@sema-agent/core 7.49.3 → 7.49.5

package/CHANGELOG.md

@@ -1,3 +1,21 @@
+## 7.49.5 — 2026-10-13
+
+**Hard-breaking changes (#1701):** none. **Closed sets:** none. **Package exports:** +0 / −0 names (`posixModeBitsMeaningful` lives in `src/core/posix-mode-face.ts` and is not on the package index); member changes, all optional: `vetPeerRegistryDirectory(dir, { platform? })`, `judgePeerRecordFile(stat, selfUid, platform?)`, `new FileDurableRulePartitionProvider(dir, onError, { platform? })`. **Behavior:** on Windows the rule store and the peer registry stop reading the platform's `0o666` as "writable by group or others" — a loosening on exactly one platform, and the one that restores the store's purpose there (open to veto: it departs from "refuse what you cannot prove safe" for that platform); POSIX hosts are unchanged.
+
+### A platform with no POSIX permission bits is not "writable by everyone" (#1701; fix; security fail-open on Windows; hard-breaking: none, open to veto; exports: +0 / −0) (@test @server @cli @client-core)
+
+- **Before (7.49.4 and earlier).** The permission-rule store refused its whole directory when `(mode & 0o022) !== 0` — "writable by group or others" — and loaded ZERO rules. Windows has no POSIX permission bits: Node reports `0o666` for every file and directory there (a directory created with mode `0o700` too), so on a Windows host the check fired on every run. A persisted `deny` / `ask` row never applied (the engine disclosed "loading zero rules" and went on), no `allow` row was read either, the write face refused every write (an "always allow" could not be saved), and the org state file in the same directory was refused with it. The peer registry's directory chain (`vetPeerRegistryDirectory`) and a registration file (`judgePeerRecordFile`) judged the same bits and refused with `group_or_world_writable` on every Windows path. A POSIX host loaded normally.
+- **Now.** ONE predicate, `posixModeBitsMeaningful(platform = process.platform)` (`src/core/posix-mode-face.ts`: `platform !== "win32"`), is read by every site that tests those bits: the store's directory vetting (bucket read, org state read, the write face's lock, the adoption marker writer), the peer registry's chain walk and its file judge, and the execution env's file-mode report (`HAS_POSIX_MODE_FACE`, which already asked this question for itself and now reads the same predicate — no second spelling of the fact). Where the bits are not meaningful the group/other-writable judgment is not made. The owner judgment is unchanged (it was already skipped where `process.getuid` is absent); symlink, not-a-directory, unreadable, checksum and shape refusals are unchanged. On a platform with bits (macOS, Linux) nothing changes: a `0o777` directory is still refused whole. The store says it ONCE per store instance through its existing error disclosure (`onError`): the directory is not checked for being writable by other accounts, this platform reports no POSIX permission bits, so who else can write there is not verified here. The peer registry's two functions are pure verdicts with no disclosure seat; they only skip. There is no ACL-level check (KL-1701-a).
+- **Who needs it.** Every Windows host that persists permission rules (a `deny` / `ask` row, an org snapshot, a rule imported through the consent flow) — until now none of them took part in a decision there.
+- **Who is hurt.** None by design. What changes for a Windows host: persisted rows now take part — `allow` rows silence the asks they were approved to silence, `deny` / `ask` rows apply, org state loads — which is the contract on every other platform. A host that was (unknowingly) running with zero persisted rules will see asks and refusals appear and approved commands stop asking. A directory another Windows account can write to is no longer refused by this check (KL-1701-a).
+- **Compensation.** Nothing to do on POSIX. A Windows deployment that wants the old refusal on a shared machine has no switch for it (the old refusal was this bug, not a policy); restrict the rule directory's ACL to the engine's account.
+- **Consumers.** server / cli / client-core on Windows: the `onError` sink of `FileDurableRulePartitionProvider` now receives one extra sentence per provider instance on win32 (it contains the directory); a host that treats every `onError` line as an error should read this one as a notice. Nothing else on the wire or the card changes.
+- Pins: `test/backlog1701-win32-mode-bits.test.ts` (① the predicate; ② the rule store on a REAL `0o777` directory with the platform injected — win32 loads the deny row, says it once however many reads, says it again per instance, still refuses a symlink / corrupt bucket, the write face and the org read follow it; darwin / linux still refuse whole with no skip notice; a `0o700` darwin directory loads with no notice; a throwing sink changes nothing; ③ the same deny row on the real Runner — win32 refuses the command, a `0o777` darwin directory is the pre-fix reading and runs it; ④ the peer registry — the file judge and the chain walk with a `0o777` ancestor, the other arms unchanged; ⑤ no source file outside the predicate tests those bits without importing it, and the execution env's mode face flips with the platform its module loads under).
+
+## 7.49.4 — 2026-10-13
+
+**Rebuild of 7.49.3 — no source change.** The npm tarball of 7.49.3 (shasum `77a7fd37…`, now deprecated) carried the `dist/` of 7.49.2: it was published with `--ignore-scripts` from a checkout whose `dist/` had not been rebuilt (the release-candidate build and gates had run on a detached gate copy). None of the four 7.49.3 entries below (#1685, #1691, #1692, #1693) were in that package. 7.49.4 is the same source as tag `v7.49.3` built in the publishing checkout and compared byte-for-byte with the gated dist before publish; every 7.49.3 entry, criterion (`docs/release-criteria/7.49.3.json`) and wire manifest applies to 7.49.4. **Hard-breaking changes:** none. **Closed sets:** none. **Package exports:** +0 / −0 (`npm run handoff:diff v7.49.3 HEAD`). Consumers pinned to 7.49.3 must move to 7.49.4 (@server @cli @web-admin @client-core @test).
+
 ## 7.49.3 — 2026-10-13
 
