@sema-agent/core 7.49.1 → 7.49.2

package/CHANGELOG.md

@@ -1,3 +1,49 @@
+## 7.49.2 — 2026-10-13
+
+**Hard-breaking changes (#1674):** one, open to veto — #1674 (see its entry). **Closed sets:** none. **Package exports:** +0 / −0 names, no member changes (the exported data `describeToolCatalog()` / `TOOL_CONFORMANCE_VECTORS` change values, below). **Behavior:** #1674 mounts `LSP` only on a leg that has an execution env, and seeds the pre-mount effect table for a caller's own tool that shares a hand-band name with the more conservative of its declared effect and the hand's. **Known limits added** (`docs/KNOWN-LIMITS.md`): KL-1674-a.
+
+### A leg without hands has no LSP tool (#1674; fix; security; hard-breaking: one, open to veto) (@server @cli @client-core @test)
+
+**Security face first — a leg with no execution env no longer mounts `LSP`.** Before, a runner built without an execution env that still carried `lspManager` mounted the tool over the engine's stub environment, whose `fileInfo` answers `not_supported` (`src/core/stub-env.ts:62`) — a precheck outcome the tool lets through (`src/core/lsp.ts:488-491` blocks only not-found / invalid / directory) — and then asked the manager for a session (`lsp.ts:506`); the in-process manager's default reader opens the path on the host's own disk (`src/engine/lsp/node-lsp-manager.ts:520`). So the one leg with no read face at all had an LSP reader outside every fence. @server: the hands-less runner is built with `withoutExecutionEnv` (`src/boot/stage-06-runners.ts:303`) and the hands lane drops only `executionEnvFactory` (`src/capabilities/hands-lane.ts:29`) — both coordinates as reported to this repository, not re-read here (inferred); a deployment-side drop of `lspManager` on that runner is the matching shape on your side.
+
+- **Before (v7.49.1).** The catalog row said `mountedBy: ["optional"]` and the mount read `if (lspManager)`: a manager on the task seat or the deployment seat mounted the tool on every leg, hands or not (measured on a hands-less leg that also carried a caller's own tool named `LSP`: the model was offered the name twice).
+- **Now.** One rule: LSP mounts where the hands are AND a manager seat resolved (`spec.lspManager ?? deps.lspManager`). The catalog row says `mountedBy: ["hands"]` and the mount site carries the same tag. A hands-less leg with a manager wired has no engine-mounted `LSP` in its roster (a caller's own tool of that name still mounts), calls it as an unknown tool when none is mounted (`Tool LSP not found.` with the live roster, `details.code` `tool.not_found`, `absence` `unknown`), never reaches the manager, and its wiring manifest still discloses the seat: `lsp: { mounted: false }`. The diagnostics lane already required hands and is unchanged. Exported data: `describeToolCatalog()`'s LSP row `mountedBy` `["optional"]` → `["hands"]`; `TOOL_CONFORMANCE_VECTORS`: `hands-full` and `hands-readonly` gain the absent row `{ LSP, "needs a wired LSP manager" }` and `plan-mode` drops it — every vector's `expected` set is unchanged; `predictMountedToolNames` of a hands-only set now names `LSP`, and `handBandEffects()` / `HANDS_BAND_TAGS` consumers see one more hand-band name (`LSP`, effect `read`). The JSDoc of `RunnerDeps.lspManager` / `TaskSpec.lspManager` and the SDK page say "legs with hands". The hand band's effect table is filled by name up front on every leg with an execution env; with `LSP` in the band, a caller's own tool of that name on a leg with no manager wired would have read `read` there whatever it declared — a declared-`write` one would pass `allowDirs` confinement, which it was refused by before. So a caller tool's own name now claims the entry the way an alias already did: the table is seeded with the less repeat-safe of its declared effect (a write when it declares none) and the hand's, for every hand-band name, not only `LSP`, and read off the instance the roster keeps when several caller tools share a name (the later one — one selection, `survivorsByName`, used by the roster, by this table and by the post-assembly sync; an earlier same-named tool's declaration leaves no entry, none declared on the kept one ⇒ write). A caller tool is written into the table by that scan alone: the roster's scenario mount no longer writes it (it used to write an absent name from whichever same-named tool arrived first, over a kept tool that declared nothing — for any tool name, not only the hand band's), and the post-assembly sync fills only from each name's kept instance. The alias mirror (effect, tier, probe, egress mark onto each alias) walks the same kept instances in the roster's order too: a dropped duplicate's alias used to be registered with the dropped instance's effect (`Scratch(read, alias a)` then `Scratch(write, alias a)`: the kept write instance runs a call by `a`, the table said `read`, and a wake-time reconcile called an interrupted such call a safe retry). The seed is what the pre-mount readers see (the wake-time reconcile, the confinement policy) until a mount sets the entry, and an engine tool that does mount (`LSP` with a manager wired) replaces it with its own effect. The table keyed by the mounted tool instead of the name is the planned root fix (#1680, 7.50.0).
+- **Hard-breaking (open to veto).** (1) **What changed:** a leg without an execution env and with a manager wired no longer has the `LSP` tool (it used to). (2) **Who is hurt:** a deployment whose hands-less scenarios relied on `LSP` — server `hands: none` runs with LSP enabled lose the tool (user-visible: the model is no longer offered code-intelligence lookups there); a host that derives its hand band from the catalog (`HANDS_BAND_TAGS`, `handBandEffects`) or checks its factory against `TOOL_CONFORMANCE_VECTORS` sees the row move as above (server's memory-notice filter keys on effect ≠ read — inferred unaffected); a probe that pinned `lsp.mounted: true` on a runner with no execution env. (3) **How to migrate:** give the scenario that needs LSP an execution env (hands); a library host that really wants LSP without hands mounts `createLspTool` itself over a manager and an env it owns (that mount is the host's own: the engine fences nothing in it, KL-1674-a).
+- **Known limits.** The tool on a leg WITH hands is unchanged: its `filePath` is still not a declared read target and its session reads through the manager's own reader (KL-1674-a); the read-face wiring is a later release's.
+- **Pins.** `test/backlog1674-lsp-needs-hands.test.ts` (① hands-less × deps seat / task seat: not in the roster, `{ mounted: false }`, no session lookup; ② the call is the unknown-tool miss in sentence and record, manager unreached; ③ hands × both seats: mounted, `{ mounted: true, lane: "tool" }`, a call reaches the manager once; ④ catalog and roster row carry `hands`; ⑤ plan-mode / bare mount none under a wired manager, hands-full / hands-readonly flip exactly `LSP`; ⑥ hands from an execution-env factory count, and a caller's own `LSP` tool on a hands-less leg is offered once and runs); `test/backlog1674-hand-band-same-name.test.ts` (a caller tool named `LSP` declaring write / declaring none / declaring read on a leg with hands and no manager: table and `allowDirs` verdict; the engine's own LSP unclaimed; another hand-band name, `TaskOutput`, under read-only hands; ⑦ two caller tools under one name — `[read, none]`, `[none, read]`, `[read, read]`, `[write, write]` × full / read-only hands × a hand-band name (`LSP`) and an ordinary name: table, roster row and `allowDirs` verdict follow the kept instance; ⑧ the same with a shared alias — the alias entry, the instance a call by the alias runs, the `allowDirs` verdict and the wake-time reconcile's wording follow the kept instance, with the claim order of the roster); `test/tool-roster.test.ts` unchanged and green; re-pinned: `test/prepare-lsp.test.ts`, `test/prepare-lsp-transcript.test.ts`, `test/backlog789-wiring-manifest-hooks-lsp.test.ts`, `test/public-knob-liveness.test.ts`, `test/tool-catalog.test.ts` (hand-band snapshots), `test/backlog1432-deny-universe.test.ts` (hand list), `test/design388-write-fences.test.ts` (a scenario mount writes nothing), `test/backlog1167-roster-freeze.test.ts` (R28: a non-array `tools` value is refused by the roster door's code).
+
