@sema-agent/core 7.49.2 → 7.49.4

package/dist/tools/fs/shell-read-device.d.ts

@@ -0,0 +1,92 @@
+/**
+ * THE STANDARD DEVICES — the spellings a shell command names for its own standard streams and terminal, which the
+ * containment question is not asked of, and which write nothing durable: ONE table, ONE predicate, read by every layer that
+ * would otherwise treat the word as a path — the shell read station's entries (an output or input redirection's target, a read
+ * operand, the content a program writes through an operand, a `git diff` operand) and the shape tier's two readings of "does
+ * this redirection write" (the read-only reader, the classify faces' data-free redirections).
+ *
+ * The table is the reference implementation's own device predicate (CC 2.1.296 `wwe`, cli296.js @18511591): the null
+ * device, the three standard streams, the terminal, any `/dev/fd/<digits>`, and `/proc/self/fd/{0,1,2}`. A word is such a
+ * spelling AS WRITTEN (quotes removed, nothing folded: `/dev/./null` is a path, not the null device).
+ *
+ * What exempts a word is more than its spelling, on both counts:
+ *  · it is I/O THROUGH the node — a redirection, a read operand, the content a program writes by opening the path
+ *    (`ReadCandidate.through`). A program that creates, unlinks, renames or retargets the path's directory ENTRY
+ *    (`rm`, `mv`, `mkdir`, `touch`, an in-place edit) is judged as it judges any path, and so is a word of a program the
+ *    station has no row for (`ln`, `chmod`): nothing says that program only opens it;
+ *  · no redirection of the same text can have rebound the descriptor the spelling names. A descriptor spelling is a
+ *    name for whatever that descriptor is bound to WHEN THE WORD IS OPENED: `3< f` or `exec 3>f` before it makes
+ *    `/dev/fd/3` the file `f`, and `1<f > /dev/stdout` reopens `f` for writing. Such a descriptor is judged at its landing
+ *    like any path. (One step stricter than the reference, which exempts the spelling whatever the text does.) A text the
+ *    consumer cannot read in full may bind anything, so it exempts no descriptor spelling; the null device and the
+ *    terminal name no descriptor and are exempt always.
+ *
+ * Beside the table, the generator devices (`/dev/zero`, `/dev/random`, `/dev/urandom`, `/dev/full`) are not a stream of the
+ * process: a read of one is no question only while the program read model knows the read is bounded
+ * (`byteBoundIsSmall`: `head -c N`), the same fact the read-only classifier's endless-device arm reads.
+ */
+import type { ReadCandidate, ReadCandidateProvenance, ShellReadPlan } from "./shell-read-plan.js";
+/** Is this word, as written, a standard device? `descriptor`: the descriptor number it names, when it names one. */
+export declare function standardDeviceOf(spelled: string): {
+    readonly descriptor?: number;
+} | undefined;
+/** The devices that PRODUCE data without end: read in bounded bytes they cost nothing, read unbounded they never finish. */
+export declare const GENERATOR_DEVICES: ReadonlySet<string>;
+/** A redirection, as far as binding a descriptor goes: its operator and the number written in front of it (the lexer's
+ *  `LexedRedirect` and the plan's `ShellReadRedirect` both are one). */
+export interface RedirectionBinding {
+    readonly op: string;
+    readonly fd?: number;
+}
+/** What a text does to its descriptors: how many redirections bind each (a count, so the one that IS the use of a spelling
+ *  can be taken out of it), and whether it may bind any it does not show. */
+export interface LineDescriptors {