 **Hard-breaking changes (#1685, #1693, #1691, #1692):** none. **Closed sets:** none (`READ_CANDIDATE_PROVENANCES`, `SHELL_READ_FINDINGS`, `ASK_CLASSES`, `PERSISTED_RULE_MANDATES` unchanged). **Package exports:** +0 / −0 names (`npm run handoff:diff v7.49.2 HEAD`: 2 609 → 2 609); member changes, all optional: `ReadCandidate.device` / `through`, and the plan's redirection record `fd` (`ShellReadSegment.redirects[]`). **Behavior:** #1685 makes the reference's device table a non-question at every entry of the shell read station and of the shape tier — a loosening for the standard streams (open to veto: it departs from the reference at the output-redirection, read-operand and write-operand entries), and a one-line tightening for `touch` / `mkdir` of the null device; #1693 makes an environment non-answer a bypass-immune ask — a tightening that restores what 7.49.2's own documentation promised; #1691 removes a value that was left in clear after a bearer token (a name=value glued to the token by `:` `,` `@` `!` `;` `|` `&`) and hides the character that joins it; #1692 gives the overlapping re-scan's work allowance a floor (2^17 characters of matches, binding below 16 KB of input only), so a short text with a dense line is read in full instead of losing every line behind it — a scan that still runs out of work masks to the end of the input exactly as in 7.49.2 — redaction only, nothing a run could do before is refused. **Known limits added / closed** (`docs/KNOWN-LIMITS.md`): KL-1644-a closed; KL-1685-b / -c / -d / -e / -f added; KL-958-f, KL-958-g, KL-958-h added (KL-958-d and KL-958-e restated).

package/dist/agents/peer-directory.d.ts

@@ -216,20 +216,25 @@ export type PeerRegistryDirectoryVerdict = {
     path: string;
 };
 /** Vet a registry directory and every ancestor. `uid` defaults to the process uid; on a platform with
- *  no uid (win32) the owner arm is skipped. Refuses on the FIRST failing ancestor (closest first). */
+ *  no uid (win32) the owner arm is skipped. Refuses on the FIRST failing ancestor (closest first).
+ *  `platform` (default: this process's) decides whether the permission bits are judged at all
+ *  ({@link posixModeBitsMeaningful}): where they are not meaningful the group/world-writable arm is skipped,
+ *  and nothing in this verdict says so — the caller that reads it owns any disclosure. */
 export declare function vetPeerRegistryDirectory(dir: string, opts?: {
     uid?: number;
     stopAt?: string;
+    platform?: NodeJS.Platform;
 }): Promise<PeerRegistryDirectoryVerdict>;
 /** §2.1 ③ — the read-side judgment on ONE registration file's stat facts (pure; the reader supplies
  *  the stat): owner must be this uid, mode must carry no group/world write bit, and it must be a
- *  regular file under the read cap. A refused file is skipped LOUDLY by the reader. */
+ *  regular file under the read cap. A refused file is skipped LOUDLY by the reader. The mode arm is judged
+ *  only where `platform` (default: this process's) has permission bits to judge ({@link posixModeBitsMeaningful}). */
 export declare function judgePeerRecordFile(stat: {
     uid?: number;
     mode: number;
     isFile: boolean;
     size: number;
-}, selfUid: number | undefined): {
+}, selfUid: number | undefined, platform?: NodeJS.Platform): {
     ok: true;
 } | {
     ok: false;

package/dist/agents/peer-directory.js

@@ -2,6 +2,7 @@ import { lstat } from "node:fs/promises";
 import { isAbsolute, dirname, resolve as resolvePath } from "node:path";
 import { formatPeerNameRef, mintPeerRef, normalizePeerName, parsePeerNameRef, PEER_REF_RE } from "./cross-session-ref.js";
 import { inlineUntrusted } from "../core/untrusted-text.js";
+import { posixModeBitsMeaningful } from "../core/posix-mode-face.js";
 export const PEER_SESSION_RECORD_SCHEMA_VERSION = 1;
 export const PEER_SESSION_RECORD_MAX_BYTES = 262_144;
 export const PEER_PRESENCE_MAX_CHARS = 120;
@@ -252,6 +253,7 @@ export async function vetPeerRegistryDirectory(dir, opts) {
     if (!isAbsolute(dir))
         return { ok: false, code: "not_absolute", path: dir };
     const uid = opts?.uid ?? (typeof process.getuid === "function" ? process.getuid() : undefined);
+    const judgeModeBits = posixModeBitsMeaningful(opts?.platform);
     const stopAt = opts?.stopAt !== undefined ? resolvePath(opts.stopAt) : undefined;
     let cursor = resolvePath(dir);
     for (;;) {
@@ -271,7 +273,7 @@ export async function vetPeerRegistryDirectory(dir, opts) {
         if (!isRoot) {
             if (uid !== undefined && st.uid !== uid)
                 return { ok: false, code: "foreign_owner", path: cursor };
-            if ((st.mode & 0o022) !== 0)
+            if (judgeModeBits && (st.mode & 0o022) !== 0)
                 return { ok: false, code: "group_or_world_writable", path: cursor };
         }
         if (isRoot)
@@ -279,12 +281,12 @@ export async function vetPeerRegistryDirectory(dir, opts) {
         cursor = parent;
     }
 }
-export function judgePeerRecordFile(stat, selfUid) {
+export function judgePeerRecordFile(stat, selfUid, platform) {
     if (!stat.isFile)
         return { ok: false, code: "not_regular" };
     if (selfUid !== undefined && stat.uid !== undefined && stat.uid !== selfUid)
         return { ok: false, code: "foreign_owner" };
-    if ((stat.mode & 0o022) !== 0)
+    if (posixModeBitsMeaningful(platform) && (stat.mode & 0o022) !== 0)
         return { ok: false, code: "group_or_world_writable" };
     if (stat.size > PEER_SESSION_RECORD_MAX_BYTES)
         return { ok: false, code: "too_large" };

