the loop's decision, not the message's. New optional key `detail.outcome` (`"terminal"` | `"reissued"`): new optional key, readers need no action; present only when `cause` is `truncated` or `unnamed` and the message states it — its absence is a fact, not missing data; absent on `bad_frame` and `missing_result_synthesized`. Once per run per cause stands — the first turn that showed the cause decides. A `reissued` turn is the turn, not the run: a recovery budget already spent, a turn limit or an interrupt that follows it is not read (KL-1598-b; the exact reading, announced after the loop decides, is #1666).
+- **Who is hurt.** A consumer that matches the sentence text for the cases above (a refusal, an abort, a text-only completion and the failed turn no longer say "re-issue"); everything else is read from `detail`, which only gained a key.
+- **Consumers.** cli may show `outcome`; nothing needs to change. The harness's own continuation gate (`lastTurnHadToolCalls`) now reads the same exported predicate (`turnCarriesToolCall`), one spelling.
+- Pins: `test/backlog1640-incomplete-outcome.test.ts` (three lanes × two causes × the dropped call alone / beside a valid call / beside text only / a provider refusal, each against the run's own terminal and request count; a torn stream the loop resumes, said nothing about; the seat on hostile and mixed messages; the one shared predicate); `test/backlog1230-tool-turn-incomplete.test.ts` ③ and `test/backlog1598-truncated-args.test.ts` ③ ⑧ re-pinned for the new key.
+
+### A launcher's bare `--` and `command -v` / `-V` are read as the launcher reads them: neither is text the engine could not read (#1643; fix; loosening of 7.49.0 toward 7.48.0; hard-breaking: none; closed sets: `OptionMode` +1; exports: +0 / −0) (@test @cli @server @client-core)
+
+- **Before (v7.49.0).** The launcher rows (`command`, `env`, `nice`, `nohup`, `builtin`, `exec`, `stdbuf`, `timeout`, `setsid`, `flock`) carried neither a bare `--` (end of options: the next word is the program) nor `command -v` / `-V` (a lookup: the words after it are names, nothing is run). The program-position walk refused both as "an option no row explains", and 7.49.0's removal guard asks a refused program position as text the engine did not read — `unverifiable_shell_text`, a release row no stored allow and no `bypassPermissions` clears, which `dontAsk` refuses. So `command -v git`, `if command -v node >/dev/null; then …`, `test -x "$(command -v git)"`, `command -- ls`, `env -- ls`, `nice -- ls`, `nohup -- ls` and `timeout -- 5 ls` drew an uncleared question whose card said "`command` runs shell text this guard cannot read (command -v git)" about a command whose text was plain; `command -- rm -rf "$X"` was asked as unreadable text instead of the removal guard's own unverifiable-delete question. 7.48.0 asked these in `default` (an ordinary "the read boundary could not establish what is read") and ran them under a whole-tool `Bash` allow and under bypass.
+- **Now.** One walk, rows carry the fact. A bare `--` is stepped by every launcher row the binary gate witnesses against its real program (`command`, `builtin`, `exec`, `env`, `nice`, `nohup`, `stdbuf`, `timeout`, `setsid`, `flock`; `time`, `sudo`, `doas`, `su`, `runuser`, `watch` already did) and it ENDS the options: the next word is the program (or the launcher's required operand — `timeout -- 5 ls`), whatever it spells, and a word spelled like an option after it is not stepped (`env -- -i ls` stays unread: bash runs a program named `-i`). `command -v` / `-V` (also `-pv`, `-p -v`, behind another launcher: `env command -V x`) is a new option mode, `queries`: the chain names no program, so nothing is read as run — `command -v rm -rf "$X"` looks up three names and removes nothing, and asks no removal question. `command -- rm -rf "$X"` reads as `rm -rf "$X"` (`unverifiable_delete`, as without the launcher). An option no row explains (`command -x ls`, `env --frobnicate ls`, `nice -z ls`) is still unread text. The card says "cannot read" only for a text that was not read: the finding and its sentence are one source.
+- **Who needs it.** Any session whose shell checks for a tool before using it (`command -v`) or ends a launcher's options with `--`: both were uncleared questions under a whole-tool allow and under bypass. **Who is hurt.** Nobody is newly asked; this is looser than 7.49.0 by exactly the two spellings, and each word after `--` is judged as the program it is (a removal behind `command --` is the removal guard's). `default` / `acceptEdits` still ask a lookup the ordinary question (KL-1643-a: the lookup is no read-only program, as in 7.48.0 and the reference).
+- **Divergence from the reference (open to veto).** CC 2.1.296's wrapper strip steps `--` for `command`, `builtin`, `nice`, `nohup`, `time` and `timeout` (`bL` @18513380, `R3e` @18541453) — aligned — but not for `env` (`cvr` @18513144 returns −1 on it) or `stdbuf` (`uvr`), which stay the program there; sema reads them by the real grammar (GNU and BSD `env`, `stdbuf`: getopt ends options at `--`). `exec`, `setsid`, `flock` are not in the reference's wrapper set at all.
+- **Compensation.** None needed. **If unchanged.** A plain presence check or `--` form keeps drawing an uncleared card that says it cannot read text it read.
+- Pins: `test/backlog1643-launcher-options.test.ts` (① lookups × five arms × two read faces, ② `--` per launcher, ③ the word after `--` is the program, `-- -i` stays unread, ④ unexplained options stay unread, ⑤ the card's sentence, ⑥ controls; 7.48.0 / 7.49.0 / this tree columns in the receipt); `test/program-read-model.binary-gate.cells.ts` (a `-- <program>` cell for every row that steps `--`, a `-v <names>` cell for the lookup — run against the real programs); re-pinned where `env --` / `command --` stood for "an option no row explains": `backlog780-program-position-reader`, `backlog891-seat-keyed-declines`, `backlog945-plan`, `backlog769-sed-script-slot`, `backlog1498-retire`, `backlog1505-streamfed-shell`, the two program-read-model equivalence allowed-lists (classes `1643-launcher-end-of-options`, `1643-launcher-lookup`) and the #994 S1 dual-run attribution `launcher_end_of_options`.
+- Consumers: test — the G10 forms (`command -v`, `command --`, `env --`, `nice --`) answer as the table above; cli / server / client-core — wording only (the card no longer says "cannot read" for these), no new field.
+
+### An output redirection outside the write roots is the reference's ordinary redirection ask again — `> /dev/stdout`, `2>/dev/stderr`, `> /dev/tty`, `> /dev/fd/N` ask the ordinary question, bypass and a pre-approval release them; `> /dev/null` stays exempt (#1644; fix; loosening of 7.49.0 toward 7.48.0 and the reference; hard-breaking: none; closed sets: +0; exports: +0 / −0) (@test @cli @server @client-core)
+
+- **Before (v7.49.0).** #1427 judged every write target a shell command names against the write roots and made an outside finding the write face's MANDATED probe — the same row a read outside the roots has. The reference's redirection check does not: CC 2.1.296 `lvr` (cli296.js @18502854, called @18508831) exempts `/dev/null` alone and asks every other target outside the working directories as a plain permission ask (`> /dev/stdout` too: `sR` @13116941 has no device case), which bypass (`$pn` @18716980) and a whole-tool allow rule (`@18717070`) release and a prefix allow does not (the ask is not `bashAllowRuleOverridable`; `vX`'s caller returns it before the allow rules, @18567915). So 7.49.0 was stricter than the reference on exactly this cell, disclosed with #1427: `echo x > /dev/stdout`, `echo x 2>/dev/stderr`, `> /dev/tty`, `> /dev/fd/N` and `> <outside file>` drew a probe card that nothing but bypass released — a spec pre-approval (`allowedTools: ["Bash"]`) included, which 7.48.0's ordinary question had accepted.
+- **Now.** One cell, read where the reference's check reads it. A command whose every outside-the-roots finding is an OUTPUT REDIRECTION (`>` `>>` `>|` `&>` `N>`, `exec >`, a here-document into a file) reads the redirection cell of the decision table — `ordinary` on the full shell, `refuse` on the read-only face — instead of the table's `mandated`: `default` and `acceptEdits` ask the question (the card still says "writes outside the directories allowed for this session"), `bypassPermissions` and a spec pre-approval release it, `dontAsk` refuses it by the mode; a stored whole-tool `Bash` rule and a prefix allow keep asking it (the rule-silencing principle, unchanged: they did in 7.48.0, and the reference's prefix allow does not release it either). `/dev/null` stays exempt. A program OPERAND written outside the roots (`tee`, `cp`, `mv`, `rm`, `touch`, `sed -i`, a `sed w` file), a redirection beside a read outside the roots, beside such an operand or beside any word the station could not place (`echo x > <outside>; cat "$UNKNOWN"`), and a redirection target the shell rewrites (`> "$OUT"`) keep the mandated probe; the table's row for `outside_roots` is unchanged and still the read face's.
+- **Who needs it.** Any session whose commands print to a standard stream by name or redirect outside the workspace under bypass or a pre-approval. **Who is hurt.** Nobody is asked more than in 7.49.0; a session that relied on the 7.49.0 mandate to stop a redirected write under `allowedTools: ["Bash"]` or bypass no longer gets it (7.48.0 and the reference never did) — the roots still ask under `default` / `acceptEdits`. The 7.49.0 divergence row (stricter than the reference on this cell) is retired.
+- **Compensation.** None needed. A deployment that wants the mandate back for redirections declares a write deny row or runs `default` without a pre-approval. **If unchanged.** A command that only prints to its own output stays unrunnable under a pre-approval.
+- **For the record (not done, awaiting the owner's ruling).** The device spellings the reference's predicate `wwe` (cli296.js @18511591: `/dev/null`, `/dev/stdin`, `/dev/stdout`, `/dev/stderr`, `/dev/tty`, `/dev/fd/<digits>`, `/proc/self/fd/{0,1,2}`) drops from its write list, git-diff operands, read-path list and input-redirection check could be exempt from the containment question too — `> /dev/stdout` would then run unasked in `default` (7.48.0's behavior), one step looser than the reference's redirection check. Not implemented: it departs from the reference and needs an explicit ruling; its cost is that a descriptor spelling is exempt whatever the same command backs it with (`exec 3< <file in a read-only grant>; echo x > /dev/fd/3` writes the file on Linux), and it would also settle KL-1644-a (`/dev/fd/9`).
+- Pins: `test/backlog1644-device-targets.test.ts` (① the real Runner × seven arms × two read faces over outside files and seven device spellings, ② `/dev/null`, ③ what keeps the mandate — operands, a read beside, a rewritten target, ④ the judge's cell and the unchanged table row); re-pinned: `backlog1427-write-targets-roots` (① split into redirections and operands, ⑦ lanes, ⑨).
+
 ## 7.49.0 — 2026-10-12
 