+    /** Some part of the text the consumer cannot read in full may bind any descriptor (an unreadable text, a program or an
+     *  `eval` / `source` text it does not see, a numbered here-document whose number the lexer drops, a redirection whose number
+     *  the reader keeps no record of). */
+    unknown: boolean;
+    /** A `{name}` word — bash allocates a descriptor from 10 up for a redirection written `{name}>f`. */
+    named: boolean;
+    readonly bound: Map<number, number>;
+}
+export declare const newLineDescriptors: () => LineDescriptors;
+/** The descriptors one redirection binds: the number written in front of it, else the operator's own (`>` family: 1,
+ *  `<` family: 0, `&>`: both output streams). */
+export declare function descriptorsBoundBy(r: RedirectionBinding): readonly number[];
+export declare function bindDescriptors(into: LineDescriptors, r: RedirectionBinding): void;
+export declare const isNamedDescriptorWord: (raw: string) => boolean;
+/**
+ * THE predicate for a word and the text it stands in: is it a standard device (the table, as written) whose descriptor — if it
+ * names one — no redirection of the text rebinds? `self`: the descriptors the redirection that IS the use binds (a word that
+ * is not a redirection's target passes none).
+ */
+export declare function standardDeviceUnrebound(spelled: string, text: LineDescriptors, self: readonly number[]): boolean;
+/**
+ * The provenances whose word a program OPENS (or a redirection opens): a read operand or option value, an input
+ * redirection's source, an output redirection's target, and a word of a program the deployment did not list as a reader but
+ * whose row the station holds (`unlisted_word`, unless it waits for the filesystem — {@link ReadCandidate.speculative}: a
+ * program with no row may do anything with the word), and the root of a tree walk (`grep -r`, `diff`: a standard device is
+ * no directory to walk — an option that writes beyond the operands, `find -delete`, takes the exemption back, see
+ * `judgedCandidatesOf`). Not a directory a program changes into (`cd_target`), not a program, an assignment's value or a
+ * mount source.
+ */
+export declare const OPENED_PROVENANCES: ReadonlySet<ReadCandidateProvenance>;
+/**
+ * Does the containment question go unasked of this candidate? The one predicate every entry of the station reads: the plan
+ * marked the word a standard device no redirection of its text rebinds ({@link ReadCandidate.device}), and — for a word the
+ * program WRITES — the program writes its content through the path ({@link ReadCandidate.through}), not its entry.
+ */
+export declare function passesUnasked(candidate: ReadCandidate): boolean;
+/**
+ * What the whole text of a plan binds: every redirection of every segment — a single one, an `exec`'s, a `{name}` one included —
+ * and whether the text may bind more than it shows. The ONE computation behind the station's rebinding rule
+ * ({@link markStandardDevices}) and the shape tier's reading of a program's device operands (`tee /dev/fd/3`).
+ */
+export declare function descriptorsOfPlan(plan: ShellReadPlan): LineDescriptors;
+/**
+ * Mark every candidate of a whole plan (the nested plans included) that names a standard device the containment question
+ * is not asked of ({@link ReadCandidate.device}): the word is the table's, it is a word a program or a redirection opens,
+ * and no redirection of the text rebinds the descriptor it names. Computed once, over the text as a whole: whether a
+ * descriptor is rebound is a fact of the line, not of a segment.
+ */
+export declare function markStandardDevices(plan: ShellReadPlan): ShellReadPlan;