package/dist/core/arg-summary.js

@@ -87,12 +87,13 @@ function removedRegion(pass, match, groups, inserted) {
     return [head, match.length - tail];
 }
 const SOLO_SCAN_WORK_PER_CHAR = 8;
+const SOLO_SCAN_WORK_FLOOR = 1 << 17;
 function soloHits(input, passes) {
     const hits = [];
     passes.forEach((pass, i) => {
         const re = new RegExp(pass.re.source, pass.re.flags.includes("g") ? pass.re.flags : `${pass.re.flags}g`);
         const rescans = pass.family !== undefined;
-        let work = SOLO_SCAN_WORK_PER_CHAR * input.length;
+        let work = Math.max(SOLO_SCAN_WORK_PER_CHAR * input.length, SOLO_SCAN_WORK_FLOOR);
         for (let m = re.exec(input); m !== null; m = re.exec(input)) {
             const at = m.index;
             const familyAt = () => (typeof pass.family === "function" ? pass.family(input, at) : pass.family);

package/dist/core/credential-vocabulary.js

@@ -16,7 +16,7 @@ const QUOTED_VALUE = [
     ...ESCAPED_QUOTES.map((q, i) => pairedValue(`(${BACKSLASHES})${q}`, `(?<!\\\\)(?:\\${i + 2})${q}`)),
     `${QUOTE}(?!${AFTER_CLOSING_QUOTE})${GLUED_RUN}`,
 ].join("|");
-const BEARER_TAIL = `(?<==)(?:(?!${QUOTE})${GLUED_RUN}|${QUOTED_VALUE})`;
+const BEARER_TAIL = `(?:(?!${QUOTE})\\S${GLUED_RUN}|(?<==)(?:${QUOTED_VALUE}))`;
 export const CREDENTIAL_VOCABULARY = {
     values: [
         { id: "github-token", kind: "prefixed-token", source: "arg-summary", confidence: "high", pass: "vendor-prefixed", match: new RegExp(`(?<![A-Za-z0-9])gh[opsur][-_]${VENDOR_BODY}`, "g"), strict: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/ },

package/dist/core/gate-fold.js

@@ -208,9 +208,13 @@ function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
         case "mandated": {
             if (verdict.details !== undefined)
                 pass.shellReadDetails = verdict.details;
+            const unreadable = verdict.finding === "unanswered";
             if (pass.decision.action !== "allow") {
-                if (pass.decision.action === "ask")
-                    pass.decision = { ...pass.decision, probeMandated: true };
+                if (pass.decision.action === "ask") {
+                    pass.decision = !unreadable
+                        ? { ...pass.decision, probeMandated: true }
+                        : { ...pass.decision, requiresRealApproval: true, ...(pass.decision.guard === undefined ? { guard: "unverifiable_shell_text" } : { foldedAskClasses: [...new Set([...(pass.decision.foldedAskClasses ?? []), "unverifiable_shell_text"])] }) };
+                }
                 return;
             }
             const candidate = normalizeReadRootCandidate(verdict.readRootCandidate);
@@ -218,7 +222,7 @@ function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
                 action: "ask",
                 message: shellReadAskMessage(toolName, verdict),
                 decisionReason: "safety",
-                probeMandated: true,
+                ...(unreadable ? { requiresRealApproval: true, guard: "unverifiable_shell_text" } : { probeMandated: true }),
                 ...(account !== undefined ? { probeReason: account } : {}),
                 ...(candidate !== undefined ? { probeReadRootCandidate: candidate } : {}),
             };

package/dist/core/permission-rule-model.js

@@ -9,7 +9,7 @@ import { heldValues } from "./tool-name-readings.js";
 import { carriesDotSegment, isAbsoluteForFamily, isIdentityDir, isPathIdentity, isShellRootedSpellingUnmapped, isUncIdentity, pathFamilyOf, pathIdentityOf } from "../tools/fs/safety.js";
 import { bindPathRules, judgeRuleRows, rowsWhereTheyLead } from "./path-rule-binding.js";
 import { readShellCommand } from "./shell-lexer.js";
-import { readOnlyLineObjection, readOnlyShellVerdict } from "./read-only-shell.js";
+import { lineDescriptorsOfText, readOnlyLineObjection, readOnlyShellVerdict } from "./read-only-shell.js";
 export const RULE_BEHAVIORS = Object.freeze(["deny", "ask", "allow"]);
 const RULE_BEHAVIOR_SET = new Set(RULE_BEHAVIORS);
 export function isRuleBehavior(v) {
@@ -951,7 +951,7 @@ export function findAdmittingRule(rules, call) {
         const dir = cdDirs[i];
         const first = firstEligibleAdmittingRule(rules, segment, call) ?? (dir !== undefined ? firstEligibleDirectoryRule(rules, dir, call) : undefined);
         if (first === undefined) {
-            if (readsOnlyAsSegment(segment, lineObjection))
+            if (readsOnlyAsSegment(segment, lineObjection, call.command))
                 continue;
             return undefined;
         }
@@ -960,8 +960,8 @@ export function findAdmittingRule(rules, call) {
     }
     return covering.length > 0 ? covering : undefined;
 }
-function readsOnlyAsSegment(segment, lineObjection) {
-    return lineObjection === undefined && !movesShellCursor(segment) && readOnlyShellVerdict(segment).readOnly;
+function readsOnlyAsSegment(segment, lineObjection, whole) {
+    return lineObjection === undefined && !movesShellCursor(segment) && readOnlyShellVerdict(segment, undefined, undefined, () => lineDescriptorsOfText(whole)).readOnly;
 }
 function firstEligibleDirectoryRule(rules, directory, call) {
     for (const rule of rules) {
@@ -1067,7 +1067,7 @@ export function segmentCoverageOf(command, rules, call) {
         const dir = cdDirs[i];
         return {
             segment: segment.trim(),
-            covered: readsOnlyAsSegment(segment, lineObjection) ||
+            covered: readsOnlyAsSegment(segment, lineObjection, folded) ||
                 firstEligibleAdmittingRule(rules.persisted, segment, call) !== undefined ||
                 (dir !== undefined && firstEligibleDirectoryRule(rules.persisted, dir, call) !== undefined) ||
                 proposed.some((p) => p.rule.tool === "Read"