 **Retirement and unification wave — BREAKING.** One reading per fact across the path tables, the tool selector, the removal guard, the checkpoint row, the terminal detail and the decide record; the orchestration families with no reference counterpart leave the package. Every entry below states Before / Now / who is hurt / compensation; this head lists only the hard-breaking items, each open to veto (rulings in parentheses).

package/dist/core/arg-summary.d.ts

@@ -62,10 +62,10 @@ export interface RedactionPass {
  * only the first (or neither) matches. The OUTPUT keeps every format character that sits OUTSIDE a
  * replaced span — a joiner in an emoji sequence, a non-joiner in Persian text, a soft hyphen in a word
  * — and drops only those INSIDE the span the marker replaces (they were part of the secret). A
- * format-free input takes the exact historical path (byte-identical output). When the replacements
- * cannot be mapped back exactly (a later pass matched across an earlier pass's inserted text), the
- * output is the redacted view itself — every format character dropped: the failure direction is
- * over-stripping, never a leak.
+ * format-free input takes the exact historical path (byte-identical output). The view's replacements and
+ * every boundary scan's are taken as disjoint spans of their input (a later pass that matched across an
+ * earlier pass's inserted text is rendered from the removals instead), so the spans always map back
+ * exactly and no scan is skipped.
  */
 export declare function runRedactionPasses(input: string, passes: readonly RedactionPass[], report?: RedactionReport): string;
 /**