package/dist/tools/fs/shell-read-device.js

@@ -0,0 +1,109 @@
+const STANDARD_DEVICES = [
+    { spelled: /^\/dev\/null$/ },
+    { spelled: /^\/dev\/stdin$/, descriptor: () => 0 },
+    { spelled: /^\/dev\/stdout$/, descriptor: () => 1 },
+    { spelled: /^\/dev\/stderr$/, descriptor: () => 2 },
+    { spelled: /^\/dev\/tty$/ },
+    { spelled: /^\/dev\/fd\/(\d+)$/, descriptor: (m) => Number(m[1]) },
+    { spelled: /^\/proc\/self\/fd\/([0-2])$/, descriptor: (m) => Number(m[1]) },
+];
+export function standardDeviceOf(spelled) {
+    for (const row of STANDARD_DEVICES) {
+        const match = row.spelled.exec(spelled);
+        if (match !== null)
+            return row.descriptor === undefined ? {} : { descriptor: row.descriptor(match) };
+    }
+    return undefined;
+}
+export const GENERATOR_DEVICES = new Set(["/dev/zero", "/dev/random", "/dev/urandom", "/dev/full"]);
+export const newLineDescriptors = () => ({ unknown: false, named: false, bound: new Map() });
+export function descriptorsBoundBy(r) {
+    if (r.fd !== undefined)
+        return [r.fd];
+    if (r.op === "&>" || r.op === "&>>")
+        return [1, 2];
+    return [r.op === "<" || r.op === "<<<" || r.op === "<&" ? 0 : 1];
+}
+export function bindDescriptors(into, r) {
+    for (const fd of descriptorsBoundBy(r))
+        into.bound.set(fd, (into.bound.get(fd) ?? 0) + 1);
+}
+const NAMED_DESCRIPTOR_WORD = /^\{[A-Za-z_][A-Za-z0-9_]*\}$/;
+export const isNamedDescriptorWord = (raw) => NAMED_DESCRIPTOR_WORD.test(raw);
+function reboundBy(text, descriptor, self) {
+    if (text.unknown || (text.named && descriptor >= 3))
+        return true;
+    return (text.bound.get(descriptor) ?? 0) - (self.includes(descriptor) ? 1 : 0) > 0;
+}
+export function standardDeviceUnrebound(spelled, text, self) {
+    const device = standardDeviceOf(spelled);
+    return device !== undefined && (device.descriptor === undefined || !reboundBy(text, device.descriptor, self));
+}
+export const OPENED_PROVENANCES = new Set(["operand", "option_value", "stdin_redirect", "write_redirect_target", "unlisted_word", "traversal_root"]);
+export function passesUnasked(candidate) {
+    return candidate.device === true && (candidate.face !== "write" || candidate.through === true);
+}
+const SHELL_CODE_VERBS = new Set(["eval", "source", "."]);
+function collectDescriptors(plan, into) {
+    if (plan.unreadable !== undefined)
+        into.unknown = true;
+    for (const segment of plan.segments) {
+        if (segment.declines.length > 0 || segment.unreadProgramText !== undefined)
+            into.unknown = true;
+        if (segment.verb !== undefined && SHELL_CODE_VERBS.has(segment.verb.basename) && segment.nested.length === 0)
+            into.unknown = true;
+        if (segment.reads.some((c) => c.provenance === "program_path" && c.expands === "unresolvable"))
+            into.unknown = true;
+        for (const r of segment.redirects)
+            bindDescriptors(into, r);
+        if (segment.argv.some((w) => isNamedDescriptorWord(w.raw)))
+            into.named = true;
+        const text = segment.text.replace(/\\\r?\n/g, "");
+        if (/(?:^|[^<])<<(?!<)/.test(text)) {
+            if (/\d<<(?!<)/.test(text))
+                into.unknown = true;
+            else
+                into.bound.set(0, (into.bound.get(0) ?? 0) + 1);
+        }
+        for (const n of segment.nested)
+            collectDescriptors(n, into);
+    }
+}
+export function descriptorsOfPlan(plan) {
+    const into = newLineDescriptors();
+    collectDescriptors(plan, into);
+    return into;
+}
+export function markStandardDevices(plan) {
+    const text = descriptorsOfPlan(plan);
+    const mark = (c, self) => {
+        if (c.device === true || c.expands !== false || c.denyOnly === true || c.speculative !== undefined || !OPENED_PROVENANCES.has(c.provenance))
+            return c;
+        return standardDeviceUnrebound(c.spelled, text, self) ? { ...c, device: true } : c;
+    };
+    const marked = new Map();
+    const walk = (p) => {
+        const seen = marked.get(p);
+        if (seen !== undefined)
+            return seen;
+        const out = markedPlan(p);
+        marked.set(p, out);
+        return out;
+    };
+    const markedPlan = (p) => ({
+        ...p,
+        segments: p.segments.map((s) => {
+            const useOf = (c) => {
+                const r = s.redirects.find((x) => x.target !== undefined && x.target.raw === c.raw && x.target.provenance === c.provenance);
+                return r === undefined ? [] : descriptorsBoundBy(r);
+            };
+            return {
+                ...s,
+                reads: s.reads.map((c) => mark(c, c.provenance === "stdin_redirect" ? useOf(c) : [])),
+                redirects: s.redirects.map((r) => (r.target === undefined ? r : { ...r, target: mark(r.target, descriptorsBoundBy(r)) })),
+                nested: s.nested.map(walk),
+            };
+        }),
+    });
+    return walk(plan);
+}

package/dist/tools/fs/shell-read-establish.js

@@ -4,6 +4,7 @@ import { boundaryIsTheSandbox } from "../../core/remote-env.js";
 import { resolveOperandSpellings } from "./bash-readonly-classifier.js";
 import { judgedCandidatesOf, sedBackupNames } from "./shell-read-write-targets.js";
 import { movedReads, withHomeViews } from "./shell-read-identity.js";
+import { passesUnasked } from "./shell-read-device.js";
 const GLOB_METACHAR_RE = /[*?[]/;
 export const MAX_GLOB_DIRS = 256;
 export const MAX_GLOB_MATCHES = 8192;
@@ -569,7 +570,7 @@ function establishLegOver(seen, readRoots) {
                     out.push({ ...(await canonicalReadOf(candidate, m.path, [m.path], "expansion", folded, m.canonical, signal)), node: m.node, walked: true });
             };
             for (const [i, lexical] of lexicalReadsOf(candidate, boundary).entries()) {
-                if (lexical.established !== "lexical") {
+                if (lexical.established !== "lexical" || passesUnasked(candidate)) {
                     out.push(writtenAt(lexical, writtenSeats, writtenSeats.written.includes("landing") ? "landing" : "entry"));
                     continue;
                 }