package/dist/core/posix-mode-face.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Does this platform report POSIX permission bits worth judging? Windows' `Stats.mode` is a projection of
+ * the read-only attribute (`0o666` / `0o444`; a directory created with mode `0o700` reads `0o666` too), not
+ * permission bits — so a group/world-writable test over it fires on every file and says nothing about who may
+ * write. Every reader of `mode & 0o022` (and the file-mode report of the execution env) asks THIS predicate,
+ * so a platform never judges a bit it cannot have.
+ *
+ * `platform` is a parameter so a caller can ask about the platform it was told, not only the one it runs on.
+ */
+export declare function posixModeBitsMeaningful(platform?: NodeJS.Platform): boolean;

package/dist/core/posix-mode-face.js

@@ -0,0 +1,3 @@
+export function posixModeBitsMeaningful(platform = process.platform) {
+    return platform !== "win32";
+}

package/dist/core/read-only-shell.d.ts

@@ -1,4 +1,5 @@
 import { type ShellCommandShape } from "./shell-lexer.js";
+import { type LineDescriptors } from "../tools/fs/shell-read-device.js";
 /** The reader's answer: read-only, or not — with the first reason the reading stopped on (a sentence a
  *  trace or a card can show; never adjudication input). */
 export type ReadOnlyShellVerdict = {
@@ -32,7 +33,7 @@ export declare function changesDirectoryBeforeGit(shape: ShellCommandShape, cwd?
  * stands ({@link changesDirectoryBeforeGit}). Anything the reading does not positively admit is NOT read-only — the
  * answer is never a guess, and a `false` costs one question.
  */
-export declare function readOnlyShellVerdict(command: string, shape?: ShellCommandShape, cwd?: string): ReadOnlyShellVerdict;
+export declare function readOnlyShellVerdict(command: string, shape?: ShellCommandShape, cwd?: string, bound?: LineDescriptors | (() => LineDescriptors)): ReadOnlyShellVerdict;
 /**
  * The reader's LINE-level objection to `command` — what makes no segment of it read-only in its place, whatever the
  * segment reads on its own: the line's structure, or a `cd` beside a `git` ({@link changesDirectoryBeforeGit}). A caller
@@ -40,3 +41,9 @@ export declare function readOnlyShellVerdict(command: string, shape?: ShellComma
  * line first.
  */
 export declare function readOnlyLineObjection(command: string, cwd?: string): string | undefined;
+/**
+ * What the whole text of `command` binds — every redirection of every segment (a single one, an `exec`'s, a `{name}` one included),
+ * read by the station's own computation ({@link descriptorsOfPlan}): the one binding map the shape tier's operand reading shares with
+ * the station's rebinding rule. The plan is read with no listed readers: the bindings do not depend on which programs read.
+ */
+export declare function lineDescriptorsOfText(command: string): LineDescriptors;

