@sema-agent/core 7.49.0 → 7.49.2

package/dist/tools/fs/shell-read-establish.js

@@ -1,5 +1,6 @@
+import { canonicalRootsOnce, observeEnvironment } from "./shell-read-environment.js";
 import { anchorSpelling, normalizeAbsPathLexically, pathFamilyOf } from "./safety.js";
-import { boundaryIsTheSandbox, canonicalPathIsAuthoritative } from "../../core/remote-env.js";
+import { boundaryIsTheSandbox } from "../../core/remote-env.js";
 import { resolveOperandSpellings } from "./bash-readonly-classifier.js";
 import { judgedCandidatesOf, sedBackupNames } from "./shell-read-write-targets.js";
 import { movedReads, withHomeViews } from "./shell-read-identity.js";
@@ -196,33 +197,44 @@ export function establishShellReadsLexically(plan, boundary) {
 }
 export function createShellReadEstablisher(env, readRoots, opts) {
     const lexicalOnly = boundaryIsTheSandbox(env);
-    const resolverIsAuthoritative = canonicalPathIsAuthoritative(env);
+    const canonicalRoots = canonicalRootsOnce(env, readRoots, opts?.rootsCanonical === true);
+    const legOver = (seen) => establishLegOver(seen, readRoots);
+    return {
+        lexicalOnly,
+        establish: async (plan, boundary, signal, door = observeEnvironment(env)) => {
+            if (lexicalOnly)
+                return establishShellReadsLexically(plan, boundary);
+            const { roots, incomplete, answered } = await canonicalRoots(signal);
+            door.adopt(incomplete, answered);
+            return await withHomeViews(door, opts, await legOver(door)(plan, { ...boundary, roots }, roots, signal), signal);
+        },
+        reestablish: async (previous, boundary, signal) => {
+            if (lexicalOnly)
+                return { changed: [] };
+            const again = await legOver(observeEnvironment(env))(previous.plan, { ...boundary, roots: previous.roots }, previous.roots, signal);
+            return { changed: movedReads(previous, again) };
+        },
+    };
+}
+function establishLegOver(seen, readRoots) {
+    const env = seen.fs;
+    const resolverIsAuthoritative = seen.authoritative;
+    const bounded = (detail) => (seen.bound(detail), { unverifiable: detail });
     const family = pathFamilyOf({ root: readRoots[0] ?? "/" });
     const SEP = family === "posix" ? /\// : /[\\/]/;
     const TRAILING_SEP = family === "posix" ? /\/+$/ : /[\\/]+$/;
     const joinUnder = (dir, name) => `${dir.replace(TRAILING_SEP, "")}/${name}`;
-    let rootsOnce = opts?.rootsCanonical === true ? Promise.resolve(readRoots) : undefined;
-    const canonicalRoots = async (signal) => {
-        rootsOnce ??= (async () => {
-            const out = [];
-            for (const r of readRoots) {
-                const c = await env.canonicalPath(r, signal);
-                out.push(c.ok ? c.value : r);
-            }
-            return out;
-        })();
-        return await rootsOnce;
-    };
     const resolveWithoutParentSteps = async (p, signal, writeTarget = false, linkHops = WRITE_LINK_HOPS) => {
         const parts = p.split(SEP);
         const tail = [];
         let allAbsent = true;
+        const began = seen.mark();
         while (parts.length > 0) {
             const at = parts.join("/") || "/";
             const canon = await env.canonicalPath(at, signal);
             if (!canon.ok && canon.error.code === "not_found" && writeTarget && allAbsent) {
                 const entry = await env.fileInfo(at, signal);
-                const link = entry.ok && entry.value.kind === "symlink" && linkHops > 0 ? await env.readLink?.(at, signal) : undefined;
+                const link = entry.ok && entry.value.kind === "symlink" ? (linkHops > 0 ? await env.readLink?.(at, signal) : void bounded(`"${at}" is a link chain of more than ${WRITE_LINK_HOPS} links, too many to follow to verify where it lands`)) : undefined;
                 if (link?.ok === true) {
                     const landing = anchorSpelling(family, parts.slice(0, -1).join("/") || "/", link.value);
                     return await resolve([landing, ...[...tail].reverse()].join("/"), signal, true, linkHops - 1);
@@ -239,7 +251,7 @@ export function createShellReadEstablisher(env, readRoots, opts) {
                 allAbsent = false;
             tail.push(parts.pop());
         }
-        return undefined;
+        return void seen.silence(began);
     };
     const parentOf = (canonical) => normalizeAbsPathLexically(`${canonical}/..`);
     const resolve = async (p, signal, writeTarget = false, linkHops = WRITE_LINK_HOPS) => {
