@sema-agent/core 7.49.2 → 7.49.4

package/CHANGELOG.md

@@ -1,3 +1,52 @@
+## 7.49.4 — 2026-10-13
+
+**Rebuild of 7.49.3 — no source change.** The npm tarball of 7.49.3 (shasum `77a7fd37…`, now deprecated) carried the `dist/` of 7.49.2: it was published with `--ignore-scripts` from a checkout whose `dist/` had not been rebuilt (the release-candidate build and gates had run on a detached gate copy). None of the four 7.49.3 entries below (#1685, #1691, #1692, #1693) were in that package. 7.49.4 is the same source as tag `v7.49.3` built in the publishing checkout and compared byte-for-byte with the gated dist before publish; every 7.49.3 entry, criterion (`docs/release-criteria/7.49.3.json`) and wire manifest applies to 7.49.4. **Hard-breaking changes:** none. **Closed sets:** none. **Package exports:** +0 / −0 (`npm run handoff:diff v7.49.3 HEAD`). Consumers pinned to 7.49.3 must move to 7.49.4 (@server @cli @web-admin @client-core @test).
+
+## 7.49.3 — 2026-10-13
+
+**Hard-breaking changes (#1685, #1693, #1691, #1692):** none. **Closed sets:** none (`READ_CANDIDATE_PROVENANCES`, `SHELL_READ_FINDINGS`, `ASK_CLASSES`, `PERSISTED_RULE_MANDATES` unchanged). **Package exports:** +0 / −0 names (`npm run handoff:diff v7.49.2 HEAD`: 2 609 → 2 609); member changes, all optional: `ReadCandidate.device` / `through`, and the plan's redirection record `fd` (`ShellReadSegment.redirects[]`). **Behavior:** #1685 makes the reference's device table a non-question at every entry of the shell read station and of the shape tier — a loosening for the standard streams (open to veto: it departs from the reference at the output-redirection, read-operand and write-operand entries), and a one-line tightening for `touch` / `mkdir` of the null device; #1693 makes an environment non-answer a bypass-immune ask — a tightening that restores what 7.49.2's own documentation promised; #1691 removes a value that was left in clear after a bearer token (a name=value glued to the token by `:` `,` `@` `!` `;` `|` `&`) and hides the character that joins it; #1692 gives the overlapping re-scan's work allowance a floor (2^17 characters of matches, binding below 16 KB of input only), so a short text with a dense line is read in full instead of losing every line behind it — a scan that still runs out of work masks to the end of the input exactly as in 7.49.2 — redaction only, nothing a run could do before is refused. **Known limits added / closed** (`docs/KNOWN-LIMITS.md`): KL-1644-a closed; KL-1685-b / -c / -d / -e / -f added; KL-958-f, KL-958-g, KL-958-h added (KL-958-d and KL-958-e restated).
+
+### The standard-device table is no containment question at any entry — and no write to a standard stream is a write (#1685; fix; loosening toward the reference's device predicate, one step stricter on rebinding; hard-breaking: none; closed sets: +0; exports: +0 / −0) (@test @cli @server @client-core @web-admin)
+
+- **Before (v7.49.2).** Only `> /dev/null` (and a `tee` / `-o` operand written at the landing seat) was exempt from the containment question. Every other spelling of the reference's device table (`wwe`, cli296.js @18511591: `/dev/null` `/dev/stdin` `/dev/stdout` `/dev/stderr` `/dev/tty`, `/dev/fd/<digits>`, `/proc/self/fd/{0,1,2}`) asked at every entry: `echo x > /dev/stdout` the ordinary redirection question; `cat /dev/stdin`, `cat < /dev/tty`, `git diff /dev/null`, `ls /dev/tty` the MANDATED probe (a spec pre-approval did not release it); `echo x > /dev/fd/9` the unanswered probe (the host process holds no descriptor 9); `cp a.txt /dev/stdout` and `echo x | tee /dev/stderr` the probe. The shape tier kept `/dev/null` as the one redirection that writes nothing (`read-only-shell.ts`, the classify faces' `2>/dev/null`), so `echo x > /dev/stdout` also asked in `default`. A program's write to a device, and a rebinding to one, drew the shape tier's question in `default` as the file writes they are, measured on the real Runner (identical on both read faces): `echo x | tee /dev/tty`, `echo x | tee /dev/fd/2` and `cp a.txt /dev/stdout` the mandated probe ("writes outside the directories allowed"); `echo x | tee /dev/null a.txt`, `exec >/dev/null` and `exec 3>/dev/null; echo x >&3` the ordinary "performs an irreversible action".
+- **Now.** ONE predicate (`src/tools/fs/shell-read-device.ts`: the table, read AS WRITTEN — `/dev/./null` is a path) is read by every entry: an output redirection's target, an input redirection's source, a read operand (a root of a tree walk included), the content a program writes through an operand (`tee`, an output file an option names, a plain copy's destination), a `git diff` operand — on both read faces, every mode — and by the shape tier's durability reading (the read-only reader and the classify faces' data-free `2>` read it for redirections; the read-only reader reads it for a program that writes nothing but standard devices — `tee` and `cp`, by the rows' own write facts — and for a bare `exec` whose redirections are devices; a program's device operand is read against the same binding map the station's rebinding rule reads — every redirection of the whole text binds its descriptor, a single one, a read, an `exec`'s and a `{name}` one included — so `cp b.txt /dev/fd/3 3<a.txt` and `exec 3<a.txt; echo x | tee /dev/fd/3` keep asking, where `tee /dev/fd/2` with nothing bound is quiet). A standard device is established as spelled (the filesystem is not asked where `/dev/fd/9` leads) and the write-protection table is not asked about it. In `default`, `echo x > /dev/stdout`, `echo x 2> /dev/stderr`, `cat a >> /dev/tty`, `ls 2>/dev/stderr`, `echo x | tee /dev/tty`, `echo x | tee /dev/fd/2`, `cp a.txt /dev/stdout`, `exec >/dev/null` and `exec 3>/dev/null; echo x >&3` run as quietly as `> /dev/null`; the durable ones keep the shape tier's ordinary question: `echo x > ./inroot.txt`, `echo x | tee a.txt`, `echo x | tee /dev/null a.txt` (one written operand is a file), `cp a.txt b.txt`, `exec >out.txt`, `curl -o /dev/null …` (it also sends), `dd … of=/dev/null` (no row, KL-1685-f).
+- **What is NOT exempt.** (1) The exemption is I/O THROUGH the node: `rm` `mv` `mkdir` `touch` `ln` `chmod`, an in-place `sed`, a copy with an option word (`-f` `-b` `-l` `--remove-destination`: they replace or link the entry; any word starting with `-` counts, a bare `--` included), `find … -delete`, and any word of a program the station holds no row for, are judged as any path (the program read model's write roles carry a new `through` mark, claimed only by the rows that state how they handle their output files: `tee`'s operands, `curl`'s output files and a plain copy's destination — not a program's output option as such, which may name files beside the one it is given: `strace -ff -o F` writes `F.<pid>`, `curl --no-clobber -o F` writes `F.1` beside an existing `F`, `--remove-on-error` unlinks it; an option a row does not explain withdraws the mark). (2) A descriptor spelling names whatever the descriptor is bound to when it is opened: where the SAME command line rebinds it (`3< f`, `exec 3>f`, `1<f > /dev/stdout`, `{fd}>f`, a numbered here-document) or the station cannot read the line in full (`eval "$X"`, `source`, an unreadable text), it is judged at its landing as before — **one step stricter than the reference, which exempts it whatever the text does**. The null device and the terminal name no descriptor and are exempt always. (3) A spelling outside the table (`/dev/sda`, `/dev/shm/x`, `/proc/self/environ`, `/proc/self/fd/3`, `/dev/./null`) is a path. (4) The generator devices (`/dev/zero`, `/dev/random`, `/dev/urandom`, `/dev/full`) are no stream of the process: a read of one is no question only while the program read model knows it is bounded — `head -c N` with a small literal byte bound (the existing `byteBoundIsSmall` fact, now hoisted to the model); `head -n`, `cat /dev/zero`, `dd count=`, `od -N` keep asking (KL-1685-c).
+- **Divergence from the reference (open to veto).** The reference exempts the table only at its input-redirection check, its git-diff operands, its read-path list and its write list, `/dev/null` alone at the output-redirection check (`lvr` @18502854) and four devices at `tee` (`Bwr` @18478565); here every entry reads the whole table — looser at the output-redirection, read-operand and write-operand entries (the owner's ruling: "the whole table asks nothing"). The rebinding rule is stricter than the reference (above).
+- **Who needs it.** Every run that prints to its own streams (`> /dev/stderr`, `tee /dev/tty`, `cat /dev/stdin`, `grep -f /dev/stdin`, `git diff --no-index /dev/null file`, `curl -o /dev/null`, `head -c 16 /dev/urandom | base64`) under `roots` read face: the mandated probe a pre-approval did not clear is gone. **Who is hurt.** (a) `touch /dev/null` and `mkdir /dev/null` now ask (7.49.2 let them through only because they write at the landing seat — an artifact, not a design: they are metadata / namespace operations), and so do the output options of rows that do not claim the mark (`strace -o /dev/null`, `find … -fprint /dev/null`, `time -o` …: 7.49.2 exempted `/dev/null` alone for them, whatever the option did beside it); (b) a line that rebinds a descriptor asks where a reference would not (`exec 3>f; echo x > /dev/fd/3`, `cat /dev/stdin < f`); (c) `dd if=a.txt of=/dev/null` has no row in the program read model, so it keeps asking — the mandated probe on `roots`, the shape tier's ordinary question on `open` (KL-1685-f; a pre-approval and `bypassPermissions` release the second); (d) in `default`, a descriptor-naming device passes the shape tier only as the line's one redirection (`echo x > /dev/stdout 2> f.txt` still asks; KL-1685-b); (e) `tee` carries no declared option, so `echo x | tee -a /dev/null` (any option word on `tee`, any word starting with `-` on `cp` / `mv`, a bare `--` included) is judged as a path: on an `open` read face the 7.49.2 station vouched it (the null device at the landing seat) and `default` asked the shape tier's ordinary question; now the station asks the mandated one (a pre-approval no longer releases it), on `roots` as it already did (KL-1685-e); on `roots` it already asked.