package/dist/tools/fs/shell-read-judge.js

@@ -1,6 +1,7 @@
 import { hasWin32AliasedComponent, normalizeAbsPathLexically, withinAnyRoot } from "./safety.js";
 import { globInWord } from "./bash-readonly-classifier.js";
 import { readOfText } from "./shell-read-word.js";
+import { passesUnasked } from "./shell-read-device.js";
 import { skipsRootsContainment } from "./containment-face.js";
 export const SHELL_READ_FINDINGS = Object.freeze(["deny_hit", "outside_roots", "unestablishable", "declined", "identity_changed", "unanswered", "none"]);
 export const SHELL_READ_SEATS = Object.freeze(["full_shell", "readonly", "rejudge"]);
@@ -57,6 +58,8 @@ export function judgeRead(read, boundary) {
     const containment = containmentOf(read, boundary);
     if (read.candidate.denyOnly === true)
         return { read, kind: "none", containment };
+    if (passesUnasked(read.candidate))
+        return { read, kind: "none", containment: "open" };
     const provenance = read.candidate.provenance;
     if (provenance === "env_assignment" || (provenance === "program_path" && read.candidate.expands !== "unresolvable"))
         return { read, kind: "none", containment };
@@ -84,10 +87,8 @@ function containmentOf(read, boundary) {
         return "unknown";
     return withinAnyRoot(boundary.roots, read.target) ? "inside" : "outside";
 }
-const NULL_DEVICE = "/dev/null";
 function writeContainmentOf(read, boundary) {
-    const device = read.written?.seat === "landing" && read.candidate.expands === false && read.candidate.spelled === NULL_DEVICE;
-    if (read.written === undefined || read.candidate.denyOnly === true || device)
+    if (read.written === undefined || read.candidate.denyOnly === true || passesUnasked(read.candidate))
         return "open";
     const roots = boundary.writeRoots;
     if (roots === undefined || read.target === undefined)

package/dist/tools/fs/shell-read-plan.d.ts

@@ -84,6 +84,10 @@ export interface ReadCandidate {
      *  word) that is a candidate at all only where it exists as a file. Where the filesystem confirms it is not there (and
      *  nothing in the text writes or creates it), it is no read; a lexical establishment keeps it whole. */
     readonly speculative?: "containment" | "whole";
+    /** A standard device a program or redirection OPENS, its descriptor (if any) unrebound by the text ({@link markStandardDevices}). */
+    readonly device?: true;
+    /** Only beside `face: "write"`: the program writes the word's CONTENT through the path, not its ENTRY ({@link passesUnasked}). */
+    readonly through?: true;
 }
 /** How the shell reached one segment — what the base-candidate walk needs from the connectors. */
 export interface SegmentReach {
@@ -97,6 +101,7 @@ export interface SegmentReach {
 export interface ShellReadRedirect {
     readonly op: LexedRedirect["op"];
     readonly direction: "in" | "out" | "dup";
+    readonly fd?: number;
     readonly target?: ReadCandidate;
 }
 export interface ShellReadSegment {