@@ -318,7 +330,7 @@ export function createShellReadEstablisher(env, readRoots, opts) {
             const next = [];
             for (const dir of frontier) {
                 if (++dirsUsed > MAX_GLOB_DIRS)
-                    return { unverifiable: `"${p}" expands over more than ${MAX_GLOB_DIRS} directories, too many to enumerate to verify` };
+                    return bounded(`"${p}" expands over more than ${MAX_GLOB_DIRS} directories, too many to enumerate to verify`);
                 const canonDir = await resolve(dir, signal);
                 if (canonDir !== undefined && canonDir.missing === true)
                     continue;
@@ -340,7 +352,7 @@ export function createShellReadEstablisher(env, readRoots, opts) {
                     if (!globSegmentMatches(re, seg, entry.name))
                         continue;
                     if (++matches > MAX_GLOB_MATCHES)
-                        return { unverifiable: `"${p}" expands to more than ${MAX_GLOB_MATCHES} names, too many to enumerate to verify` };
+                        return bounded(`"${p}" expands to more than ${MAX_GLOB_MATCHES} names, too many to enumerate to verify`);
                     const candidate = joinUnder(dir, entry.name);
                     if (canonDirHere !== undefined && entry.kind !== "symlink")
                         canonicalOfMatch.set(candidate, joinUnder(canonDirHere, entry.name));
@@ -363,7 +375,7 @@ export function createShellReadEstablisher(env, readRoots, opts) {
         while (stack.length > 0) {
             const { dir, spell } = stack.pop();
             if (++dirsUsed > MAX_GLOB_DIRS)
-                return { unverifiable: `"${rootCanonical}" holds more than ${MAX_GLOB_DIRS} directories, too many to enumerate to verify what a recursive read would open` };
+                return bounded(`"${rootCanonical}" holds more than ${MAX_GLOB_DIRS} directories, too many to enumerate to verify what a recursive read would open`);
             const listed = await env.listDir(dir, signal);
             if (!listed.ok) {
                 if (dir === rootCanonical && listed.error.code === "not_directory")
@@ -377,7 +389,7 @@ export function createShellReadEstablisher(env, readRoots, opts) {
                 root = "directory";
             for (const entry of listed.value) {
                 if (found.length >= MAX_GLOB_MATCHES)
-                    return { unverifiable: `"${rootCanonical}" holds more than ${MAX_GLOB_MATCHES} entries, too many to enumerate to verify what a recursive read would open` };
+                    return bounded(`"${rootCanonical}" holds more than ${MAX_GLOB_MATCHES} entries, too many to enumerate to verify what a recursive read would open`);
                 const path = joinUnder(spell, entry.name);
                 const canonicalPath = joinUnder(dir, entry.name);
                 if (entry.kind === "symlink") {
@@ -453,7 +465,7 @@ export function createShellReadEstablisher(env, readRoots, opts) {
             const dir = name.slice(0, name.search(/[^/]*$/));
             name = dir === "" ? link.value : anchorSpelling(family, dir, link.value);
         }
-        return undefined;
+        return void bounded(`"${spelled}" is a link chain of more than ${WRITE_LINK_HOPS} links, too many to follow to verify where its backup is written`);
     };
     const followedBackupReads = async (j, boundary, signal) => {
         const { operand, suffix } = j.followed;
@@ -601,19 +613,5 @@ export function createShellReadEstablisher(env, readRoots, opts) {
         }
         return { plan, reads, nested, roots };
     };
-    return {
-        lexicalOnly,
-        establish: async (plan, boundary, signal) => {
-            if (lexicalOnly)
-                return establishShellReadsLexically(plan, boundary);
-            const roots = await canonicalRoots(signal);
-            return await withHomeViews(env, opts, await establishPlan(plan, { ...boundary, roots }, roots, signal), signal);
-        },
-        reestablish: async (previous, boundary, signal) => {
-            if (lexicalOnly)
-                return { changed: [] };
-            const again = await establishPlan(previous.plan, { ...boundary, roots: previous.roots }, previous.roots, signal);
-            return { changed: movedReads(previous, again) };
-        },
-    };
+    return establishPlan;
 }

package/dist/tools/fs/shell-read-identity.d.ts

@@ -8,8 +8,9 @@
  * matched, or onto a home shadow's target, left the pool unchanged and the call was admitted unjudged.