package/dist/core/read-only-shell.js

@@ -1,5 +1,8 @@
 import { posix } from "node:path";
 import { readShellCommand } from "./shell-lexer.js";
+import { descriptorsOfPlan, newLineDescriptors, standardDeviceUnrebound } from "../tools/fs/shell-read-device.js";
+import { planShellReads } from "../tools/fs/shell-read-plan.js";
+import { writesOnlyStandardDevices } from "../tools/fs/shell-read-write-targets.js";
 import { FIND_ACTION_PRIMARIES, FIND_NEWER_PRIMARY, FIND_VALUE_PRIMARIES, FLAG_VALUE_ACCEPTS, READ_ONLY_BARE_ONLY, READ_ONLY_BARE_PROGRAMS, READ_ONLY_COMMAND_TABLE, READ_ONLY_ENV_NAMES, READ_ONLY_EXACT_FORMS, READ_ONLY_GLOB_PROGRAMS, XARGS_READ_ONLY_TARGETS, dockerRetargetDanger, } from "./read-only-shell-table.js";
 const NOT = (reason) => ({ readOnly: false, reason });
 export const CD_GIT_COMPOUND_SENTENCE = "This command changes directory before running a version-control command, which can pick up untrusted hooks or repository configuration from the target directory. Approve only if you trust it.";
@@ -39,7 +42,7 @@ const PRINTF_ESCAPE = new RegExp(`%[^%a-zA-Z]*${PRINTF_LENGTH}\\\\[0-7xX]`);
 const PRINTF_NUMERIC = new RegExp(`%[-+ 0#']*[0-9.*]*${PRINTF_LENGTH}[diouxXeEfFgGaAn]`);
 const JQ_DANGER_FLAG = /^['"]?-[a-zA-Z]*[fL]/;
 const JQ_DANGER_TEXT = /--from-file|--rawfile|--slurpfile|--run-tests|--library-path|\benv\b|\$ENV\b|\binclude\b|\bimport\b/;
-export function readOnlyShellVerdict(command, shape = readShellCommand(command), cwd) {
+export function readOnlyShellVerdict(command, shape = readShellCommand(command), cwd, bound) {
     const line = lineStructureObjection(shape);
     if (line !== undefined)
         return NOT(line);
@@ -59,8 +62,12 @@ export function readOnlyShellVerdict(command, shape = readShellCommand(command),
     }
     if (changesDirectoryBeforeGit(shape, cwd))
         return NOT(CD_GIT_REASON);
+    const descriptors = newLineDescriptors();
+    descriptors.unknown = shape.segments.reduce((n, s) => n + s.redirections.length, 0) > 1;
+    let boundOfText;
+    const bindings = () => (boundOfText ??= (typeof bound === "function" ? bound() : bound) ?? lineDescriptorsOfText(command));
     for (const seg of shape.segments) {
-        const verdict = segmentVerdict(seg);
+        const verdict = segmentVerdict(seg, descriptors, bindings);
         if (!verdict.readOnly)
             return verdict;
     }
@@ -125,10 +132,10 @@ function peelBuiltinPrefix(words) {
             return t;
     }
 }
-function segmentVerdict(seg) {
+function segmentVerdict(seg, line, bindings) {
     for (const r of seg.redirections) {
         const target = r.target.text;
-        if (!READING_REDIRECTS.has(r.op) && target !== "/dev/null" && !(r.op === ">&" && /^\d+$/.test(target)))
+        if (!READING_REDIRECTS.has(r.op) && !standardDeviceUnrebound(target, line, []) && !(r.op === ">&" && /^\d+$/.test(target)))
             return NOT(`the redirection \`${r.op} ${target}\` writes`);
         if (/^\/dev\/(tcp|udp)\//.test(target))
             return NOT("a redirection to a network pseudo-device");
@@ -148,11 +155,17 @@ function segmentVerdict(seg) {
     const program = words[0];
     if (run.some((w) => expansionKind(w) === "glob"))
         return GLOB_PROGRAMS.has(program) ? READ_ONLY : NOT(`\`${program}\` with a glob argument — the glob may name anything`);
+    if (DEVICE_WRITERS.has(program) && writesOnlyStandardDevices(program, words.slice(1), bindings()))
+        return READ_ONLY;
     const structural = structuralReading(words);
     if (structural !== null)
         return structural ? READ_ONLY : NOT(`\`${program}\` with these arguments is not a read-only form`);
     return tableReading(words, run);
 }
+export function lineDescriptorsOfText(command) {
+    return descriptorsOfPlan(planShellReads(command, { readers: new Set(), cwd: "/", roots: [] }));
+}
+const DEVICE_WRITERS = new Set(["tee", "cp"]);
 function structuralReading(words) {
     const program = words[0];
     if (BARE_ONLY.has(program))
@@ -167,6 +180,8 @@ function structuralReading(words) {
             return form[0] !== "docker" || !dockerRetargetDanger(words);
     if (program === "echo")
         return true;
+    if (program === "exec")
+        return words.length === 1;
     if (program === "printf")
         return printfReading(words);
     if (program === "ls")

package/dist/engine/execution-env/node-execution-env.js

@@ -9,6 +9,7 @@ import { ExecutionError, err, FileError, ok, toError, } from "../harness/types.j
 import { killProcessTree, shutdownDebug } from "./kill-tree.js";
 import { __resetSecretEnvScrubNoticeAnnouncement, announceSecretEnvScrub, inheritEnvPolicyProblem, inheritedHostEnv, scrubSecretEnv } from "../../core/secret-env.js";
 import { physicalPathOfAsync } from "../../core/physical-path.js";
+import { posixModeBitsMeaningful } from "../../core/posix-mode-face.js";
 import { walkSymlinkChain } from "./symlink-chain.js";
 import { RollingTailBuffer, markTruncated, newStreamCursorState, sliceStreamIncrement, } from "../../core/exec-output-tail.js";
 import { BackgroundShellError } from "../../core/background-shell.js";
@@ -41,7 +42,7 @@ function fileKindFromStats(stats) {
     }
     return undefined;
 }
-const HAS_POSIX_MODE_FACE = process.platform !== "win32";
+const HAS_POSIX_MODE_FACE = posixModeBitsMeaningful();
 function fileInfoFromStats(path, stats) {
     const kind = fileKindFromStats(stats);
     if (!kind) {

