@sema-agent/core 7.49.3 → 7.49.4

package/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 7.49.4 — 2026-10-13
+
+**Rebuild of 7.49.3 — no source change.** The npm tarball of 7.49.3 (shasum `77a7fd37…`, now deprecated) carried the `dist/` of 7.49.2: it was published with `--ignore-scripts` from a checkout whose `dist/` had not been rebuilt (the release-candidate build and gates had run on a detached gate copy). None of the four 7.49.3 entries below (#1685, #1691, #1692, #1693) were in that package. 7.49.4 is the same source as tag `v7.49.3` built in the publishing checkout and compared byte-for-byte with the gated dist before publish; every 7.49.3 entry, criterion (`docs/release-criteria/7.49.3.json`) and wire manifest applies to 7.49.4. **Hard-breaking changes:** none. **Closed sets:** none. **Package exports:** +0 / −0 (`npm run handoff:diff v7.49.3 HEAD`). Consumers pinned to 7.49.3 must move to 7.49.4 (@server @cli @web-admin @client-core @test).
+
 ## 7.49.3 — 2026-10-13
 
 **Hard-breaking changes (#1685, #1693, #1691, #1692):** none. **Closed sets:** none (`READ_CANDIDATE_PROVENANCES`, `SHELL_READ_FINDINGS`, `ASK_CLASSES`, `PERSISTED_RULE_MANDATES` unchanged). **Package exports:** +0 / −0 names (`npm run handoff:diff v7.49.2 HEAD`: 2 609 → 2 609); member changes, all optional: `ReadCandidate.device` / `through`, and the plan's redirection record `fd` (`ShellReadSegment.redirects[]`). **Behavior:** #1685 makes the reference's device table a non-question at every entry of the shell read station and of the shape tier — a loosening for the standard streams (open to veto: it departs from the reference at the output-redirection, read-operand and write-operand entries), and a one-line tightening for `touch` / `mkdir` of the null device; #1693 makes an environment non-answer a bypass-immune ask — a tightening that restores what 7.49.2's own documentation promised; #1691 removes a value that was left in clear after a bearer token (a name=value glued to the token by `:` `,` `@` `!` `;` `|` `&`) and hides the character that joins it; #1692 gives the overlapping re-scan's work allowance a floor (2^17 characters of matches, binding below 16 KB of input only), so a short text with a dense line is read in full instead of losing every line behind it — a scan that still runs out of work masks to the end of the input exactly as in 7.49.2 — redaction only, nothing a run could do before is refused. **Known limits added / closed** (`docs/KNOWN-LIMITS.md`): KL-1644-a closed; KL-1685-b / -c / -d / -e / -f added; KL-958-f, KL-958-g, KL-958-h added (KL-958-d and KL-958-e restated).

package/dist/core/arg-summary.js

@@ -87,12 +87,13 @@ function removedRegion(pass, match, groups, inserted) {
     return [head, match.length - tail];
 }
 const SOLO_SCAN_WORK_PER_CHAR = 8;
+const SOLO_SCAN_WORK_FLOOR = 1 << 17;
 function soloHits(input, passes) {
     const hits = [];
     passes.forEach((pass, i) => {
         const re = new RegExp(pass.re.source, pass.re.flags.includes("g") ? pass.re.flags : `${pass.re.flags}g`);
         const rescans = pass.family !== undefined;
-        let work = SOLO_SCAN_WORK_PER_CHAR * input.length;
+        let work = Math.max(SOLO_SCAN_WORK_PER_CHAR * input.length, SOLO_SCAN_WORK_FLOOR);
         for (let m = re.exec(input); m !== null; m = re.exec(input)) {
             const at = m.index;
             const familyAt = () => (typeof pass.family === "function" ? pass.family(input, at) : pass.family);

package/dist/core/credential-vocabulary.js

@@ -16,7 +16,7 @@ const QUOTED_VALUE = [
     ...ESCAPED_QUOTES.map((q, i) => pairedValue(`(${BACKSLASHES})${q}`, `(?<!\\\\)(?:\\${i + 2})${q}`)),
     `${QUOTE}(?!${AFTER_CLOSING_QUOTE})${GLUED_RUN}`,
 ].join("|");
-const BEARER_TAIL = `(?<==)(?:(?!${QUOTE})${GLUED_RUN}|${QUOTED_VALUE})`;
+const BEARER_TAIL = `(?:(?!${QUOTE})\\S${GLUED_RUN}|(?<==)(?:${QUOTED_VALUE}))`;
 export const CREDENTIAL_VOCABULARY = {
     values: [
         { id: "github-token", kind: "prefixed-token", source: "arg-summary", confidence: "high", pass: "vendor-prefixed", match: new RegExp(`(?<![A-Za-z0-9])gh[opsur][-_]${VENDOR_BODY}`, "g"), strict: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/ },

package/dist/core/gate-fold.js

@@ -208,9 +208,13 @@ function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
         case "mandated": {
             if (verdict.details !== undefined)
                 pass.shellReadDetails = verdict.details;
+            const unreadable = verdict.finding === "unanswered";
             if (pass.decision.action !== "allow") {
-                if (pass.decision.action === "ask")
-                    pass.decision = { ...pass.decision, probeMandated: true };
+                if (pass.decision.action === "ask") {
+                    pass.decision = !unreadable
+                        ? { ...pass.decision, probeMandated: true }
+                        : { ...pass.decision, requiresRealApproval: true, ...(pass.decision.guard === undefined ? { guard: "unverifiable_shell_text" } : { foldedAskClasses: [...new Set([...(pass.decision.foldedAskClasses ?? []), "unverifiable_shell_text"])] }) };
+                }
                 return;
             }
             const candidate = normalizeReadRootCandidate(verdict.readRootCandidate);
@@ -218,7 +222,7 @@ function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
                 action: "ask",
                 message: shellReadAskMessage(toolName, verdict),
                 decisionReason: "safety",
-                probeMandated: true,
+                ...(unreadable ? { requiresRealApproval: true, guard: "unverifiable_shell_text" } : { probeMandated: true }),
                 ...(account !== undefined ? { probeReason: account } : {}),
                 ...(candidate !== undefined ? { probeReadRootCandidate: candidate } : {}),
             };

package/dist/core/permission-rule-model.js

@@ -9,7 +9,7 @@ import { heldValues } from "./tool-name-readings.js";
 import { carriesDotSegment, isAbsoluteForFamily, isIdentityDir, isPathIdentity, isShellRootedSpellingUnmapped, isUncIdentity, pathFamilyOf, pathIdentityOf } from "../tools/fs/safety.js";
 import { bindPathRules, judgeRuleRows, rowsWhereTheyLead } from "./path-rule-binding.js";
 import { readShellCommand } from "./shell-lexer.js";
-import { readOnlyLineObjection, readOnlyShellVerdict } from "./read-only-shell.js";
+import { lineDescriptorsOfText, readOnlyLineObjection, readOnlyShellVerdict } from "./read-only-shell.js";
 export const RULE_BEHAVIORS = Object.freeze(["deny", "ask", "allow"]);
 const RULE_BEHAVIOR_SET = new Set(RULE_BEHAVIORS);
 export function isRuleBehavior(v) {
@@ -951,7 +951,7 @@ export function findAdmittingRule(rules, call) {
         const dir = cdDirs[i];
         const first = firstEligibleAdmittingRule(rules, segment, call) ?? (dir !== undefined ? firstEligibleDirectoryRule(rules, dir, call) : undefined);
         if (first === undefined) {
-            if (readsOnlyAsSegment(segment, lineObjection))
+            if (readsOnlyAsSegment(segment, lineObjection, call.command))
                 continue;
             return undefined;
         }
@@ -960,8 +960,8 @@ export function findAdmittingRule(rules, call) {
     }
     return covering.length > 0 ? covering : undefined;
 }
-function readsOnlyAsSegment(segment, lineObjection) {
-    return lineObjection === undefined && !movesShellCursor(segment) && readOnlyShellVerdict(segment).readOnly;
+function readsOnlyAsSegment(segment, lineObjection, whole) {
+    return lineObjection === undefined && !movesShellCursor(segment) && readOnlyShellVerdict(segment, undefined, undefined, () => lineDescriptorsOfText(whole)).readOnly;
 }
 function firstEligibleDirectoryRule(rules, directory, call) {
     for (const rule of rules) {
@@ -1067,7 +1067,7 @@ export function segmentCoverageOf(command, rules, call) {
         const dir = cdDirs[i];
         return {
             segment: segment.trim(),
-            covered: readsOnlyAsSegment(segment, lineObjection) ||
+            covered: readsOnlyAsSegment(segment, lineObjection, folded) ||
                 firstEligibleAdmittingRule(rules.persisted, segment, call) !== undefined ||
                 (dir !== undefined && firstEligibleDirectoryRule(rules.persisted, dir, call) !== undefined) ||
                 proposed.some((p) => p.rule.tool === "Read"