  */
 import type { EstablishedPlan } from "./shell-read-establish.js";
+import type { ObservedEnvironment } from "./shell-read-environment.js";
 import type { EstablishedRead } from "./shell-read-judge.js";
-import { type HomeViewEnv, type HomeViewsCarrier } from "./read-deny-home.js";
+import { type HomeViewsCarrier } from "./read-deny-home.js";
 /** Every read of either establishment whose candidate's settled target set differs between the two. */
 export declare function movedReads(previous: EstablishedPlan, again: EstablishedPlan): EstablishedRead[];
 /**
@@ -18,4 +19,4 @@ export declare function movedReads(previous: EstablishedPlan, again: Established
  * spelled through. The views are `placed`'s — the home views of the placement the boundary's deny seats were compiled
  * at. A read that did not land (lexical, unestablishable) is left as it is.
  */
-export declare function withHomeViews(env: HomeViewEnv, placed: HomeViewsCarrier | undefined, established: EstablishedPlan, signal?: AbortSignal): Promise<EstablishedPlan>;
+export declare function withHomeViews(door: Pick<ObservedEnvironment, "fs" | "adopt">, placed: HomeViewsCarrier | undefined, established: EstablishedPlan, signal?: AbortSignal): Promise<EstablishedPlan>;

package/dist/tools/fs/shell-read-identity.js

@@ -38,8 +38,8 @@ function targetsByCandidate(e) {
 function sameTargets(a, b) {
     return a.size === b.size && [...a].every((t) => b.has(t));
 }
-export async function withHomeViews(env, placed, established, signal) {
-    const views = homeViewsOf(env, placed, signal);
+export async function withHomeViews(door, placed, established, signal) {
+    const views = homeViewsOf(door.fs, placed, signal);
     const place = async (p) => {
         const reads = new Map();
         for (const [segment, rs] of p.reads) {
@@ -56,5 +56,7 @@ export async function withHomeViews(env, placed, established, signal) {
             nested.set(n, await place(np));
         return { ...p, reads, nested };
     };
-    return await place(established);
+    const withViews = await place(established);
+    door.adopt(views.unread.map((p) => ({ op: "fileIdentity", detail: `"${p}" cannot be identified against the home directories` })));
+    return withViews;
 }

package/dist/tools/fs/shell-read-judge.d.ts

@@ -11,7 +11,7 @@
  *    judge is `withinAnyRoot` over the roots the boundary declares — a WRITE target's over the write roots, at the
  *    seat it is written, under the write face in force ({@link judgeWrite}).
  *  · `foldShellReadFindings` folds a command's findings — every segment, every nested plan — to ONE word by
- *    the priority `identity_changed > deny_hit > outside_roots > unestablishable > declined > none`.
+ *    the priority `identity_changed > deny_hit > unanswered > outside_roots > unestablishable > declined > none`.