package/dist/tools/fs/shell-read-plan.js

@@ -10,6 +10,7 @@ import { shellWordsOf } from "../../shell/shell-words.js";
 import { isAbsoluteForFamily } from "./safety.js";
 import { codeBodies, launchedInput, reentryText, scriptFileAt, stdinTextsOf } from "./shell-reentry-text.js";
 import { heldAt, plannedOnce, rebasePlan, startedAt, stdinFeeds } from "./shell-read-start.js";
+import { markStandardDevices } from "./shell-read-device.js";
 export const READ_CANDIDATE_PROVENANCES = Object.freeze([
     "operand",
     "option_value",
@@ -27,7 +28,8 @@ export const READ_CANDIDATE_PROVENANCES = Object.freeze([
 const NESTING_MAX = 4;
 const LOOP_END = shellWordsOf("loop_end"), LOOP_CONDITION = shellWordsOf("loop_condition"), COPROC = shellWordsOf("background"), RESERVED = shellWordsOf("rule_reserved");
 export function planShellReads(command, decl, depth = 0, start) {
-    return planText(command, decl, depth, start).plan;
+    const plan = planText(command, decl, depth, start).plan;
+    return depth === 0 ? markStandardDevices(plan) : plan;
 }
 function planText(command, decl, depth, start, from) {
     const shape = { grouped: false, backgrounded: false, strayRedirection: false };
@@ -209,7 +211,7 @@ function planText(command, decl, depth, start, from) {
                 ...(f.stdin !== undefined ? { stdin: f.stdin } : {}),
                 declines: f.declines,
                 reads: dedupe(f.reads).map(programRead),
-                redirects: f.redirects.map((r) => (r.target === undefined ? { op: r.op, direction: r.direction } : { op: r.op, direction: r.direction, target: withBases(r.target) })),
+                redirects: f.redirects.map((r) => ({ op: r.op, direction: r.direction, ...(r.fd !== undefined ? { fd: r.fd } : {}), ...(r.target !== undefined ? { target: withBases(r.target) } : {}) })),
                 ...(move !== undefined ? { baseMove: { target: typeof move.target === "string" ? move.target : withBases(move.target) } } : {}),
                 bases,
                 nested: f.nested.map((n) => (f.elsewhere?.has(n) === true ? n : rebasePlan(n, decl.cwd, moved && f.shellSide?.has(n) !== true ? "unmodelled" : bases, bases === "unmodelled" ? floor : bases))),
@@ -669,13 +671,14 @@ function relativeSpelling(spelled) {
     return !(isAbsoluteForFamily("own", spelled) || spelled.startsWith("~"));
 }
 function redirectFact(r, table, homeDir) {
+    const fd = r.fd !== undefined ? { fd: r.fd } : {};
     if (r.target === undefined)
-        return { op: r.op, direction: "dup" };
+        return { op: r.op, direction: "dup", ...fd };
     if (r.op === "<")
-        return { op: r.op, direction: "in", target: bare(readsOf([r.target], table, homeDir)[0], "stdin_redirect") };
+        return { op: r.op, direction: "in", ...fd, target: bare(readsOf([r.target], table, homeDir)[0], "stdin_redirect") };
     if (r.op === "<<<")
-        return { op: r.op, direction: "in" };
-    return { op: r.op, direction: "out", target: bare(readsOf([r.target], table, homeDir)[0], "write_redirect_target") };
+        return { op: r.op, direction: "in", ...fd };
+    return { op: r.op, direction: "out", ...fd, target: bare(readsOf([r.target], table, homeDir)[0], "write_redirect_target") };
 }
 function commandStringValue(row, toks, option) {
     const at = toks.findIndex((r) => r.folded === option);

package/dist/tools/fs/shell-read-write-targets.d.ts

@@ -9,6 +9,7 @@
  * program writes is its row's.
  */
 import type { ReadCandidate, ShellReadSegment } from "./shell-read-plan.js";
+import { type LineDescriptors } from "./shell-read-device.js";
 import { type WriteSeat } from "./program-read-model.js";
 export type { WriteSeat } from "./program-read-model.js";
 /** A word of a program's argv: its raw spelling (the plan's candidates are keyed by it) and its folded spelling. */
@@ -46,6 +47,19 @@ export interface JudgedCandidate {
     };
     readonly onlyIfExists?: ReadCandidate;
 }
+/** Is any of these words an option word (one starting with `-`)? The reference implementation's reading of a copy or a move: a
+ *  command with flags is not one whose paths it can validate (`--target-directory`, `--remove-destination`, a backup suffix
+ *  all change what is written where). */
+export declare const anyOptionWord: (words: readonly string[]) => boolean;
+/**
+ * Does this invocation write ONLY standard devices — what the shape tier reads as "writes nothing durable" for a PROGRAM (a
+ * redirection is the reader's own)? Every word any implementation's reading of the row writes ({@link writeReadings}; a word the
+ * reading names written at no seat, a copy's source, is read) is one the program writes THROUGH ({@link writesThrough}) and
+ * is a standard device no redirection of the line rebinds ({@link standardDeviceUnrebound}) — the station's own predicate
+ * (`passesUnasked`) over the same row facts, for the one entry a text-only reader has: `tee /dev/tty`, `cp a.txt /dev/stdout`.
+ * No program is named here: which programs may ask this is the caller's.
+ */
+export declare function writesOnlyStandardDevices(program: string, args: readonly string[], line: LineDescriptors): boolean;
 /** Every candidate a segment hands the judge: its reads minus the write targets, plus its `cd` target (the plan already
  *  lists it among the reads), plus its WRITE targets for the write face ({@link writeTargetsOf}), plus the deny-floor
  *  shadow of every unplaced home word ({@link denyFloorShadowsOf}) on both faces. A word the program only writes keeps