package/dist/core/read-only-shell.d.ts

@@ -1,4 +1,5 @@
 import { type ShellCommandShape } from "./shell-lexer.js";
+import { type LineDescriptors } from "../tools/fs/shell-read-device.js";
 /** The reader's answer: read-only, or not — with the first reason the reading stopped on (a sentence a
  *  trace or a card can show; never adjudication input). */
 export type ReadOnlyShellVerdict = {
@@ -32,7 +33,7 @@ export declare function changesDirectoryBeforeGit(shape: ShellCommandShape, cwd?
  * stands ({@link changesDirectoryBeforeGit}). Anything the reading does not positively admit is NOT read-only — the
  * answer is never a guess, and a `false` costs one question.
  */
-export declare function readOnlyShellVerdict(command: string, shape?: ShellCommandShape, cwd?: string): ReadOnlyShellVerdict;
+export declare function readOnlyShellVerdict(command: string, shape?: ShellCommandShape, cwd?: string, bound?: LineDescriptors | (() => LineDescriptors)): ReadOnlyShellVerdict;
 /**
  * The reader's LINE-level objection to `command` — what makes no segment of it read-only in its place, whatever the
  * segment reads on its own: the line's structure, or a `cd` beside a `git` ({@link changesDirectoryBeforeGit}). A caller
@@ -40,3 +41,9 @@ export declare function readOnlyShellVerdict(command: string, shape?: ShellComma
  * line first.
  */
 export declare function readOnlyLineObjection(command: string, cwd?: string): string | undefined;
+/**
+ * What the whole text of `command` binds — every redirection of every segment (a single one, an `exec`'s, a `{name}` one included),
+ * read by the station's own computation ({@link descriptorsOfPlan}): the one binding map the shape tier's operand reading shares with
+ * the station's rebinding rule. The plan is read with no listed readers: the bindings do not depend on which programs read.
+ */
+export declare function lineDescriptorsOfText(command: string): LineDescriptors;

package/dist/core/read-only-shell.js

@@ -1,5 +1,8 @@
 import { posix } from "node:path";
 import { readShellCommand } from "./shell-lexer.js";
+import { descriptorsOfPlan, newLineDescriptors, standardDeviceUnrebound } from "../tools/fs/shell-read-device.js";
+import { planShellReads } from "../tools/fs/shell-read-plan.js";
+import { writesOnlyStandardDevices } from "../tools/fs/shell-read-write-targets.js";
 import { FIND_ACTION_PRIMARIES, FIND_NEWER_PRIMARY, FIND_VALUE_PRIMARIES, FLAG_VALUE_ACCEPTS, READ_ONLY_BARE_ONLY, READ_ONLY_BARE_PROGRAMS, READ_ONLY_COMMAND_TABLE, READ_ONLY_ENV_NAMES, READ_ONLY_EXACT_FORMS, READ_ONLY_GLOB_PROGRAMS, XARGS_READ_ONLY_TARGETS, dockerRetargetDanger, } from "./read-only-shell-table.js";
 const NOT = (reason) => ({ readOnly: false, reason });
 export const CD_GIT_COMPOUND_SENTENCE = "This command changes directory before running a version-control command, which can pick up untrusted hooks or repository configuration from the target directory. Approve only if you trust it.";
@@ -39,7 +42,7 @@ const PRINTF_ESCAPE = new RegExp(`%[^%a-zA-Z]*${PRINTF_LENGTH}\\\\[0-7xX]`);
 const PRINTF_NUMERIC = new RegExp(`%[-+ 0#']*[0-9.*]*${PRINTF_LENGTH}[diouxXeEfFgGaAn]`);
 const JQ_DANGER_FLAG = /^['"]?-[a-zA-Z]*[fL]/;
 const JQ_DANGER_TEXT = /--from-file|--rawfile|--slurpfile|--run-tests|--library-path|\benv\b|\$ENV\b|\binclude\b|\bimport\b/;
-export function readOnlyShellVerdict(command, shape = readShellCommand(command), cwd) {
+export function readOnlyShellVerdict(command, shape = readShellCommand(command), cwd, bound) {
     const line = lineStructureObjection(shape);
     if (line !== undefined)
         return NOT(line);
@@ -59,8 +62,12 @@ export function readOnlyShellVerdict(command, shape = readShellCommand(command),
     }
     if (changesDirectoryBeforeGit(shape, cwd))
         return NOT(CD_GIT_REASON);
+    const descriptors = newLineDescriptors();
+    descriptors.unknown = shape.segments.reduce((n, s) => n + s.redirections.length, 0) > 1;
+    let boundOfText;
+    const bindings = () => (boundOfText ??= (typeof bound === "function" ? bound() : bound) ?? lineDescriptorsOfText(command));
     for (const seg of shape.segments) {
-        const verdict = segmentVerdict(seg);
+        const verdict = segmentVerdict(seg, descriptors, bindings);
         if (!verdict.readOnly)
             return verdict;
     }
@@ -125,10 +132,10 @@ function peelBuiltinPrefix(words) {
             return t;
     }
 }
-function segmentVerdict(seg) {
+function segmentVerdict(seg, line, bindings) {
     for (const r of seg.redirections) {
         const target = r.target.text;
-        if (!READING_REDIRECTS.has(r.op) && target !== "/dev/null" && !(r.op === ">&" && /^\d+$/.test(target)))
+        if (!READING_REDIRECTS.has(r.op) && !standardDeviceUnrebound(target, line, []) && !(r.op === ">&" && /^\d+$/.test(target)))
             return NOT(`the redirection \`${r.op} ${target}\` writes`);
         if (/^\/dev\/(tcp|udp)\//.test(target))
             return NOT("a redirection to a network pseudo-device");
@@ -148,11 +155,17 @@ function segmentVerdict(seg) {
     const program = words[0];
     if (run.some((w) => expansionKind(w) === "glob"))
         return GLOB_PROGRAMS.has(program) ? READ_ONLY : NOT(`\`${program}\` with a glob argument — the glob may name anything`);
+    if (DEVICE_WRITERS.has(program) && writesOnlyStandardDevices(program, words.slice(1), bindings()))
+        return READ_ONLY;
     const structural = structuralReading(words);
     if (structural !== null)
         return structural ? READ_ONLY : NOT(`\`${program}\` with these arguments is not a read-only form`);
     return tableReading(words, run);
 }
+export function lineDescriptorsOfText(command) {
+    return descriptorsOfPlan(planShellReads(command, { readers: new Set(), cwd: "/", roots: [] }));
+}
+const DEVICE_WRITERS = new Set(["tee", "cp"]);
 function structuralReading(words) {
     const program = words[0];
     if (BARE_ONLY.has(program))
@@ -167,6 +180,8 @@ function structuralReading(words) {
             return form[0] !== "docker" || !dockerRetargetDanger(words);
     if (program === "echo")
         return true;
+    if (program === "exec")
+        return words.length === 1;
     if (program === "printf")
         return printfReading(words);
     if (program === "ls")