+- **Compensation.** None needed for (a) (`> /dev/null` and `: > /dev/null` are the idioms); (b) is the old behavior; (c) and (d) are released by the arms that release any ordinary ask.
+- **Consumers.** cli: `verify/_bash-gate-danger-matrix.mjs` (classify-face strict arms) is unchanged for `> /dev/null` (the data-free face still passes only `2>`); `_bypass-disclosure-live-pty.mjs` reads `probe_mandate` / `probe_unanswered` on bypass releases (unchanged for outside-roots and unplaced reads). server: `test/read-face-e2e.test.ts` pins `released.askClass: "probe"` for a read outside the roots (unchanged); a deployment whose runs print to `/dev/stderr` stops getting the card. test: re-pinned readings are listed below; the equivalence corpora ignore the new marks.
+- Pins: `test/backlog1685-device-table-exempt.test.ts` (① eleven table spellings × seven entries × two read faces × three arms on the real Runner; ② controls — the namespace operations, a copy with an option word, a rebound descriptor, the spellings outside the table, an unbounded generator, the in-root write — each reading as 7.49.2 gave, but for `touch` / `mkdir` of the null device; ③ the judge over the rebinding rule, the unreadable-line rule, quoting, the program's rows; ④ the plan's `device` mark and the write roles' `through` mark; ⑤ the shape tier's readings, directly and on the real Runner in `default` — the quiet forms and the durable controls above, the classify faces still admitting readers only). Re-pinned: `backlog1427-write-targets-roots` (the stream spellings are no finding; the rebound ones are), `backlog1644-device-targets` (the redirection cell now pins a file and a device NODE outside the table), `backlog7300-shell-reentry` (its `</dev/null` was an accidental read outside the roots), `backlog945-plan` (the redirection record carries its descriptor number), `program-read-model.structure` (the role schema has `through`), `module-size-ratchet` (plan / establish ceilings, with reasons), the equivalence corpora's views (the marks are the station's facts) and the #994 dual-run attribution `device_unasked`.
+
+### An environment that gave no answer is an unreadable shell text, not a probe a mode releases (#1693; fix; security; hard-breaking: none, open to veto; exports: +0 / −0) (@server @cli @client-core @test @web-admin)
+
+- **Before (v7.49.2).** The `unanswered` finding — a resolver error or timeout, a listing, link or identity lookup that errored, a bound the station stopped at — was mandated, but the gate stamped it as the `probe` class. `bypassPermissions` RELEASES the `probe` class with a disclosure: a real run under bypass answered `cat <path the environment could not resolve>` with `allowed`, `released: { askClass: "probe" }` and the content sent. `docs/PERMISSION-MODES.md` said "never released by a mode" — that sentence was false (**7.49.2 erratum**).
+- **Now.** Every missing answer is the one finding `unanswered` — the fold's (a lookup errored, a bound was hit) and the station's own fallback, which the gate substitutes when the judge hung past the gate's bound or threw: the same infrastructure silence, not a fact about the command. The gate stamps an `unanswered` ask with the existing class of "the engine cannot read what this command touches", `unverifiable_shell_text` (a guard plus the real-approval bit: no mode releases it, no rule or prefix allow clears it, the classifier is not consulted); `probe` stays for a boundary the engine COULD read (outside the roots, a spelling the text leaves unplaced on a narrowed read face). Under `default`, `acceptEdits`, a pre-approval, a stored rule, a prefix allow and **`bypassPermissions`** a person is asked; `dontAsk` refuses. No new class, no new table row.
+- **Who needs it.** (a) The `auto` half is the one that bites a multi-tenant host (it refuses `bypassPermissions`): on an `open` read face, `permissionMode: "auto"` sent an environment non-answer to the auto-mode classifier and its `allow` released the command, at five lookup sites — a read operand, the declared home view, a level of the home's identity chain, a write whose only answered lookup is the write guard's own probe, a directory listing behind a glob (the redirection and write-operand `target_unresolved` asks never consulted the classifier). Now the classifier is not asked, the question reaches a person as `unverifiable_shell_text`, and `dontAsk` refuses; pinned per site × fault × arm. (b) A deployment that runs `bypassPermissions` against a backend whose filesystem lookups can fail (SSH, remote adapters): a read the environment could not resolve no longer runs unasked. (c) A lane that declares its `canonicalPath` the authority on where a path lands (the k8s lane among them) reads a broken file-system face as `unanswered` — silence is a failure there, not a reason to fall back to the text — so every one of its face failures meets this class instead of a mode's release. **Who is hurt.** Such a run, and a host running `auto` mode on an `open` read face (the classifier no longer answers this ask; 7.49.2 consulted it there); a `bypassPermissions` host whose environment cannot resolve a written target (`touch loop/x` where `loop` is a link loop) is now asked instead of released — the run is refused by the mode where no one can answer. **Compensation.** Fix the environment, or answer the ask (the card names the unplaced word).
+- **A card detail.** The card's `mandate` word is absent for this ask (its reason is the unreadable-text door, not a table word) — including where `target_unresolved` also holds (`touch loop/x` with `loop -> loop`: the class set is `unverifiable_shell_text` + `target_unresolved`, the mode refuses it under bypass). The persisted-rule table words are unchanged.
+- **Not in this entry.** Unreadable rules (`rule_unreadable`) get their origin from the rules door's own mint.
+- **Consumers.** server / cli: a card whose `askClass` was `probe` for an environment non-answer now reads `unverifiable_shell_text` (no `released.askClass: "probe"` for it); `docs/PERMISSION-MODES.md` states it.
+- Pins: `test/backlog1693-unanswered-environment-class.test.ts` (① the verdict's origin bit — resolver, listing, bound, and the station's own fallback; absent on every other finding; ② three environment shapes × both read faces × eight arms on the real Runner: asked, never released, the classifier never consulted, the class never `probe`; ④ a judge that hangs past the gate's bound (a lookup that never settles) × `bypassPermissions` / `auto` (classifier allowing and blocking) / `dontAsk` / `default` / a pre-approval × both read faces: asked once with the class `unverifiable_shell_text`, nothing served, the classifier zero calls, `dontAsk` refuses; ③ controls: an unplaced word and a read outside the roots keep the `probe` and bypass still releases it). Re-pinned: `backlog1672-variable-read-ordinary-ask` (⑦ ⑨: the environment matrix; ⑦b: one cell per site — operand / home / homechain / onlywrite / glob — × injected `canonicalPath` / `fileIdentity` / `listDir` fault × arm, on the `open` face under `default`, a pre-approval, `bypassPermissions`, `auto` with the classifier allowing and blocking, and `dontAsk`, and on the `roots` face under `auto` and `dontAsk`: the classifier is never consulted, the class is `unverifiable_shell_text`, `dontAsk` refuses; a tripwire cell records that the station asks `fileInfo` only about the copy target), `backlog955-real-lane-matrix` (F5, `touch loop/x`: the first two arms carry the class `unverifiable_shell_text`, the `bypassPermissions` arm is `denied:mode`; the other forms are Write-tool or non-environment readings and do not move), `backlog1092-mandate-word` (the `target_unresolved` word is derived from its fact; the shell-lane card is a two-reason ask with no word), `backlog222-recursive-read-demote` (the bound card), `module-size-ratchet` (gate-fold).
+
+### A bearer credential is the whole run to whitespace — whatever character joins a name=value to the token (#1691; fix; erratum to 7.49.2) (@server @cli @client-core @test)
+
+- **Before (7.49.2, 7.49.1, 7.49.0).** The 7.49.2 entry said "a bearer credential is the whole run to whitespace — a name=value glued to the token goes with it". The glued tail started only behind an `=`: a name=value joined to the token by a token68 character (`_` `-` `.`) or by nothing went with it, but one joined by `:` `,` `@` `!` `;` `|` `&` did not — `Bearer <token>:auth=<value>` (a name outside the keyword list: `auth`, `apikey`, `sig`) printed `[redacted]:auth=<value>` on every face. v7.48.0 hid part of that family only by accident (the `Authorization:` keyword row's value run ate what followed). **Erratum:** the 7.49.2 claim that "no text shows a value or a token that 7.48.0 hid" (its probe's connector set was `_` `-` `.` / none) did not hold for the connectors `: , @ ! ; | &`. As reported to this repository (test, 2 268 forms): 1 176 forms show a value on 7.49.2 and on 7.49.1, and v7.48.0 had hidden 224 of them. Re-measured here (252 constructed texts: 7 connectors × 4 names × bare / `Authorization:` / JSON member × 3 token families; values built at run time): the value is shown in 165 / 156 / 156 texts on `scrubSecrets` / `redactSecrets` / `redactHostLeaks` on 7.49.2 and 141 / 132 / 132 on v7.48.0.