package/dist/tools/fs/shell-read-write-targets.js

@@ -1,6 +1,7 @@
 import { denyFloorShadowsOf } from "./shell-read-judge.js";
+import { GENERATOR_DEVICES, OPENED_PROVENANCES, passesUnasked, standardDeviceUnrebound } from "./shell-read-device.js";
 import { renamed } from "./shell-read-word.js";
-import { implementationsOf, programRow, selectedOptions, writeReadings } from "./program-read-model.js";
+import { byteBoundIsSmall, implementationsOf, programRow, readArgRoles, selectedOptions, subcommandOf, writeReadings } from "./program-read-model.js";
 import { programBasename, readProgramPosition } from "./bash-program-position.js";
 export function programArgs(segment) {
     const words = segment.argv.map((w) => ({ raw: w.raw, spelled: w.folded }));
@@ -11,6 +12,25 @@ export function sedBackupNames(name, suffix) {
     const appended = `${name}${suffix}`;
     return suffix.includes("*") ? [suffix.replace(/\*/g, () => name), appended] : [appended];
 }
+export const anyOptionWord = (words) => words.some((w) => w.startsWith("-"));
+function writesThrough(roles, row, words) {
+    const args = words.map((w) => w.spelled);
+    if (roles.length === 0 || readArgRoles(row, args).some((e) => e.kind === "option" && e.reading === "speculative"))
+        return false;
+    return roles.every((role) => role.through === true || (role.through === "plain" && !anyOptionWord(args)));
+}
+export function writesOnlyStandardDevices(program, args, line) {
+    const row = programRow(program);
+    if (row === undefined)
+        return false;
+    const words = args.map((a) => ({ raw: a, spelled: a }));
+    const readings = writeReadings(row, [...args]);
+    return (readings.length > 0 &&
+        readings.every((r) => {
+            const written = r.written.filter((w) => w.role.writtenAt?.length !== 0);
+            return !r.unexplained && written.length > 0 && writesThrough(written.map((w) => w.role), row, words) && written.every((w) => standardDeviceUnrebound(w.value ?? args[w.at], line, []));
+        }));
+}
 const WORD_PROVENANCES = new Set(["operand", "unlisted_word", "option_value"]);
 function writeOwnersOf(segment) {
     const pos = readProgramPosition(segment.argv);
@@ -30,18 +50,19 @@ function writeOwnersOf(segment) {
 function writeTargetsOf(segment) {
     const out = [];
     const writeOnly = new Set();
-    const write = (c, seats, written, child, onlyIfExists) => void out.push({ candidate: { ...c, face: "write" }, ...(seats !== undefined ? { seats } : {}), ...(written !== undefined ? { written } : {}), ...(child === true ? { child } : {}), ...(onlyIfExists !== undefined ? { onlyIfExists } : {}) });
+    const write = (c, seats, written, child, onlyIfExists, through) => void out.push({ candidate: { ...c, face: "write", ...(through === true ? { through } : {}) }, ...(seats !== undefined ? { seats } : {}), ...(written !== undefined ? { written } : {}), ...(child === true ? { child } : {}), ...(onlyIfExists !== undefined ? { onlyIfExists } : {}) });
     for (const r of segment.redirects)
         if (r.direction === "out" && r.target !== undefined)
-            write(r.target);
+            write(r.target, undefined, undefined, undefined, undefined, true);
     for (const c of segment.reads)
         if (c.provenance === "write_redirect_target")
-            write(c);
+            write(c, undefined, undefined, undefined, undefined, true);
     const owners = writeOwnersOf(segment).map(({ row, words, program }) => {
         const args = words.map((w) => w.spelled);
         const all = writeReadings(row, args);
-        const moved = [...new Set(implementationsOf(row).flatMap((view) => selectedOptions(view, args, "one-implementation")).flatMap((o) => o.writesAt ?? []))];
-        return { words, program, all, readings: all.filter((r) => r.written.length > 0 || (r.unexplained && r.operandRole !== undefined)), override: moved.length > 0 ? moved : undefined };
+        const selected = implementationsOf(row).flatMap((view) => selectedOptions(view, args, "one-implementation"));
+        const moved = [...new Set(selected.flatMap((o) => o.writesAt ?? []))];
+        return { row, words, program, all, readings: all.filter((r) => r.written.length > 0 || (r.unexplained && r.operandRole !== undefined)), override: moved.length > 0 ? moved : undefined, beyondOperands: selected.some((o) => o.effect === "writes" || o.effect === "executes") };
     });
     const edited = new Map();
     for (const c of segment.reads) {
@@ -77,7 +98,7 @@ function writeTargetsOf(segment) {
             const seats = stated ? [...new Set(roles.flatMap((role) => o.override ?? role.seats ?? ["landing"]))] : undefined;
             const written = unexplained || roles.some((role) => role.writtenAt === undefined) ? undefined : [...new Set(roles.flatMap((role) => role.writtenAt ?? []))];
             const speculative = readings < o.all.length && roles.every((role) => role.effect === "edit-in-place") ? c : undefined;
-            write(c, seats, written, undefined, speculative);
+            write(c, seats, written, undefined, speculative, !unexplained && writesThrough(roles, o.row, o.words) ? true : undefined);