package/dist/tools/fs/bash-readonly-classifier.js

@@ -2,8 +2,9 @@ import { anchorSpelling, isAbsoluteForFamily, isBlockedDevicePath, isShellRooted
 import { PARSE_FAILURE_SENTENCE, UNRESOLVED_SENTENCE, argvOf, lexShell, literalTildeSpelling, } from "../../shell/lex.js";
 import { shellWordsOf } from "../../shell/shell-words.js";
 import { textBindsHome } from "./shell-read-bindings.js";
+import { GENERATOR_DEVICES, newLineDescriptors, bindDescriptors, isNamedDescriptorWord, standardDeviceUnrebound, descriptorsBoundBy } from "./shell-read-device.js";
 import { NOT_AUTO_ALLOWED, argvReentryUnjudged, isBareControlWord, programPositionRefusalSentence, readProgramPosition, } from "./bash-program-position.js";
-import { BLOCK_WORD_NAMES, attachedStdinFile, declaresOption, firstOperandSlot, opensNoOperand, programDelivery, programRow, programTextReadings, readArgRoles, readArgs, readProgramTextLanguage, runsShellText, selectedOptions, slotValueCandidates, suppliesFirstOperandSlot, takesSeparatedDatum, valuesAreLiteral, writeReadings, writesPath, } from "./program-read-model.js";
+import { BLOCK_WORD_NAMES, attachedStdinFile, byteBoundIsSmall, declaresOption, firstOperandSlot, opensNoOperand, programDelivery, programRow, programTextReadings, readArgs, readProgramTextLanguage, runsShellText, selectedOptions, slotValueCandidates, suppliesFirstOperandSlot, takesSeparatedDatum, valuesAreLiteral, writeReadings, writesPath, } from "./program-read-model.js";
 export const BASH_READONLY_DEFAULT_ALLOW = [
     "ls", "cat", "head", "tail", "wc", "pwd", "echo", "whoami", "uname",
     "grep", "cut", "tr", "basename", "dirname", "stat", "du", "df", "which",
@@ -82,8 +83,8 @@ export function carriesShellRedirection(text) {
     return SHELL_REDIRECTION_OPERATORS.test(text);
 }
 const SHELL_REDIRECTION_OPERATORS = /[<>]/;
-function isDataFreeRedirection(r) {
-    if (r.op === ">" && r.fd === 2 && r.target !== undefined && r.target.raw === "/dev/null")
+function isDataFreeRedirection(r, line) {
+    if (r.op === ">" && r.fd === 2 && r.target !== undefined && standardDeviceUnrebound(r.target.raw, line, descriptorsBoundBy(r)))
         return true;
     return r.op === ">&" && r.dup !== undefined && /^[12]$/.test(r.dup) && (r.fd === undefined || r.fd === 1 || r.fd === 2);
 }
@@ -103,6 +104,13 @@ export function strictResidualRefusal(lexed, source, opts = {}) {
     if ("parseFailure" in lexed)
         return inClass(source) || SHELL_EXPANSION_CHARS.test(source) ? reason : PARSE_FAILURE_SENTENCE[lexed.parseFailure.reason];
     const words = [];
+    const line = newLineDescriptors();
+    for (const s of lexed.segments)
+        for (const t of s.tokens)
+            if (t.kind === "redirect")
+                bindDescriptors(line, t);
+            else if (t.kind === "word" && isNamedDescriptorWord(t.raw))
+                line.named = true;
     for (const s of lexed.segments) {
         if (s.connector === "\n")
             return reason;
@@ -115,7 +123,7 @@ export function strictResidualRefusal(lexed, source, opts = {}) {
             }
             if (t.kind !== "redirect")
                 return reason;
-            if (opts.dataFreeRedirections === true && isDataFreeRedirection(t))
+            if (opts.dataFreeRedirections === true && isDataFreeRedirection(t, line))
                 continue;
             if (!tolerate)
                 return reason;
@@ -795,30 +803,6 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
         }
         unlistedSegments.add(si);
     }
-    const HEAD_AUTO_ALLOW_MAX = 1_000_000;
-    const byteBoundIsSmall = (row, args) => {
-        if (row === undefined)
-            return false;
-        let byteBound = false;
-        for (const e of readArgRoles(row, args)) {
-            if (e.kind === "operand" || e.kind === "end-of-options")
-                continue;
-            if (e.kind === "value" && e.spec?.bounds === "bytes") {
-                if (!/^\d+$/.test(args[e.at]) || Number(args[e.at]) > HEAD_AUTO_ALLOW_MAX)
-                    return false;
-                byteBound = true;
-                continue;
-            }
-            if (e.kind === "option" && typeof e.reading === "object" && e.reading.spec?.bounds === "bytes") {
-                if (!/^\d+$/.test(e.reading.attached) || Number(e.reading.attached) > HEAD_AUTO_ALLOW_MAX)
-                    return false;
-                byteBound = true;
-                continue;
-            }
-            return false;
-        }
-        return byteBound;
-    };
     const foldedSegments = [];
     let shapeRefusal = nameRefusal;
     for (let si = 0; si < segments.length; si++) {
@@ -896,7 +880,6 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
             shapeRefusal ??= `\`${name}\` in follow mode never terminates ${NOT_AUTO_ALLOWED}`;
             continue;
         }
-        const GENERATOR_DEVICES = new Set(["/dev/zero", "/dev/random", "/dev/urandom", "/dev/full"]);
         const deviceCandidates = openableWordsOf(row, restArgs);
         const deviceArgs = deviceCandidates.map((t) => resolveOperandLexically(undefined, t, boundary?.homeDir) ?? normalizeAbsPathLexically(t)).filter(isBlockedDevicePath);
         const rescuedByHead = byteBoundIsSmall(row, restArgs) && deviceArgs.every((d) => GENERATOR_DEVICES.has(d));

package/dist/tools/fs/program-read-model.d.ts

@@ -65,6 +65,11 @@ export type ArgRole =
      *  copy READS its sources; the write face still judges them, as the reference implementation does). Absent: every
      *  seat in {@link seats}. */
     readonly writtenAt?: readonly WriteSeat[];
+    /** A writing effect that writes the path's CONTENT by opening it (`true`), or does so only while the invocation carries
+     *  no option word (`"plain"`: a copy's `-f`, `-b` and `--remove-destination` replace the entry, `-l` and `-s` link it) —
+     *  the one kind of write a standard device takes without a containment question (`passesUnasked`). Absent: the program
+     *  creates, unlinks, renames or retargets the path's ENTRY, or the row does not say it only writes through. */
+    readonly through?: true | "plain";
     /** The program RUNS in this directory (`env -C <dir>`), or with it as its root (`sudo -R <dir>`): the paths it is
      *  handed resolve against it, not against the working directory the command line stands in. Or the program word is
      *  LOOKED UP in these directories (`env -P <dirs>`): which program runs is not the one the word names on the PATH. */
@@ -789,4 +794,14 @@ export declare function messageWords(program: string, words: readonly {
         readonly expansions: readonly WordPiece[];
     };
 }[], programIndex: number): Set<number>;
+/** The most bytes a read may be bounded to and still count as small (`head -c N`): a bound above it is no bound a person would call one. */
+export declare const SMALL_BYTE_BOUND_MAX = 1000000;
+/**
+ * Does this invocation read at most a SMALL, LITERAL number of BYTES? The rule is positive: the row's role walk ({@link readArgRoles})
+ * must find an option the row says bounds the output in BYTES ({@link OptionSpec.bounds}), valued with a plain integer within
+ * {@link SMALL_BYTE_BOUND_MAX}, and NO other option word — a line bound is no bound for a source that holds no newline, and a
+ * switch, a spelling the row does not explain or an option-shaped word past an operand makes the invocation unreadable, which is
+ * not exempt (the safe side). `false` for a program with no row.
+ */
+export declare function byteBoundIsSmall(row: ProgramRow | undefined, args: readonly string[]): boolean;
 export {};

package/dist/tools/fs/program-read-model.js

@@ -1351,3 +1351,27 @@ export function messageWords(program, words, programIndex) {
     }
     return out;
 }
+export const SMALL_BYTE_BOUND_MAX = 1_000_000;
+export function byteBoundIsSmall(row, args) {
+    if (row === undefined)
+        return false;
+    let byteBound = false;
+    for (const e of readArgRoles(row, args)) {
+        if (e.kind === "operand" || e.kind === "end-of-options")
+            continue;
+        if (e.kind === "value" && e.spec?.bounds === "bytes") {
+            if (!/^\d+$/.test(args[e.at]) || Number(args[e.at]) > SMALL_BYTE_BOUND_MAX)
+                return false;
+            byteBound = true;
+            continue;
+        }
+        if (e.kind === "option" && typeof e.reading === "object" && e.reading.spec?.bounds === "bytes") {
+            if (!/^\d+$/.test(e.reading.attached) || Number(e.reading.attached) > SMALL_BYTE_BOUND_MAX)
+                return false;
+            byteBound = true;
+            continue;
+        }
+        return false;
+    }
+    return byteBound;
+}