+- **Now.** The bearer row's tail starts behind the token68 run and its `=` padding at the first non-white-space character that is no quote — `:` `,` `@` `!` `;` `|` `&`, or the first character of a value behind an `=` — takes that character whole, whatever it is, then runs to its usual end (white space, a quote, `;` `|` `&`). Everything else of the grammar is unchanged: a quote behind the `=` padding is read by the character that follows it and pairs with its own spelling at its own depth; an opening quote with no closing quote falls back to the value run; the engine's overlapping re-scan is untouched; no new table. A quote right behind the token68 run (no `=`) is the quote of a string around the text — nobody glues a quoted value to a bare token — so it starts no tail, in every spelling and whatever follows it: `'Authorization: Bearer <token>') && echo 'done'`, `x="Bearer <token>"&y=1` and `{"a":"Bearer <token>","b":1}` keep their structure exactly as in 7.49.2 (read by the character that follows it, as a quote behind an `=` is, the first two would be taken for the opening of a quoted value and swallow the rest of the command). Same probe: the value is shown in 0 of 252 texts on every face; the 2 400-text seeded random stratum shows no value on any face (7.49.2: 997 / 984 / 982), no token the v7.48.0 reading hid, every marker whole; the outer JSON of the one- and two-layer wrappers parses exactly where it parsed on 7.49.2 (JSON inside JSON: 165 / 169 / 169 broken on both, 142 / 146 / 146 on v7.48.0 — the keyword-row and signed-URL limits, KL-958-d ⑤). Token68 connectors (`/` `+` `.` `-` `_` `~`) read as before.
+- **Who needs it.** Any host that prints, logs or forwards an `Authorization` header or a command line holding a bearer token that is followed by a connector and a name=value (a cookie-ish `…:sid=…`, a `,realm=…`, a `@host` suffix, a `;sig=…`), where the name is not a credential keyword.
+- **Who is hurt.** Text glued to a bare token without a space now goes with it (over-redaction is this face's cheap direction): `(Bearer <token>) more` prints `([redacted] more`, `` `Bearer <token>` `` loses its closing backtick, `echo Bearer <token>|base64` prints `echo [redacted]`, `Bearer <token>, next` prints `[redacted] next`. On 1 800 constructed texts (a token, one of 18 glued characters or sequences, ordinary text after; seeded) 1 303 lose exactly that one character against 7.49.2; the four quote sequences and the token's own `.` are unchanged (KL-958-g). A host that counts findings sees the bearer finding's span reach the end of the glued tail. An unquoted connector-glued tail also runs over an ENCODED closing quote of a string around the text (`"`, `%22`, an HTML entity), exactly as a tail behind an `=` already did (KL-958-d ③): `{"payload":"{"auth": " Bearer <token>:auth=<value>"}"}` keeps its outer document but the inner string is cut at the marker — the value is hidden where 7.49.2 printed it with the structure intact (over-redaction preferred over structure).
+- **Compensation.** Put a space (or a quote) behind the token; nothing else to do.
+- **Not changed (KL-958-f).** `Bearer <token>:auth="<value>"` — a QUOTED value behind a connector-glued name — still prints `[redacted]"<value>"`, and so does a quote straight behind the connector (`Bearer <token>,"auth":"<value>"`): the tail's run ends at a quote, and reading past it needs a grammar extension. v7.48.0 and 7.49.2 print them too; the unquoted value, and the quoted value behind a token68 character or an `=`, are read.
+- Pins: `test/backlog1691-bearer-connectors.test.ts` H (3 token families × 4 wrappers × 7 connectors × 4 names on four faces, exact output; nested JSON up to six layers; every quote spelling × 14 followers directly behind the token; the commonest hosts of that shape; the `=` padding's quote reading; the token68 connectors; the declared limits) and S (the seeded probe against the frozen v7.48.0 chain, ≥ 2 000 texts); re-pinned: `backlog1675` A3 (`Bearer <token>,next=1` no longer ends at the comma), `backlog954` G5 (the row's source).
+
+### The overlapping re-scan's work allowance has a floor, so a dense line no longer masks the lines behind it (#1692; fix) (@server @cli @client-core @test)
+
+- **Before (7.49.2).** The overlapping re-scan of a vocabulary row (7.49.2, #1675) was bounded to eight characters of matches per character of input; a scan that ran out of work masked everything from the start it stopped at to the END OF THE INPUT (a start left unread is a credential left in clear, so the over-strip is deliberate). A start nested in a run costs about half the run, so a dense same-line run — `password=<v>,password=<v>,…` joined by `,` `:` `/` with no white space — ran a SHORT text out of work at about twenty assignments, and every line behind it went (as reported by test: k = 400 on a 3.6 KB line masked about 88 KB behind it). Measured on 7.49.2 (`password=<12-character value><n>` × k joined by one separator, then ` and tail words`, then 2 or 40 ordinary lines; 36 cells = 3 separators × k ∈ {24, 50, 100, 103, 104, 400} × 2 line counts, on `scrubSecrets` / `redactSecrets` / `redactHostLeaks`): the lines behind the dense line survived on 3 of 36 cells (k = 24 with 40 lines behind); on v7.48.0 on 36 of 36; the value was shown in none.
+- **Now.** The allowance has a floor: `max(8 × input length, 2^17)` characters of matches per row and scan (`SOLO_SCAN_WORK_FLOOR` = 131 072, one constant beside `SOLO_SCAN_WORK_PER_CHAR`; no new rule). Two bounds: the floor is the larger term only below 16 KB of input (`8 × 16 384 = 2^17`) and changes nothing from there on; and a row spends it at most once in each scan of a call (the format-free view, the raw text, up to 64 format-character cuts), so one call costs at most about `66 × 131 072` ≈ 8.6 million regex steps. Below the floor the re-scan is always read in full. A scan that still runs out of work does what 7.49.2's did and nothing else: ONE hit from the start that ran out to the end of the input, then that row's scan stops. The same 36 cells on this tree: the lines behind survive on 24 of 36 (every cell with k ≤ 103) and are masked on the 12 with k ≥ 104, as on 7.49.2; the value is shown in none. The threshold k₀ (smallest k that runs out; one line alone, two lines behind): **104** with 12-character values, 72 with 40-character values, 137 with 4-character values; the same line inside 100 KB of ordinary text: 265 (the allowance follows the text there, as before); inside about 1 MB: 829. A credential and a bearer token on a line behind the dense line are hidden on both sides of the threshold (read there, masked with the rest of the input at and above it). A bare-keyword run (`password=` × 2 000; it runs out from 171 starts on) with its value on the NEXT line (LF, CRLF, lone CR, blank lines between) hides that value: it is masked with the rest of the input; a roomier text reads it.
+- **Who needs it.** Any host whose redacted text can carry one dense machine-generated line (a joined config dump, a query string of many `password=` assignments) among ordinary lines: before, a short text with about twenty such assignments lost every line behind it.
+- **Who is hurt.** One white-space-free run of k₀ or more nested starts (about a hundred `password=` assignments joined without white space in a text under 16 KB) still masks the rest of the input from where the allowance ran out — unchanged from 7.49.2, fail-closed (KL-958-e). Time: one call at the threshold takes 0.4–0.8 ms (median, quiet machine); the worst case is the product above, measured on a 9 KB text with 64 zero-width characters and 400 nested assignments: `scrubSecrets` 19 ms and `redactHostLeaks` 36 ms, against 12 / 32 ms on 7.49.2 and 4 / 5 ms on v7.48.0.
+- **Compensation.** None needed.
+- **Not changed.** The fail-closed direction and shape (one hit to the end of the input, the row's scan stops), the trigger (cumulative match length against the allowance, per row and per scan) and the per-character rate (8).
+- Pins: `test/backlog1691-bearer-connectors.test.ts` E1 (k = 24 / 50 / 100 × `,` `:` `/` × 2 / 40 lines behind, four faces: dense line read in full, lines behind byte-identical, no value), E2 (the threshold found by bisection and held in [90, 120]: one fewer reads in full, the threshold masks to the end of the input, a credential and a bearer token on a line behind hidden on both sides), E2b (inside 100 KB the threshold follows the text: in [240, 290] and more than twice the lone line's), E3 (`password=` × 2 000, then LF / CRLF / CR and a value: hidden on four faces; roomy control), E4 (a 1.2 MB dense line returns), E5 (24 nested starts in 245 characters read in full — the floor's unit), E6 (one finding runs to the end of the input); `backlog1675` A6i (its exhausting fixture raised from 100 to 400 nested starts: 100 no longer run out).
+
 ## 7.49.2 — 2026-10-13
 
