@sema-agent/core 7.49.3 → 7.49.5

package/dist/tools/fs/program-read-model.d.ts

@@ -65,6 +65,11 @@ export type ArgRole =
      *  copy READS its sources; the write face still judges them, as the reference implementation does). Absent: every
      *  seat in {@link seats}. */
     readonly writtenAt?: readonly WriteSeat[];
+    /** A writing effect that writes the path's CONTENT by opening it (`true`), or does so only while the invocation carries
+     *  no option word (`"plain"`: a copy's `-f`, `-b` and `--remove-destination` replace the entry, `-l` and `-s` link it) —
+     *  the one kind of write a standard device takes without a containment question (`passesUnasked`). Absent: the program
+     *  creates, unlinks, renames or retargets the path's ENTRY, or the row does not say it only writes through. */
+    readonly through?: true | "plain";
     /** The program RUNS in this directory (`env -C <dir>`), or with it as its root (`sudo -R <dir>`): the paths it is
      *  handed resolve against it, not against the working directory the command line stands in. Or the program word is
      *  LOOKED UP in these directories (`env -P <dirs>`): which program runs is not the one the word names on the PATH. */
@@ -789,4 +794,14 @@ export declare function messageWords(program: string, words: readonly {
         readonly expansions: readonly WordPiece[];
     };
 }[], programIndex: number): Set<number>;
+/** The most bytes a read may be bounded to and still count as small (`head -c N`): a bound above it is no bound a person would call one. */
+export declare const SMALL_BYTE_BOUND_MAX = 1000000;
+/**
+ * Does this invocation read at most a SMALL, LITERAL number of BYTES? The rule is positive: the row's role walk ({@link readArgRoles})
+ * must find an option the row says bounds the output in BYTES ({@link OptionSpec.bounds}), valued with a plain integer within
+ * {@link SMALL_BYTE_BOUND_MAX}, and NO other option word — a line bound is no bound for a source that holds no newline, and a
+ * switch, a spelling the row does not explain or an option-shaped word past an operand makes the invocation unreadable, which is
+ * not exempt (the safe side). `false` for a program with no row.
+ */
+export declare function byteBoundIsSmall(row: ProgramRow | undefined, args: readonly string[]): boolean;
 export {};

package/dist/tools/fs/program-read-model.js

@@ -1351,3 +1351,27 @@ export function messageWords(program, words, programIndex) {
     }
     return out;
 }
+export const SMALL_BYTE_BOUND_MAX = 1_000_000;
+export function byteBoundIsSmall(row, args) {
+    if (row === undefined)
+        return false;
+    let byteBound = false;
+    for (const e of readArgRoles(row, args)) {
+        if (e.kind === "operand" || e.kind === "end-of-options")
+            continue;
+        if (e.kind === "value" && e.spec?.bounds === "bytes") {
+            if (!/^\d+$/.test(args[e.at]) || Number(args[e.at]) > SMALL_BYTE_BOUND_MAX)
+                return false;
+            byteBound = true;
+            continue;
+        }
+        if (e.kind === "option" && typeof e.reading === "object" && e.reading.spec?.bounds === "bytes") {
+            if (!/^\d+$/.test(e.reading.attached) || Number(e.reading.attached) > SMALL_BYTE_BOUND_MAX)
+                return false;
+            byteBound = true;
+            continue;
+        }
+        return false;
+    }
+    return byteBound;
+}