package/dist/core/arg-summary.js

@@ -53,7 +53,28 @@ function insertedFor(pass, match, groups) {
         ? pass.replace.replace(/\$(\d)/g, (_m, d) => groups[Number(d) - 1] ?? "")
         : pass.replace(match, ...groups);
 }
-function removedRegion(match, inserted) {
+function removedRegion(pass, match, groups, inserted) {
+    if (typeof pass.replace === "string") {
+        const parts = pass.replace.split(/(\$\d)/).filter((p) => p !== "");
+        const isRef = (p) => /^\$\d$/.test(p);
+        const refText = (p) => groups[Number(p[1]) - 1] ?? "";
+        let head = "";
+        for (const p of parts) {
+            if (!isRef(p))
+                break;
+            head += refText(p);
+        }
+        let tail = "";
+        for (let i = parts.length - 1; i >= 0 && isRef(parts[i]); i--)
+            tail = refText(parts[i]) + tail;
+        if (parts.every(isRef))
+            return [0, match.length];
+        if (!match.startsWith(head))
+            head = "";
+        if (!match.endsWith(tail) || head.length + tail.length > match.length)
+            tail = "";
+        return [head.length, match.length - tail.length];
+    }
     let head = 0;
     while (head < match.length && head < inserted.length && match[head] === inserted[head])
         head++;
@@ -69,7 +90,7 @@ function soloHits(input, passes) {
             const inserted = insertedFor(pass, m[0], m.slice(1));
             if (inserted === m[0])
                 continue;
-            const [a, b] = removedRegion(m[0], inserted);
+            const [a, b] = removedRegion(pass, m[0], m.slice(1), inserted);
             if (b <= a)
                 continue;
             const at = m.index;
@@ -79,17 +100,30 @@ function soloHits(input, passes) {
     });
     return hits;
 }
-function enclosingHits(hits) {
-    const sorted = [...hits].sort((x, y) => x.start - y.start || y.end - x.end);
-    const outer = new Set();
-    let reach;
-    for (const r of sorted) {
-        if (reach !== undefined && reach.pass !== r.pass && reach.end >= r.end && reach.end - reach.start > r.end - r.start)
-            outer.add(reach);
-        if (reach === undefined || r.end > reach.end)
-            reach = r;
+function unremovedHits(hits, removals) {
+    const gone = [];
+    for (const r of [...removals].filter((x) => x.end > x.start).sort((x, y) => x.start - y.start || y.end - x.end)) {
+        const last = gone[gone.length - 1];
+        if (last !== undefined && r.start <= last[1])
+            last[1] = Math.max(last[1], r.end);
+        else
+            gone.push([r.start, r.end]);
     }
-    return [...outer];
+    return hits.filter((h) => {
+        let lo = 0;
+        let hi = gone.length - 1;
+        let at = -1;
+        while (lo <= hi) {
+            const mid = (lo + hi) >> 1;
+            if (gone[mid][0] <= h.start) {
+                at = mid;
+                lo = mid + 1;
+            }
+            else
+                hi = mid - 1;
+        }
+        return at === -1 || gone[at][1] < h.end;
+    });
 }
 function sequentialRemovals(batches) {
     const removals = [];
@@ -143,7 +177,7 @@ function runPasses(input, passes, findings, toOriginal) {
             const family = typeof pass.family === "function" ? pass.family(passInput, offset) : pass.family;
             if (findings !== undefined)
                 findings.push({ pass: passIndex, f: finding(pass, [toOriginal(toPassZero(offset)), toOriginal(toPassZero(offset + match.length))], family) });
-            const [a, b] = removedRegion(match, inserted);
+            const [a, b] = removedRegion(pass, match, groups, inserted);
             edits.push({ at: offset, removedLen: match.length, insertedLen: inserted.length, inserted, family, head: a, tail: match.length - b, pass: passIndex });
             return inserted;
         });
@@ -151,12 +185,15 @@ function runPasses(input, passes, findings, toOriginal) {
     });
     return { out: cur, batches };
 }
-function applyPasses(input, passes, report, toOriginal) {
+function applyPasses(input, passes, report, toOriginal, disjoint = false) {
     const found = report === undefined ? undefined : [];
     const plain = runPasses(input, passes, found, toOriginal);
-    const outer = enclosingHits(soloHits(input, passes));
-    const whole = outer.length === 0 ? undefined : renderRemovals(input, [...sequentialRemovals(plain.batches), ...outer]);
-    if (whole === undefined || whole.out === plain.out) {
+    const solo = soloHits(input, passes);
+    const sequential = solo.length === 0 ? [] : sequentialRemovals(plain.batches);
+    const outer = unremovedHits(solo, sequential);
+    const mappable = !disjoint || replacedSpans(plain.batches) !== undefined;
+    const whole = outer.length === 0 && mappable ? undefined : renderRemovals(input, [...sequential, ...outer]);
+    if (whole === undefined || (whole.out === plain.out && mappable)) {
         if (report !== undefined)
             report.findings.push(...found.map((x) => x.f));
         return plain;
@@ -233,10 +270,10 @@ export function runRedactionPasses(input, passes, report) {
         const idx = offsetToCharIndex.get(pos);
         return idx === undefined ? input.length : viewToOriginal[idx];
     };
-    const { out, batches } = applyPasses(view, passes, report, toOriginal);
+    const { batches } = applyPasses(view, passes, report, toOriginal, true);
     const viewSpans = replacedSpans(batches);
     if (viewSpans === undefined)
-        return out;
+        return REDACTED_WHOLE;
     const spans = viewSpans.map((sp) => {
         const startIdx = offsetToCharIndex.get(sp.start) ?? viewChars.length;
         const endIdx = offsetToCharIndex.get(sp.end) ?? viewChars.length;
@@ -258,11 +295,11 @@ export function runRedactionPasses(input, passes, report) {
     if (cutOffsets.length > MAX_FORMAT_SLOT_SCANS)
         return REDACTED_WHOLE;
     const extra = [];
-    const rawSpans = replacedSpans(applyPasses(input, passes, undefined, (pos) => pos).batches);
+    const rawSpans = replacedSpans(applyPasses(input, passes, undefined, (pos) => pos, true).batches);
     if (rawSpans !== undefined)
         extra.push(...rawSpans);
     for (const cut of cutOffsets) {
-        const cutSpans = replacedSpans(applyPasses(view.slice(cut), passes, undefined, (pos) => pos).batches);
+        const cutSpans = replacedSpans(applyPasses(view.slice(cut), passes, undefined, (pos) => pos, true).batches);
         if (cutSpans === undefined)
             continue;
         for (const c of cutSpans) {
@@ -271,27 +308,36 @@ export function runRedactionPasses(input, passes, report) {
         }
     }
     extra.sort((a, b) => a.start - b.start);
+    const firstEndingAfter = (pos) => {
+        let lo = 0;
+        let hi = spans.length;
+        while (lo < hi) {
+            const mid = (lo + hi) >> 1;
+            if (spans[mid].end > pos)
+                hi = mid;
+            else
+                lo = mid + 1;
+        }
+        return lo;
+    };
     for (const r of extra) {
-        const overlapping = spans.find((v) => r.start < v.end && v.start < r.end);
-        if (overlapping !== undefined) {
-            if (r.start < overlapping.start)
-                overlapping.start = r.start;
-            if (r.end > overlapping.end)
-                overlapping.end = r.end;
+        const at = firstEndingAfter(r.start);
+        const hit = spans[at];
+        if (hit !== undefined && hit.start < r.end) {
+            if (r.start < hit.start)
+                hit.start = r.start;
+            if (r.end > hit.end)
+                hit.end = r.end;
+            let next = at + 1;
+            while (next < spans.length && spans[next].start < hit.end)
+                hit.end = Math.max(hit.end, spans[next++].end);
+            if (next > at + 1)
+                spans.splice(at + 1, next - at - 1);
             continue;
         }
-        spans.push({ start: r.start, end: r.end, inserted: r.inserted });
+        spans.splice(at, 0, { start: r.start, end: r.end, inserted: r.inserted });
         if (report !== undefined)
             report.findings.push(finding(passes[r.pass], [r.start, r.end], r.family));
-        spans.sort((a, b) => a.start - b.start);
-    }
-    for (let i = 1; i < spans.length;) {
-        if (spans[i].start < spans[i - 1].end) {
-            spans[i - 1].end = Math.max(spans[i - 1].end, spans[i].end);
-            spans.splice(i, 1);
-        }
-        else
-            i++;
     }
     let result = "";
     let cursor = 0;