 **Hard-breaking changes (#1674):** one, open to veto — #1674 (see its entry). **Closed sets:** none. **Package exports:** +0 / −0 names, no member changes (the exported data `describeToolCatalog()` / `TOOL_CONFORMANCE_VECTORS` change values, below). **Behavior:** #1674 mounts `LSP` only on a leg that has an execution env, and seeds the pre-mount effect table for a caller's own tool that shares a hand-band name with the more conservative of its declared effect and the hand's. **Known limits added** (`docs/KNOWN-LIMITS.md`): KL-1674-a.

package/dist/core/arg-summary.js

@@ -87,12 +87,13 @@ function removedRegion(pass, match, groups, inserted) {
     return [head, match.length - tail];
 }
 const SOLO_SCAN_WORK_PER_CHAR = 8;
+const SOLO_SCAN_WORK_FLOOR = 1 << 17;
 function soloHits(input, passes) {
     const hits = [];
     passes.forEach((pass, i) => {
         const re = new RegExp(pass.re.source, pass.re.flags.includes("g") ? pass.re.flags : `${pass.re.flags}g`);
         const rescans = pass.family !== undefined;
-        let work = SOLO_SCAN_WORK_PER_CHAR * input.length;
+        let work = Math.max(SOLO_SCAN_WORK_PER_CHAR * input.length, SOLO_SCAN_WORK_FLOOR);
         for (let m = re.exec(input); m !== null; m = re.exec(input)) {
             const at = m.index;
             const familyAt = () => (typeof pass.family === "function" ? pass.family(input, at) : pass.family);

package/dist/core/credential-vocabulary.js

@@ -16,7 +16,7 @@ const QUOTED_VALUE = [
     ...ESCAPED_QUOTES.map((q, i) => pairedValue(`(${BACKSLASHES})${q}`, `(?<!\\\\)(?:\\${i + 2})${q}`)),
     `${QUOTE}(?!${AFTER_CLOSING_QUOTE})${GLUED_RUN}`,
 ].join("|");
-const BEARER_TAIL = `(?<==)(?:(?!${QUOTE})${GLUED_RUN}|${QUOTED_VALUE})`;
+const BEARER_TAIL = `(?:(?!${QUOTE})\\S${GLUED_RUN}|(?<==)(?:${QUOTED_VALUE}))`;
 export const CREDENTIAL_VOCABULARY = {
     values: [
         { id: "github-token", kind: "prefixed-token", source: "arg-summary", confidence: "high", pass: "vendor-prefixed", match: new RegExp(`(?<![A-Za-z0-9])gh[opsur][-_]${VENDOR_BODY}`, "g"), strict: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/ },

package/dist/core/gate-fold.js

@@ -208,9 +208,13 @@ function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
         case "mandated": {
             if (verdict.details !== undefined)
                 pass.shellReadDetails = verdict.details;
+            const unreadable = verdict.finding === "unanswered";
             if (pass.decision.action !== "allow") {
-                if (pass.decision.action === "ask")
-                    pass.decision = { ...pass.decision, probeMandated: true };
+                if (pass.decision.action === "ask") {
+                    pass.decision = !unreadable
+                        ? { ...pass.decision, probeMandated: true }
+                        : { ...pass.decision, requiresRealApproval: true, ...(pass.decision.guard === undefined ? { guard: "unverifiable_shell_text" } : { foldedAskClasses: [...new Set([...(pass.decision.foldedAskClasses ?? []), "unverifiable_shell_text"])] }) };
+                }
                 return;
             }
             const candidate = normalizeReadRootCandidate(verdict.readRootCandidate);
@@ -218,7 +222,7 @@ function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
                 action: "ask",
                 message: shellReadAskMessage(toolName, verdict),
                 decisionReason: "safety",
-                probeMandated: true,
+                ...(unreadable ? { requiresRealApproval: true, guard: "unverifiable_shell_text" } : { probeMandated: true }),
                 ...(account !== undefined ? { probeReason: account } : {}),
                 ...(candidate !== undefined ? { probeReadRootCandidate: candidate } : {}),
             };