  *  · `SHELL_READ_DECISION` is the total table (finding × seat → disposition) that is the ONLY source of
  *    "refuse / mandated ask / ordinary ask / vouch" for a shell read. A seat is a FACE word, not a tool name
  *    and not a permission mode: which shell face the call runs on (the full shell, the read-only shell) or
@@ -22,11 +22,12 @@
  */
 import type { BashReadonlyRootBoundary } from "./bash-readonly-classifier.js";
 import type { ReadCandidate, ShellReadPlan, ShellReadSegment } from "./shell-read-plan.js";
+import type { Incomplete, ObservedFilesystem } from "./shell-read-environment.js";
 import type { WriteSeat } from "./shell-read-write-targets.js";
 import { type ContainmentFace } from "./containment-face.js";
 import type { AssertAllKeysHandled } from "../../core/ask-origin.js";
 /** WHAT the judge found about a command — a closed set, registered in `docs/CLOSED-SETS.md`. */
-export declare const SHELL_READ_FINDINGS: readonly ["deny_hit", "outside_roots", "unestablishable", "declined", "identity_changed", "none"];
+export declare const SHELL_READ_FINDINGS: readonly ["deny_hit", "outside_roots", "unestablishable", "declined", "identity_changed", "unanswered", "none"];
 export type ShellReadFinding = (typeof SHELL_READ_FINDINGS)[number];
 /** WHERE a read is judged — the seats the decision table is keyed on, one per FACE: `full_shell` the
  *  writable shell (`Bash`, `Monitor`) under every permission mode and every shell-gate floor; `readonly`
@@ -38,9 +39,10 @@ export type ShellReadSeat = (typeof SHELL_READ_SEATS)[number];
 export declare const SHELL_READ_FINDING_RANK: {
     readonly identity_changed: 6;
     readonly deny_hit: 5;
-    readonly outside_roots: 4;
-    readonly unestablishable: 3;
-    readonly declined: 2;
+    readonly unanswered: 4;
+    readonly outside_roots: 3;
+    readonly unestablishable: 2;
+    readonly declined: 1;
     readonly none: 0;
 };
 /** Compile-time fence: `never` while every finding has a rank. */
@@ -50,6 +52,14 @@ export type RankTableCoversEveryFinding = AssertAllKeysHandled<Exclude<ShellRead
  *  the auto-mode classifier, a stored allow rule) but no answerless engine table may; `vouch` = the station
  *  has no question. */
 export type ShellReadDisposition = "refuse" | "mandated" | "ordinary" | "vouch";
+/** One cell of the decision table: a disposition, or — where the READ FACE the question was raised under decides it — the two
+ *  readings, `narrowed` (the `roots` face: the fence the deployment narrowed, and the engine default) and `open`. */
+export type ShellReadCell = ShellReadDisposition | {
+    readonly narrowed: ShellReadDisposition;
+    readonly open: ShellReadDisposition;
+};
+/** A cell, read for a question raised under a narrowed read face (`true`) or an open one (`false`). */
+export declare function dispositionOfCell(cell: ShellReadCell, narrowedReadFace: boolean): ShellReadDisposition;
 /**
  * THE decision table — total over findings × seats; no cell is n/a. Row by row:
  *  · `deny_hit` — refused on every seat, for a spelling the station can establish: a deny row is a floor
@@ -58,8 +68,14 @@ export type ShellReadDisposition = "refuse" | "mandated" | "ordinary" | "vouch";
  *  · `outside_roots` — asked where a person can be asked (the full shell), refused where none can (the
  *    read-only face has no approval channel; a rewrite that leaves the roots after approval was seen by
  *    nobody).
- *  · `unestablishable` — the same shape: the floor could not say where the command reads, so it is not
- *    vouched anywhere; a person may still answer it on the full shell.