package/dist/tools/fs/program-read-model.rows.js

@@ -1,12 +1,14 @@
 import { shellWordsOf } from "../../shell/shell-words.js";
 const READ = { kind: "path", effect: "read" };
 const WRITE = { kind: "path", effect: "write" };
+const WRITE_THROUGH = { kind: "path", effect: "write", through: true };
 const CREATED = { kind: "path", effect: "create" };
 const TOUCHED = { kind: "path", effect: "create", seats: ["landing"] };
 const REMOVED = { kind: "path", effect: "write", seats: ["entry"] };
 const COPY_SOURCE = { kind: "path", effect: "write", seats: ["landing", "entry"], writtenAt: [] };
 const MOVE_SOURCE = { kind: "path", effect: "write", seats: ["landing", "entry"], writtenAt: ["entry"] };
-const DESTINATION = { kind: "path", effect: "write", seats: ["landing", "entry"] };
+const MOVE_DESTINATION = { kind: "path", effect: "write", seats: ["landing", "entry"] };
+const COPY_DESTINATION = { kind: "path", effect: "write", seats: ["landing", "entry"], through: "plain" };
 const EDITED = { kind: "path", effect: "edit-in-place", seats: ["entry"] };
 const NAMES = { kind: "path", effect: "names" };
 const INDIRECT = { kind: "path", effect: "read", valueForm: "indirect" };
@@ -203,18 +205,18 @@ const find = {
 const curl = {
     key: "curl",
     grammars: [grammar({
-            A: val(LABEL), b: val(INDIRECT), C: val(COUNT), c: val(WRITE), D: val(WRITE), d: val(INDIRECT), E: val(READ), e: val(LABEL),
-            F: val(FORM), H: val(HEADER), K: val(READ), m: val(COUNT), o: val(WRITE), P: val(LABEL), Q: val(LABEL), r: val(COUNT),
+            A: val(LABEL), b: val(INDIRECT), C: val(COUNT), c: val(WRITE_THROUGH), D: val(WRITE_THROUGH), d: val(INDIRECT), E: val(READ), e: val(LABEL),
+            F: val(FORM), H: val(HEADER), K: val(READ), m: val(COUNT), o: val(WRITE_THROUGH), P: val(LABEL), Q: val(LABEL), r: val(COUNT),
             T: val(UPLOAD), t: val(LABEL), U: val(LABEL), u: val(LABEL), w: val(INDIRECT), X: val(LABEL), x: val(LABEL), Y: val(COUNT),
             y: val(COUNT), z: val(READ), g: { arity: 0, literalValues: true },
             ...switches("#012346aBfGiIjJklLnNOpqRsSvZ"),
             ...switches("hMV", { mode: "banner" }),
         }, {
-            cacert: val(READ), capath: val(READ), cert: val(READ), config: val(READ), "connect-timeout": val(COUNT), cookie: val(INDIRECT), "cookie-jar": val(WRITE),
-            data: val(INDIRECT), "data-ascii": val(INDIRECT), "data-binary": val(INDIRECT), "data-raw": val(LABEL), "data-urlencode": val(FORM), "dump-header": val(WRITE),
-            form: val(FORM), "form-string": val(LABEL), header: val(HEADER), key: val(READ), "max-time": val(COUNT), "netrc-file": val(READ), output: val(WRITE),
-            proxy: val(LABEL), range: val(COUNT), referer: val(LABEL), request: val(LABEL), resolve: val(LABEL), trace: val(WRITE), "time-cond": val(READ),
-            "trace-ascii": val(WRITE), "upload-file": val(UPLOAD), url: val(URL), user: val(LABEL), "user-agent": val(LABEL), "write-out": val(INDIRECT),
+            cacert: val(READ), capath: val(READ), cert: val(READ), config: val(READ), "connect-timeout": val(COUNT), cookie: val(INDIRECT), "cookie-jar": val(WRITE_THROUGH),
+            data: val(INDIRECT), "data-ascii": val(INDIRECT), "data-binary": val(INDIRECT), "data-raw": val(LABEL), "data-urlencode": val(FORM), "dump-header": val(WRITE_THROUGH),
+            form: val(FORM), "form-string": val(LABEL), header: val(HEADER), key: val(READ), "max-time": val(COUNT), "netrc-file": val(READ), output: val(WRITE_THROUGH),
+            proxy: val(LABEL), range: val(COUNT), referer: val(LABEL), request: val(LABEL), resolve: val(LABEL), trace: val(WRITE_THROUGH), "time-cond": val(READ),
+            "trace-ascii": val(WRITE_THROUGH), "upload-file": val(UPLOAD), url: val(URL), user: val(LABEL), "user-agent": val(LABEL), "write-out": val(INDIRECT),
             ...longSwitches(["append", "compressed", "disable", "fail", "get", "head", "include", "insecure", "junk-session-cookies", "list-only", "location", "netrc", "next", "no-buffer", "parallel", "proxytunnel", "remote-header-name", "remote-name", "remote-time", "show-error", "silent", "use-ascii", "verbose"]), ...BANNERS,