package/dist/core/engine-notice.d.ts

@@ -309,13 +309,20 @@ export interface EngineNotice {
      *    the run and announced on the first. Absent ⇒ every request of the run already had the structure.
      *  - `"task.tool_turn_incomplete"` (#1230) — the person's line for a tool turn the model was handed incomplete, beside
      *    the note the model itself reads. `detail.cause` (closed `TOOL_TURN_INCOMPLETE_CAUSES`): `truncated` — calls whose
-     *    arguments were cut before they parsed, dropped (they did not run; the model is asked to re-issue them);
-     *    `unnamed` — calls that arrived with no tool name, dropped the same way; `bad_frame` — streamed response frames
+     *    arguments were cut before they parsed, dropped (they did not run); `unnamed` — calls that arrived with no tool
+     *    name, dropped the same way; `bad_frame` — streamed response frames
      *    that could not be read, dropped (the response may be missing content); `missing_result_synthesized` — a
      *    call of this run with no recorded result, which the request view closed as interrupted, outcome unknown (the
      *    `missing_result` repair above; a call that went unanswered before the run began is the transcript's history and
-     *    is on that operator line only). Audience `"user"`; `detail: { cause, count, toolCallIds?, sessionId, runId }` —
-     *    `count` the calls (or frames) of that cause in the turn or request that first showed it; `toolCallIds` on
+     *    is on that operator line only). Audience `"user"`; `detail: { cause, count, outcome?, toolCallIds?, sessionId, runId }` —
+     *    `count` the calls (or frames) of that cause in the turn or request that first showed it; `outcome` (#1640) on
+     *    `truncated` / `unnamed` only, and only where the turn's own message states it: `"terminal"` — the lane failed
+     *    the run on those calls (its dropped-calls account is on the failed turn; the terminal's `detail.kind` is
+     *    `model_output_invalid`), the sentence says the run ended; `"reissued"` — the turn goes on by the loop's turn
+     *    rules (it carries a tool call, or stopped to call a tool, or stopped at the output cap) and the next request
+     *    asks the model to re-issue them. ABSENT is a fact, not missing data: the message does not say what became of the
+     *    run (a refusal, an abort, a completed turn with nothing to run, a torn stream the loop may resume), and the
+     *    sentence then stops at "so they did not run". Once for the cause that first showed it; `toolCallIds` on
      *    `missing_result_synthesized` only, each id in the provider echo shape (a stored id outside it is not shown;
      *    `count` still counts it). Closed-set words, a count and call ids only: never a tool name, an argument or the
      *    note's text. ONCE PER RUN PER CAUSE. Absent ⇒ nothing of that cause reached the model.

package/dist/core/hooks.d.ts

@@ -856,6 +856,23 @@ export interface HookToolOutput {
  * formerly APPEARED on the promoted ask object as an undeclared property, because that fold spread the
  * whole hook result; the concurrent arm never carried it, so the two arms disagreed on a member neither
  * of them reads. Nothing in the engine reads it off a decision.
+ *
+ * PreToolUse lane × settlement table (the gate's phase 1 in {@link runToolGate}; the delegated twin in
+ * {@link createPreToolUseConstraintPolicy} speaks the same words as a policy layer). "Held" = the ask survives to a person:
+ * neither an allow rule (`decisionReason: "hook"` is outside the allow layer) nor the classifier (hook asks are
+ * never classifier-answerable) clears it.
+ *  · returns `allow` (± `updatedInput` / `additionalContext`) → the face's own word (`hookAllowed`); the policy
+ *    still adjudicates the FINAL args; the allow layer's hook member may clear an unmandated ask. Not held.
+ *  · returns `ask` (± `updatedInput`, ± `requiresRealApproval`) → folded as `hookAsk`: a policy deny still
+ *    outranks it, a policy allow is PROMOTED to this ask with `"hook"` stamped by the engine; the rewrite rides
+ *    into execution and the real-approval bit crosses delegation. Held.
+ *  · returns `deny` → {@link hookDenyExit}: the hook's OWN refusal — the deny observer does NOT fire, the model
+ *    reads the hook's sentence. Nothing executes.
+ *  · returns `undefined` ("no opinion") or no screening face is installed → no word at all; the policy decides.
+ *  · throws / times out / is aborted / returns an out-of-contract object (refused by {@link receiveHookResult}) →
+ *    {@link engineFailClosedExit}: an ENGINE deny — the deny observer fires, a crash and a timeout also reach
+ *    `onHookError`→`onError(phase:"hook")` (an abort does not), the model reads the engine's envelope. Nothing
+ *    executes, nothing is held.
  */
 export type PreToolUseResult = PermissionResult & {
     additionalContext?: string;

package/dist/core/runner/run-harness-handlers.js

@@ -13,7 +13,7 @@ import { announceToolCall, batchResponseDigest, emitSettled } from "./tool-end-b
 import { createResponseModelSeat } from "./response-model-seat.js";
 import { createToolCallIdFoldSeat } from "./tool-call-id-fold-seat.js";
 import { createFinishReasonSeat } from "./finish-reason-seat.js";
-import { createToolTurnIncompleteSeat } from "./tool-turn-repair-seat.js";
+import { createToolTurnIncompleteSeat, turnCarriesToolCall } from "./tool-turn-repair-seat.js";
 import { wireOf } from "../tool-name-readings.js";
 import { rosterToolName } from "../tool-roster.js";
 export function createHarnessHandlers(input) {
@@ -199,7 +199,7 @@ export function createHarnessHandlers(input) {
             const content = m.content;
             if (rs.attach.attachState !== undefined)
                 rs.counters.cadenceTurns = advanceCadenceClock(rs.attach.attachState, rs.counters.cadenceTurns, content, writeFamilyOf);
-            rs.turn.lastTurnHadToolCalls = Array.isArray(content) && content.some((c) => c?.type === "toolCall");
+            rs.turn.lastTurnHadToolCalls = turnCarriesToolCall(content);
         }
         rs.turn.callStartAt = undefined;
         rs.turn.firstTokenAt = undefined;

package/dist/core/runner/tool-turn-repair-seat.d.ts

@@ -1,15 +1,39 @@
 import type { EngineNotice } from "../engine-notice.js";
-import { type ToolTurnIncompleteCause, type ToolTurnRepair } from "../../internal/llm.js";
+import { type ToolTurnRepair } from "../../internal/llm.js";
 /** The notice's attribution ids — the same pair, for the same reason, as the fold seat's. */
 export interface ToolTurnRepairSeatIds {
     sessionId: string;
     runId: string;
 }
+/** What the message says became of a turn that dropped calls: the run ended on it (`model_output_invalid`), or the next
+ *  request asks the model to re-issue them. */
+export type ToolTurnOutcome = "terminal" | "reissued";
+/** One thing the person is told, per cause. A dropped-call cause carries the outcome when its message states one (else
+ *  `undefined`: nothing is said about the run's fate); the others have none. */
+export type ToolTurnIncompleteItem = {
+    cause: "truncated";
+    count: number;
+    outcome: ToolTurnOutcome | undefined;
+} | {
+    cause: "unnamed";
+    count: number;
+    outcome: ToolTurnOutcome | undefined;
+} | {
+    cause: "bad_frame";
+    count: number;
+} | {
+    cause: "missing_result_synthesized";
+    count: number;
+    toolCallIds: readonly string[];
+};
+/** Does a turn's content carry a tool call? A tool-calling turn GUARANTEES a next request (its results go back to the
+ *  model): the engine's one continuation fact — the harness's boundary gates and the dropped-call line read it here. */
+export declare function turnCarriesToolCall(content: unknown): boolean;
 /** The person's line for one cause — once per run per cause, whichever observer saw it first. */
 export interface ToolTurnIncompleteSeat {
-    /** Announce `count` items of `cause` (and, for a missing result, the calls) unless this run already said it. */
-    announce(cause: ToolTurnIncompleteCause, count: number, toolCallIds?: readonly string[]): void;
-    /** Observe one assistant message: announces each stream drop it reports (`streamDropsOf`). */
+    /** Announce `item` unless this run already said its cause. */
+    announce(item: ToolTurnIncompleteItem): void;
+    /** Observe one assistant message: announces each stream drop it reports (`streamDropsOf`), worded by what became of the turn. */
     observe(message: {
         readonly diagnostics?: unknown;
     }): void;