+ *  · `unestablishable` — the floor could not say where the command reads, so it is not vouched anywhere: asked
+ *    where a person can be asked (the full shell), refused where none can be asked. The full shell's cell is read by the read face
+ *    the question was raised under: on a NARROWED (`roots`) face — the engine default — the deployment asked to be asked, so the
+ *    ask is MANDATED and no automatic lane answers; on the OPEN face (where the station asks only because a deny list has
+ *    rows), and for a written target alone (a narrowed WRITE face fences what is written; it is no request to be asked about
+ *    every word the floor cannot place), it is the ORDINARY ask — the reference implementation's plain permission ask (CC
+ *    2.1.296 `sR`, cli296.js @13116941, reason `other`), which a whole-tool allow (`$pn` @18717070), bypass (`$pn` @18716980)
+ *    and the auto-mode classifier release and a prefix allow does not.
  *  · `declined` — the one deliberate fail-open of this table: the scan could not read the program bash
  *    will run, or the operands arrive on a stream. On the full shell it is an ORDINARY ask — an answerer
  *    may settle it, and an out-of-root read hidden inside such a command is then not asked again. The
@@ -67,6 +83,15 @@ export type ShellReadDisposition = "refuse" | "mandated" | "ordinary" | "vouch";
  *    n/a.
  *  · `identity_changed` — a candidate established at approval time resolves elsewhere at spawn time:
  *    refused everywhere (it is only ever produced on the `rejudge` seat).
+ *  · `unanswered` — the judge did not FINISH: it threw or timed out, the lookup it stands on was absent, or — recorded at the
+ *    one door to the environment ({@link import("./shell-read-environment.js").Incomplete}) — an environment lookup gave no
+ *    answer (an error that is no conclusive "not there"), the station stopped at its own bound (more directories or names than
+ *    it enumerates, a link chain past its hop bound), or a home view could not be read. Any one makes the whole command
+ *    `unanswered`, whatever the other words found. Not a fact about the command but the state of the station, so it is not
+ *    the `unestablishable` row's question (a text the station cannot place — a word the shell rewrites, a lost working
+ *    directory, a pattern its matcher does not model). Absence is not
+ *    "nothing there": the full shell asks it MANDATED on every read face — a standing allow was given on the premise that the
+ *    judge works, and a broken judge is not cleared by it — and the read-only face refuses.
  *  · `none` — vouched: the station has no question (the full shell's shape tier may still ask).
  */
 export declare const SHELL_READ_DECISION: {
@@ -81,7 +106,10 @@ export declare const SHELL_READ_DECISION: {
         readonly rejudge: "refuse";
     };
     readonly unestablishable: {
-        readonly full_shell: "mandated";
+        readonly full_shell: {
+            readonly narrowed: "mandated";
+            readonly open: "ordinary";
+        };
         readonly readonly: "refuse";
         readonly rejudge: "refuse";
     };
@@ -95,6 +123,11 @@ export declare const SHELL_READ_DECISION: {
         readonly readonly: "refuse";
         readonly rejudge: "refuse";
     };
+    readonly unanswered: {
+        readonly full_shell: "mandated";
+        readonly readonly: "refuse";
+        readonly rejudge: "refuse";
+    };
     readonly none: {
         readonly full_shell: "vouch";
         readonly readonly: "vouch";
@@ -109,7 +142,15 @@ export type DecisionTableCoversEverySeat = AssertAllKeysHandled<Exclude<ShellRea
 /** The disposition of one command-level finding on one seat — the table, read. A seat word outside
  *  {@link SHELL_READ_SEATS} (an untyped caller, or one still passing a retired word) is refused loudly: an
  *  absent disposition would read as "no verdict", which no caller can act on safely. */
-export declare function decideShellRead(finding: ShellReadFinding, seat: ShellReadSeat): ShellReadDisposition;
+export declare function decideShellRead(finding: ShellReadFinding, seat: ShellReadSeat, context?: ShellReadCellContext): ShellReadDisposition;