+**Hard-breaking changes (#1672):** one exported value's shape, and one exported ordering. `SHELL_READ_FINDING_RANK` is renumbered (`unanswered` sits between `deny_hit` and `outside_roots`: 4 / 3 / 2 / 1 / 0 for `unanswered` / `outside_roots` / `unestablishable` / `declined` / `none`; `identity_changed` 6 and `deny_hit` 5 keep their numbers). `SHELL_READ_DECISION.unestablishable.full_shell` is the object `{ narrowed: "mandated", open: "ordinary" }` where it was the string `"mandated"` (every other cell stays a string), and `SHELL_READ_FINDINGS` / `SHELL_READ_DECISION` gain the member / row `unanswered`. A consumer that compares that cell to a disposition word, or switches exhaustively over the findings, reads the new shape — the readers in the family are sema-cli's dist verify scripts (`verify/_bash-gate-danger-matrix.mjs`, dev-time, they compare cells and the six-word finding set) and sema-server's `test/read-face-e2e.test.ts` (prose only); both read `typeof cell === "string" ? cell : cell.narrowed` for the engine default. **Closed sets:** `ShellReadFinding` +1 (`unanswered`). **Package exports:** +0 / −0 names. **Behavior:** #1672 loosens the mandated probe 7.49.0 made of every read the station cannot place — on an `open` read face and for a written target alone, both toward the reference implementation's plain permission ask (CC 2.1.296), open to veto; the engine-default `roots` face keeps the mandate. **Known limits added** (`docs/KNOWN-LIMITS.md`): KL-1644-c rewritten (the rewritten redirection target is the ordinary question now), KL-1672-a, KL-1672-b, KL-1672-c (a followed sed backup the text places nowhere is still read open, as in 7.49.1).
+
+### A read the station cannot place is the read face's question: the plain permission ask on an `open` read face and for a written target, the mandated probe on a `roots` read face (#1672; fix; loosening of 7.49.0 toward the reference; hard-breaking: one value shape; closed sets: `ShellReadFinding` +1; exports: +0 / −0) (@web-admin @server @cli @test)
+
+- **Before (7.49.1).** Every word the read station could not place — `ls -1 $ANDROID_HOME/platforms`, `cat ~root/x`, `cat $(echo …)`, a program the shell re-enters (`sh -c '…'`), a directory change the text does not settle, a redirection or `tee` operand the shell rewrites (`> "$DEST"`) — drew the write/read face's MANDATED probe: no allow of any kind, a spec pre-approval (`allowedTools: ["Bash"]`) included, released it, and under `auto` the classifier was never asked. The reference implementation asks the same word as a plain permission ask (CC 2.1.296 `sR`, cli296.js @13116941, reason `other`: "Shell expansion syntax in paths requires manual approval"; the tilde variants likewise) that a whole-tool allow (`$pn` @18717070), bypass (`$pn` @18716980) and the auto-mode classifier release and a prefix allow does not (`vX`'s ask returns before the allow rules, @18567915). A headless team run (`-p`, `auto`) whose first command read `$ANDROID_HOME/…` hung on the card.
+- **Now.** One decision-table cell, keyed by the READ FACE the question was raised under (`SHELL_READ_DECISION.unestablishable.full_shell`, read by `decideShellRead`): on an **`open`** read face — where the station asks only because a deny list has rows — the unplaced read is the ORDINARY ask: `default` / `acceptEdits` ask it, a spec pre-approval and `bypassPermissions` release it, the auto-mode classifier is consulted and its yes releases it, `dontAsk` refuses it by the mode; a stored whole-tool rule and a prefix allow keep asking it. On a **`roots`** read face (the engine default) it stays the mandated probe, as in 7.49.1: a deployment that narrowed the fence asked to be asked. A **written target** the station cannot place and nothing else (`echo x > "$DEST"`, `printf x | tee $X`) is the ordinary ask on either read face — a narrowed write face fences what is written and is no request to be asked about every word the floor cannot place; a command that also has an unplaced READ keeps the read face's reading. The read-only face and the post-approval re-judgement still refuse; the deny row, the out-of-roots mandate, the removal guards and the judge that gave no answer rank above or beside the cell and do not move. The unplaced-read card (`read_unestablished`) rides the finding on either question. A deployment that wants the plain ask for such commands declares the read face `open` (`RunnerDeps.readFace: "open"`); a lane on the engine default keeps the card.
+- **A judge that did not finish is its own finding, `unanswered`**: the gate's fallback when the station timed out, threw or a lookup it stands on was absent — and, recorded at ONE door, anything the station could not finish while establishing the command: an environment lookup that gave no answer (`canonicalPath`, `listDir`, `fileInfo`, `readLink` returning an error that is no conclusive "not there"; a conclusive absence and an adapter that declares no filesystem surface are not failures, and a resolver that declared nothing and answered NOTHING in the whole command keeps the lexical reading it always had — one answer anywhere in the command, the declared roots and a write guard's probe included, makes every silence beside it a failure, whichever word it falls on; the decision is taken once, after the write guards have asked too, so a read and a write on the same resolver are read alike), a bound the station stopped at (more directories or names than it enumerates, a link chain past its hop bound), a home view that could not be read (an identity lookup that errored on the path, on a level of the declared home's chain or on an auxiliary home's, or a home whose canonical spelling did not answer), and the write guards' own probes (they ask the environment through the command's one door; what their silence means is decided with the establishment's, and folded into the verdict BEFORE the plan's `writesPlaced` is read off it). Any one makes the WHOLE command `unanswered`, whatever the words it did reach found: mandated on the full shell on every read face — a standing allow was given on the premise that the judge works — and refused on the read-only face; ranked directly under `deny_hit` (`identity_changed > deny_hit > unanswered > outside_roots > unestablishable > declined > none`), so the redirection-only ordinary cell, a grant offer, a pre-approval or the classifier cannot answer for the part it did not check. It was the `unestablishable` row in 7.49.1, and earlier cuts of this ticket let a lookup's failure fall into that row one producer at a time — the ordinary question on an open read face with a deny list, so a pre-approval or the classifier could release a read the station had not checked against the deny table (`cat link` whose resolution errored while the link led to a denied file; a glob write whose listing errored; a path spelled through a bind-mount alias of the home whose identity lookup errored). The establisher now asks the environment ONLY through the observed door (`shell-read-environment.ts`: it is handed the door, not the environment), which records each failure and bound on the establishment's `incomplete`; the fold reads that list in one rule. No producer has to remember to mark anything. The door covers every lookup the command makes — the establishment, the declared roots, the home views, the write guards AND the leg's write judgment — and the station decides what a silence means once, after all of them have asked. `ShellReadBoundary.writeTargetJudge` therefore takes the command's door in its options (`opts.fs`, required) and resolves nowhere else (type-level change on a public member: a host-supplied judge keeps compiling and should resolve in `opts.fs`; no consumer in the sibling checkouts supplies one — **inferred**, grep of the local sema-server / sema-cli trees). What stays `unestablishable` is the TEXT's own unplaced word: a word the shell rewrites, a lost working directory, a pattern the matcher does not model, a spelling it cannot place.
+- **The allow lane's floor reads `~user` / `~+` / `~-` as it reads `$`** (b): a tilde word that is neither the bare `~` nor `~/…` — also after `=` / `:` in an assignment-shaped word — is an expansion word (the account database or the shell's own variables decide where it points), so a standing prefix allow no longer matches a command carrying one, the classify faces read it as outside their residual space (no longer a read-only command), and a rule body naming one is `invalid.not_simple_command` (as with `$`). The bare `~`, `~/…`, quoted and mid-word tildes are read as before. Consequence: an `ask` / `deny` rule text naming a `~user` word can no longer be minted (an org snapshot carrying one fails loudly, as one naming `$X` does).
+- **Who needs it.** Any session on an `open` read face with a deny list (a single-user product) whose shell reads go through a variable, a substitution, a re-entered shell text or an unknown program: the pre-approval and the classifier answer them now. **Who is hurt.** A deployment that relied on the mandate to stop an `allowedTools: ["Bash"]` run from executing an unplaced read on an open face no longer gets it (the deny rows still refuse every spelling the station can place; an unplaceable spelling is the ordinary question). A lane on the engine-default `roots` face is unchanged for reads — it is released only by `bypassPermissions`, a person's yes, or the deployment declaring the face `open`.
+- **Divergence from the reference (open to veto).** A stored whole-tool `Bash` rule does not clear this ask (the reference's `N9` does): the shape tier's irreversibility mark still asks (the rule-silencing principle, as for the redirection ask in 7.49.1). The `roots` face's mandate is sema's (C-R261b), not the reference's.