package/dist/core/permission-rule-model.js

@@ -9,7 +9,7 @@ import { heldValues } from "./tool-name-readings.js";
 import { carriesDotSegment, isAbsoluteForFamily, isIdentityDir, isPathIdentity, isShellRootedSpellingUnmapped, isUncIdentity, pathFamilyOf, pathIdentityOf } from "../tools/fs/safety.js";
 import { bindPathRules, judgeRuleRows, rowsWhereTheyLead } from "./path-rule-binding.js";
 import { readShellCommand } from "./shell-lexer.js";
-import { readOnlyLineObjection, readOnlyShellVerdict } from "./read-only-shell.js";
+import { lineDescriptorsOfText, readOnlyLineObjection, readOnlyShellVerdict } from "./read-only-shell.js";
 export const RULE_BEHAVIORS = Object.freeze(["deny", "ask", "allow"]);
 const RULE_BEHAVIOR_SET = new Set(RULE_BEHAVIORS);
 export function isRuleBehavior(v) {
@@ -951,7 +951,7 @@ export function findAdmittingRule(rules, call) {
         const dir = cdDirs[i];
         const first = firstEligibleAdmittingRule(rules, segment, call) ?? (dir !== undefined ? firstEligibleDirectoryRule(rules, dir, call) : undefined);
         if (first === undefined) {
-            if (readsOnlyAsSegment(segment, lineObjection))
+            if (readsOnlyAsSegment(segment, lineObjection, call.command))
                 continue;
             return undefined;
         }
@@ -960,8 +960,8 @@ export function findAdmittingRule(rules, call) {
     }
     return covering.length > 0 ? covering : undefined;
 }
-function readsOnlyAsSegment(segment, lineObjection) {
-    return lineObjection === undefined && !movesShellCursor(segment) && readOnlyShellVerdict(segment).readOnly;
+function readsOnlyAsSegment(segment, lineObjection, whole) {
+    return lineObjection === undefined && !movesShellCursor(segment) && readOnlyShellVerdict(segment, undefined, undefined, () => lineDescriptorsOfText(whole)).readOnly;
 }
 function firstEligibleDirectoryRule(rules, directory, call) {
     for (const rule of rules) {
@@ -1067,7 +1067,7 @@ export function segmentCoverageOf(command, rules, call) {
         const dir = cdDirs[i];
         return {
             segment: segment.trim(),
-            covered: readsOnlyAsSegment(segment, lineObjection) ||
+            covered: readsOnlyAsSegment(segment, lineObjection, folded) ||
                 firstEligibleAdmittingRule(rules.persisted, segment, call) !== undefined ||
                 (dir !== undefined && firstEligibleDirectoryRule(rules.persisted, dir, call) !== undefined) ||
                 proposed.some((p) => p.rule.tool === "Read"

package/dist/core/read-only-shell.d.ts

@@ -1,4 +1,5 @@
 import { type ShellCommandShape } from "./shell-lexer.js";
+import { type LineDescriptors } from "../tools/fs/shell-read-device.js";
 /** The reader's answer: read-only, or not — with the first reason the reading stopped on (a sentence a
  *  trace or a card can show; never adjudication input). */
 export type ReadOnlyShellVerdict = {
@@ -32,7 +33,7 @@ export declare function changesDirectoryBeforeGit(shape: ShellCommandShape, cwd?
  * stands ({@link changesDirectoryBeforeGit}). Anything the reading does not positively admit is NOT read-only — the
  * answer is never a guess, and a `false` costs one question.
  */
-export declare function readOnlyShellVerdict(command: string, shape?: ShellCommandShape, cwd?: string): ReadOnlyShellVerdict;
+export declare function readOnlyShellVerdict(command: string, shape?: ShellCommandShape, cwd?: string, bound?: LineDescriptors | (() => LineDescriptors)): ReadOnlyShellVerdict;
 /**
  * The reader's LINE-level objection to `command` — what makes no segment of it read-only in its place, whatever the
  * segment reads on its own: the line's structure, or a `cd` beside a `git` ({@link changesDirectoryBeforeGit}). A caller
@@ -40,3 +41,9 @@ export declare function readOnlyShellVerdict(command: string, shape?: ShellComma
  * line first.
  */
 export declare function readOnlyLineObjection(command: string, cwd?: string): string | undefined;
+/**
+ * What the whole text of `command` binds — every redirection of every segment (a single one, an `exec`'s, a `{name}` one included),
+ * read by the station's own computation ({@link descriptorsOfPlan}): the one binding map the shape tier's operand reading shares with
+ * the station's rebinding rule. The plan is read with no listed readers: the bindings do not depend on which programs read.
+ */
+export declare function lineDescriptorsOfText(command: string): LineDescriptors;

package/dist/core/read-only-shell.js

@@ -1,5 +1,8 @@
 import { posix } from "node:path";
 import { readShellCommand } from "./shell-lexer.js";
+import { descriptorsOfPlan, newLineDescriptors, standardDeviceUnrebound } from "../tools/fs/shell-read-device.js";
+import { planShellReads } from "../tools/fs/shell-read-plan.js";
+import { writesOnlyStandardDevices } from "../tools/fs/shell-read-write-targets.js";
 import { FIND_ACTION_PRIMARIES, FIND_NEWER_PRIMARY, FIND_VALUE_PRIMARIES, FLAG_VALUE_ACCEPTS, READ_ONLY_BARE_ONLY, READ_ONLY_BARE_PROGRAMS, READ_ONLY_COMMAND_TABLE, READ_ONLY_ENV_NAMES, READ_ONLY_EXACT_FORMS, READ_ONLY_GLOB_PROGRAMS, XARGS_READ_ONLY_TARGETS, dockerRetargetDanger, } from "./read-only-shell-table.js";
 const NOT = (reason) => ({ readOnly: false, reason });
 export const CD_GIT_COMPOUND_SENTENCE = "This command changes directory before running a version-control command, which can pick up untrusted hooks or repository configuration from the target directory. Approve only if you trust it.";
@@ -39,7 +42,7 @@ const PRINTF_ESCAPE = new RegExp(`%[^%a-zA-Z]*${PRINTF_LENGTH}\\\\[0-7xX]`);
 const PRINTF_NUMERIC = new RegExp(`%[-+ 0#']*[0-9.*]*${PRINTF_LENGTH}[diouxXeEfFgGaAn]`);
 const JQ_DANGER_FLAG = /^['"]?-[a-zA-Z]*[fL]/;
 const JQ_DANGER_TEXT = /--from-file|--rawfile|--slurpfile|--run-tests|--library-path|\benv\b|\$ENV\b|\binclude\b|\bimport\b/;
-export function readOnlyShellVerdict(command, shape = readShellCommand(command), cwd) {
+export function readOnlyShellVerdict(command, shape = readShellCommand(command), cwd, bound) {
     const line = lineStructureObjection(shape);
     if (line !== undefined)
         return NOT(line);
@@ -59,8 +62,12 @@ export function readOnlyShellVerdict(command, shape = readShellCommand(command),
     }
     if (changesDirectoryBeforeGit(shape, cwd))
         return NOT(CD_GIT_REASON);
+    const descriptors = newLineDescriptors();
+    descriptors.unknown = shape.segments.reduce((n, s) => n + s.redirections.length, 0) > 1;
+    let boundOfText;
+    const bindings = () => (boundOfText ??= (typeof bound === "function" ? bound() : bound) ?? lineDescriptorsOfText(command));
     for (const seg of shape.segments) {
-        const verdict = segmentVerdict(seg);
+        const verdict = segmentVerdict(seg, descriptors, bindings);
         if (!verdict.readOnly)
             return verdict;
     }
@@ -125,10 +132,10 @@ function peelBuiltinPrefix(words) {
             return t;
     }
 }
-function segmentVerdict(seg) {
+function segmentVerdict(seg, line, bindings) {
     for (const r of seg.redirections) {
         const target = r.target.text;
-        if (!READING_REDIRECTS.has(r.op) && target !== "/dev/null" && !(r.op === ">&" && /^\d+$/.test(target)))
+        if (!READING_REDIRECTS.has(r.op) && !standardDeviceUnrebound(target, line, []) && !(r.op === ">&" && /^\d+$/.test(target)))
             return NOT(`the redirection \`${r.op} ${target}\` writes`);
         if (/^\/dev\/(tcp|udp)\//.test(target))
             return NOT("a redirection to a network pseudo-device");
@@ -148,11 +155,17 @@ function segmentVerdict(seg) {
     const program = words[0];
     if (run.some((w) => expansionKind(w) === "glob"))
         return GLOB_PROGRAMS.has(program) ? READ_ONLY : NOT(`\`${program}\` with a glob argument — the glob may name anything`);
+    if (DEVICE_WRITERS.has(program) && writesOnlyStandardDevices(program, words.slice(1), bindings()))
+        return READ_ONLY;
     const structural = structuralReading(words);
     if (structural !== null)
         return structural ? READ_ONLY : NOT(`\`${program}\` with these arguments is not a read-only form`);
     return tableReading(words, run);
 }
+export function lineDescriptorsOfText(command) {
+    return descriptorsOfPlan(planShellReads(command, { readers: new Set(), cwd: "/", roots: [] }));
+}
+const DEVICE_WRITERS = new Set(["tee", "cp"]);
 function structuralReading(words) {
     const program = words[0];
     if (BARE_ONLY.has(program))
@@ -167,6 +180,8 @@ function structuralReading(words) {
             return form[0] !== "docker" || !dockerRetargetDanger(words);
     if (program === "echo")
         return true;
+    if (program === "exec")
+        return words.length === 1;
     if (program === "printf")
         return printfReading(words);
     if (program === "ls")