package/dist/stores/file/permission-rule-store.d.ts

@@ -113,15 +113,23 @@ export type RuleAdoptionFile = {
 export declare function readRuleAdoptionFile(dir: string): RuleAdoptionFile | undefined;
 /** Atomically publish the adoption marker (same write-temp → fsync → rename discipline as the store). */
 export declare function writeRuleAdoptionFile(dir: string, content: RuleAdoptionFile): void;
+/** What a directory vetting reads from its host. Absent ⇒ this process's platform, and a skipped judgment goes unsaid. */
+interface DirVetting {
+    /** The platform whose permission bits are read (default: this process's — see {@link posixModeBitsMeaningful}). */
+    readonly platform?: NodeJS.Platform;
+    /** Said when the group/other-writable judgment was NOT made because the platform reports no permission bits. */
+    readonly modeBitsUnjudged?: (dir: string) => void;
+}
 /** One principal's rule file. */
 declare class FileDurableRulePartition implements WritableDurableRulePartition {
     private readonly dir;
     private readonly file;
     private readonly acquireWriteLock;
     private readonly onError?;
+    private readonly vetting?;
     readonly durability: StoreDurability;
     readonly fidelity: StoreFidelity;
-    constructor(dir: string, file: string, acquireWriteLock: () => void, onError?: ((message: string) => void) | undefined);
+    constructor(dir: string, file: string, acquireWriteLock: () => void, onError?: ((message: string) => void) | undefined, vetting?: DirVetting | undefined);
     /** Read and validate. Any refusal answers with an empty set AND says so — never a silent empty store. The answer's
      *  sentence names no location ({@link refusalText}); the disclosure that accompanies it does. */
     private read;
@@ -198,9 +206,13 @@ export declare class FileDurableRulePartitionProvider implements DurableRulePart
     private readonly onError?;
     private lock;
     private orgPersistence;
+    /** What every directory vetting of this instance reads; it says an unjudged mode check ONCE per instance. */
+    private readonly vetting;
     constructor(dir: string, onError?: ((message: string) => void) | undefined, opts?: {
         /** The data root whose adoption marker gates construction (design/183 I6). Absent ⇒ no root gate. */
         dataRoot?: string;
+        /** The platform whose permission bits the directory vetting reads. Absent ⇒ this process's platform. */
+        platform?: NodeJS.Platform;
     });
     /** The org partition's durable home in this directory (design/182 §7.4 contract; `org.json`). Shares
      *  this provider's writer lock — an install is a write. */