package/dist/core/runner/tool-turn-repair-seat.js

@@ -1,6 +1,8 @@
 import { deliverEngineNotice } from "../engine-notice.js";
 import { isProviderEchoShape } from "../../brain/errors.js";
 import { streamDropsOf } from "../../internal/llm.js";
+import { readMember } from "../thrown-value.js";
+import { modelOutputInvalidOfMessage } from "./terminal-account.js";
 const FORM_SENTENCE = {
     trailing_text: "a block after an assistant's tool calls was moved ahead of them",
     late_result: "a result recorded later was moved up behind its call",
@@ -9,30 +11,51 @@ const FORM_SENTENCE = {
     duplicate_call: "a second call with the same id in one assistant message was left out (its results answer the first)",
     orphan_result: "a result that answers no call before it was left out",
 };
+const afterDroppedCalls = (outcome) => outcome === "reissued" ? "; the model was asked to re-issue them" : outcome === "terminal" ? "; the run ended with this turn (model_output_invalid)" : "";
 const INCOMPLETE_SENTENCE = {
-    truncated: (n) => `${n} tool call(s) the model made were cut off before their arguments were complete, so they did not run; the model was asked to re-issue them`,
-    unnamed: (n) => `${n} tool call(s) the model made arrived with no tool name, so they did not run; the model was asked to re-issue them`,
-    bad_frame: (n) => `${n} frame(s) of the model's streamed response could not be read and were dropped, so the response may be missing content; the model was told`,
-    missing_result_synthesized: (n) => `${n} earlier tool call(s) have no recorded result, so the model was told their outcome is unknown`,
+    truncated: (i) => `${i.count} tool call(s) the model made were cut off before their arguments were complete, so they did not run${afterDroppedCalls(i.outcome)}`,
+    unnamed: (i) => `${i.count} tool call(s) the model made arrived with no tool name, so they did not run${afterDroppedCalls(i.outcome)}`,
+    bad_frame: (i) => `${i.count} frame(s) of the model's streamed response could not be read and were dropped, so the response may be missing content; the model was told`,
+    missing_result_synthesized: (i) => `${i.count} earlier tool call(s) have no recorded result, so the model was told their outcome is unknown`,
 };
+export function turnCarriesToolCall(content) {
+    try {
+        return Array.isArray(content) && content.some((c) => c?.type === "toolCall");
+    }
+    catch {
+        return false;
+    }
+}
+function outcomeOf(message) {
+    const stop = readMember(message, "stopReason");
+    if (stop === "error")
+        return modelOutputInvalidOfMessage(message) !== undefined ? "terminal" : undefined;
+    if (stop === "aborted")
+        return undefined;
+    return turnCarriesToolCall(readMember(message, "content")) || stop === "toolUse" || stop === "length" ? "reissued" : undefined;
+}
 export function createToolTurnIncompleteSeat(onNotice, ids) {
     const announced = new Set();
-    const announce = (cause, count, toolCallIds) => {
-        if (announced.has(cause))
+    const announce = (item) => {
+        if (announced.has(item.cause))
             return;
-        announced.add(cause);
-        const shown = (toolCallIds ?? []).filter((id) => isProviderEchoShape(id));
+        announced.add(item.cause);
+        const shown = "toolCallIds" in item ? item.toolCallIds.filter((id) => isProviderEchoShape(id)) : [];
         deliverEngineNotice(onNotice, {
             code: "task.tool_turn_incomplete",
-            message: `${INCOMPLETE_SENTENCE[cause](count)}. Announced once per run for this cause.`,
-            detail: { cause, count, ...(shown.length > 0 ? { toolCallIds: shown } : {}), sessionId: ids.sessionId, runId: ids.runId },
+            message: `${INCOMPLETE_SENTENCE[item.cause](item)}. Announced once per run for this cause.`,
+            detail: { cause: item.cause, count: item.count, ...("outcome" in item && item.outcome !== undefined ? { outcome: item.outcome } : {}), ...(shown.length > 0 ? { toolCallIds: shown } : {}), sessionId: ids.sessionId, runId: ids.runId },
         });
     };
     return {
         announce,
         observe(message) {
-            for (const drop of streamDropsOf(message))
-                announce(drop.cause, drop.count);
+            const drops = streamDropsOf(message);
+            if (drops.length === 0)
+                return;
+            const outcome = outcomeOf(message);
+            for (const drop of drops)
+                announce(drop.cause === "bad_frame" ? { cause: "bad_frame", count: drop.count } : { cause: drop.cause, count: drop.count, outcome });
         },
     };
 }
@@ -42,7 +65,7 @@ export function createToolTurnRepairSeat(onNotice, ids) {
     return (repairs) => {
         const missing = repairs.filter((repair) => repair.form === "missing_result" && repair.beforeRun !== true).flatMap((repair) => repair.toolCallIds);
         if (missing.length > 0)
-            incomplete.announce("missing_result_synthesized", missing.length, missing);
+            incomplete.announce({ cause: "missing_result_synthesized", count: missing.length, toolCallIds: missing });
         const fresh = repairs.filter((repair) => {
             const key = `${repair.form}\u0000${[...repair.toolCallIds].sort().join("\u0000")}`;
             if (announced.has(key))

package/dist/core/shell-wrapper-projection.js

@@ -38,7 +38,7 @@ function projectRow(row) {
         return executes.length > 0 ? { valueFlags: [], flags: [], commandString: [], executes } : undefined;
     }
     const commandString = sorted(all.filter((o) => o.spec.value?.kind === "shell-text").map((o) => o.spelling));
-    const values = all.filter((o) => o.spec.value?.kind !== "shell-text");
+    const values = all.filter((o) => o.spec.value?.kind !== "shell-text" && o.spec.mode !== "queries");
     const attached = sorted(values.filter((o) => o.arity === "attached" && !o.spelling.startsWith("--")).map((o) => o.spelling));
     const required = row.launcher.requiredOperands ?? 0;
     const duration = required > 0 && row.launcher.requiredOperandSpelling === DURATION_SPELLING;

package/dist/tools/fs/bash-program-position.d.ts

@@ -94,7 +94,8 @@ export interface ProgramPosition {
     /** The program the stream-fed chain member runs when the chain names none (`xargs` runs `echo`). */
     readonly defaultProgram?: string;
     /** The program bash RUNS: the first word past the chain. `name` is the folded word as written, `basename` what
-     *  bash resolves (`/usr/bin/cat` is `cat`). `undefined` when the chain names none or the read was refused. */
+     *  bash resolves (`/usr/bin/cat` is `cat`). `undefined` when the chain names none (a lookup, `command -v git`, runs
+     *  nothing) or the read was refused. */
     readonly program: {
         readonly index: number;
         readonly name: string;