             manual: { arity: 0, mode: "banner" }, globoff: { arity: 0, literalValues: true },
         })],
@@ -497,6 +499,7 @@ const git = {
         merge: gitSubcommand("nqve", "S", "mFsX", ["message", "file", "strategy", "strategy-option", "into-name", "cleanup"]),
         stash: gitSubcommand("pkuaqS", "", "m", ["message", "pathspec-from-file"]),
         grep: GIT_GREP,
+        diff: { grammar: grammar({}, {}), operands: { rest: READ } },
         show: gitObjectSubcommand(),
         "cat-file": gitObjectSubcommand(switches("ptsep")),
         archive: gitObjectSubcommand({ o: val(WRITE) }, { output: val(WRITE), format: val(LABEL), prefix: val(LABEL), remote: val(LABEL) }),
@@ -568,15 +571,15 @@ const codeBodyRows = [
     { key: "compgen", grammars: [grammar({ ...switches("abcdefgjksuv"), ...values("oAGWPSXV"), F: val(COMMAND), C: val(SHELL_TEXT) })], body: "option-values", witness: BINARY },
     { key: "complete", grammars: [grammar({ ...switches("abcdefgjksuvDEIpr"), ...values("oAGWPSXV"), F: val(COMMAND), C: val(SHELL_TEXT) })], body: "option-values", witness: { declared: "a completion spec runs its command only when a person asks for a completion interactively" } },
 ];
-const copyGrammars = (bsdSuffixSwitch) => implementations(grammar({ S: val(LABEL, { effect: "writes" }), t: val(DESTINATION, { fillsLast: true }) }, { "target-directory": val(DESTINATION, { fillsLast: true }), suffix: val(LABEL, { effect: "writes" }), "no-preserve": val(LABEL), sparse: val(LABEL) }), { afterFirstOperand: "options" }, { ...(bsdSuffixSwitch ? { reads: { "-S": SWITCH } } : {}), lacks: [...(bsdSuffixSwitch ? [] : ["-S"]), "-t", "--target-directory", "--suffix", "--no-preserve", "--sparse"], afterFirstOperand: "operands" });
+const copyGrammars = (bsdSuffixSwitch, destination) => implementations(grammar({ S: val(LABEL, { effect: "writes" }), t: val(destination, { fillsLast: true }) }, { "target-directory": val(destination, { fillsLast: true }), suffix: val(LABEL, { effect: "writes" }), "no-preserve": val(LABEL), sparse: val(LABEL) }), { afterFirstOperand: "options" }, { ...(bsdSuffixSwitch ? { reads: { "-S": SWITCH } } : {}), lacks: [...(bsdSuffixSwitch ? [] : ["-S"]), "-t", "--target-directory", "--suffix", "--no-preserve", "--sparse"], afterFirstOperand: "operands" });
 const writerRows = [
     { key: "mkdir", grammars: [], operands: { rest: CREATED, dash: "file" }, witness: BINARY },
     { key: "touch", grammars: implementations(grammar({ h: { arity: 0, writesAt: ["landing", "entry"] } }, { "no-dereference": { arity: 0, writesAt: ["landing", "entry"] } }), {}, { lacks: ["--no-dereference"] }), operands: { rest: TOUCHED, dash: "file" }, witness: BINARY },
     { key: "rm", grammars: implementations(grammar({ ...switches("rR", { selects: "traversal" }), f: { arity: 0, mode: "forced" } }, { ...longSwitches(["recursive"], { selects: "traversal" }), force: { arity: 0, mode: "forced" } }), {}, { lacks: ["--recursive", "--force"] }), operands: { rest: REMOVED, dash: "file" }, witness: BINARY },
     { key: "rmdir", grammars: implementations(grammar({ p: { arity: 0, effect: "writes" } }, { parents: { arity: 0, effect: "writes" } }), {}, { lacks: ["--parents"] }), operands: { rest: REMOVED, dash: "file" }, witness: BINARY },
-    { key: "tee", grammars: [], operands: { rest: WRITE, dash: "file" }, witness: BINARY },
-    { key: "cp", grammars: copyGrammars(true), operands: { rest: COPY_SOURCE, last: DESTINATION, dash: "file" }, witness: BINARY },
-    { key: "mv", grammars: copyGrammars(false), operands: { rest: MOVE_SOURCE, last: DESTINATION, dash: "file" }, witness: BINARY },
+    { key: "tee", grammars: [], operands: { rest: WRITE_THROUGH, dash: "file" }, witness: BINARY },
+    { key: "cp", grammars: copyGrammars(true, COPY_DESTINATION), operands: { rest: COPY_SOURCE, last: COPY_DESTINATION, dash: "file" }, witness: BINARY },
+    { key: "mv", grammars: copyGrammars(false, MOVE_DESTINATION), operands: { rest: MOVE_SOURCE, last: MOVE_DESTINATION, dash: "file" }, witness: BINARY },
 ];
 const stdinReaders = [
     { key: "cat", grammars: [], operands: { stdinBelow: 1 }, witness: BINARY },