             if (roles.some((role) => role.effect === "edit-in-place") && c.expands === false)
                 edited.set(o, [...(edited.get(o) ?? []), { candidate: c, ...(speculative !== undefined ? { onlyIfExists: speculative } : {}) }]);
         }
@@ -85,11 +106,25 @@ function writeTargetsOf(segment) {
             writeOnly.add(c);
     }
     for (const o of owners) {
-        for (const c of copyDestinationChildren(segment, o.words, o.readings))
+        for (const c of copyDestinationChildren(segment, o.row, o.words, o.readings))
             write(c, ["landing", "entry"], undefined, true);
         out.push(...backupTargetsOf(edited.get(o) ?? [], o.readings, o.override));
     }
-    return { targets: out, writeOnly };
+    const readWords = new Set();
+    for (const o of owners) {
+        if (!o.program)
+            continue;
+        const args = o.words.map((w) => w.spelled);
+        const found = subcommandOf(o.row, args);
+        const sub = found !== undefined && found.row.operands !== undefined ? found : undefined;
+        const at = sub === undefined ? 0 : sub.at + 1;
+        for (const e of readArgRoles(sub?.row ?? o.row, args.slice(at))) {
+            const role = e.kind === "operand" || e.kind === "value" ? e.role : undefined;
+            if (role?.kind === "path" && (role.effect === "read" || role.writtenAt?.length === 0))
+                readWords.add(o.words[at + e.at].raw);
+        }
+    }
+    return { targets: out, writeOnly, beyondOperands: owners.some((o) => o.beyondOperands), boundedRead: owners.some((o) => o.program && byteBoundIsSmall(o.row, o.words.map((w) => w.spelled))), readWords };
 }
 function backupTargetsOf(edited, readings, override) {
     const suffixes = [...new Set(readings.flatMap((r) => r.suffixes))];
@@ -98,7 +133,7 @@ function backupTargetsOf(edited, readings, override) {
         ? [{ candidate: { ...renamed(f, `${f.spelled}${suffix}`), face: "write" }, seats: ["entry"], followed: { operand: f, suffix }, ...(onlyIfExists !== undefined ? { onlyIfExists } : {}) }]
         : sedBackupNames(f.spelled, suffix).map((spelled) => ({ candidate: { ...renamed(f, spelled), face: "write" }, seats: ["entry"], ...(onlyIfExists !== undefined ? { onlyIfExists } : {}) }))));
 }
-function copyDestinationChildren(segment, words, readings) {
+function copyDestinationChildren(segment, row, words, readings) {
     const candidateOf = (raw) => segment.reads.find((c) => c.raw === raw && WORD_PROVENANCES.has(c.provenance));
     const children = new Map();
     for (const r of readings) {
@@ -109,6 +144,9 @@ function copyDestinationChildren(segment, words, readings) {
         const destCandidate = candidateOf(dest.raw);
         if (destCandidate !== undefined && destCandidate.expands !== false)
             continue;
+        const destRole = r.written.find((w) => w.at === r.copy.destination.at)?.role;
+        if (destCandidate !== undefined && destRole !== undefined && passesUnasked({ ...destCandidate, face: "write", ...(writesThrough([destRole], row, words) ? { through: true } : {}) }))
+            continue;
         for (const at of r.copy.sources) {
             const src = words[at];
             const source = candidateOf(src.raw);
@@ -123,8 +161,21 @@ function copyDestinationChildren(segment, words, readings) {
     return [...children.values()];
 }
 export function judgedCandidatesOf(segment) {
-    const { targets: writes, writeOnly } = writeTargetsOf(segment);
-    const reads = segment.reads.flatMap((c) => (c.provenance === "write_redirect_target" ? [] : [writeOnly.has(c) ? { ...c, denyOnly: true } : c]));
+    const { targets: writes, writeOnly, beyondOperands, boundedRead, readWords } = writeTargetsOf(segment);
+    const throughWritten = new Set(writes.filter((w) => w.candidate.through === true && w.candidate.device === true).map((w) => w.candidate.raw));
+    const opened = (c) => {
+        if (c.provenance === "unlisted_word" && c.device === true && !readWords.has(c.raw) && !throughWritten.has(c.raw)) {
+            const { device: _unread, ...judged } = c;
+            return judged;
+        }
+        if (boundedRead && c.device !== true && c.expands === false && c.speculative === undefined && c.denyOnly !== true && GENERATOR_DEVICES.has(c.spelled) && OPENED_PROVENANCES.has(c.provenance) && (c.provenance !== "unlisted_word" || readWords.has(c.raw)))
+            return { ...c, device: true };
+        if (!beyondOperands || c.device !== true || c.provenance === "stdin_redirect")
+            return c;
+        const { device: _device, ...judged } = c;
+        return judged;
+    };
+    const reads = segment.reads.flatMap((c) => (c.provenance === "write_redirect_target" ? [] : [opened(writeOnly.has(c) ? { ...c, denyOnly: true } : c)]));
     const plain = (cs) => cs.map((candidate) => ({ candidate }));
     return [...plain(reads), ...plain(denyFloorShadowsOf(reads)), ...writes, ...plain(denyFloorShadowsOf(writes.map((w) => w.candidate)))];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.49.2",
+  "version": "7.49.4",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.49.3.json