package/dist/tools/fs/bash-program-position.js

@@ -1,6 +1,6 @@
 import { SHELL_CONTROL_PREFIXES } from "../../shell/lex.js";
 import { shellWordsOf } from "../../shell/shell-words.js";
-import { BLOCK_WORD_NAMES, LAUNCHER_NAMES, feedsArgvFromStdin, launcherOptionMovesBase, launcherOptionStep, launcherRunsShell, programRow, selectedOptions, streamDefaultProgram } from "./program-read-model.js";
+import { BLOCK_WORD_NAMES, LAUNCHER_NAMES, feedsArgvFromStdin, launcherOptionMovesBase, launcherOptionQueries, launcherOptionStep, launcherRunsShell, programRow, selectedOptions, streamDefaultProgram } from "./program-read-model.js";
 export const NOT_AUTO_ALLOWED = "— not auto-allowed";
 export function programBasename(word) {
     return word.includes("/") ? (word.split("/").pop() ?? word) : word;
@@ -38,7 +38,7 @@ function launcherRowOf(name) {
     const row = programRow(name);
     return row?.launcher !== undefined ? row : undefined;
 }
-function pastLauncherOptions(launcher, folded, i, moved) {
+function pastLauncherOptions(launcher, folded, i, moved, queried) {
     const row = launcherRowOf(launcher);
     if (row === undefined)
         return i;
@@ -57,7 +57,11 @@ function pastLauncherOptions(launcher, folded, i, moved) {
             return i;
         if (launcherOptionMovesBase(row, tok))
             moved?.();
+        if (launcherOptionQueries(row, tok))
+            queried?.();
         i += step;
+        if (tok === "--")
+            return i;
     }
 }
 export const PROGRAM_POSITION_REFUSAL_KINDS = Object.freeze(["option_at_program_position", "control_syntax_at_program_position"]);
@@ -103,12 +107,17 @@ export function readProgramPosition(words) {
     let reentryDefault = argvFromStdin ? streamDefaultProgram(basename) : undefined;
     let launcherMovesBase = false;
     const moved = () => { launcherMovesBase = true; };
+    let looksUp = false;
+    const queried = () => { looksUp = true; };
     const chain = (program, refusal) => {
         const runsDefaultProgram = lastReentry === folded.length - 1;
         return { controlWords, written, assignments, launchers, argvFromStdin, runsDefaultProgram, ...(runsDefaultProgram && reentryDefault !== undefined ? { defaultProgram: reentryDefault } : {}), program, refusal, launcherMovesBase };
     };
     const selectsShell = (l, end) => selectedOptions(launcherRowOf(l.name), folded.slice(l.index + 1, end)).some((o) => o.mode === "interactive");
-    for (let j = pastLauncherOptions(basename, folded, i + 1, moved); j < folded.length; j++) {
+    const first = pastLauncherOptions(basename, folded, i + 1, moved, queried);
+    if (looksUp)
+        return chain(undefined);
+    for (let j = first; j < folded.length; j++) {
         const t = folded[j];
         if (owedOperands > 0 && !t.startsWith("-")) {
             owedOperands -= 1;
@@ -133,7 +142,9 @@ export function readProgramPosition(words) {
             if (launcherRunsShell(launcherRowOf(wordBasename), folded.slice(j + 1)))
                 return chain(undefined, shellRefusal(j, j + 1));
             owedOperands = lastRow?.requiredOperands ?? 0;
-            j = pastLauncherOptions(wordBasename, folded, j + 1, moved) - 1;
+            j = pastLauncherOptions(wordBasename, folded, j + 1, moved, queried) - 1;
+            if (looksUp)
+                return chain(undefined);
             continue;
         }
         if (t.startsWith("-"))

package/dist/tools/fs/program-read-model.d.ts

@@ -29,7 +29,7 @@ export declare const PATH_VALUE_FORMS: readonly ["indirect", "form", "header", "
 export type PathValueForm = (typeof PATH_VALUE_FORMS)[number];
 /** What selecting an option does to how the program runs ({@link OptionSpec.mode}) — a CLOSED set (`docs/CLOSED-SETS.md`,
  *  `OptionMode`). */
-export declare const OPTION_MODES: readonly ["banner", "interactive", "names-program", "follows", "repeats", "quiet", "forced"];
+export declare const OPTION_MODES: readonly ["banner", "interactive", "names-program", "follows", "repeats", "quiet", "forced", "queries"];
 export type OptionMode = (typeof OPTION_MODES)[number];
 /**
  * What one word is in this program's hands — a CLOSED set (`docs/CLOSED-SETS.md`, `ArgRoleKind`), the eleven members the
@@ -188,7 +188,8 @@ export interface OptionSpec {
      *  the program to run without a value (`node --test`; a launcher's, from the caller's environment: `su -m`); `follows`:
      *  follows its files as they grow, until killed (`tail -f`); `repeats`: repeats on an interval until killed (`free -s`);
      *  `quiet`: prints only what the program's own text tells it to (`sed -n`); `forced`: removes without asking, and passes
-     *  over an operand that is not there (`rm -f`). */
+     *  over an operand that is not there (`rm -f`); `queries`: a LOOKUP — the operands are names it looks up and describes, and
+     *  it runs none of them (`command -v`). */
     readonly mode?: OptionMode;
     /** This switch turns the program's own value glob off (`curl -g`): every {@link ArgRole} `programGlob` value of the
      *  invocation is read literally. */
@@ -717,6 +718,10 @@ export declare function launcherOptionPathRole(row: ProgramRow, tok: string): Ex
  *  written (`nsenter -w` bare takes the target process's directory)? In a cluster, a letter up to the first that takes a
  *  value. `false` for any word the walk does not step. */
 export declare function launcherOptionMovesBase(row: ProgramRow, tok: string): boolean;
+/** Does this launcher option word select a LOOKUP ({@link OptionSpec.mode} `queries`: `command -v`, `-V`, a cluster
+ *  carrying one — `-pv`), so that the words after the options are names and no program is run? In a cluster, a letter up
+ *  to the first that takes a value. `false` for any word the walk does not step. */
+export declare function launcherOptionQueries(row: ProgramRow, tok: string): boolean;
 /** How many words one launcher option occupies ({@link readLauncherOption}), or `undefined` where the row does not
  *  explain it. */
 export declare function launcherOptionStep(row: ProgramRow, tok: string): 1 | 2 | undefined;

package/dist/tools/fs/program-read-model.js

@@ -2,7 +2,7 @@ import { literalTildeSpelling } from "../../shell/lex.js";
 import { PROGRAM_ROWS } from "./program-read-model.rows.js";
 export const DATUM_FORMS = Object.freeze(["count", "pattern", "name-pattern", "label", "message", "delimiter"]);
 export const PATH_VALUE_FORMS = Object.freeze(["indirect", "form", "header", "url"]);
-export const OPTION_MODES = Object.freeze(["banner", "interactive", "names-program", "follows", "repeats", "quiet", "forced"]);
+export const OPTION_MODES = Object.freeze(["banner", "interactive", "names-program", "follows", "repeats", "quiet", "forced", "queries"]);
 export const ARG_ROLE_KINDS = Object.freeze(["path", "mount-source", "object-path", "program-text", "program-file", "shell-text", "command", "assignment", "binds-name", "entry-probe", "datum"]);
 export const PATH_EFFECTS = Object.freeze(["read", "names", "write", "create", "edit-in-place"]);
 export const WRITING_EFFECTS = new Set(["write", "create", "edit-in-place"]);
@@ -1091,6 +1091,26 @@ export function launcherOptionMovesBase(row, tok) {
     }
     return false;
 }
+export function launcherOptionQueries(row, tok) {
+    if (tok === "-" || tok === "--")
+        return false;
+    if (tok.startsWith("--")) {
+        const eq = tok.indexOf("=");
+        return steppableLauncherOption(row, eq > 2 ? tok.slice(0, eq) : tok)?.spec.mode === "queries";
+    }
+    if (!/^-[^-]/.test(tok))
+        return false;
+    for (let i = 1; i < tok.length; i++) {
+        const m = steppableLauncherOption(row, `-${tok[i]}`);
+        if (m === undefined)
+            return false;
+        if (m.spec.mode === "queries")
+            return true;
+        if (m.arity !== 0)
+            return false;
+    }
+    return false;
+}
 export function launcherOptionStep(row, tok) {
     return readLauncherOption(row, tok)?.step;
 }