+- **Consumers.** web-admin / server: a sandbox lane that mounts the engine-default read face keeps the card for `$VAR` reads; declare the lane's read face `open` to release it (this ticket does not change a deployment's face). cli: `SHELL_READ_DECISION.unestablishable.full_shell` and the finding set changed shape (above). test: re-pinned readings are the open-face / written-target cells of the pins listed below.
+- Pins: `test/backlog1672-variable-read-ordinary-ask.test.ts` (shapes × read face × nine arms on the real Runner, the tilde floor's four consumers, the table's face-keyed cell, the seats, `unanswered` on both faces, the floors above the cell on both faces); re-pinned where an OPEN-face cell or a written-target cell was pinned mandated: `backlog1100`, `backlog1102-program-facts`, `backlog1102-read-station-semantics`, `backlog1421-launcher-reread`, `backlog1425-readonly-binding`, `backlog1427-write-targets-roots`, `backlog1599-delegate-auto`, `backlog1644-device-targets`, `backlog769`, `backlog791`, `backlog854`, `backlog860`; the table readers `backlog924`, `backlog1004`, `backlog1010`; the equivalence allowed lists (class `1672-tilde-variant-floor` in both) and the #994 S1 attribution rows `tilde_variant_floor`, `write_target_ordinary`.
+
+**Hard-breaking changes (#1675 / #1676):** none. **Closed sets:** +0 / −0. **Package exports:** +0 / −0 names, no member changes (`npm run handoff:diff v7.49.1 HEAD`: 2 609 → 2 609). **Behavior:** #1675 removes a value that was left in clear after a bearer token, and #1676 stops one marker from being written cut — redaction only, nothing a run could do before is refused. **Known limits added** (`docs/KNOWN-LIMITS.md`): KL-958-c, KL-958-d, KL-958-e (and KL-958-a restated).
+
+### A bearer credential is the whole run to whitespace — a name=value glued to the token goes with it (#1675; fix) (@server @cli @client-core @test)
+
+- **Before (7.49.1, and 7.49.0).** `Authorization: Bearer <vendor token><connector><name>=<value>` left `<value>` in clear when the name was no credential keyword or sat glued to the token. The token pass takes the token (its body takes `_` `-`), the bearer row stopped at `=`, and the keyword pass found no name for the value. 7.48.0 hid it, in the `Authorization:` spelling, only by accident: its bearer row took the token, and the `Authorization:` keyword row's value run then ate the glued remainder. On a 19 000-text constructed probe (seeded; eleven token families × connectors `_` `-` `.` / none × ten keyword and ten plain names × seven wrappers; values and tokens built at run time) 7.49.1 left at least 6 characters of the value visible in 383 of 6 000 bearer-wrapped texts where 7.48.0 did not (3 488 of 6 000 in all on 7.49.1, most of them texts where 7.48.0 showed it too — a token row that takes the name before the bearer row reads the text; 4 386 on 7.48.0).
+- **Now.** The bearer row's wide form reads the credential the way the header does: the token68 run and, when `=` follows it, whatever is glued after the `=` up to the same delimiters the keyword row's value run ends at (whitespace, a quote, `;`, `|`, `&` — one constant, read by both rows). The tail starts at `=` only: `Bearer <token>,next=1` still ends at the comma. A quote right after the `=` is read by the character that follows it. A boundary (`,` `}` `]` `:`, white space, another quote, the end) = the quote that closes a string around the text: the `=` is the token's padding and no tail starts. Anything else = an opening quote: the value up to the next quote of the same spelling goes whole, quotes included (bounded to 1 024 characters, one line; a backslash escape closes with the same word behind exactly the same number of backslashes — a quote of another depth inside is value content). An opening quote with no closing quote is read as an unquoted value, to its usual end and no further: it never lets the value through. Whether a string around the text closes inside that run is not something a local reading can tell, so it does not try: when the text sits inside a string whose own quotes are written as escapes (a backslash and a quote, a Unicode escape, `%22`), the run takes that string's encoded closing quote and the members after it in the same segment with the value, over-redaction being this face's cheap direction (known-limits row). The spellings: `"` and `'`; the backslash escapes `\"` `\'` `\x22` `\x27`, the Unicode escapes (a backslash, then `u0022` or `u0027`) and the octal `\042` `\047`, behind up to 63 backslashes; `&quot;` `&apos;` `&#34;` `&#39;`; `%22` `%27`. Lower case only (`\X22` and `\U0022` are no quotes), which is why the header word is spelled out (`[Bb][Ee]…`) instead of carrying the `i` flag. Any other backslash after the `=` is value content, and the tail starts. The run gives back the backslashes that escape the quote closing it (up to 63 — six layers of JSON inside JSON; the check looks a bounded 63 characters ahead, so a backslash run of any length costs a bounded amount per hit), so `\"Bearer <token>=\"` inside a string keeps its escape. A hit that ran over the next credential's keyword (`…,Bearer` at the end of a glued value) no longer hides that credential: the engine scans every vocabulary row on the original text from one character after each hit's start instead of at its end — bounded to eight characters of matches per character of input; a scan that runs out of that work stops, and everything from its last hit's start to the end of the text goes as one hit (over-redaction, never a leak; known-limits row) — and the union with the sequential run removes what the run left. No vendor row, character class or word list changed; the strict (refuse-write) form is untouched. The pass engine's existing union carries the enclosing hit, so the vendor token's own finding is still reported beside the bearer finding, whose span is now the whole credential. Same probe: 0 of 6 000 bearer-wrapped texts show a value on any of the three faces (the activity summary is pinned separately, A1), 0 show a token, and no text shows a value or a token that 7.48.0 hid.
+- **Who is hurt.** Nobody who relied on a value surviving: text after `Bearer <token>=` up to whitespace is part of the credential now (over-redaction is this face's cheap direction). A host that counts findings sees the bearer finding's span reach the end of the glued tail.
+- **Consumers.** None needs to act.
+- Pins: `test/backlog1675-bearer-tail-and-url-marker.test.ts` A (two token families × four wrappers × four connectors × six names on four faces; the delimiters; the header word's case; JSON inside JSON up to six layers; every quote spelling × bare / spaced / comma-and-brace / inside a JSON string, opening and closing; the escape-depth boundary; a second credential whose keyword the first hit's run took in; a scan that runs out of work, fail-closed; a two-million-character run; the finding's span) and D (the seeded probe against the frozen v7.48.0 chain: ≥ 2 000 texts, no value or token the old reading hid is shown, every marker whole).
+
+### A replacement marker is never cut: a URL userinfo that holds a token and a keyword-named tail (#1676; fix) (@server @cli @client-core @test)
+
+- **Before (7.49.0 and 7.49.1).** `https://user:<vendor token>_password=<value>@host/path` (the `curl -H` spelling too) read `https://user:-credentials]` on the same-principal tier: the marker lost its head and the host went with the value. The userinfo replacement is a function, so the engine inferred what it keeps from the characters it shares with the match; the match had run to the vendor token's marker `[redacted`, which `[redacted-credentials]` starts with, so the kept head reached into the marker and the union wrote the rest. The value was not shown; the output was broken. 933 of 4 000 constructed URL texts on 7.49.1 (0 on 7.48.0).
+- **Now.** What a function replacement keeps at each end never reaches into the pass's own marker literal (the last occurrence in what it wrote); a replacement that writes no marker literal is read as before. Same probe: 0 broken markers, and no value or token shown, on the same-principal and human tiers.
+- **Not changed (KL-958-c).** When the name is a credential keyword, the keyword hit read on the original runs over the `@` (a value run ends at whitespace), so the host tail still goes with it: 1 727 of 2 046 such texts on 7.49.1 and now, 887 on 7.48.0 (only for the families whose token body does not take the name). The host is no secret; the loss is the over-redacting direction. Closing it needs one more engine rule (text a pass explicitly keeps bounds the hits read on the original) and is left to 7.50.0.
+- **Who is hurt.** Nobody; the broken marker was never meaningful. A host that parsed `[redacted-credentials]` out of these outputs now finds it.
+- **Consumers.** None needs to act.
+- Pins: `test/backlog1675-bearer-tail-and-url-marker.test.ts` B (both families, both name classes, the `curl` spelling, bare / userinfo tokens) and C (the engine law on synthetic passes — head side and tail side).
+
 ## 7.49.1 — 2026-10-12
 