package/dist/tools/fs/bash-readonly-classifier.js

@@ -2,8 +2,9 @@ import { anchorSpelling, isAbsoluteForFamily, isBlockedDevicePath, isShellRooted
 import { PARSE_FAILURE_SENTENCE, UNRESOLVED_SENTENCE, argvOf, lexShell, literalTildeSpelling, } from "../../shell/lex.js";
 import { shellWordsOf } from "../../shell/shell-words.js";
 import { textBindsHome } from "./shell-read-bindings.js";
+import { GENERATOR_DEVICES, newLineDescriptors, bindDescriptors, isNamedDescriptorWord, standardDeviceUnrebound, descriptorsBoundBy } from "./shell-read-device.js";
 import { NOT_AUTO_ALLOWED, argvReentryUnjudged, isBareControlWord, programPositionRefusalSentence, readProgramPosition, } from "./bash-program-position.js";
-import { BLOCK_WORD_NAMES, attachedStdinFile, declaresOption, firstOperandSlot, opensNoOperand, programDelivery, programRow, programTextReadings, readArgRoles, readArgs, readProgramTextLanguage, runsShellText, selectedOptions, slotValueCandidates, suppliesFirstOperandSlot, takesSeparatedDatum, valuesAreLiteral, writeReadings, writesPath, } from "./program-read-model.js";
+import { BLOCK_WORD_NAMES, attachedStdinFile, byteBoundIsSmall, declaresOption, firstOperandSlot, opensNoOperand, programDelivery, programRow, programTextReadings, readArgs, readProgramTextLanguage, runsShellText, selectedOptions, slotValueCandidates, suppliesFirstOperandSlot, takesSeparatedDatum, valuesAreLiteral, writeReadings, writesPath, } from "./program-read-model.js";
 export const BASH_READONLY_DEFAULT_ALLOW = [
     "ls", "cat", "head", "tail", "wc", "pwd", "echo", "whoami", "uname",
     "grep", "cut", "tr", "basename", "dirname", "stat", "du", "df", "which",
@@ -82,8 +83,8 @@ export function carriesShellRedirection(text) {
     return SHELL_REDIRECTION_OPERATORS.test(text);
 }
 const SHELL_REDIRECTION_OPERATORS = /[<>]/;
-function isDataFreeRedirection(r) {
-    if (r.op === ">" && r.fd === 2 && r.target !== undefined && r.target.raw === "/dev/null")
+function isDataFreeRedirection(r, line) {
+    if (r.op === ">" && r.fd === 2 && r.target !== undefined && standardDeviceUnrebound(r.target.raw, line, descriptorsBoundBy(r)))
         return true;
     return r.op === ">&" && r.dup !== undefined && /^[12]$/.test(r.dup) && (r.fd === undefined || r.fd === 1 || r.fd === 2);
 }
@@ -103,6 +104,13 @@ export function strictResidualRefusal(lexed, source, opts = {}) {
     if ("parseFailure" in lexed)
         return inClass(source) || SHELL_EXPANSION_CHARS.test(source) ? reason : PARSE_FAILURE_SENTENCE[lexed.parseFailure.reason];
     const words = [];
+    const line = newLineDescriptors();
+    for (const s of lexed.segments)
+        for (const t of s.tokens)
+            if (t.kind === "redirect")
+                bindDescriptors(line, t);
+            else if (t.kind === "word" && isNamedDescriptorWord(t.raw))
+                line.named = true;
     for (const s of lexed.segments) {
         if (s.connector === "\n")
             return reason;
@@ -115,7 +123,7 @@ export function strictResidualRefusal(lexed, source, opts = {}) {
             }
             if (t.kind !== "redirect")
                 return reason;
-            if (opts.dataFreeRedirections === true && isDataFreeRedirection(t))
+            if (opts.dataFreeRedirections === true && isDataFreeRedirection(t, line))
                 continue;
             if (!tolerate)
                 return reason;
@@ -795,30 +803,6 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
         }
         unlistedSegments.add(si);
     }
-    const HEAD_AUTO_ALLOW_MAX = 1_000_000;
-    const byteBoundIsSmall = (row, args) => {
-        if (row === undefined)
-            return false;
-        let byteBound = false;
-        for (const e of readArgRoles(row, args)) {
-            if (e.kind === "operand" || e.kind === "end-of-options")
-                continue;
-            if (e.kind === "value" && e.spec?.bounds === "bytes") {
-                if (!/^\d+$/.test(args[e.at]) || Number(args[e.at]) > HEAD_AUTO_ALLOW_MAX)
-                    return false;
-                byteBound = true;
-                continue;
-            }
-            if (e.kind === "option" && typeof e.reading === "object" && e.reading.spec?.bounds === "bytes") {
-                if (!/^\d+$/.test(e.reading.attached) || Number(e.reading.attached) > HEAD_AUTO_ALLOW_MAX)
-                    return false;
-                byteBound = true;
-                continue;
-            }
-            return false;
-        }
-        return byteBound;
-    };
     const foldedSegments = [];
     let shapeRefusal = nameRefusal;
     for (let si = 0; si < segments.length; si++) {
@@ -896,7 +880,6 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
             shapeRefusal ??= `\`${name}\` in follow mode never terminates ${NOT_AUTO_ALLOWED}`;
             continue;
         }
-        const GENERATOR_DEVICES = new Set(["/dev/zero", "/dev/random", "/dev/urandom", "/dev/full"]);
         const deviceCandidates = openableWordsOf(row, restArgs);
         const deviceArgs = deviceCandidates.map((t) => resolveOperandLexically(undefined, t, boundary?.homeDir) ?? normalizeAbsPathLexically(t)).filter(isBlockedDevicePath);
         const rescuedByHead = byteBoundIsSmall(row, restArgs) && deviceArgs.every((d) => GENERATOR_DEVICES.has(d));