package/dist/tools/fs/program-read-model.rows.js

@@ -31,6 +31,7 @@ const OBJECT_PATH = { kind: "object-path" };
 const text = (language) => ({ kind: "program-text", language });
 const file = (language) => ({ kind: "program-file", language });
 const SWITCH = { arity: 0 };
+const QUERY = { arity: 0, mode: "queries" };
 const val = (value, extra = {}) => ({ arity: 1, ...(value !== undefined ? { value } : {}), ...extra });
 const optional = (value) => ({ arity: "attached", ...(value !== undefined ? { value } : {}) });
 const switches = (letters, extra = {}) => Object.fromEntries([...letters].map((l) => [l, { arity: 0, ...extra }]));
@@ -380,10 +381,10 @@ const launchers = [
             values: { "-u": LABEL, "--unset": LABEL, "-C": WORKDIR, "--chdir": WORKDIR, "-a": LABEL, "--argv0": LABEL, "-P": PROGRAM_SEARCH },
             optional: { "--default-signal": LABEL, "--ignore-signal": LABEL },
             shellText: ["-S", "--split-string"],
-        }), { lacks: ["-P"] }, { lacks: ["-a", "--ignore-environment", "--debug", "--list-signal-handling", "--help", "--version", "--unset", "--chdir", "--argv0", "--default-signal", "--ignore-signal", "--split-string"] }), launcher: { assignmentOperands: true, bareDash: true }, witness: BINARY },
-    launcher("command", {}, grammar({ p: SWITCH })),
-    launcher("builtin"),
-    launcher("exec", {}, launcherGrammar({ switches: ["-c", "-l"], values: { "-a": LABEL } })),
+        }, { stepsDashDash: true }), { lacks: ["-P"] }, { lacks: ["-a", "--ignore-environment", "--debug", "--list-signal-handling", "--help", "--version", "--unset", "--chdir", "--argv0", "--default-signal", "--ignore-signal", "--split-string"] }), launcher: { assignmentOperands: true, bareDash: true }, witness: BINARY },
+    launcher("command", {}, grammar({ p: SWITCH, v: QUERY, V: QUERY }, {}, { stepsDashDash: true })),
+    launcher("builtin", {}, grammar({}, {}, { stepsDashDash: true })),
+    launcher("exec", {}, launcherGrammar({ switches: ["-c", "-l"], values: { "-a": LABEL } }, { stepsDashDash: true })),
     launcher("noglob", {}, undefined, { witness: { declared: "a zsh precommand modifier" } }),
     launcher("nocorrect", {}, undefined, { witness: { declared: "a zsh precommand modifier" } }),
     { key: "xargs", grammars: implementations(launcherGrammar({
@@ -406,8 +407,8 @@ const launchers = [
     { key: "runuser", grammars: [launcherGrammar({ ...SU_OPTIONS, values: { ...SU_OPTIONS.values, "-u": LABEL, "--user": LABEL } }, { afterFirstOperand: "options", stepsDashDash: true })], launcher: { shellText: "user", programWith: ["-u", "--user"], asUser: { home: "target", loginWith: ["-l", "--login"] } }, witness: PRIVILEGED },
     launcher("chroot", { requiredOperands: 1, whenNoProgram: "shell" }, undefined, { witness: PRIVILEGED }),
     launcher("setpriv", {}, undefined, { witness: PRIVILEGED }),
-    launcher("nohup", {}, grammar({}, BANNERS)),
-    { key: "nice", grammars: implementations(grammar({ n: val(COUNT) }, { adjustment: val(COUNT), ...BANNERS }), {}, { lacks: ["--adjustment", "--help", "--version"] }), launcher: { negativeIntegerIsOwnArgument: true }, witness: BINARY },
+    launcher("nohup", {}, grammar({}, BANNERS, { stepsDashDash: true })),
+    { key: "nice", grammars: implementations(grammar({ n: val(COUNT) }, { adjustment: val(COUNT), ...BANNERS }, { stepsDashDash: true }), {}, { lacks: ["--adjustment", "--help", "--version"] }), launcher: { negativeIntegerIsOwnArgument: true }, witness: BINARY },
     launcher("ionice", {}, launcherGrammar({
         switches: ["-t", "--ignore", "-h", "--help", "-V", "--version"],
         banners: ["-h", "-V"],
@@ -418,8 +419,8 @@ const launchers = [
         values: { "-p": COUNT, "--pid": COUNT, "-T": COUNT, "-P": COUNT, "-D": COUNT, "--sched-runtime": COUNT, "--sched-period": COUNT, "--sched-deadline": COUNT },
     }), { witness: LINUX_NAMESPACE }),
     launcher("taskset", { requiredOperands: 1, requiredOperandSpelling: /^(?:0x)?[\da-f]+$|^[\d,:-]+$/i }, launcherGrammar({ switches: ["-a", "-p", "-c", "--all-tasks", "--pid", "--cpu-list", "--help", "--version"] }), { witness: LINUX_NAMESPACE }),
-    { key: "stdbuf", grammars: implementations(grammar({ i: val(LABEL), o: val(LABEL), e: val(LABEL) }, { input: val(LABEL), output: val(LABEL), error: val(LABEL), ...BANNERS }), {}, { lacks: ["--input", "--output", "--error", "--help", "--version"] }), launcher: {}, witness: BINARY },
-    launcher("timeout", { requiredOperands: 1, requiredOperandSpelling: DURATION_SPELLING }, grammar({ v: SWITCH, k: val(COUNT), s: val(LABEL) }, { foreground: SWITCH, "preserve-status": SWITCH, verbose: SWITCH, "kill-after": val(COUNT), signal: val(LABEL), ...BANNERS })),
+    { key: "stdbuf", grammars: implementations(grammar({ i: val(LABEL), o: val(LABEL), e: val(LABEL) }, { input: val(LABEL), output: val(LABEL), error: val(LABEL), ...BANNERS }, { stepsDashDash: true }), {}, { lacks: ["--input", "--output", "--error", "--help", "--version"] }), launcher: {}, witness: BINARY },
+    launcher("timeout", { requiredOperands: 1, requiredOperandSpelling: DURATION_SPELLING }, grammar({ v: SWITCH, k: val(COUNT), s: val(LABEL) }, { foreground: SWITCH, "preserve-status": SWITCH, verbose: SWITCH, "kill-after": val(COUNT), signal: val(LABEL), ...BANNERS }, { stepsDashDash: true })),
     { key: "time", grammars: implementations(grammar({ p: SWITCH, a: SWITCH, v: SWITCH, q: SWITCH, f: val(LABEL), o: val(WRITE) }, { portability: SWITCH, append: SWITCH, verbose: SWITCH, quiet: SWITCH, help: SWITCH, version: SWITCH, format: val(LABEL), output: val(WRITE) }, { stepsDashDash: true }), {}, { lacks: ["-v", "-q", "-f", "--portability", "--append", "--verbose", "--quiet", "--help", "--version", "--format", "--output"] }), launcher: {}, witness: BINARY },
     { key: "watch", grammars: [
             launcherGrammar({
@@ -430,12 +431,12 @@ const launchers = [
             }, { afterFirstOperand: "operands", stepsDashDash: true }),
             launcherGrammar({ switches: ["-d", "-t"], values: { "-n": COUNT } }, { afterFirstOperand: "operands", stepsDashDash: true }),
         ], launcher: { shellText: "joined", programWith: ["-x", "--exec"] }, witness: SHELL_TEXT_LAUNCHER },
-    launcher("setsid", {}, launcherGrammar({ switches: ["-c", "-f", "-w", "--ctty", "--fork", "--wait", "--help", "--version"] })),
+    launcher("setsid", {}, launcherGrammar({ switches: ["-c", "-f", "-w", "--ctty", "--fork", "--wait", "--help", "--version"] }, { stepsDashDash: true })),
     launcher("flock", { requiredOperands: 1 }, launcherGrammar({
         switches: ["-s", "-x", "-u", "-n", "-o", "-F", "--shared", "--exclusive", "--unlock", "--nonblock", "--nb", "--close", "--no-fork", "--verbose", "--help", "--version"],
         values: { "-w": COUNT, "-E": COUNT, "--timeout": COUNT, "--wait": COUNT, "--conflict-exit-code": COUNT },
         shellText: ["-c", "--command"],
-    }), { operands: { rest: CREATED } }),
+    }, { stepsDashDash: true }), { operands: { rest: CREATED } }),
     launcher("unshare", { whenNoProgram: "shell" }, launcherGrammar({
         switches: ["-m", "-u", "-i", "-n", "-p", "-U", "-C", "-T", "-f", "-r", "-c", "--mount", "--uts", "--ipc", "--net", "--pid", "--user", "--cgroup", "--time", "--fork", "--map-root-user", "--map-current-user", "--kill-child", "--mount-proc", "--keep-caps", "--help", "--version"],
         values: { "-R": ROOTDIR, "-w": WORKDIR, "-S": LABEL, "-G": LABEL, "--setuid": LABEL, "--setgid": LABEL, "--root": ROOTDIR, "--wd": WORKDIR, "--propagation": LABEL, "--setgroups": LABEL, "--monotonic": COUNT, "--boottime": COUNT, "--map-user": LABEL, "--map-group": LABEL },