+/** What the table is read for beyond (finding, seat): the two facts of a judged command a cell can depend on. */
+export interface ShellReadCellContext {
+    /** Every containment finding is an output redirection outside the write roots ({@link SHELL_REDIRECT_DECISION}). Absent ⇒ no. */
+    readonly redirectsOnly?: boolean;
+    /** The question was raised under a NARROWED (`roots`) read face — a read candidate or the text's own structure while the read
+     *  face runs the roots containment; `false` for the open face and for a written target alone. Absent ⇒ narrowed, the engine default. */
+    readonly narrowedReadFace?: boolean;
+}
 /**
  * The boundary a shell read is judged against: the declared roots (canonical), the working directory and
  * home the plan's bases start from, the deny seat (the SAME `denyMatch` closure every read face mounts),
@@ -140,8 +181,11 @@ export interface ShellReadBoundary extends BashReadonlyRootBoundary {
      *  the path is a key the station established (judged as a key, never as a spelling). `"protected"`: the table covers it —
      *  the target is not placed and the verdict says so ({@link import("./shell-read-check.js").ShellReadVerdict.writeProtected});
      *  `"guarded"`: a deployment row covers it — the target is not placed; `undefined`: nothing covers it. Read by the
-     *  station's write facts only. A judgment that throws fails the station's answer (the caller's fail-closed arm). */
-    readonly writeTargetJudge?: (target: string, opts?: {
+     *  station's write facts only. A judgment that throws fails the station's answer (the caller's fail-closed arm). Every lookup
+     *  it makes goes through `fs` — the command's door — and through no environment of its own: the station's one decision about
+     *  what a silence means reads the answers the judgment got as well as the ones it did not. */
+    readonly writeTargetJudge?: (target: string, opts: {
+        readonly fs: ObservedFilesystem;
         readonly signal?: AbortSignal;
         readonly canonical?: true;
     }) => Promise<"protected" | "guarded" | undefined>;
@@ -174,7 +218,8 @@ export interface EstablishedRead {
     /** The candidate's spelling WAS placed and the environment could not resolve where it leads (the whole chain unanswered by
      *  a resolver that declares itself authoritative, or a component it could not follow) — the reading's
      *  `target_unresolved` fact, as opposed to a text the station cannot read (a rewritten word, an unsettled working
-     *  directory). Present only on an `unestablishable` read. */
+     *  directory). Present only on an `unestablishable` read. (That the environment gave no answer is the establishment's
+     *  `incomplete`, which makes the command `unanswered` whether or not a candidate carries this mark.) */
     readonly unresolved?: true;
     /** WHERE the command's program writes this target — present only on a write target the program itself writes, at the
      *  seat this read was established at (`landing`: through the path's links; `entry`: the directory entry, a link there
@@ -186,7 +231,8 @@ export interface EstablishedRead {
     };
 }
 /** What the judge found about ONE candidate. `kind` is one of the four candidate-level findings
- *  (`declined` is a segment fact, `identity_changed` a re-establishment fact — neither is a candidate's). */
+ *  (`declined` is a segment fact, `identity_changed` a re-establishment fact, `unanswered` a fact of the whole establishment —
+ *  none is a candidate's). */
 export interface ReadFinding {
     readonly read: EstablishedRead;
     readonly kind: Extract<ShellReadFinding, "deny_hit" | "outside_roots" | "unestablishable" | "none">;
@@ -252,6 +298,8 @@ export interface JudgedPlan {
     readonly guards: boolean;
     /** {@link writeFaceGuards} of the same boundary — what a WRITE target's finding folds by. */
     readonly writeGuards: boolean;
+    /** What the command could not finish (the station's one door, decided after the write guards asked); on the top plan only. */
+    readonly incomplete?: readonly Incomplete[];