 **Hard-breaking changes:** none. **Closed sets:** `OptionMode` +1 (`queries`; internal to the program read model, not exported). **Package exports:** +0 / −0 names, no member changes (`SHELL_WRAPPER_TABLE` is byte-equal: a lookup switch is no peel flag; the two types #1583 / #1640 add live in a runner-internal module). **Behavior:** #1583 removes a value that was left in clear next to a credential-shaped name and #1640 makes a line say what already happened — nothing a run could do before is refused; #1643 and #1644 restore two readings 7.49.0 made too strict to the shell's and the reference's own — both are loosenings of 7.49.0 toward 7.48.0 and the reference implementation (CC 2.1.296), each open to veto. **Known limits added** (`docs/KNOWN-LIMITS.md`): KL-1643-a / -b, KL-1644-a / -b / -c (and the rows #1583 / #1640 carry).

package/dist/core/arg-summary.js

@@ -75,26 +75,44 @@ function removedRegion(pass, match, groups, inserted) {
             tail = "";
         return [head.length, match.length - tail.length];
     }
+    const markerAt = pass.marker === "" ? -1 : inserted.lastIndexOf(pass.marker);
+    const headStop = markerAt < 0 ? inserted.length : markerAt;
+    const tailStop = markerAt < 0 ? inserted.length : inserted.length - markerAt - pass.marker.length;
     let head = 0;
-    while (head < match.length && head < inserted.length && match[head] === inserted[head])
+    while (head < match.length && head < headStop && match[head] === inserted[head])
         head++;
     let tail = 0;
-    while (tail < match.length - head && tail < inserted.length - head && match[match.length - 1 - tail] === inserted[inserted.length - 1 - tail])
+    while (tail < match.length - head && tail < inserted.length - head && tail < tailStop && match[match.length - 1 - tail] === inserted[inserted.length - 1 - tail])
         tail++;
     return [head, match.length - tail];
 }
+const SOLO_SCAN_WORK_PER_CHAR = 8;
 function soloHits(input, passes) {
     const hits = [];
     passes.forEach((pass, i) => {
-        for (const m of input.matchAll(new RegExp(pass.re.source, pass.re.flags.includes("g") ? pass.re.flags : `${pass.re.flags}g`))) {
+        const re = new RegExp(pass.re.source, pass.re.flags.includes("g") ? pass.re.flags : `${pass.re.flags}g`);
+        const rescans = pass.family !== undefined;
+        let work = SOLO_SCAN_WORK_PER_CHAR * input.length;
+        for (let m = re.exec(input); m !== null; m = re.exec(input)) {
+            const at = m.index;
+            const familyAt = () => (typeof pass.family === "function" ? pass.family(input, at) : pass.family);
+            if (rescans) {
+                work -= m[0].length;
+                if (work < 0) {
+                    hits.push({ start: at, end: input.length, marker: pass.marker === "" ? REDACTED_WHOLE : pass.marker, pass: i, family: familyAt(), matchStart: at, matchEnd: input.length });
+                    break;
+                }
+                re.lastIndex = at + 1;
+            }
+            else
+                re.lastIndex = at + Math.max(m[0].length, 1);
             const inserted = insertedFor(pass, m[0], m.slice(1));
             if (inserted === m[0])
                 continue;
             const [a, b] = removedRegion(pass, m[0], m.slice(1), inserted);
             if (b <= a)
                 continue;
-            const at = m.index;
-            const family = typeof pass.family === "function" ? pass.family(input, at) : pass.family;
+            const family = familyAt();
             hits.push({ start: at + a, end: at + b, marker: inserted.slice(a, inserted.length - (m[0].length - b)), pass: i, family, matchStart: at, matchEnd: at + m[0].length });
         }
     });