package/dist/tools/fs/program-read-model.rows.js

@@ -1,12 +1,14 @@
 import { shellWordsOf } from "../../shell/shell-words.js";
 const READ = { kind: "path", effect: "read" };
 const WRITE = { kind: "path", effect: "write" };
+const WRITE_THROUGH = { kind: "path", effect: "write", through: true };
 const CREATED = { kind: "path", effect: "create" };
 const TOUCHED = { kind: "path", effect: "create", seats: ["landing"] };
 const REMOVED = { kind: "path", effect: "write", seats: ["entry"] };
 const COPY_SOURCE = { kind: "path", effect: "write", seats: ["landing", "entry"], writtenAt: [] };
 const MOVE_SOURCE = { kind: "path", effect: "write", seats: ["landing", "entry"], writtenAt: ["entry"] };
-const DESTINATION = { kind: "path", effect: "write", seats: ["landing", "entry"] };
+const MOVE_DESTINATION = { kind: "path", effect: "write", seats: ["landing", "entry"] };
+const COPY_DESTINATION = { kind: "path", effect: "write", seats: ["landing", "entry"], through: "plain" };
 const EDITED = { kind: "path", effect: "edit-in-place", seats: ["entry"] };
 const NAMES = { kind: "path", effect: "names" };
 const INDIRECT = { kind: "path", effect: "read", valueForm: "indirect" };
@@ -203,18 +205,18 @@ const find = {
 const curl = {
     key: "curl",
     grammars: [grammar({
-            A: val(LABEL), b: val(INDIRECT), C: val(COUNT), c: val(WRITE), D: val(WRITE), d: val(INDIRECT), E: val(READ), e: val(LABEL),
-            F: val(FORM), H: val(HEADER), K: val(READ), m: val(COUNT), o: val(WRITE), P: val(LABEL), Q: val(LABEL), r: val(COUNT),
+            A: val(LABEL), b: val(INDIRECT), C: val(COUNT), c: val(WRITE_THROUGH), D: val(WRITE_THROUGH), d: val(INDIRECT), E: val(READ), e: val(LABEL),
+            F: val(FORM), H: val(HEADER), K: val(READ), m: val(COUNT), o: val(WRITE_THROUGH), P: val(LABEL), Q: val(LABEL), r: val(COUNT),
             T: val(UPLOAD), t: val(LABEL), U: val(LABEL), u: val(LABEL), w: val(INDIRECT), X: val(LABEL), x: val(LABEL), Y: val(COUNT),
             y: val(COUNT), z: val(READ), g: { arity: 0, literalValues: true },
             ...switches("#012346aBfGiIjJklLnNOpqRsSvZ"),
             ...switches("hMV", { mode: "banner" }),
         }, {
-            cacert: val(READ), capath: val(READ), cert: val(READ), config: val(READ), "connect-timeout": val(COUNT), cookie: val(INDIRECT), "cookie-jar": val(WRITE),
-            data: val(INDIRECT), "data-ascii": val(INDIRECT), "data-binary": val(INDIRECT), "data-raw": val(LABEL), "data-urlencode": val(FORM), "dump-header": val(WRITE),
-            form: val(FORM), "form-string": val(LABEL), header: val(HEADER), key: val(READ), "max-time": val(COUNT), "netrc-file": val(READ), output: val(WRITE),
-            proxy: val(LABEL), range: val(COUNT), referer: val(LABEL), request: val(LABEL), resolve: val(LABEL), trace: val(WRITE), "time-cond": val(READ),
-            "trace-ascii": val(WRITE), "upload-file": val(UPLOAD), url: val(URL), user: val(LABEL), "user-agent": val(LABEL), "write-out": val(INDIRECT),
+            cacert: val(READ), capath: val(READ), cert: val(READ), config: val(READ), "connect-timeout": val(COUNT), cookie: val(INDIRECT), "cookie-jar": val(WRITE_THROUGH),
+            data: val(INDIRECT), "data-ascii": val(INDIRECT), "data-binary": val(INDIRECT), "data-raw": val(LABEL), "data-urlencode": val(FORM), "dump-header": val(WRITE_THROUGH),
+            form: val(FORM), "form-string": val(LABEL), header: val(HEADER), key: val(READ), "max-time": val(COUNT), "netrc-file": val(READ), output: val(WRITE_THROUGH),
+            proxy: val(LABEL), range: val(COUNT), referer: val(LABEL), request: val(LABEL), resolve: val(LABEL), trace: val(WRITE_THROUGH), "time-cond": val(READ),
+            "trace-ascii": val(WRITE_THROUGH), "upload-file": val(UPLOAD), url: val(URL), user: val(LABEL), "user-agent": val(LABEL), "write-out": val(INDIRECT),
             ...longSwitches(["append", "compressed", "disable", "fail", "get", "head", "include", "insecure", "junk-session-cookies", "list-only", "location", "netrc", "next", "no-buffer", "parallel", "proxytunnel", "remote-header-name", "remote-name", "remote-time", "show-error", "silent", "use-ascii", "verbose"]), ...BANNERS,
             manual: { arity: 0, mode: "banner" }, globoff: { arity: 0, literalValues: true },
         })],
@@ -497,6 +499,7 @@ const git = {
         merge: gitSubcommand("nqve", "S", "mFsX", ["message", "file", "strategy", "strategy-option", "into-name", "cleanup"]),
         stash: gitSubcommand("pkuaqS", "", "m", ["message", "pathspec-from-file"]),
         grep: GIT_GREP,
+        diff: { grammar: grammar({}, {}), operands: { rest: READ } },
         show: gitObjectSubcommand(),
         "cat-file": gitObjectSubcommand(switches("ptsep")),
         archive: gitObjectSubcommand({ o: val(WRITE) }, { output: val(WRITE), format: val(LABEL), prefix: val(LABEL), remote: val(LABEL) }),
@@ -568,15 +571,15 @@ const codeBodyRows = [
     { key: "compgen", grammars: [grammar({ ...switches("abcdefgjksuv"), ...values("oAGWPSXV"), F: val(COMMAND), C: val(SHELL_TEXT) })], body: "option-values", witness: BINARY },
     { key: "complete", grammars: [grammar({ ...switches("abcdefgjksuvDEIpr"), ...values("oAGWPSXV"), F: val(COMMAND), C: val(SHELL_TEXT) })], body: "option-values", witness: { declared: "a completion spec runs its command only when a person asks for a completion interactively" } },
 ];
-const copyGrammars = (bsdSuffixSwitch) => implementations(grammar({ S: val(LABEL, { effect: "writes" }), t: val(DESTINATION, { fillsLast: true }) }, { "target-directory": val(DESTINATION, { fillsLast: true }), suffix: val(LABEL, { effect: "writes" }), "no-preserve": val(LABEL), sparse: val(LABEL) }), { afterFirstOperand: "options" }, { ...(bsdSuffixSwitch ? { reads: { "-S": SWITCH } } : {}), lacks: [...(bsdSuffixSwitch ? [] : ["-S"]), "-t", "--target-directory", "--suffix", "--no-preserve", "--sparse"], afterFirstOperand: "operands" });
+const copyGrammars = (bsdSuffixSwitch, destination) => implementations(grammar({ S: val(LABEL, { effect: "writes" }), t: val(destination, { fillsLast: true }) }, { "target-directory": val(destination, { fillsLast: true }), suffix: val(LABEL, { effect: "writes" }), "no-preserve": val(LABEL), sparse: val(LABEL) }), { afterFirstOperand: "options" }, { ...(bsdSuffixSwitch ? { reads: { "-S": SWITCH } } : {}), lacks: [...(bsdSuffixSwitch ? [] : ["-S"]), "-t", "--target-directory", "--suffix", "--no-preserve", "--sparse"], afterFirstOperand: "operands" });
 const writerRows = [
     { key: "mkdir", grammars: [], operands: { rest: CREATED, dash: "file" }, witness: BINARY },
     { key: "touch", grammars: implementations(grammar({ h: { arity: 0, writesAt: ["landing", "entry"] } }, { "no-dereference": { arity: 0, writesAt: ["landing", "entry"] } }), {}, { lacks: ["--no-dereference"] }), operands: { rest: TOUCHED, dash: "file" }, witness: BINARY },
     { key: "rm", grammars: implementations(grammar({ ...switches("rR", { selects: "traversal" }), f: { arity: 0, mode: "forced" } }, { ...longSwitches(["recursive"], { selects: "traversal" }), force: { arity: 0, mode: "forced" } }), {}, { lacks: ["--recursive", "--force"] }), operands: { rest: REMOVED, dash: "file" }, witness: BINARY },
     { key: "rmdir", grammars: implementations(grammar({ p: { arity: 0, effect: "writes" } }, { parents: { arity: 0, effect: "writes" } }), {}, { lacks: ["--parents"] }), operands: { rest: REMOVED, dash: "file" }, witness: BINARY },
-    { key: "tee", grammars: [], operands: { rest: WRITE, dash: "file" }, witness: BINARY },
-    { key: "cp", grammars: copyGrammars(true), operands: { rest: COPY_SOURCE, last: DESTINATION, dash: "file" }, witness: BINARY },
-    { key: "mv", grammars: copyGrammars(false), operands: { rest: MOVE_SOURCE, last: DESTINATION, dash: "file" }, witness: BINARY },
+    { key: "tee", grammars: [], operands: { rest: WRITE_THROUGH, dash: "file" }, witness: BINARY },
+    { key: "cp", grammars: copyGrammars(true, COPY_DESTINATION), operands: { rest: COPY_SOURCE, last: COPY_DESTINATION, dash: "file" }, witness: BINARY },
+    { key: "mv", grammars: copyGrammars(false, MOVE_DESTINATION), operands: { rest: MOVE_SOURCE, last: MOVE_DESTINATION, dash: "file" }, witness: BINARY },
 ];
 const stdinReaders = [
     { key: "cat", grammars: [], operands: { stdinBelow: 1 }, witness: BINARY },