package/dist/tools/fs/shell-read-check.js

@@ -8,7 +8,8 @@ import { bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
 import { planShellReads } from "./shell-read-plan.js";
 import { createShellReadEstablisher, establishShellReadsLexically } from "./shell-read-establish.js";
 import { declaredReadDenyHomes, homeViewsAt } from "./read-deny-home.js";
-import { programArgs } from "./shell-read-write-targets.js";
+import { anyOptionWord, programArgs } from "./shell-read-write-targets.js";
+import { passesUnasked } from "./shell-read-device.js";
 import { programRow, selectedOptions } from "./program-read-model.js";
 import { allFindings, anyFaceGuards, decideShellRead, denyRowAtOrBelow, foldShellReadFindings, judgeEstablishedPlan, readRootGrantCandidateOf, stationGuards, writeFaceGuards, } from "./shell-read-judge.js";
 import { seatOf } from "../../core/tool-name-readings.js";
@@ -32,7 +33,6 @@ const WRITES_BENEATH = {
 };
 const isPattern = (f) => f.read.candidate.expands !== false && f.read.candidate.expands !== "unresolvable";
 const RESHAPES_TREE = new Set(["mv"]);
-const anyOptionWord = (words) => words.some((w) => w.startsWith("-"));
 const UNPLACED_OPTIONS = {
     rmdir: (ws) => selectedOptions(programRow("rmdir"), ws).some((o) => o.effect === "writes"),
     sed: (ws) => selectedOptions(programRow("sed"), ws).some((o) => o.value?.kind === "program-file"),
@@ -117,7 +117,7 @@ async function writeGuardsOf(judged, boundary, env, signal) {
     runs.forEach((s, at) => {
         for (const f of s.findings) {
             const written = f.read.written;
-            if (written === undefined || f.read.established === "unestablishable" || f.read.target === undefined)
+            if (written === undefined || f.read.established === "unestablishable" || f.read.target === undefined || passesUnasked(f.read.candidate))
                 continue;
             const child = written.child === true;
             const key = f.read.established === "canonical" || f.read.established === "expansion";