package/dist/core/credential-vocabulary.js

@@ -1,5 +1,22 @@
 export const URI_SCHEME_SOURCE = String.raw `[A-Za-z][A-Za-z0-9+.\-_]{0,63}`;
 const VENDOR_BODY = "[A-Za-z0-9_-]{8,}";
+const VALUE_END = String.raw `\s"';|&`;
+const VALUE_CHAR = `[^${VALUE_END}]`;
+const ESCAPE_DEPTH = 63;
+const QUOTED_VALUE_MAX = 1024;
+const PLAIN_QUOTES = [`"`, `'`, `"`, `'`, `"`, `'`, `%22`, `%27`];
+const ESCAPED_QUOTES = [`"`, `'`, `x22`, `x27`, `u0022`, `u0027`, `042`, `047`];
+const BACKSLASHES = String.raw `\\{1,${ESCAPE_DEPTH}}`;
+const QUOTE = `(?:${PLAIN_QUOTES.join("|")}|${BACKSLASHES}(?:${ESCAPED_QUOTES.join("|")}))`;
+const AFTER_CLOSING_QUOTE = String.raw `(?:[\s,}\]:]|["']|$)`;
+const GLUED_RUN = `${VALUE_CHAR}*(?:(?<!\\\\)|(?!\\\\{0,${ESCAPE_DEPTH}}["']))`;
+const pairedValue = (open, close) => `${open}(?!${AFTER_CLOSING_QUOTE})[^\\n]{0,${QUOTED_VALUE_MAX}}?${close}`;
+const QUOTED_VALUE = [
+    ...PLAIN_QUOTES.map((q) => pairedValue(q, q)),
+    ...ESCAPED_QUOTES.map((q, i) => pairedValue(`(${BACKSLASHES})${q}`, `(?<!\\\\)(?:\\${i + 2})${q}`)),
+    `${QUOTE}(?!${AFTER_CLOSING_QUOTE})${GLUED_RUN}`,
+].join("|");
+const BEARER_TAIL = `(?<==)(?:(?!${QUOTE})${GLUED_RUN}|${QUOTED_VALUE})`;
 export const CREDENTIAL_VOCABULARY = {
     values: [
         { id: "github-token", kind: "prefixed-token", source: "arg-summary", confidence: "high", pass: "vendor-prefixed", match: new RegExp(`(?<![A-Za-z0-9])gh[opsur][-_]${VENDOR_BODY}`, "g"), strict: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/ },
@@ -14,9 +31,9 @@ export const CREDENTIAL_VOCABULARY = {
         { id: "huggingface-token", kind: "prefixed-token", source: "arg-summary", confidence: "high", match: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{20,}/g, strict: /\bhf_(?=[A-Za-z0-9]*[0-9])[A-Za-z0-9]{20,}\b/ },
         { id: "jwt", kind: "jwt", source: "arg-summary", confidence: "high", match: /(?<![A-Za-z0-9])eyJ[A-Za-z0-9._-]{20,}/g, strict: /\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]{16,}\b/ },
         { id: "private-key", kind: "private-key-block", source: "arg-summary", confidence: "high", match: /-----BEGIN[ A-Z0-9]*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?(?:-----END[ A-Z0-9]*PRIVATE KEY(?: BLOCK)?-----|$)/g, strict: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/ },
-        { id: "bearer-token", kind: "bearer-token", source: "arg-summary", confidence: "high", match: /(?<![A-Za-z0-9])Bearer\s+[A-Za-z0-9._~+/-]{8,}=*/gi, strict: /\bAuthorization:\s*Bearer\s+(?=[A-Za-z0-9._~+/-]*[0-9])[A-Za-z0-9._~+/-]{20,}=*/ },
+        { id: "bearer-token", kind: "bearer-token", source: "arg-summary", confidence: "high", match: new RegExp(String.raw `(?<![A-Za-z0-9])()[Bb][Ee][Aa][Rr][Ee][Rr]\s+[A-Za-z0-9._~+/-]{8,}=*(?:${BEARER_TAIL})?`, "g"), strict: /\bAuthorization:\s*Bearer\s+(?=[A-Za-z0-9._~+/-]*[0-9])[A-Za-z0-9._~+/-]{20,}=*/ },
         { id: "azure-storage-account-key", kind: "prefixed-token", source: "arg-summary", confidence: "high", match: /(AccountKey=)[A-Za-z0-9+/]{40,}={0,2}/g, strict: /AccountKey=[A-Za-z0-9+/]{40,}={0,2}/ },
-        { id: "keyword-value", kind: "keyword-value", source: "arg-summary", confidence: "medium", match: /(?<![A-Za-z0-9])((?:token|secret|key|password|passwd|credential|authorization)["']?\s*[=:]\s*["']?)[^\s"';|&]{4,}/gi },
+        { id: "keyword-value", kind: "keyword-value", source: "arg-summary", confidence: "medium", match: new RegExp(String.raw `(?<![A-Za-z0-9])((?:token|secret|key|password|passwd|credential|authorization)["']?\s*[=:]\s*["']?)${VALUE_CHAR}{4,}`, "gi") },
         { id: "url-userinfo", kind: "url-credentials", source: "untrusted-egress", confidence: "medium", match: new RegExp(String.raw `(${URI_SCHEME_SOURCE}:\/\/)((?:[^/\s"'@]*@)+)`, "gi") },
         { id: "signed-url-param", kind: "signed-url-param", source: "untrusted-egress", confidence: "high", match: /([?&#](?:sig|signature|sas|code)=)[^&\s"'#]+/gi },
     ],

package/dist/core/gate-fold.js

@@ -194,7 +194,7 @@ function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
         pass.targetUnresolved = true;
     if (verdict.unplacedOptions !== undefined)
         pass.shellUnplacedOptions = verdict.unplacedOptions;
-    if (verdict.finding === "unestablishable" || verdict.finding === "declined" || verdict.unestablished === true)
+    if (verdict.finding === "unestablishable" || verdict.finding === "declined" || verdict.finding === "unanswered" || verdict.unestablished === true)
         pass.shellReadUnestablished = true;
     switch (verdict.disposition) {
         case "vouch":
@@ -244,7 +244,7 @@ function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
                     pass.shellReadOffer = true;
                 pass.tightenedBy = shellGated ? "shell_gate" : "safety";
             }
-            if (verdict.finding === "declined")
+            if (verdict.finding === "declined" || verdict.finding === "unestablishable")
                 pass.probeBoundaryDeclined = true;
             return;
         }

package/dist/core/runner/prepare-gate-stations.js

@@ -10,7 +10,7 @@ import { askUnresolvableNotice } from "../ask-unresolvable-notice.js";
 import { askReachesPerson } from "../wiring-manifest.js";
 import { classifierUnavailableSeat } from "./classifier-ladder.js";
 import { PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
-import { callFaceSeat, rosterToolName, toolCallFaceOf } from "../tool-roster.js";
+import { callFaceSeat, rosterToolName, survivorsByName, toolCallFaceOf } from "../tool-roster.js";
 import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
 import { createApprovedCallScreen, createToolResultStation } from "./call-hook-stations.js";
 const PEER_MESSAGE_NAMES = new Set([SEND_MESSAGE_TOOL_NAME]);
@@ -73,7 +73,7 @@ export function prepareGateStations(input) {
     if (askLane !== undefined && parkAsk !== undefined) {
         const { adjudicate, resolveAskBound, notifyPermissionDenied, notifyHookError } = askLane;
         const { resolveContentAsk, suspendAsk } = parkAsk;
-        for (const t of tools) {
+        for (const t of survivorsByName(tools).values()) {
             const eff = t.effect;
             if (eff !== undefined && !toolEffects.has(t.name))
                 toolEffects.set(t.name, eff);