@@ -0,0 +1,142 @@
+{
+  "repo": "core",
+  "version": "7.49.3",
+  "from": "f1c55b07b7533fc1afdb428c6148d87e44744c2b",
+  "to": "2a6b9343850cb0c77213c7c9d8b52619b6a24148",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [
+    {
+      "type": "ReadCandidate",
+      "at": [
+        "src/tools/fs/shell-read-plan.ts:140"
+      ],
+      "added": [
+        "device",
+        "through"
+      ],
+      "addedDetail": [
+        {
+          "key": "device",
+          "optional": true
+        },
+        {
+          "key": "through",
+          "optional": true
+        }
+      ],
+      "addedRequired": [],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "type": "ShellReadRedirect",
+      "at": [
+        "src/tools/fs/shell-read-plan.ts:189"
+      ],
+      "via": "ShellReadSegment.redirects",
+      "added": [
+        "fd"
+      ],
+      "addedDetail": [
+        {
+          "key": "fd",
+          "optional": true
+        }
+      ],
+      "addedRequired": [],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 223,
+  "signatures": [
+    {
+      "name": "readOnlyShellVerdict",
+      "at": [
+        "src/core/read-only-shell.ts:111"
+      ],
+      "from": [
+        "(command: string, shape?: ShellCommandShape, cwd?: string): ReadOnlyShellVerdict"
+      ],
+      "to": [
+        "(command: string, shape?: ShellCommandShape, cwd?: string, bound?: (() => LineDescriptors) | LineDescriptors): ReadOnlyShellVerdict"
+      ],
+      "changes": [
+        {
+          "aspect": "param",
+          "detail": "+optional param `bound?: (() => LineDescriptors) | LineDescriptors`",
+          "breaking": false
+        }
+      ],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.classes",
+      "assertions": [
+        "G1.a",
+        "G2.a",
+        "G7.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.mandated",
+      "assertions": [
+        "G1.a",
+        "G7.a",
+        "G8.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.requiresRealApproval",
+      "assertions": [
+        "G8.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RedactionReport.findings",
+      "assertions": [
+        "G4.a",
+        "G5.a",
+        "G6.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ShellReadVerdict.finding",
+      "assertions": [
+        "G3.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [
+      "ReadCandidate",
+      "readOnlyShellVerdict"
+    ],
+    "server": [
+      "ReadCandidate",
+      "readOnlyShellVerdict"
+    ],
+    "sdk": [],
+    "note": "scanned cli@d23f3258 server@1922afc1 sdk@f1b30d4 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}