package/dist/tools/fs/program-read-model.d.ts

@@ -65,6 +65,11 @@ export type ArgRole =
      *  copy READS its sources; the write face still judges them, as the reference implementation does). Absent: every
      *  seat in {@link seats}. */
     readonly writtenAt?: readonly WriteSeat[];
+    /** A writing effect that writes the path's CONTENT by opening it (`true`), or does so only while the invocation carries
+     *  no option word (`"plain"`: a copy's `-f`, `-b` and `--remove-destination` replace the entry, `-l` and `-s` link it) —
+     *  the one kind of write a standard device takes without a containment question (`passesUnasked`). Absent: the program
+     *  creates, unlinks, renames or retargets the path's ENTRY, or the row does not say it only writes through. */
+    readonly through?: true | "plain";
     /** The program RUNS in this directory (`env -C <dir>`), or with it as its root (`sudo -R <dir>`): the paths it is
      *  handed resolve against it, not against the working directory the command line stands in. Or the program word is
      *  LOOKED UP in these directories (`env -P <dirs>`): which program runs is not the one the word names on the PATH. */
@@ -789,4 +794,14 @@ export declare function messageWords(program: string, words: readonly {
         readonly expansions: readonly WordPiece[];
     };
 }[], programIndex: number): Set<number>;
+/** The most bytes a read may be bounded to and still count as small (`head -c N`): a bound above it is no bound a person would call one. */
+export declare const SMALL_BYTE_BOUND_MAX = 1000000;
+/**
+ * Does this invocation read at most a SMALL, LITERAL number of BYTES? The rule is positive: the row's role walk ({@link readArgRoles})
+ * must find an option the row says bounds the output in BYTES ({@link OptionSpec.bounds}), valued with a plain integer within
+ * {@link SMALL_BYTE_BOUND_MAX}, and NO other option word — a line bound is no bound for a source that holds no newline, and a
+ * switch, a spelling the row does not explain or an option-shaped word past an operand makes the invocation unreadable, which is
+ * not exempt (the safe side). `false` for a program with no row.
+ */
+export declare function byteBoundIsSmall(row: ProgramRow | undefined, args: readonly string[]): boolean;
 export {};

package/dist/tools/fs/program-read-model.js

@@ -1351,3 +1351,27 @@ export function messageWords(program, words, programIndex) {
     }
     return out;
 }
+export const SMALL_BYTE_BOUND_MAX = 1_000_000;
+export function byteBoundIsSmall(row, args) {
+    if (row === undefined)
+        return false;
+    let byteBound = false;
+    for (const e of readArgRoles(row, args)) {
+        if (e.kind === "operand" || e.kind === "end-of-options")
+            continue;
+        if (e.kind === "value" && e.spec?.bounds === "bytes") {
+            if (!/^\d+$/.test(args[e.at]) || Number(args[e.at]) > SMALL_BYTE_BOUND_MAX)
+                return false;
+            byteBound = true;
+            continue;
+        }
+        if (e.kind === "option" && typeof e.reading === "object" && e.reading.spec?.bounds === "bytes") {
+            if (!/^\d+$/.test(e.reading.attached) || Number(e.reading.attached) > SMALL_BYTE_BOUND_MAX)
+                return false;
+            byteBound = true;
+            continue;
+        }
+        return false;
+    }
+    return byteBound;
+}