 }
 /**
  * Does the station GUARD anything for this boundary — a closed face (roots: containment is what it guards; an absent
@@ -278,12 +326,18 @@ export interface ShellReadFold {
     readonly finding: ShellReadFinding;
     readonly witness?: ReadFinding;
     readonly declined?: ShellReadSegment;
-    /** Some read of the text could not be established (an `unestablishable` or `declined` finding anywhere, winning or not). */
+    /** What the judge did not finish, for an `unanswered` finding: the first thing the establishment recorded ({@link Incomplete.detail}). */
+    readonly cause?: string;
+    /** Some read of the text could not be established (an `unestablishable`, `unanswered` or `declined` finding anywhere, winning or not). */
     readonly unestablished?: true;
+    /** Some `unestablishable` finding anywhere is about the READ face — a read candidate, or the text's own structure (a rewritten
+     *  word, a re-entered shell text) — rather than a written target alone. The cell of the row reads it with the read face in force
+     *  ({@link decideShellRead}). */
+    readonly unplacedRead?: true;
 }
 /**
  * Fold a judged plan to ONE finding by {@link SHELL_READ_FINDING_RANK}, over every segment and every nested
- * plan. Where the station guards nothing an `unestablishable` or `declined` finding is no finding: there is nothing to
+ * plan. Where the station guards nothing an `unestablishable`, `unanswered` or `declined` finding is no finding: there is nothing to
  * confirm it against. Which guard is asked is the face the finding is about — a read candidate's by the read face's
  * ({@link JudgedPlan.guards}), a write target's by the write face's ({@link JudgedPlan.writeGuards}), and a finding about
  * the text's own structure (no candidate stands in for it) by either ({@link anyFaceGuards}). Two structural rules ride the fold:

package/dist/tools/fs/shell-read-judge.js

@@ -2,32 +2,43 @@ import { hasWin32AliasedComponent, normalizeAbsPathLexically, withinAnyRoot } fr
 import { globInWord } from "./bash-readonly-classifier.js";
 import { readOfText } from "./shell-read-word.js";
 import { skipsRootsContainment } from "./containment-face.js";
-export const SHELL_READ_FINDINGS = Object.freeze(["deny_hit", "outside_roots", "unestablishable", "declined", "identity_changed", "none"]);
+export const SHELL_READ_FINDINGS = Object.freeze(["deny_hit", "outside_roots", "unestablishable", "declined", "identity_changed", "unanswered", "none"]);
 export const SHELL_READ_SEATS = Object.freeze(["full_shell", "readonly", "rejudge"]);
 export const SHELL_READ_FINDING_RANK = {
     identity_changed: 6,
     deny_hit: 5,
-    outside_roots: 4,
-    unestablishable: 3,
-    declined: 2,
+    unanswered: 4,
+    outside_roots: 3,
+    unestablishable: 2,
+    declined: 1,
     none: 0,
 };
+export function dispositionOfCell(cell, narrowedReadFace) {
+    return typeof cell === "string" ? cell : narrowedReadFace ? cell.narrowed : cell.open;
+}
 export const SHELL_READ_DECISION = {
     deny_hit: { full_shell: "refuse", readonly: "refuse", rejudge: "refuse" },
     outside_roots: { full_shell: "mandated", readonly: "refuse", rejudge: "refuse" },
-    unestablishable: { full_shell: "mandated", readonly: "refuse", rejudge: "refuse" },
+    unestablishable: { full_shell: { narrowed: "mandated", open: "ordinary" }, readonly: "refuse", rejudge: "refuse" },
     declined: { full_shell: "ordinary", readonly: "refuse", rejudge: "refuse" },
     identity_changed: { full_shell: "refuse", readonly: "refuse", rejudge: "refuse" },
+    unanswered: { full_shell: "mandated", readonly: "refuse", rejudge: "refuse" },
     none: { full_shell: "vouch", readonly: "vouch", rejudge: "vouch" },
 };
-export function decideShellRead(finding, seat) {
+export function decideShellRead(finding, seat, context = {}) {
+    const redirectCell = context.redirectsOnly === true && Object.hasOwn(SHELL_REDIRECT_DECISION, finding) ? SHELL_REDIRECT_DECISION[finding]?.[seat] : undefined;
+    if (redirectCell !== undefined)
+        return redirectCell;
     const row = Object.hasOwn(SHELL_READ_DECISION, finding) ? SHELL_READ_DECISION[finding] : undefined;