package/dist/stores/file/permission-rule-store.js

@@ -2,6 +2,7 @@ import { closeSync, constants as FS, existsSync, fsyncSync, lstatSync, mkdirSync
 import { join } from "node:path";
 import { createHash, randomBytes } from "node:crypto";
 import { isRuleBehavior } from "../../core/permission-rule-model.js";
+import { posixModeBitsMeaningful } from "../../core/posix-mode-face.js";
 import { PERMISSION_RULE_WRITER, applySyncJoin, applyTombstones, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, foldDelta, unknownRuleWriteDeltaError, } from "../../core/permission-rule-store.js";
 import { canonicalize } from "../../core/canonical-json.js";
 import { BootLock, FileStoreLockError } from "./fs-atomic.js";
@@ -118,13 +119,17 @@ const EMPTY_READ = { rules: [], tombstones: [], rev: 0 };
 function checksumOf(body) {
     return `sha256:${createHash("sha256").update(canonicalize(body), "utf8").digest("hex")}`;
 }
-function unsafeDirFault(dir) {
+function unsafeDirFault(dir, vetting) {
     mkdirSync(dir, { recursive: true, mode: 0o700 });
     const st = lstatSync(dir);
     if (st.isSymbolicLink() || !st.isDirectory())
         return "is a symlink or not a directory";
     if (typeof process.getuid === "function" && st.uid !== process.getuid())
         return "is owned by another user";
+    if (!posixModeBitsMeaningful(vetting?.platform)) {
+        vetting?.modeBitsUnjudged?.(dir);
+        return undefined;
+    }
     if ((st.mode & 0o022) !== 0)
         return `is writable by group or others (mode ${(st.mode & 0o777).toString(8)}) — anyone who can write there can grant themselves permissions`;
     return undefined;
@@ -135,15 +140,18 @@ function assertSafeDir(dir) {
         throw new Error(`permission-rule store directory ${dir} ${fault}; refusing to use it`);
 }
 function refusalText(onError, sentence, location) {
+    discloseTo(onError, `${sentence} (at ${location})`);
+    return `${sentence}. The location is reported to the store's error disclosure (onError), not in this message.`;
+}
+function discloseTo(onError, message) {
     try {
-        onError?.(`${sentence} (at ${location})`);
+        onError?.(message);
     }
     catch {
     }
-    return `${sentence}. The location is reported to the store's error disclosure (onError), not in this message.`;
 }
-function assertSafeDirAtRequest(dir, onError, act) {
-    const fault = unsafeDirFault(dir);
+function assertSafeDirAtRequest(dir, onError, act, vetting) {
+    const fault = unsafeDirFault(dir, vetting);
     if (fault !== undefined)
         throw new Error(refusalText(onError, `the permission-rule store directory ${fault}; refusing to ${act} it`, dir));
 }
@@ -171,13 +179,15 @@ class FileDurableRulePartition {
     file;
     acquireWriteLock;
     onError;
+    vetting;
     durability = "durable";
     fidelity = "json";
-    constructor(dir, file, acquireWriteLock, onError) {
+    constructor(dir, file, acquireWriteLock, onError, vetting) {
         this.dir = dir;
         this.file = file;
         this.acquireWriteLock = acquireWriteLock;
         this.onError = onError;
+        this.vetting = vetting;
     }
     read() {
         const bucket = "this owner's permission-rule bucket";
@@ -185,7 +195,7 @@ class FileDurableRulePartition {
         const unreadable = (sentence, location = this.file) => ({ unreadable: refusalText(this.onError, sentence, location) });
         let raw;
         try {
-            const dirFault = unsafeDirFault(this.dir);
+            const dirFault = unsafeDirFault(this.dir, this.vetting);
             if (dirFault !== undefined)
                 return unreadable(`the permission-rule store directory ${dirFault}; loading zero rules`, this.dir);
             const st = lstatSync(this.file);
@@ -228,11 +238,7 @@ class FileDurableRulePartition {
         return { file: parsed };
     }
     disclose(message) {
-        try {
-            this.onError?.(message);
-        }
-        catch {
-        }
+        discloseTo(this.onError, message);
     }
     screenDurableRows(file) {
         const isSession = (scope) => scope?.kind === "session";
@@ -246,7 +252,7 @@ class FileDurableRulePartition {
         return { rules, tombstones, quarantined };
     }
     write(next) {
-        assertSafeDirAtRequest(this.dir, this.onError, "write through");
+        assertSafeDirAtRequest(this.dir, this.onError, "write through", this.vetting);
         atomicPublish(this.dir, this.file, JSON.stringify({ ...next, checksum: checksumOf(next) }, null, 2));
     }
     async list() {
@@ -392,11 +398,22 @@ export class FileDurableRulePartitionProvider {
     onError;
     lock;
     orgPersistence;
+    vetting;
     constructor(dir, onError, opts) {
         this.dir = dir;
         this.onError = onError;
         if (opts?.dataRoot !== undefined)
             assertAdoptionBootGate(opts.dataRoot, "FileDurableRulePartitionProvider");
+        let said = false;
+        this.vetting = {
+            platform: opts?.platform,
+            modeBitsUnjudged: (where) => {
+                if (said)
+                    return;
+                said = true;
+                discloseTo(this.onError, `the permission-rule store directory is not checked for being writable by other accounts: this platform reports no POSIX permission bits, so who else can write there is not verified here (at ${where})`);
+            },
+        };
     }
     adoptionMarker() {
         const judged = judgeRuleAdoptionFile(this.dir);
@@ -410,13 +427,13 @@ export class FileDurableRulePartitionProvider {
         return this.fileOrgPersistence();
     }
     fileOrgPersistence() {
-        this.orgPersistence ??= new FileOrgRuleStatePersistence(this.dir, this.acquireWriteLock, this.onError);
+        this.orgPersistence ??= new FileOrgRuleStatePersistence(this.dir, this.acquireWriteLock, this.onError, this.vetting);
         return this.orgPersistence;
     }
     acquireWriteLock = () => {
         if (this.lock !== undefined)
             return;
-        assertSafeDirAtRequest(this.dir, this.onError, "write through");
+        assertSafeDirAtRequest(this.dir, this.onError, "write through", this.vetting);
         const lock = new BootLock(join(this.dir, "PERMISSION-RULES-WRITER-LOCK"));
         try {
             lock.acquire();
@@ -437,11 +454,11 @@ export class FileDurableRulePartitionProvider {
                 return this.readOnlySourceView(principalRuleFileName(principal), principalRuleFileName(rec.toPrincipal), "adopted" in adoption || adoption.marker.phase >= 4);
             }
         }
-        return new FileDurableRulePartition(this.dir, join(this.dir, principalRuleFileName(principal)), this.acquireWriteLock, this.onError);
+        return new FileDurableRulePartition(this.dir, join(this.dir, principalRuleFileName(principal)), this.acquireWriteLock, this.onError, this.vetting);
     }
     readOnlySourceView(sourceName, targetName, flipped) {
         const pick = flipped ? targetName : existsSync(join(this.dir, sourceName)) ? sourceName : targetName;
-        return readOnlyRuleStoreView(new FileDurableRulePartition(this.dir, join(this.dir, pick), this.acquireWriteLock, this.onError));
+        return readOnlyRuleStoreView(new FileDurableRulePartition(this.dir, join(this.dir, pick), this.acquireWriteLock, this.onError, this.vetting));
     }
     forLocalOwner() {
         const adoption = this.adoptionMarker();
@@ -451,7 +468,7 @@ export class FileDurableRulePartitionProvider {
                 return this.readOnlySourceView(LOCAL_OWNER_FILE, principalRuleFileName(rec.toPrincipal), "adopted" in adoption || adoption.marker.phase >= 4);
             }
         }
-        return new FileDurableRulePartition(this.dir, join(this.dir, LOCAL_OWNER_FILE), this.acquireWriteLock, this.onError);
+        return new FileDurableRulePartition(this.dir, join(this.dir, LOCAL_OWNER_FILE), this.acquireWriteLock, this.onError, this.vetting);
     }
     dispose() {
         this.lock?.release();
@@ -462,12 +479,14 @@ class FileOrgRuleStatePersistence {
     dir;
     acquireWriteLock;
     onError;
+    vetting;
     file;
     writeChain = Promise.resolve();
-    constructor(dir, acquireWriteLock, onError) {
+    constructor(dir, acquireWriteLock, onError, vetting) {
         this.dir = dir;
         this.acquireWriteLock = acquireWriteLock;
         this.onError = onError;
+        this.vetting = vetting;
         this.file = join(dir, ORG_STATE_FILE);
     }
     readSync() {
@@ -477,7 +496,7 @@ class FileOrgRuleStatePersistence {
         const ioFault = (err) => `could not be read (${err?.code ?? err?.name ?? "unknown"})`;
         let dirFault;
         try {
-            dirFault = unsafeDirFault(this.dir);
+            dirFault = unsafeDirFault(this.dir, this.vetting);
         }
         catch (err) {
             return refuse(`the permission-rule store directory ${ioFault(err)}`, `${this.dir}: ${thrownText(err)}`);
@@ -524,7 +543,7 @@ class FileOrgRuleStatePersistence {
     }
     installOrgStateSync(state) {
         this.acquireWriteLock();
-        assertSafeDirAtRequest(this.dir, this.onError, "write through");
+        assertSafeDirAtRequest(this.dir, this.onError, "write through", this.vetting);
         state = jsonForm(state);
         const cur = this.readSync();
         if (cur !== undefined && state.revisionHighWater < cur.revisionHighWater) {