package/dist/tools/fs/shell-read-check.js

@@ -8,7 +8,8 @@ import { bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
 import { planShellReads } from "./shell-read-plan.js";
 import { createShellReadEstablisher, establishShellReadsLexically } from "./shell-read-establish.js";
 import { declaredReadDenyHomes, homeViewsAt } from "./read-deny-home.js";
-import { programArgs } from "./shell-read-write-targets.js";
+import { anyOptionWord, programArgs } from "./shell-read-write-targets.js";
+import { passesUnasked } from "./shell-read-device.js";
 import { programRow, selectedOptions } from "./program-read-model.js";
 import { allFindings, anyFaceGuards, decideShellRead, denyRowAtOrBelow, foldShellReadFindings, judgeEstablishedPlan, readRootGrantCandidateOf, stationGuards, writeFaceGuards, } from "./shell-read-judge.js";
 import { seatOf } from "../../core/tool-name-readings.js";
@@ -32,7 +33,6 @@ const WRITES_BENEATH = {
 };
 const isPattern = (f) => f.read.candidate.expands !== false && f.read.candidate.expands !== "unresolvable";
 const RESHAPES_TREE = new Set(["mv"]);
-const anyOptionWord = (words) => words.some((w) => w.startsWith("-"));
 const UNPLACED_OPTIONS = {
     rmdir: (ws) => selectedOptions(programRow("rmdir"), ws).some((o) => o.effect === "writes"),
     sed: (ws) => selectedOptions(programRow("sed"), ws).some((o) => o.value?.kind === "program-file"),
@@ -117,7 +117,7 @@ async function writeGuardsOf(judged, boundary, env, signal) {
     runs.forEach((s, at) => {
         for (const f of s.findings) {
             const written = f.read.written;
-            if (written === undefined || f.read.established === "unestablishable" || f.read.target === undefined)
+            if (written === undefined || f.read.established === "unestablishable" || f.read.target === undefined || passesUnasked(f.read.candidate))
                 continue;
             const child = written.child === true;
             const key = f.read.established === "canonical" || f.read.established === "expansion";

package/dist/tools/fs/shell-read-device.d.ts

@@ -0,0 +1,92 @@
+/**
+ * THE STANDARD DEVICES — the spellings a shell command names for its own standard streams and terminal, which the
+ * containment question is not asked of, and which write nothing durable: ONE table, ONE predicate, read by every layer that
+ * would otherwise treat the word as a path — the shell read station's entries (an output or input redirection's target, a read
+ * operand, the content a program writes through an operand, a `git diff` operand) and the shape tier's two readings of "does
+ * this redirection write" (the read-only reader, the classify faces' data-free redirections).
+ *
+ * The table is the reference implementation's own device predicate (CC 2.1.296 `wwe`, cli296.js @18511591): the null
+ * device, the three standard streams, the terminal, any `/dev/fd/<digits>`, and `/proc/self/fd/{0,1,2}`. A word is such a
+ * spelling AS WRITTEN (quotes removed, nothing folded: `/dev/./null` is a path, not the null device).
+ *
+ * What exempts a word is more than its spelling, on both counts:
+ *  · it is I/O THROUGH the node — a redirection, a read operand, the content a program writes by opening the path
+ *    (`ReadCandidate.through`). A program that creates, unlinks, renames or retargets the path's directory ENTRY
+ *    (`rm`, `mv`, `mkdir`, `touch`, an in-place edit) is judged as it judges any path, and so is a word of a program the
+ *    station has no row for (`ln`, `chmod`): nothing says that program only opens it;
+ *  · no redirection of the same text can have rebound the descriptor the spelling names. A descriptor spelling is a
+ *    name for whatever that descriptor is bound to WHEN THE WORD IS OPENED: `3< f` or `exec 3>f` before it makes
+ *    `/dev/fd/3` the file `f`, and `1<f > /dev/stdout` reopens `f` for writing. Such a descriptor is judged at its landing
+ *    like any path. (One step stricter than the reference, which exempts the spelling whatever the text does.) A text the
+ *    consumer cannot read in full may bind anything, so it exempts no descriptor spelling; the null device and the
+ *    terminal name no descriptor and are exempt always.
+ *
+ * Beside the table, the generator devices (`/dev/zero`, `/dev/random`, `/dev/urandom`, `/dev/full`) are not a stream of the
+ * process: a read of one is no question only while the program read model knows the read is bounded
+ * (`byteBoundIsSmall`: `head -c N`), the same fact the read-only classifier's endless-device arm reads.
+ */
+import type { ReadCandidate, ReadCandidateProvenance, ShellReadPlan } from "./shell-read-plan.js";
+/** Is this word, as written, a standard device? `descriptor`: the descriptor number it names, when it names one. */
+export declare function standardDeviceOf(spelled: string): {
+    readonly descriptor?: number;
+} | undefined;
+/** The devices that PRODUCE data without end: read in bounded bytes they cost nothing, read unbounded they never finish. */
+export declare const GENERATOR_DEVICES: ReadonlySet<string>;
+/** A redirection, as far as binding a descriptor goes: its operator and the number written in front of it (the lexer's
+ *  `LexedRedirect` and the plan's `ShellReadRedirect` both are one). */
+export interface RedirectionBinding {
+    readonly op: string;
+    readonly fd?: number;
+}
+/** What a text does to its descriptors: how many redirections bind each (a count, so the one that IS the use of a spelling
+ *  can be taken out of it), and whether it may bind any it does not show. */
+export interface LineDescriptors {
+    /** Some part of the text the consumer cannot read in full may bind any descriptor (an unreadable text, a program or an
+     *  `eval` / `source` text it does not see, a numbered here-document whose number the lexer drops, a redirection whose number
+     *  the reader keeps no record of). */
+    unknown: boolean;
+    /** A `{name}` word — bash allocates a descriptor from 10 up for a redirection written `{name}>f`. */
+    named: boolean;
+    readonly bound: Map<number, number>;
+}
+export declare const newLineDescriptors: () => LineDescriptors;
+/** The descriptors one redirection binds: the number written in front of it, else the operator's own (`>` family: 1,
+ *  `<` family: 0, `&>`: both output streams). */
+export declare function descriptorsBoundBy(r: RedirectionBinding): readonly number[];
+export declare function bindDescriptors(into: LineDescriptors, r: RedirectionBinding): void;
+export declare const isNamedDescriptorWord: (raw: string) => boolean;
+/**
+ * THE predicate for a word and the text it stands in: is it a standard device (the table, as written) whose descriptor — if it
+ * names one — no redirection of the text rebinds? `self`: the descriptors the redirection that IS the use binds (a word that
+ * is not a redirection's target passes none).
+ */
+export declare function standardDeviceUnrebound(spelled: string, text: LineDescriptors, self: readonly number[]): boolean;
+/**
+ * The provenances whose word a program OPENS (or a redirection opens): a read operand or option value, an input
+ * redirection's source, an output redirection's target, and a word of a program the deployment did not list as a reader but
+ * whose row the station holds (`unlisted_word`, unless it waits for the filesystem — {@link ReadCandidate.speculative}: a
+ * program with no row may do anything with the word), and the root of a tree walk (`grep -r`, `diff`: a standard device is
+ * no directory to walk — an option that writes beyond the operands, `find -delete`, takes the exemption back, see
+ * `judgedCandidatesOf`). Not a directory a program changes into (`cd_target`), not a program, an assignment's value or a
+ * mount source.
+ */
+export declare const OPENED_PROVENANCES: ReadonlySet<ReadCandidateProvenance>;
+/**
+ * Does the containment question go unasked of this candidate? The one predicate every entry of the station reads: the plan
+ * marked the word a standard device no redirection of its text rebinds ({@link ReadCandidate.device}), and — for a word the
+ * program WRITES — the program writes its content through the path ({@link ReadCandidate.through}), not its entry.
+ */
+export declare function passesUnasked(candidate: ReadCandidate): boolean;
+/**
+ * What the whole text of a plan binds: every redirection of every segment — a single one, an `exec`'s, a `{name}` one included —
+ * and whether the text may bind more than it shows. The ONE computation behind the station's rebinding rule
+ * ({@link markStandardDevices}) and the shape tier's reading of a program's device operands (`tee /dev/fd/3`).
+ */
+export declare function descriptorsOfPlan(plan: ShellReadPlan): LineDescriptors;
+/**
+ * Mark every candidate of a whole plan (the nested plans included) that names a standard device the containment question
+ * is not asked of ({@link ReadCandidate.device}): the word is the table's, it is a word a program or a redirection opens,
+ * and no redirection of the text rebinds the descriptor it names. Computed once, over the text as a whole: whether a
+ * descriptor is rebound is a fact of the line, not of a segment.
+ */
+export declare function markStandardDevices(plan: ShellReadPlan): ShellReadPlan;