package/dist/core/runner/prepare-lsp.d.ts

@@ -3,8 +3,8 @@
  * LSP tool mount over the per-task env with its git-ignore filter, the diagnostics lane behind its four
  * preconditions (a manager whose sessions feed a registry, write-capable hands, not opted out), the run-scoped
  * registry key, and the edit nudge (raw path → the SAME resolution the tool leg uses → registry reset +
- * session didChange). No manager ⇒ nothing mounts and both lane seats are undefined. The interface is the
- * dependency list the segment had implicitly.
+ * session didChange). No manager, or no hands (the manifest still reports the seat, `mounted: false`), ⇒ nothing mounts and
+ * both lane seats are undefined. The interface is the dependency list the segment had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await, so the phase adds no yield between the
  * fork-governance note before it and the memory trio's occupancy read after it (a stretch
@@ -28,7 +28,7 @@ export interface PrepareLspInput {
     /** borrowed-readonly — the SETTLED task root: the tool's git-ignore root, and the nudge's resolution base when
      *  no cwd is tracked. */
     taskRootFinal: string;
-    /** borrowed-readonly — whether a real fs env is present (the lane's hands precondition). */
+    /** borrowed-readonly — whether a real fs env is present (the tool mount's and the lane's hands precondition). */
     handsEnabled: boolean;
     /** borrowed-readonly — the acquired session id: the run's key into the deployment-shared registry. */
     sessionId: string;
@@ -36,7 +36,7 @@ export interface PrepareLspInput {
      *  resolution base (identity is the contract — the band's `cd` handling writes this exact cell). */
     handsCwdRef: Prepared["cwdRef"];
     /** borrowed-mutable — the run's roster builder (identity is the contract). Writer here: ONE mount (the LSP tool)
-     *  when a manager exists. */
+     *  when a manager exists and the leg has hands. */
     roster: RosterBuilder;
     /** borrowed-mutable — the env-hand membership set the read-posture observer projects; writer here: `add("LSP")`
      *  on the mount. */

package/dist/core/runner/prepare-lsp.js

@@ -4,9 +4,9 @@ import { RosterBuilder } from "../tool-roster.js";
 export function prepareLsp(input) {
     const { spec, deps, executionEnv, taskRootFinal, handsEnabled, sessionId, handsCwdRef, roster, envHandToolNames } = input;
     const lspManager = spec.lspManager ?? deps.lspManager;
-    if (lspManager) {
+    if (lspManager && handsEnabled) {
         const lspRoot = taskRootFinal;
-        roster.mount(createLspTool(lspManager, { isPathIgnored: gitCheckIgnoreFilter(executionEnv, lspRoot), env: executionEnv }), { source: "builtin", mountedBy: "optional" });
+        roster.mount(createLspTool(lspManager, { isPathIgnored: gitCheckIgnoreFilter(executionEnv, lspRoot), env: executionEnv }), { source: "builtin", mountedBy: "hands" });
         envHandToolNames.add("LSP");
     }
     const lspDiagnostics = spec.lspDiagnostics !== false && lspManager?.diagnostics !== undefined && handsEnabled && spec.handsReadOnly !== true

package/dist/core/runner/prepare-safety-scan.js

@@ -1,15 +1,16 @@
 import { NAMESPACED_NAME_SHAPES, carriesNamespaceSeparator } from "../protocol-table.js";
 import { engineCardTypes, handBandEffects } from "../tool-registry.js";
-import { callerCardIdOf, offendingResultCard, rosterMemberBoundProblem, schemaKeyBoundProblem } from "../tool-roster.js";
+import { callerCardIdOf, offendingResultCard, rosterMemberBoundProblem, schemaKeyBoundProblem, survivorsByName } from "../tool-roster.js";
 import { toolFaceProblem } from "./tool-face-overlay.js";
 import { OFFLOAD_TOOL_NAME } from "../tool-result-store.js";
 import { PRESENT_PLAN_TOOL_NAME, ENTER_PLAN_MODE_TOOL_NAME } from "../present-plan-tool.js";
 const REPEAT_RISK = { read: 0, idempotent: 1, write: 2 };
 const leastRepeatSafe = (a, b) => (REPEAT_RISK[a] >= REPEAT_RISK[b] ? a : b);
+const tierOf = (t) => t.irreversibility ?? (t.reversibilityProbe ? "maybe" : undefined);
 export function prepareSafetyScan(input) {
     const { spec, deps } = input;
     const toolEffects = new Map();
-    const ownToolNames = new Set((spec.tools ?? []).map((t) => t.name));
+    const survivors = survivorsByName(spec.tools ?? []);
     const claimedAliases = new Set();
     const egressTools = new Set();
     const irreversibleTools = new Set();
@@ -76,10 +77,10 @@ export function prepareSafetyScan(input) {
                 throw e;
             }
         }
-        if (t.effect) {
+        if (t.effect && survivors.get(t.name) === t) {
             toolEffects.set(t.name, t.effect);
         }
-        const tier = t.irreversibility ?? (t.reversibilityProbe ? "maybe" : undefined);
+        const tier = tierOf(t);
         if (tier !== undefined) {
             irreversibilityTier.set(t.name, tier);
             if (tier === "always" || tier === "maybe") {
@@ -98,8 +99,11 @@ export function prepareSafetyScan(input) {
             egressTools.add(t.name);
             markedBy(t.name, "deployment");
         }
+    }
+    for (const t of survivors.values()) {
+        const tier = tierOf(t);
         for (const alias of t.aliases ?? []) {
-            if (alias === t.name || ownToolNames.has(alias))
+            if (alias === t.name || survivors.has(alias))
                 continue;
             if (claimedAliases.has(alias))
                 continue;
@@ -122,7 +126,7 @@ export function prepareSafetyScan(input) {
         }
     }
     toolEffects.set(OFFLOAD_TOOL_NAME, "read");
-    const claimerEffects = new Map([...claimedAliases].map((a) => [a, toolEffects.get(a) ?? "write"]));
+    const claimerEffects = new Map([...claimedAliases, ...survivors.keys()].map((a) => [a, toolEffects.get(a) ?? "write"]));
     const recordHandEffect = (name, effect) => {
         const claimed = claimerEffects.get(name);
         toolEffects.set(name, claimed === undefined ? effect : leastRepeatSafe(claimed, effect));

package/dist/core/runner-deps.d.ts

@@ -1249,10 +1249,10 @@ export interface RunnerDeps {
      * declaration refusing the batch legs). Absent = no posture check anywhere.
      */
     interactionPosture?: "interactive" | "headless";
-    /** LSP code-intelligence seam (design/64 §13.1): when set, every task mounts an `lsp` tool routed to this
+    /** LSP code-intelligence seam (design/64 §13.1): when set, every task WITH HANDS mounts an `lsp` tool routed to this
      *  manager (a deployment-provided language-server bridge, e.g. an E2B LSP sidecar). The manager returns
      *  `undefined` for a file whose language has no server, and the tool degrades to "fall back to grep". A
-     *  task's own `lspManager` overrides this. Unset ⇒ no `lsp` tool. */
+     *  task's own `lspManager` overrides this. Neither seat set, or a leg without an execution env ⇒ the engine mounts no `lsp` tool. */
     lspManager?: import("./lsp.js").LspServerManager;
     /**
      * The Artifacts hosting seat — a storage/service-tier seam of the same family as