package/dist/tools/fs/program-read-model.rows.js

@@ -1,12 +1,14 @@
 import { shellWordsOf } from "../../shell/shell-words.js";
 const READ = { kind: "path", effect: "read" };
 const WRITE = { kind: "path", effect: "write" };
+const WRITE_THROUGH = { kind: "path", effect: "write", through: true };
 const CREATED = { kind: "path", effect: "create" };
 const TOUCHED = { kind: "path", effect: "create", seats: ["landing"] };
 const REMOVED = { kind: "path", effect: "write", seats: ["entry"] };
 const COPY_SOURCE = { kind: "path", effect: "write", seats: ["landing", "entry"], writtenAt: [] };
 const MOVE_SOURCE = { kind: "path", effect: "write", seats: ["landing", "entry"], writtenAt: ["entry"] };
-const DESTINATION = { kind: "path", effect: "write", seats: ["landing", "entry"] };
+const MOVE_DESTINATION = { kind: "path", effect: "write", seats: ["landing", "entry"] };
+const COPY_DESTINATION = { kind: "path", effect: "write", seats: ["landing", "entry"], through: "plain" };
 const EDITED = { kind: "path", effect: "edit-in-place", seats: ["entry"] };
 const NAMES = { kind: "path", effect: "names" };
 const INDIRECT = { kind: "path", effect: "read", valueForm: "indirect" };
@@ -203,18 +205,18 @@ const find = {
 const curl = {
     key: "curl",
     grammars: [grammar({
-            A: val(LABEL), b: val(INDIRECT), C: val(COUNT), c: val(WRITE), D: val(WRITE), d: val(INDIRECT), E: val(READ), e: val(LABEL),
-            F: val(FORM), H: val(HEADER), K: val(READ), m: val(COUNT), o: val(WRITE), P: val(LABEL), Q: val(LABEL), r: val(COUNT),
+            A: val(LABEL), b: val(INDIRECT), C: val(COUNT), c: val(WRITE_THROUGH), D: val(WRITE_THROUGH), d: val(INDIRECT), E: val(READ), e: val(LABEL),
+            F: val(FORM), H: val(HEADER), K: val(READ), m: val(COUNT), o: val(WRITE_THROUGH), P: val(LABEL), Q: val(LABEL), r: val(COUNT),
             T: val(UPLOAD), t: val(LABEL), U: val(LABEL), u: val(LABEL), w: val(INDIRECT), X: val(LABEL), x: val(LABEL), Y: val(COUNT),
             y: val(COUNT), z: val(READ), g: { arity: 0, literalValues: true },
             ...switches("#012346aBfGiIjJklLnNOpqRsSvZ"),
             ...switches("hMV", { mode: "banner" }),
         }, {
-            cacert: val(READ), capath: val(READ), cert: val(READ), config: val(READ), "connect-timeout": val(COUNT), cookie: val(INDIRECT), "cookie-jar": val(WRITE),
-            data: val(INDIRECT), "data-ascii": val(INDIRECT), "data-binary": val(INDIRECT), "data-raw": val(LABEL), "data-urlencode": val(FORM), "dump-header": val(WRITE),
-            form: val(FORM), "form-string": val(LABEL), header: val(HEADER), key: val(READ), "max-time": val(COUNT), "netrc-file": val(READ), output: val(WRITE),
-            proxy: val(LABEL), range: val(COUNT), referer: val(LABEL), request: val(LABEL), resolve: val(LABEL), trace: val(WRITE), "time-cond": val(READ),
-            "trace-ascii": val(WRITE), "upload-file": val(UPLOAD), url: val(URL), user: val(LABEL), "user-agent": val(LABEL), "write-out": val(INDIRECT),
+            cacert: val(READ), capath: val(READ), cert: val(READ), config: val(READ), "connect-timeout": val(COUNT), cookie: val(INDIRECT), "cookie-jar": val(WRITE_THROUGH),
+            data: val(INDIRECT), "data-ascii": val(INDIRECT), "data-binary": val(INDIRECT), "data-raw": val(LABEL), "data-urlencode": val(FORM), "dump-header": val(WRITE_THROUGH),
+            form: val(FORM), "form-string": val(LABEL), header: val(HEADER), key: val(READ), "max-time": val(COUNT), "netrc-file": val(READ), output: val(WRITE_THROUGH),
+            proxy: val(LABEL), range: val(COUNT), referer: val(LABEL), request: val(LABEL), resolve: val(LABEL), trace: val(WRITE_THROUGH), "time-cond": val(READ),
+            "trace-ascii": val(WRITE_THROUGH), "upload-file": val(UPLOAD), url: val(URL), user: val(LABEL), "user-agent": val(LABEL), "write-out": val(INDIRECT),
             ...longSwitches(["append", "compressed", "disable", "fail", "get", "head", "include", "insecure", "junk-session-cookies", "list-only", "location", "netrc", "next", "no-buffer", "parallel", "proxytunnel", "remote-header-name", "remote-name", "remote-time", "show-error", "silent", "use-ascii", "verbose"]), ...BANNERS,
             manual: { arity: 0, mode: "banner" }, globoff: { arity: 0, literalValues: true },
         })],
@@ -497,6 +499,7 @@ const git = {
         merge: gitSubcommand("nqve", "S", "mFsX", ["message", "file", "strategy", "strategy-option", "into-name", "cleanup"]),
         stash: gitSubcommand("pkuaqS", "", "m", ["message", "pathspec-from-file"]),
         grep: GIT_GREP,
+        diff: { grammar: grammar({}, {}), operands: { rest: READ } },
         show: gitObjectSubcommand(),
         "cat-file": gitObjectSubcommand(switches("ptsep")),
         archive: gitObjectSubcommand({ o: val(WRITE) }, { output: val(WRITE), format: val(LABEL), prefix: val(LABEL), remote: val(LABEL) }),
@@ -568,15 +571,15 @@ const codeBodyRows = [
     { key: "compgen", grammars: [grammar({ ...switches("abcdefgjksuv"), ...values("oAGWPSXV"), F: val(COMMAND), C: val(SHELL_TEXT) })], body: "option-values", witness: BINARY },
     { key: "complete", grammars: [grammar({ ...switches("abcdefgjksuvDEIpr"), ...values("oAGWPSXV"), F: val(COMMAND), C: val(SHELL_TEXT) })], body: "option-values", witness: { declared: "a completion spec runs its command only when a person asks for a completion interactively" } },
 ];
-const copyGrammars = (bsdSuffixSwitch) => implementations(grammar({ S: val(LABEL, { effect: "writes" }), t: val(DESTINATION, { fillsLast: true }) }, { "target-directory": val(DESTINATION, { fillsLast: true }), suffix: val(LABEL, { effect: "writes" }), "no-preserve": val(LABEL), sparse: val(LABEL) }), { afterFirstOperand: "options" }, { ...(bsdSuffixSwitch ? { reads: { "-S": SWITCH } } : {}), lacks: [...(bsdSuffixSwitch ? [] : ["-S"]), "-t", "--target-directory", "--suffix", "--no-preserve", "--sparse"], afterFirstOperand: "operands" });
+const copyGrammars = (bsdSuffixSwitch, destination) => implementations(grammar({ S: val(LABEL, { effect: "writes" }), t: val(destination, { fillsLast: true }) }, { "target-directory": val(destination, { fillsLast: true }), suffix: val(LABEL, { effect: "writes" }), "no-preserve": val(LABEL), sparse: val(LABEL) }), { afterFirstOperand: "options" }, { ...(bsdSuffixSwitch ? { reads: { "-S": SWITCH } } : {}), lacks: [...(bsdSuffixSwitch ? [] : ["-S"]), "-t", "--target-directory", "--suffix", "--no-preserve", "--sparse"], afterFirstOperand: "operands" });
 const writerRows = [
     { key: "mkdir", grammars: [], operands: { rest: CREATED, dash: "file" }, witness: BINARY },
     { key: "touch", grammars: implementations(grammar({ h: { arity: 0, writesAt: ["landing", "entry"] } }, { "no-dereference": { arity: 0, writesAt: ["landing", "entry"] } }), {}, { lacks: ["--no-dereference"] }), operands: { rest: TOUCHED, dash: "file" }, witness: BINARY },
     { key: "rm", grammars: implementations(grammar({ ...switches("rR", { selects: "traversal" }), f: { arity: 0, mode: "forced" } }, { ...longSwitches(["recursive"], { selects: "traversal" }), force: { arity: 0, mode: "forced" } }), {}, { lacks: ["--recursive", "--force"] }), operands: { rest: REMOVED, dash: "file" }, witness: BINARY },
     { key: "rmdir", grammars: implementations(grammar({ p: { arity: 0, effect: "writes" } }, { parents: { arity: 0, effect: "writes" } }), {}, { lacks: ["--parents"] }), operands: { rest: REMOVED, dash: "file" }, witness: BINARY },
-    { key: "tee", grammars: [], operands: { rest: WRITE, dash: "file" }, witness: BINARY },
-    { key: "cp", grammars: copyGrammars(true), operands: { rest: COPY_SOURCE, last: DESTINATION, dash: "file" }, witness: BINARY },
-    { key: "mv", grammars: copyGrammars(false), operands: { rest: MOVE_SOURCE, last: DESTINATION, dash: "file" }, witness: BINARY },
+    { key: "tee", grammars: [], operands: { rest: WRITE_THROUGH, dash: "file" }, witness: BINARY },
+    { key: "cp", grammars: copyGrammars(true, COPY_DESTINATION), operands: { rest: COPY_SOURCE, last: COPY_DESTINATION, dash: "file" }, witness: BINARY },
+    { key: "mv", grammars: copyGrammars(false, MOVE_DESTINATION), operands: { rest: MOVE_SOURCE, last: MOVE_DESTINATION, dash: "file" }, witness: BINARY },
 ];
 const stdinReaders = [
     { key: "cat", grammars: [], operands: { stdinBelow: 1 }, witness: BINARY },

package/dist/tools/fs/shell-read-check.js

@@ -8,7 +8,8 @@ import { bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
 import { planShellReads } from "./shell-read-plan.js";
 import { createShellReadEstablisher, establishShellReadsLexically } from "./shell-read-establish.js";
 import { declaredReadDenyHomes, homeViewsAt } from "./read-deny-home.js";
-import { programArgs } from "./shell-read-write-targets.js";
+import { anyOptionWord, programArgs } from "./shell-read-write-targets.js";
+import { passesUnasked } from "./shell-read-device.js";
 import { programRow, selectedOptions } from "./program-read-model.js";
 import { allFindings, anyFaceGuards, decideShellRead, denyRowAtOrBelow, foldShellReadFindings, judgeEstablishedPlan, readRootGrantCandidateOf, stationGuards, writeFaceGuards, } from "./shell-read-judge.js";
 import { seatOf } from "../../core/tool-name-readings.js";
@@ -32,7 +33,6 @@ const WRITES_BENEATH = {
 };
 const isPattern = (f) => f.read.candidate.expands !== false && f.read.candidate.expands !== "unresolvable";
 const RESHAPES_TREE = new Set(["mv"]);
-const anyOptionWord = (words) => words.some((w) => w.startsWith("-"));
 const UNPLACED_OPTIONS = {
     rmdir: (ws) => selectedOptions(programRow("rmdir"), ws).some((o) => o.effect === "writes"),
     sed: (ws) => selectedOptions(programRow("sed"), ws).some((o) => o.value?.kind === "program-file"),
@@ -117,7 +117,7 @@ async function writeGuardsOf(judged, boundary, env, signal) {
     runs.forEach((s, at) => {
         for (const f of s.findings) {
             const written = f.read.written;
-            if (written === undefined || f.read.established === "unestablishable" || f.read.target === undefined)
+            if (written === undefined || f.read.established === "unestablishable" || f.read.target === undefined || passesUnasked(f.read.candidate))
                 continue;
             const child = written.child === true;
             const key = f.read.established === "canonical" || f.read.established === "expansion";