package/dist/tools/fs/shell-read-check.js

@@ -9,7 +9,7 @@ import { createShellReadEstablisher, establishShellReadsLexically } from "./shel
 import { declaredReadDenyHomes, homeViewsAt } from "./read-deny-home.js";
 import { programArgs } from "./shell-read-write-targets.js";
 import { programRow, selectedOptions } from "./program-read-model.js";
-import { allFindings, anyFaceGuards, decideShellRead, denyRowAtOrBelow, foldShellReadFindings, judgeEstablishedPlan, readRootGrantCandidateOf, stationGuards, writeFaceGuards, } from "./shell-read-judge.js";
+import { allFindings, anyFaceGuards, decideShellRead, decideShellReadForRedirects, denyRowAtOrBelow, foldShellReadFindings, judgeEstablishedPlan, readRootGrantCandidateOf, stationGuards, writeFaceGuards, } from "./shell-read-judge.js";
 import { seatOf } from "../../core/tool-name-readings.js";
 import { normalizeReadRootCandidate } from "../../core/read-root-candidate.js";
 import { argvOf, lexShellText } from "../../shell/lex.js";
@@ -241,6 +241,20 @@ function outsidePathsOf(judged) {
     }
     return out;
 }
+function outsideFindingsAreRedirections(judged) {
+    const walk = (plan) => plan.segments.every((s) => {
+        const redirected = new Set(s.segment.redirects.flatMap((r) => (r.direction === "out" && r.target !== undefined ? [r.target.raw] : [])));
+        const slotWrites = new Set(s.segment.reads.filter((c) => c.provenance === "write_redirect_target").map((c) => c.raw));
+        for (const f of s.findings) {
+            if (f.kind !== "outside_roots")
+                continue;
+            if (f.read.written === undefined || f.read.candidate.provenance !== "write_redirect_target" || !redirected.has(f.read.candidate.raw) || slotWrites.has(f.read.candidate.raw))
+                return false;
+        }
+        return s.nested.every(walk);
+    });
+    return walk(judged);
+}
 function refusalOf(tool, fold, boundary, paths) {
     const w = fold.witness;
     if (fold.finding === "deny_hit" && w?.deny !== undefined) {
@@ -261,7 +275,8 @@ const DENY_REFUSAL_NOTE = "The read boundary judges the paths this command names
     "a file the command reaches without naming it is judged only where a segment deny row (built in, or the deployment's " +
     "own pattern) reaches into the tree a recursive read walks.";
 function verdictOf(tool, seat, fold, judged, boundary) {
-    const disposition = decideShellRead(fold.finding, seat);
+    const redirectsOnly = fold.finding === "outside_roots" && fold.unestablished !== true && outsideFindingsAreRedirections(judged);
+    const disposition = decideShellReadForRedirects(fold.finding, seat, redirectsOnly);
     if (disposition === "vouch")
         return { disposition, finding: fold.finding };
     const paths = outsidePathsOf(judged);

package/dist/tools/fs/shell-read-judge.d.ts

@@ -110,6 +110,9 @@ export type DecisionTableCoversEverySeat = AssertAllKeysHandled<Exclude<ShellRea
  *  {@link SHELL_READ_SEATS} (an untyped caller, or one still passing a retired word) is refused loudly: an
  *  absent disposition would read as "no verdict", which no caller can act on safely. */
 export declare function decideShellRead(finding: ShellReadFinding, seat: ShellReadSeat): ShellReadDisposition;
+/** {@link decideShellRead} for a command whose containment findings are all output redirections (`redirectsOnly`) or not — the
+ *  cell {@link SHELL_REDIRECT_DECISION} states where it states one, else the table's. */
+export declare function decideShellReadForRedirects(finding: ShellReadFinding, seat: ShellReadSeat, redirectsOnly: boolean): ShellReadDisposition;
 /**
  * The boundary a shell read is judged against: the declared roots (canonical), the working directory and
  * home the plan's bases start from, the deny seat (the SAME `denyMatch` closure every read face mounts),

package/dist/tools/fs/shell-read-judge.js

@@ -28,6 +28,13 @@ export function decideShellRead(finding, seat) {
     }
     return disposition;
 }
+const SHELL_REDIRECT_DECISION = {
+    outside_roots: { full_shell: "ordinary" },
+};
+export function decideShellReadForRedirects(finding, seat, redirectsOnly) {
+    const cell = redirectsOnly && Object.hasOwn(SHELL_REDIRECT_DECISION, finding) ? SHELL_REDIRECT_DECISION[finding]?.[seat] : undefined;
+    return cell ?? decideShellRead(finding, seat);
+}
 export function judgeRead(read, boundary) {
     const writeTarget = read.candidate.face === "write";
     const deny = writeTarget ? boundary.writeDenyMatch : boundary.denyMatch;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.49.0",
+  "version": "7.49.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",