package/dist/core/task-spec.d.ts

@@ -602,8 +602,8 @@ export interface TaskSpec {
      *  AskUserQuestion tool is mounted (one of the delivery faces in the criterion — see
      *  {@link interactiveTools}). Overrides `RunnerDeps.onQuestion`. Distinct from `onAsk` (permission). */
     onQuestion?: import("./ask-question.js").OnQuestion;
-    /** LSP code-intelligence seam (design/64 §13.1): when set, the `lsp` tool is mounted and routed to this
-     *  manager. Overrides `RunnerDeps.lspManager`. Unset ⇒ no `lsp` tool (the model uses grep/read_file). */
+    /** LSP code-intelligence seam (design/64 §13.1): when set, the `lsp` tool is mounted on a leg with hands and routed to
+     *  this manager. Overrides `RunnerDeps.lspManager`. Neither seat set, or no hands ⇒ the engine mounts no `lsp` tool (the model uses grep/read_file). */
     lspManager?: import("./lsp.js").LspServerManager;
     /**
      * design/121 (CC 198 parity): after the agent edits a file, NEW language-server diagnostics are

package/dist/core/tool-catalog-entries.js

@@ -98,7 +98,7 @@ export const TOOL_CATALOG_ENTRIES = [
         },
     },
     { id: "repo-map", name: "RepoMap", source: "builtin", definedIn: "src/tools/fs/repo-map.ts", mountedBy: ["hands"], cards: ["repo-map"], face: { family: "search", effect: "read", contract: c("core.repo_map@1") } },
-    { id: "lsp", name: "LSP", source: "builtin", definedIn: "src/core/lsp.ts", mountedBy: ["optional"], cards: [], face: { family: "search", effect: "read", contract: c("core.lsp@1") } },
+    { id: "lsp", name: "LSP", source: "builtin", definedIn: "src/core/lsp.ts", mountedBy: ["hands"], cards: [], face: { family: "search", effect: "read", contract: c("core.lsp@1") } },
     {
         id: "artifact", name: ARTIFACT_TOOL_NAME, source: "builtin", definedIn: "src/tools/artifact/artifact-tool.ts", mountedBy: ["optional"], cards: ["artifact"],
         face: { family: "other", effect: "write", contract: c("core.artifact@1"), ruleFace: { primaryParams: ["action"] }, renderHints: { summaryParams: ["action", "file_path", "url"] } },

package/dist/core/tool-conformance.js

@@ -14,6 +14,7 @@ export const TOOL_CONFORMANCE_VECTORS = [
         { name: "SendMessage", why: "needs the runner self seat (a direct prepare has none)" },
         { name: "AgentTranscript", why: "needs the runner self seat (a direct prepare has none)" },
         { name: "ListAgents", why: "mounts with the delegation face only under a runner self seat (a direct prepare has none)" },
+        { name: "LSP", why: "needs a wired LSP manager" },
     ], [OFFLOAD_READER]),
     vector("hands-readonly", ["always", "hands"], [
         { name: "Edit", why: "the read-only band mounts the read half only" },
@@ -23,9 +24,9 @@ export const TOOL_CONFORMANCE_VECTORS = [
         { name: "TaskStop", why: "the background-shell pair mounts on the full shell only" },
         { name: "EnterWorktree", why: "the worktree pair needs the tracked cwd the full shell owns" },
         { name: "ExitWorktree", why: "the worktree pair needs the tracked cwd the full shell owns" },
+        { name: "LSP", why: "needs a wired LSP manager" },
     ], [OFFLOAD_READER]),
     vector("plan-mode", ["always", "optional"], [
-        { name: "LSP", why: "needs a wired LSP manager" },
         { name: "Artifact", why: "needs a wired artifact host" },
         { name: "Skill", why: "needs a skills listing" },
         { name: "StructuredOutput", why: "needs an output schema" },

package/dist/core/tool-roster.d.ts

@@ -392,6 +392,11 @@ export declare function ruleFaceOfInstance(schema: TSchema | undefined, declared
     primaryParams: string[];
     params: string[];
 };
+/** The instance each NAME dispatches to when several are mounted under it: the LATER mount (the harness keeps the
+ *  later one). The one selection — the roster's snapshot and every table keyed by a caller tool's name read it here. */
+export declare function survivorsByName<T extends {
+    readonly name: string;
+}>(mounted: readonly T[]): Map<string, T>;
 /** What a mount site knows that the instance does not: where the tool came from and which condition fired. */
 export interface RosterMountMeta {
     source: RosterSource;
@@ -443,13 +448,13 @@ export declare class RosterBuilder {
     get tools(): readonly AgentTool[];
     get length(): number;
     metaOf(tool: AgentTool): RosterMountMeta | undefined;
-    /** Mount one instance at the tail. An instance that DECLARES an effect writes it into the leg's effect map —
-     *  the later mount under a name is the one the harness dispatches to (`snapshot`'s yield rule), so its
+    /** Mount one instance at the tail. An engine-lane instance that DECLARES an effect writes it into the leg's effect
+     *  map — the later mount under a name is the one the harness dispatches to (`snapshot`'s yield rule), so its
      *  declaration is the map's truth for that name; a pre-mount registration (the hand band, the plan pair, an
-     *  MCP axis) stands only for names no mounted instance declares. ONE lane is different by construction: the
-     *  `scenario` lane's declarations were latched by the safety scan BEFORE any mount, on the synchronous
-     *  doors+scan stretch (a microtask cannot flip them) — so a scenario mount never re-reads its instance's
-     *  effect over a registered name; an engine lane's mount under that name still displaces it. */
+     *  MCP axis) stands only for names no mounted instance declares. The `scenario` lane never writes the map: its
+     *  declarations were latched by the safety scan BEFORE any mount (on the kept instance of each name, on the
+     *  synchronous doors+scan stretch — a microtask cannot flip them), so a scenario mount, kept or dropped, leaves
+     *  the map as the scan made it; an engine lane's mount under that name still displaces it. */
     mount(tool: AgentTool, meta: RosterMountMeta): void;
     /** An ENGINE-INJECTED instance the harness list carries outside the mount array (the ToolSearch lane): a roster
      *  row — the model can call it — never a mount-array element (the disclosure lane owns that list and appends the

package/dist/core/tool-roster.js

@@ -294,6 +294,12 @@ function capRenderHints(h) {
         out.approvalCard = h.approvalCard;
     return Object.keys(out).length > 0 ? out : undefined;
 }
+export function survivorsByName(mounted) {
+    const winner = new Map();
+    for (const t of mounted)
+        winner.set(t.name, t);
+    return winner;
+}
 export const faceOf = (t) => t;
 function configError(code, message) {
     const e = new Error(message);
@@ -333,7 +339,7 @@ export class RosterBuilder {
             throw configError("config.tool_roster_mount_tag", `tool ${JSON.stringify(tool.name)}: mount tag ${JSON.stringify(meta.mountedBy)} is outside the closed set`);
         this.#meta.set(tool, meta);
         const eff = faceOf(tool).effect;
-        if (eff !== undefined && !(meta.mountedBy === "scenario" && this.#effects.has(tool.name)))
+        if (eff !== undefined && meta.mountedBy !== "scenario")
             this.#effects.set(tool.name, eff);
     }
     mountAll(tools, meta) {
@@ -382,9 +388,7 @@ export class RosterBuilder {
     }
     snapshot(facts) {
         const all = [...this.#tools, ...this.#engineLane];
-        const winner = new Map();
-        for (const t of all)
-            winner.set(t.name, t);
+        const winner = survivorsByName(all);
         const entries = [];
         const emitted = new Set();
         for (const t of all) {