package/dist/tools/fs/shell-read-device.js

@@ -0,0 +1,109 @@
+const STANDARD_DEVICES = [
+    { spelled: /^\/dev\/null$/ },
+    { spelled: /^\/dev\/stdin$/, descriptor: () => 0 },
+    { spelled: /^\/dev\/stdout$/, descriptor: () => 1 },
+    { spelled: /^\/dev\/stderr$/, descriptor: () => 2 },
+    { spelled: /^\/dev\/tty$/ },
+    { spelled: /^\/dev\/fd\/(\d+)$/, descriptor: (m) => Number(m[1]) },
+    { spelled: /^\/proc\/self\/fd\/([0-2])$/, descriptor: (m) => Number(m[1]) },
+];
+export function standardDeviceOf(spelled) {
+    for (const row of STANDARD_DEVICES) {
+        const match = row.spelled.exec(spelled);
+        if (match !== null)
+            return row.descriptor === undefined ? {} : { descriptor: row.descriptor(match) };
+    }
+    return undefined;
+}
+export const GENERATOR_DEVICES = new Set(["/dev/zero", "/dev/random", "/dev/urandom", "/dev/full"]);
+export const newLineDescriptors = () => ({ unknown: false, named: false, bound: new Map() });
+export function descriptorsBoundBy(r) {
+    if (r.fd !== undefined)
+        return [r.fd];
+    if (r.op === "&>" || r.op === "&>>")
+        return [1, 2];
+    return [r.op === "<" || r.op === "<<<" || r.op === "<&" ? 0 : 1];
+}
+export function bindDescriptors(into, r) {
+    for (const fd of descriptorsBoundBy(r))
+        into.bound.set(fd, (into.bound.get(fd) ?? 0) + 1);
+}
+const NAMED_DESCRIPTOR_WORD = /^\{[A-Za-z_][A-Za-z0-9_]*\}$/;
+export const isNamedDescriptorWord = (raw) => NAMED_DESCRIPTOR_WORD.test(raw);
+function reboundBy(text, descriptor, self) {
+    if (text.unknown || (text.named && descriptor >= 3))
+        return true;
+    return (text.bound.get(descriptor) ?? 0) - (self.includes(descriptor) ? 1 : 0) > 0;
+}
+export function standardDeviceUnrebound(spelled, text, self) {
+    const device = standardDeviceOf(spelled);
+    return device !== undefined && (device.descriptor === undefined || !reboundBy(text, device.descriptor, self));
+}
+export const OPENED_PROVENANCES = new Set(["operand", "option_value", "stdin_redirect", "write_redirect_target", "unlisted_word", "traversal_root"]);
+export function passesUnasked(candidate) {
+    return candidate.device === true && (candidate.face !== "write" || candidate.through === true);
+}
+const SHELL_CODE_VERBS = new Set(["eval", "source", "."]);
+function collectDescriptors(plan, into) {
+    if (plan.unreadable !== undefined)
+        into.unknown = true;
+    for (const segment of plan.segments) {
+        if (segment.declines.length > 0 || segment.unreadProgramText !== undefined)
+            into.unknown = true;
+        if (segment.verb !== undefined && SHELL_CODE_VERBS.has(segment.verb.basename) && segment.nested.length === 0)
+            into.unknown = true;
+        if (segment.reads.some((c) => c.provenance === "program_path" && c.expands === "unresolvable"))
+            into.unknown = true;
+        for (const r of segment.redirects)
+            bindDescriptors(into, r);
+        if (segment.argv.some((w) => isNamedDescriptorWord(w.raw)))
+            into.named = true;
+        const text = segment.text.replace(/\\\r?\n/g, "");
+        if (/(?:^|[^<])<<(?!<)/.test(text)) {
+            if (/\d<<(?!<)/.test(text))
+                into.unknown = true;
+            else
+                into.bound.set(0, (into.bound.get(0) ?? 0) + 1);
+        }
+        for (const n of segment.nested)
+            collectDescriptors(n, into);
+    }
+}
+export function descriptorsOfPlan(plan) {
+    const into = newLineDescriptors();
+    collectDescriptors(plan, into);
+    return into;
+}
+export function markStandardDevices(plan) {
+    const text = descriptorsOfPlan(plan);
+    const mark = (c, self) => {
+        if (c.device === true || c.expands !== false || c.denyOnly === true || c.speculative !== undefined || !OPENED_PROVENANCES.has(c.provenance))
+            return c;
+        return standardDeviceUnrebound(c.spelled, text, self) ? { ...c, device: true } : c;
+    };
+    const marked = new Map();
+    const walk = (p) => {
+        const seen = marked.get(p);
+        if (seen !== undefined)
+            return seen;
+        const out = markedPlan(p);
+        marked.set(p, out);
+        return out;
+    };
+    const markedPlan = (p) => ({
+        ...p,
+        segments: p.segments.map((s) => {
+            const useOf = (c) => {
+                const r = s.redirects.find((x) => x.target !== undefined && x.target.raw === c.raw && x.target.provenance === c.provenance);
+                return r === undefined ? [] : descriptorsBoundBy(r);
+            };
+            return {
+                ...s,
+                reads: s.reads.map((c) => mark(c, c.provenance === "stdin_redirect" ? useOf(c) : [])),
+                redirects: s.redirects.map((r) => (r.target === undefined ? r : { ...r, target: mark(r.target, descriptorsBoundBy(r)) })),
+                nested: s.nested.map(walk),
+            };
+        }),
+    });
+    return walk(plan);
+}

package/dist/tools/fs/shell-read-establish.js

@@ -4,6 +4,7 @@ import { boundaryIsTheSandbox } from "../../core/remote-env.js";
 import { resolveOperandSpellings } from "./bash-readonly-classifier.js";
 import { judgedCandidatesOf, sedBackupNames } from "./shell-read-write-targets.js";
 import { movedReads, withHomeViews } from "./shell-read-identity.js";
+import { passesUnasked } from "./shell-read-device.js";
 const GLOB_METACHAR_RE = /[*?[]/;
 export const MAX_GLOB_DIRS = 256;
 export const MAX_GLOB_MATCHES = 8192;
@@ -569,7 +570,7 @@ function establishLegOver(seen, readRoots) {
                     out.push({ ...(await canonicalReadOf(candidate, m.path, [m.path], "expansion", folded, m.canonical, signal)), node: m.node, walked: true });
             };
             for (const [i, lexical] of lexicalReadsOf(candidate, boundary).entries()) {
-                if (lexical.established !== "lexical") {
+                if (lexical.established !== "lexical" || passesUnasked(candidate)) {
                     out.push(writtenAt(lexical, writtenSeats, writtenSeats.written.includes("landing") ? "landing" : "entry"));
                     continue;
                 }

package/dist/tools/fs/shell-read-judge.js

@@ -1,6 +1,7 @@
 import { hasWin32AliasedComponent, normalizeAbsPathLexically, withinAnyRoot } from "./safety.js";
 import { globInWord } from "./bash-readonly-classifier.js";
 import { readOfText } from "./shell-read-word.js";
+import { passesUnasked } from "./shell-read-device.js";
 import { skipsRootsContainment } from "./containment-face.js";
 export const SHELL_READ_FINDINGS = Object.freeze(["deny_hit", "outside_roots", "unestablishable", "declined", "identity_changed", "unanswered", "none"]);
 export const SHELL_READ_SEATS = Object.freeze(["full_shell", "readonly", "rejudge"]);
@@ -57,6 +58,8 @@ export function judgeRead(read, boundary) {
     const containment = containmentOf(read, boundary);
     if (read.candidate.denyOnly === true)
         return { read, kind: "none", containment };
+    if (passesUnasked(read.candidate))
+        return { read, kind: "none", containment: "open" };
     const provenance = read.candidate.provenance;
     if (provenance === "env_assignment" || (provenance === "program_path" && read.candidate.expands !== "unresolvable"))
         return { read, kind: "none", containment };
@@ -84,10 +87,8 @@ function containmentOf(read, boundary) {
         return "unknown";
     return withinAnyRoot(boundary.roots, read.target) ? "inside" : "outside";
 }
-const NULL_DEVICE = "/dev/null";
 function writeContainmentOf(read, boundary) {
-    const device = read.written?.seat === "landing" && read.candidate.expands === false && read.candidate.spelled === NULL_DEVICE;
-    if (read.written === undefined || read.candidate.denyOnly === true || device)
+    if (read.written === undefined || read.candidate.denyOnly === true || passesUnasked(read.candidate))
         return "open";
     const roots = boundary.writeRoots;
     if (roots === undefined || read.target === undefined)