package/dist/tools/fs/bash-readonly-classifier.js

@@ -2,8 +2,9 @@ import { anchorSpelling, isAbsoluteForFamily, isBlockedDevicePath, isShellRooted
 import { PARSE_FAILURE_SENTENCE, UNRESOLVED_SENTENCE, argvOf, lexShell, literalTildeSpelling, } from "../../shell/lex.js";
 import { shellWordsOf } from "../../shell/shell-words.js";
 import { textBindsHome } from "./shell-read-bindings.js";
+import { GENERATOR_DEVICES, newLineDescriptors, bindDescriptors, isNamedDescriptorWord, standardDeviceUnrebound, descriptorsBoundBy } from "./shell-read-device.js";
 import { NOT_AUTO_ALLOWED, argvReentryUnjudged, isBareControlWord, programPositionRefusalSentence, readProgramPosition, } from "./bash-program-position.js";
-import { BLOCK_WORD_NAMES, attachedStdinFile, declaresOption, firstOperandSlot, opensNoOperand, programDelivery, programRow, programTextReadings, readArgRoles, readArgs, readProgramTextLanguage, runsShellText, selectedOptions, slotValueCandidates, suppliesFirstOperandSlot, takesSeparatedDatum, valuesAreLiteral, writeReadings, writesPath, } from "./program-read-model.js";
+import { BLOCK_WORD_NAMES, attachedStdinFile, byteBoundIsSmall, declaresOption, firstOperandSlot, opensNoOperand, programDelivery, programRow, programTextReadings, readArgs, readProgramTextLanguage, runsShellText, selectedOptions, slotValueCandidates, suppliesFirstOperandSlot, takesSeparatedDatum, valuesAreLiteral, writeReadings, writesPath, } from "./program-read-model.js";
 export const BASH_READONLY_DEFAULT_ALLOW = [
     "ls", "cat", "head", "tail", "wc", "pwd", "echo", "whoami", "uname",
     "grep", "cut", "tr", "basename", "dirname", "stat", "du", "df", "which",
@@ -82,8 +83,8 @@ export function carriesShellRedirection(text) {
     return SHELL_REDIRECTION_OPERATORS.test(text);
 }
 const SHELL_REDIRECTION_OPERATORS = /[<>]/;
-function isDataFreeRedirection(r) {
-    if (r.op === ">" && r.fd === 2 && r.target !== undefined && r.target.raw === "/dev/null")
+function isDataFreeRedirection(r, line) {
+    if (r.op === ">" && r.fd === 2 && r.target !== undefined && standardDeviceUnrebound(r.target.raw, line, descriptorsBoundBy(r)))
         return true;
     return r.op === ">&" && r.dup !== undefined && /^[12]$/.test(r.dup) && (r.fd === undefined || r.fd === 1 || r.fd === 2);
 }
@@ -103,6 +104,13 @@ export function strictResidualRefusal(lexed, source, opts = {}) {
     if ("parseFailure" in lexed)
         return inClass(source) || SHELL_EXPANSION_CHARS.test(source) ? reason : PARSE_FAILURE_SENTENCE[lexed.parseFailure.reason];
     const words = [];
+    const line = newLineDescriptors();
+    for (const s of lexed.segments)
+        for (const t of s.tokens)
+            if (t.kind === "redirect")
+                bindDescriptors(line, t);
+            else if (t.kind === "word" && isNamedDescriptorWord(t.raw))
+                line.named = true;
     for (const s of lexed.segments) {
         if (s.connector === "\n")
             return reason;
@@ -115,7 +123,7 @@ export function strictResidualRefusal(lexed, source, opts = {}) {
             }
             if (t.kind !== "redirect")
                 return reason;
-            if (opts.dataFreeRedirections === true && isDataFreeRedirection(t))
+            if (opts.dataFreeRedirections === true && isDataFreeRedirection(t, line))
                 continue;
             if (!tolerate)
                 return reason;
@@ -795,30 +803,6 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
         }
         unlistedSegments.add(si);
     }
-    const HEAD_AUTO_ALLOW_MAX = 1_000_000;
-    const byteBoundIsSmall = (row, args) => {
-        if (row === undefined)
-            return false;
-        let byteBound = false;
-        for (const e of readArgRoles(row, args)) {
-            if (e.kind === "operand" || e.kind === "end-of-options")
-                continue;
-            if (e.kind === "value" && e.spec?.bounds === "bytes") {
-                if (!/^\d+$/.test(args[e.at]) || Number(args[e.at]) > HEAD_AUTO_ALLOW_MAX)
-                    return false;
-                byteBound = true;
-                continue;
-            }
-            if (e.kind === "option" && typeof e.reading === "object" && e.reading.spec?.bounds === "bytes") {
-                if (!/^\d+$/.test(e.reading.attached) || Number(e.reading.attached) > HEAD_AUTO_ALLOW_MAX)
-                    return false;
-                byteBound = true;
-                continue;
-            }
-            return false;
-        }
-        return byteBound;
-    };
     const foldedSegments = [];
     let shapeRefusal = nameRefusal;
     for (let si = 0; si < segments.length; si++) {
@@ -896,7 +880,6 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
             shapeRefusal ??= `\`${name}\` in follow mode never terminates ${NOT_AUTO_ALLOWED}`;
             continue;
         }
-        const GENERATOR_DEVICES = new Set(["/dev/zero", "/dev/random", "/dev/urandom", "/dev/full"]);
         const deviceCandidates = openableWordsOf(row, restArgs);
         const deviceArgs = deviceCandidates.map((t) => resolveOperandLexically(undefined, t, boundary?.homeDir) ?? normalizeAbsPathLexically(t)).filter(isBlockedDevicePath);
         const rescuedByHead = byteBoundIsSmall(row, restArgs) && deviceArgs.every((d) => GENERATOR_DEVICES.has(d));