package/dist/core/write-protect.d.ts

@@ -1,4 +1,5 @@
 import type { ExecutionEnv } from "../internal/harness-types.js";
+import type { ObservedFilesystem } from "../tools/fs/shell-read-environment.js";
 import type { PermissionResult } from "./tool-policy.js";
 import { type ToolCallLike } from "./tool-registry.js";
 /**
@@ -231,7 +232,8 @@ export interface LegWriteJudgment {
      *  write rows together — one reading of the target (its spelling, its real target, its symlink chain; a `canonical` key
      *  judged as a key), one exempt root, one absence law. `undefined` ⇒ no row covers it. Absent when neither table has a
      *  row. */
-    readonly judgeWriteTarget: ((target: string, opts?: {
+    readonly judgeWriteTarget: ((target: string, opts: {
+        readonly fs: ObservedFilesystem;
         readonly signal?: AbortSignal;
         readonly canonical?: true;
     }) => Promise<WriteTargetCoverage | undefined>) | undefined;

package/dist/core/write-protect.js

@@ -223,7 +223,7 @@ export function compileLegWriteJudgment(entries, opts) {
         judgeWriteTarget: rows.length === 0 && guardRows === undefined
             ? undefined
             : async (target, judgeOpts) => {
-                const hit = await compiled.judgment(target, { ...(judgeOpts?.signal !== undefined ? { signal: judgeOpts.signal } : {}), ...(judgeOpts?.canonical === true ? { canonical: true } : {}) }, guardRows);
+                const hit = await compiled.judgment(target, { ...(judgeOpts.signal !== undefined ? { signal: judgeOpts.signal } : {}), ...(judgeOpts.canonical === true ? { canonical: true } : {}) }, judgeOpts.fs, guardRows);
                 return hit === undefined ? undefined : hit.unreadable === undefined && TABLE_ROWS.has(hit.row) ? "protected" : "guarded";
             },
     };
@@ -283,9 +283,8 @@ function compileWriteJudgment(rows, origin, opts) {
         const base = typeof cwd === "string" && cwd.length > 0 ? cwd : undefined;
         return base !== undefined ? anchorSpelling(pathFamilyOf({ cwd: base }), base, path) : path;
     };
-    const env = opts?.env;
     const rootPath = opts?.rootPath;
-    const judgment = async (path, ctx, extraSource) => {
+    const judgment = async (path, ctx, env, extraSource) => {
         let noted = false;
         const noteAbsence = (cause, unresolvedSymlink) => {
             if (noted)
@@ -384,13 +383,13 @@ function compileWriteJudgment(rows, origin, opts) {
     };
     const matcher = {
         rows,
-        targetView: env === undefined ? "spelling-only" : "target",
+        targetView: opts?.env === undefined ? "spelling-only" : "target",
         matchPath(path, cwd) {
             const hit = judgePathRows(tableAt([]), { views: [spelledView(anchoredSpelling(path, cwd), "lexical")] }, "tighten");
             return hit === undefined ? null : { name: hit.row.name, kind: hit.row.kind };
         },
         async judge(path, ctx = {}) {
-            const hit = await judgment(path, ctx);
+            const hit = await judgment(path, ctx, opts?.env);
             if (hit === undefined)
                 return { kind: "clear" };
             if (hit.unreadable !== undefined)

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -167,8 +167,8 @@ export interface StrictResidualOptions {
  *  1. the quote-blind class ({@link SHELL_SEGMENT_QUOTE_BLIND_REJECT}) over every written spelling — a word, a
  *     redirection target under `tolerateRedirection` — plus every group, here-document, line-break connector
  *     and (unless tolerated or data-free) redirection token;
- *  2. the expansion character where bash expands it ({@link expandsDollar}), the home-directory word excepted
- *     under `homeDeclared`;
+ *  2. the expansion character where bash expands it and a `~user` / `~+` / `~-` tilde word
+ *     ({@link expandsBeyondText}), the home-directory word excepted under `homeDeclared`;
  *  3. a backgrounding `&` and a `|&`;
  *  4. a word whose value the text does not settle ({@link UNRESOLVED_SENTENCE}) — a compound array, an
  *     off-table ANSI-C escape, a subscript or parameter expansion this lexer does not read.

package/dist/tools/fs/bash-readonly-classifier.js

@@ -26,20 +26,22 @@ function hasBareShellOperator(s, quotedOperatorsAreText) {
     for (const t of lexed.segments[0].tokens) {
         if (t.kind !== "word")
             return true;
-        if (expandsDollar(t) || t.assignment?.form === "compound")
+        if (expandsBeyondText(t) || t.assignment?.form === "compound")
             return true;
         if (t.pieces.some((p) => p.quotedBy === "\\" || (p.quotedBy === undefined && p.literal !== undefined && /[\r\\]/.test(p.literal))))
             return true;
     }
     return false;
 }
-function expandsDollar(w) {
+function expandsBeyondText(w) {
     if (w.quotedSpans.some((q) => q.by === '$"'))
         return true;
     for (const p of w.pieces) {
         const k = p.expansion?.kind;
         if (k === "parameter" || k === "command" || k === "process" || k === "arithmetic")
             return true;
+        if (k === "tilde" && p.expansion?.body !== "~")
+            return true;
         if (p.literal !== undefined && (p.quotedBy === undefined || p.quotedBy === '"') && /[$`]/.test(p.literal))
             return true;
     }
@@ -126,7 +128,7 @@ export function strictResidualRefusal(lexed, source, opts = {}) {
     }
     const home = opts.homeDir !== undefined && !textBindsHome(source) ? opts.homeDir : undefined;
     for (const w of words) {
-        if (expandsDollar(w) && !(home !== undefined && homeSpelledForClassify(w, home) !== undefined))
+        if (expandsBeyondText(w) && !(home !== undefined && homeSpelledForClassify(w, home) !== undefined))
             return reason;
     }
     for (const s of lexed.segments) {

package/dist/tools/fs/read-deny-home.d.ts

@@ -93,7 +93,7 @@ export type HomeViewEnv = Pick<ExecutionEnv, "homeDir" | "canonicalPath" | "file
 export interface HomeViewSource {
     /** The home views of one judgment (a tool call, a command's establishment, one search): a view per directory is read
      *  once and shared by every path below it. */
-    views(signal?: AbortSignal): HomeViews;
+    views(signal?: AbortSignal, env?: HomeViewEnv): HomeViews;
 }
 /** A judgment's views. `of` answers the view only where it differs from the path as spelled; `undefined` otherwise, and
  *  wherever it cannot be read: no `fileIdentity` seat, no home, a level of the path whose identity fails (the path is
@@ -103,6 +103,10 @@ export interface HomeViews {
     of(path: string, opts?: {
         readonly leaf?: "file";
     }): Promise<string | undefined>;
+    /** The paths whose identity lookup gave no answer in this judgment (a throw, a timeout, an error that is no conclusive "not
+     *  there"): for them `of` answered `undefined` for want of a reading, not because there is no view — a consumer that
+     *  must not vouch past an unread view (the shell station) reads this after its lookups. Live: grows as `of` is asked. */
+    readonly unread: readonly string[];
 }
 /** A judge that carries the home views of the placement its rows were compiled at. */
 export interface HomeViewsCarrier {