package/dist/tools/fs/shell-read-plan.d.ts

@@ -84,6 +84,10 @@ export interface ReadCandidate {
      *  word) that is a candidate at all only where it exists as a file. Where the filesystem confirms it is not there (and
      *  nothing in the text writes or creates it), it is no read; a lexical establishment keeps it whole. */
     readonly speculative?: "containment" | "whole";
+    /** A standard device a program or redirection OPENS, its descriptor (if any) unrebound by the text ({@link markStandardDevices}). */
+    readonly device?: true;
+    /** Only beside `face: "write"`: the program writes the word's CONTENT through the path, not its ENTRY ({@link passesUnasked}). */
+    readonly through?: true;
 }
 /** How the shell reached one segment — what the base-candidate walk needs from the connectors. */
 export interface SegmentReach {
@@ -97,6 +101,7 @@ export interface SegmentReach {
 export interface ShellReadRedirect {
     readonly op: LexedRedirect["op"];
     readonly direction: "in" | "out" | "dup";
+    readonly fd?: number;
     readonly target?: ReadCandidate;
 }
 export interface ShellReadSegment {

package/dist/tools/fs/shell-read-plan.js

@@ -10,6 +10,7 @@ import { shellWordsOf } from "../../shell/shell-words.js";
 import { isAbsoluteForFamily } from "./safety.js";
 import { codeBodies, launchedInput, reentryText, scriptFileAt, stdinTextsOf } from "./shell-reentry-text.js";
 import { heldAt, plannedOnce, rebasePlan, startedAt, stdinFeeds } from "./shell-read-start.js";
+import { markStandardDevices } from "./shell-read-device.js";
 export const READ_CANDIDATE_PROVENANCES = Object.freeze([
     "operand",
     "option_value",
@@ -27,7 +28,8 @@ export const READ_CANDIDATE_PROVENANCES = Object.freeze([
 const NESTING_MAX = 4;
 const LOOP_END = shellWordsOf("loop_end"), LOOP_CONDITION = shellWordsOf("loop_condition"), COPROC = shellWordsOf("background"), RESERVED = shellWordsOf("rule_reserved");
 export function planShellReads(command, decl, depth = 0, start) {
-    return planText(command, decl, depth, start).plan;
+    const plan = planText(command, decl, depth, start).plan;
+    return depth === 0 ? markStandardDevices(plan) : plan;
 }
 function planText(command, decl, depth, start, from) {
     const shape = { grouped: false, backgrounded: false, strayRedirection: false };
@@ -209,7 +211,7 @@ function planText(command, decl, depth, start, from) {
                 ...(f.stdin !== undefined ? { stdin: f.stdin } : {}),
                 declines: f.declines,
                 reads: dedupe(f.reads).map(programRead),
-                redirects: f.redirects.map((r) => (r.target === undefined ? { op: r.op, direction: r.direction } : { op: r.op, direction: r.direction, target: withBases(r.target) })),
+                redirects: f.redirects.map((r) => ({ op: r.op, direction: r.direction, ...(r.fd !== undefined ? { fd: r.fd } : {}), ...(r.target !== undefined ? { target: withBases(r.target) } : {}) })),
                 ...(move !== undefined ? { baseMove: { target: typeof move.target === "string" ? move.target : withBases(move.target) } } : {}),
                 bases,
                 nested: f.nested.map((n) => (f.elsewhere?.has(n) === true ? n : rebasePlan(n, decl.cwd, moved && f.shellSide?.has(n) !== true ? "unmodelled" : bases, bases === "unmodelled" ? floor : bases))),
@@ -669,13 +671,14 @@ function relativeSpelling(spelled) {
     return !(isAbsoluteForFamily("own", spelled) || spelled.startsWith("~"));
 }
 function redirectFact(r, table, homeDir) {
+    const fd = r.fd !== undefined ? { fd: r.fd } : {};
     if (r.target === undefined)
-        return { op: r.op, direction: "dup" };
+        return { op: r.op, direction: "dup", ...fd };
     if (r.op === "<")
-        return { op: r.op, direction: "in", target: bare(readsOf([r.target], table, homeDir)[0], "stdin_redirect") };
+        return { op: r.op, direction: "in", ...fd, target: bare(readsOf([r.target], table, homeDir)[0], "stdin_redirect") };
     if (r.op === "<<<")
-        return { op: r.op, direction: "in" };
-    return { op: r.op, direction: "out", target: bare(readsOf([r.target], table, homeDir)[0], "write_redirect_target") };
+        return { op: r.op, direction: "in", ...fd };
+    return { op: r.op, direction: "out", ...fd, target: bare(readsOf([r.target], table, homeDir)[0], "write_redirect_target") };
 }
 function commandStringValue(row, toks, option) {
     const at = toks.findIndex((r) => r.folded === option);

package/dist/tools/fs/shell-read-write-targets.d.ts

@@ -9,6 +9,7 @@
  * program writes is its row's.
  */
 import type { ReadCandidate, ShellReadSegment } from "./shell-read-plan.js";
+import { type LineDescriptors } from "./shell-read-device.js";
 import { type WriteSeat } from "./program-read-model.js";
 export type { WriteSeat } from "./program-read-model.js";
 /** A word of a program's argv: its raw spelling (the plan's candidates are keyed by it) and its folded spelling. */
@@ -46,6 +47,19 @@ export interface JudgedCandidate {
     };
     readonly onlyIfExists?: ReadCandidate;
 }
+/** Is any of these words an option word (one starting with `-`)? The reference implementation's reading of a copy or a move: a
+ *  command with flags is not one whose paths it can validate (`--target-directory`, `--remove-destination`, a backup suffix
+ *  all change what is written where). */
+export declare const anyOptionWord: (words: readonly string[]) => boolean;
+/**
+ * Does this invocation write ONLY standard devices — what the shape tier reads as "writes nothing durable" for a PROGRAM (a
+ * redirection is the reader's own)? Every word any implementation's reading of the row writes ({@link writeReadings}; a word the
+ * reading names written at no seat, a copy's source, is read) is one the program writes THROUGH ({@link writesThrough}) and
+ * is a standard device no redirection of the line rebinds ({@link standardDeviceUnrebound}) — the station's own predicate
+ * (`passesUnasked`) over the same row facts, for the one entry a text-only reader has: `tee /dev/tty`, `cp a.txt /dev/stdout`.
+ * No program is named here: which programs may ask this is the caller's.
+ */
+export declare function writesOnlyStandardDevices(program: string, args: readonly string[], line: LineDescriptors): boolean;
 /** Every candidate a segment hands the judge: its reads minus the write targets, plus its `cd` target (the plan already
  *  lists it among the reads), plus its WRITE targets for the write face ({@link writeTargetsOf}), plus the deny-floor
  *  shadow of every unplaced home word ({@link denyFloorShadowsOf}) on both faces. A word the program only writes keeps