-    const disposition = row !== undefined && Object.hasOwn(row, seat) ? row[seat] : undefined;
-    if (disposition === undefined) {
+    const cell = row !== undefined && Object.hasOwn(row, seat) ? row[seat] : undefined;
+    if (cell === undefined) {
         throw new Error(`shell read decision: no cell for finding ${JSON.stringify(finding)} on seat ${JSON.stringify(seat)} — the seats are ${SHELL_READ_SEATS.map((w) => JSON.stringify(w)).join(", ")} (a seat names the face the command runs on)`);
     }
-    return disposition;
+    return dispositionOfCell(cell, context.narrowedReadFace !== false);
 }
+const SHELL_REDIRECT_DECISION = {
+    outside_roots: { full_shell: "ordinary" },
+};
 export function judgeRead(read, boundary) {
     const writeTarget = read.candidate.face === "write";
     const deny = writeTarget ? boundary.writeDenyMatch : boundary.denyMatch;
@@ -103,12 +114,15 @@ export function anyFaceGuards(boundary) {
 export function foldShellReadFindings(judged) {
     let best = { finding: "none" };
     let unestablished = false;
+    let unplacedRead = false;
     const raise = (next) => {
         if (next.finding === "unestablishable" || next.finding === "declined") {
             const face = next.witness?.read.candidate.face;
             if (!(next.witness === undefined ? judged.guards || judged.writeGuards : face === "write" ? judged.writeGuards : judged.guards))
                 return;
             unestablished = true;
+            if (next.finding === "unestablishable" && face !== "write")
+                unplacedRead = true;
         }
         const rank = SHELL_READ_FINDING_RANK[next.finding] - SHELL_READ_FINDING_RANK[best.finding];
         if (rank > 0 || (rank === 0 && next.witness?.read.candidate.face === "write" && best.witness?.read.candidate.face !== "write"))
@@ -141,7 +155,12 @@ export function foldShellReadFindings(judged) {
         }
     };
     walk(judged, false);
-    return unestablished ? { ...best, unestablished: true } : best;
+    const unfinished = judged.incomplete?.[0];
+    if (unfinished !== undefined && (judged.guards || judged.writeGuards) && SHELL_READ_FINDING_RANK.unanswered > SHELL_READ_FINDING_RANK[best.finding]) {
+        unestablished = true;
+        best = { finding: "unanswered", cause: unfinished.detail, ...(best.finding === "unestablishable" ? { ...(best.witness !== undefined ? { witness: best.witness } : {}), ...(best.declined !== undefined ? { declined: best.declined } : {}) } : {}) };
+    }
+    return { ...best, ...(unestablished ? { unestablished: true } : {}), ...(unplacedRead ? { unplacedRead: true } : {}) };
 }
 export function judgeEstablishedPlan(plan, established, boundary, nestedOf) {
     return {
@@ -237,5 +256,6 @@ export function rejudge(judged, boundary) {
         })),
         guards: stationGuards(boundary),
         writeGuards: writeFaceGuards(boundary),
+        ...(judged.incomplete !== undefined ? { incomplete: judged.incomplete } : {}),
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.49.0",
+  "version": "7.49.2",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.49.1.json

@@ -0,0 +1,57 @@
+{
+  "repo": "core",
+  "version": "7.49.1",
+  "from": "a58f6fef9c81bf031cc3dc1a12a8c5bc72d35193",
+  "to": "57363d52a115a659d902a81e8aad865ed98e2419",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [
+    {
+      "set": "OPTION_MODES",
+      "at": [
+        "src/tools/fs/program-read-model.ts:38"
+      ],
+      "newSet": false,
+      "added": [
+        "queries"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "set": "ToolTurnOutcome",
+      "at": [
+        "src/core/runner/tool-turn-repair-seat.ts:50"
+      ],
+      "newSet": true,
+      "added": [
+        "reissued",
+        "terminal"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 223,
+  "signatures": [],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [],
+  "consumersHint": {
+    "cli": [
+      "OPTION_MODES"
+    ],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@82bb8c2d server@a51468d9 sdk@006ce24 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}