package/dist/tools/fs/shell-read-write-targets.js

@@ -1,6 +1,7 @@
 import { denyFloorShadowsOf } from "./shell-read-judge.js";
+import { GENERATOR_DEVICES, OPENED_PROVENANCES, passesUnasked, standardDeviceUnrebound } from "./shell-read-device.js";
 import { renamed } from "./shell-read-word.js";
-import { implementationsOf, programRow, selectedOptions, writeReadings } from "./program-read-model.js";
+import { byteBoundIsSmall, implementationsOf, programRow, readArgRoles, selectedOptions, subcommandOf, writeReadings } from "./program-read-model.js";
 import { programBasename, readProgramPosition } from "./bash-program-position.js";
 export function programArgs(segment) {
     const words = segment.argv.map((w) => ({ raw: w.raw, spelled: w.folded }));
@@ -11,6 +12,25 @@ export function sedBackupNames(name, suffix) {
     const appended = `${name}${suffix}`;
     return suffix.includes("*") ? [suffix.replace(/\*/g, () => name), appended] : [appended];
 }
+export const anyOptionWord = (words) => words.some((w) => w.startsWith("-"));
+function writesThrough(roles, row, words) {
+    const args = words.map((w) => w.spelled);
+    if (roles.length === 0 || readArgRoles(row, args).some((e) => e.kind === "option" && e.reading === "speculative"))
+        return false;
+    return roles.every((role) => role.through === true || (role.through === "plain" && !anyOptionWord(args)));
+}
+export function writesOnlyStandardDevices(program, args, line) {
+    const row = programRow(program);
+    if (row === undefined)
+        return false;
+    const words = args.map((a) => ({ raw: a, spelled: a }));
+    const readings = writeReadings(row, [...args]);
+    return (readings.length > 0 &&
+        readings.every((r) => {
+            const written = r.written.filter((w) => w.role.writtenAt?.length !== 0);
+            return !r.unexplained && written.length > 0 && writesThrough(written.map((w) => w.role), row, words) && written.every((w) => standardDeviceUnrebound(w.value ?? args[w.at], line, []));
+        }));
+}
 const WORD_PROVENANCES = new Set(["operand", "unlisted_word", "option_value"]);
 function writeOwnersOf(segment) {
     const pos = readProgramPosition(segment.argv);
@@ -30,18 +50,19 @@ function writeOwnersOf(segment) {
 function writeTargetsOf(segment) {
     const out = [];
     const writeOnly = new Set();
-    const write = (c, seats, written, child, onlyIfExists) => void out.push({ candidate: { ...c, face: "write" }, ...(seats !== undefined ? { seats } : {}), ...(written !== undefined ? { written } : {}), ...(child === true ? { child } : {}), ...(onlyIfExists !== undefined ? { onlyIfExists } : {}) });
+    const write = (c, seats, written, child, onlyIfExists, through) => void out.push({ candidate: { ...c, face: "write", ...(through === true ? { through } : {}) }, ...(seats !== undefined ? { seats } : {}), ...(written !== undefined ? { written } : {}), ...(child === true ? { child } : {}), ...(onlyIfExists !== undefined ? { onlyIfExists } : {}) });
     for (const r of segment.redirects)
         if (r.direction === "out" && r.target !== undefined)
-            write(r.target);
+            write(r.target, undefined, undefined, undefined, undefined, true);
     for (const c of segment.reads)
         if (c.provenance === "write_redirect_target")
-            write(c);
+            write(c, undefined, undefined, undefined, undefined, true);
     const owners = writeOwnersOf(segment).map(({ row, words, program }) => {
         const args = words.map((w) => w.spelled);
         const all = writeReadings(row, args);
-        const moved = [...new Set(implementationsOf(row).flatMap((view) => selectedOptions(view, args, "one-implementation")).flatMap((o) => o.writesAt ?? []))];
-        return { words, program, all, readings: all.filter((r) => r.written.length > 0 || (r.unexplained && r.operandRole !== undefined)), override: moved.length > 0 ? moved : undefined };
+        const selected = implementationsOf(row).flatMap((view) => selectedOptions(view, args, "one-implementation"));
+        const moved = [...new Set(selected.flatMap((o) => o.writesAt ?? []))];
+        return { row, words, program, all, readings: all.filter((r) => r.written.length > 0 || (r.unexplained && r.operandRole !== undefined)), override: moved.length > 0 ? moved : undefined, beyondOperands: selected.some((o) => o.effect === "writes" || o.effect === "executes") };
     });
     const edited = new Map();
     for (const c of segment.reads) {
@@ -77,7 +98,7 @@ function writeTargetsOf(segment) {
             const seats = stated ? [...new Set(roles.flatMap((role) => o.override ?? role.seats ?? ["landing"]))] : undefined;
             const written = unexplained || roles.some((role) => role.writtenAt === undefined) ? undefined : [...new Set(roles.flatMap((role) => role.writtenAt ?? []))];
             const speculative = readings < o.all.length && roles.every((role) => role.effect === "edit-in-place") ? c : undefined;
-            write(c, seats, written, undefined, speculative);
+            write(c, seats, written, undefined, speculative, !unexplained && writesThrough(roles, o.row, o.words) ? true : undefined);
             if (roles.some((role) => role.effect === "edit-in-place") && c.expands === false)
                 edited.set(o, [...(edited.get(o) ?? []), { candidate: c, ...(speculative !== undefined ? { onlyIfExists: speculative } : {}) }]);
         }
@@ -85,11 +106,25 @@ function writeTargetsOf(segment) {
             writeOnly.add(c);
     }
     for (const o of owners) {
-        for (const c of copyDestinationChildren(segment, o.words, o.readings))
+        for (const c of copyDestinationChildren(segment, o.row, o.words, o.readings))
             write(c, ["landing", "entry"], undefined, true);
         out.push(...backupTargetsOf(edited.get(o) ?? [], o.readings, o.override));
     }
-    return { targets: out, writeOnly };
+    const readWords = new Set();
+    for (const o of owners) {
+        if (!o.program)
+            continue;
+        const args = o.words.map((w) => w.spelled);
+        const found = subcommandOf(o.row, args);
+        const sub = found !== undefined && found.row.operands !== undefined ? found : undefined;
+        const at = sub === undefined ? 0 : sub.at + 1;
+        for (const e of readArgRoles(sub?.row ?? o.row, args.slice(at))) {
+            const role = e.kind === "operand" || e.kind === "value" ? e.role : undefined;
+            if (role?.kind === "path" && (role.effect === "read" || role.writtenAt?.length === 0))
+                readWords.add(o.words[at + e.at].raw);
+        }
+    }
+    return { targets: out, writeOnly, beyondOperands: owners.some((o) => o.beyondOperands), boundedRead: owners.some((o) => o.program && byteBoundIsSmall(o.row, o.words.map((w) => w.spelled))), readWords };
 }
 function backupTargetsOf(edited, readings, override) {
     const suffixes = [...new Set(readings.flatMap((r) => r.suffixes))];
@@ -98,7 +133,7 @@ function backupTargetsOf(edited, readings, override) {
         ? [{ candidate: { ...renamed(f, `${f.spelled}${suffix}`), face: "write" }, seats: ["entry"], followed: { operand: f, suffix }, ...(onlyIfExists !== undefined ? { onlyIfExists } : {}) }]
         : sedBackupNames(f.spelled, suffix).map((spelled) => ({ candidate: { ...renamed(f, spelled), face: "write" }, seats: ["entry"], ...(onlyIfExists !== undefined ? { onlyIfExists } : {}) }))));
 }
-function copyDestinationChildren(segment, words, readings) {
+function copyDestinationChildren(segment, row, words, readings) {
     const candidateOf = (raw) => segment.reads.find((c) => c.raw === raw && WORD_PROVENANCES.has(c.provenance));
     const children = new Map();
     for (const r of readings) {
@@ -109,6 +144,9 @@ function copyDestinationChildren(segment, words, readings) {
         const destCandidate = candidateOf(dest.raw);
         if (destCandidate !== undefined && destCandidate.expands !== false)
             continue;
+        const destRole = r.written.find((w) => w.at === r.copy.destination.at)?.role;
+        if (destCandidate !== undefined && destRole !== undefined && passesUnasked({ ...destCandidate, face: "write", ...(writesThrough([destRole], row, words) ? { through: true } : {}) }))
+            continue;
         for (const at of r.copy.sources) {
             const src = words[at];
             const source = candidateOf(src.raw);
@@ -123,8 +161,21 @@ function copyDestinationChildren(segment, words, readings) {
     return [...children.values()];
 }
 export function judgedCandidatesOf(segment) {
-    const { targets: writes, writeOnly } = writeTargetsOf(segment);
-    const reads = segment.reads.flatMap((c) => (c.provenance === "write_redirect_target" ? [] : [writeOnly.has(c) ? { ...c, denyOnly: true } : c]));
+    const { targets: writes, writeOnly, beyondOperands, boundedRead, readWords } = writeTargetsOf(segment);
+    const throughWritten = new Set(writes.filter((w) => w.candidate.through === true && w.candidate.device === true).map((w) => w.candidate.raw));
+    const opened = (c) => {
+        if (c.provenance === "unlisted_word" && c.device === true && !readWords.has(c.raw) && !throughWritten.has(c.raw)) {
+            const { device: _unread, ...judged } = c;
+            return judged;
+        }
+        if (boundedRead && c.device !== true && c.expands === false && c.speculative === undefined && c.denyOnly !== true && GENERATOR_DEVICES.has(c.spelled) && OPENED_PROVENANCES.has(c.provenance) && (c.provenance !== "unlisted_word" || readWords.has(c.raw)))
+            return { ...c, device: true };
+        if (!beyondOperands || c.device !== true || c.provenance === "stdin_redirect")
+            return c;
+        const { device: _device, ...judged } = c;
+        return judged;
+    };
+    const reads = segment.reads.flatMap((c) => (c.provenance === "write_redirect_target" ? [] : [opened(writeOnly.has(c) ? { ...c, denyOnly: true } : c)]));
     const plain = (cs) => cs.map((candidate) => ({ candidate }));
     return [...plain(reads), ...plain(denyFloorShadowsOf(reads)), ...writes, ...plain(denyFloorShadowsOf(writes.map((w) => w.candidate)))];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.49.3",
+  "version": "7.49.4",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.49.4.json

@@ -0,0 +1,69 @@
+{
+  "repo": "core",
+  "version": "7.49.4",
+  "from": "33e4b503cea033b8c08b96103e4707a5f8a34573",
+  "to": "18d7fa8fa5f2d2949a3848397709cdf60920dbca",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 223,
+  "signatures": [],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.classes",
+      "assertions": [
+        "G1.a",
+        "G2.a",
+        "G7.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.mandated",
+      "assertions": [
+        "G1.a",
+        "G7.a",
+        "G8.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.requiresRealApproval",
+      "assertions": [
+        "G8.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RedactionReport.findings",
+      "assertions": [
+        "G4.a",
+        "G5.a",
+        "G6.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ShellReadVerdict.finding",
+      "assertions": [
+        "G3.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@26456d2d server@a0533487 sdk@f1b30d4 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}