package/dist/tools/fs/shell-read-device.d.ts

@@ -0,0 +1,92 @@
+/**
+ * THE STANDARD DEVICES — the spellings a shell command names for its own standard streams and terminal, which the
+ * containment question is not asked of, and which write nothing durable: ONE table, ONE predicate, read by every layer that
+ * would otherwise treat the word as a path — the shell read station's entries (an output or input redirection's target, a read
+ * operand, the content a program writes through an operand, a `git diff` operand) and the shape tier's two readings of "does
+ * this redirection write" (the read-only reader, the classify faces' data-free redirections).
+ *
+ * The table is the reference implementation's own device predicate (CC 2.1.296 `wwe`, cli296.js @18511591): the null
+ * device, the three standard streams, the terminal, any `/dev/fd/<digits>`, and `/proc/self/fd/{0,1,2}`. A word is such a
+ * spelling AS WRITTEN (quotes removed, nothing folded: `/dev/./null` is a path, not the null device).
+ *
+ * What exempts a word is more than its spelling, on both counts:
+ *  · it is I/O THROUGH the node — a redirection, a read operand, the content a program writes by opening the path
+ *    (`ReadCandidate.through`). A program that creates, unlinks, renames or retargets the path's directory ENTRY
+ *    (`rm`, `mv`, `mkdir`, `touch`, an in-place edit) is judged as it judges any path, and so is a word of a program the
+ *    station has no row for (`ln`, `chmod`): nothing says that program only opens it;
+ *  · no redirection of the same text can have rebound the descriptor the spelling names. A descriptor spelling is a
+ *    name for whatever that descriptor is bound to WHEN THE WORD IS OPENED: `3< f` or `exec 3>f` before it makes
+ *    `/dev/fd/3` the file `f`, and `1<f > /dev/stdout` reopens `f` for writing. Such a descriptor is judged at its landing
+ *    like any path. (One step stricter than the reference, which exempts the spelling whatever the text does.) A text the
+ *    consumer cannot read in full may bind anything, so it exempts no descriptor spelling; the null device and the
+ *    terminal name no descriptor and are exempt always.
+ *
+ * Beside the table, the generator devices (`/dev/zero`, `/dev/random`, `/dev/urandom`, `/dev/full`) are not a stream of the
+ * process: a read of one is no question only while the program read model knows the read is bounded
+ * (`byteBoundIsSmall`: `head -c N`), the same fact the read-only classifier's endless-device arm reads.
+ */
+import type { ReadCandidate, ReadCandidateProvenance, ShellReadPlan } from "./shell-read-plan.js";
+/** Is this word, as written, a standard device? `descriptor`: the descriptor number it names, when it names one. */
+export declare function standardDeviceOf(spelled: string): {
+    readonly descriptor?: number;
+} | undefined;
+/** The devices that PRODUCE data without end: read in bounded bytes they cost nothing, read unbounded they never finish. */
+export declare const GENERATOR_DEVICES: ReadonlySet<string>;
+/** A redirection, as far as binding a descriptor goes: its operator and the number written in front of it (the lexer's
+ *  `LexedRedirect` and the plan's `ShellReadRedirect` both are one). */
+export interface RedirectionBinding {
+    readonly op: string;
+    readonly fd?: number;
+}
+/** What a text does to its descriptors: how many redirections bind each (a count, so the one that IS the use of a spelling
+ *  can be taken out of it), and whether it may bind any it does not show. */
+export interface LineDescriptors {
+    /** Some part of the text the consumer cannot read in full may bind any descriptor (an unreadable text, a program or an
+     *  `eval` / `source` text it does not see, a numbered here-document whose number the lexer drops, a redirection whose number
+     *  the reader keeps no record of). */
+    unknown: boolean;
+    /** A `{name}` word — bash allocates a descriptor from 10 up for a redirection written `{name}>f`. */
+    named: boolean;
+    readonly bound: Map<number, number>;
+}
+export declare const newLineDescriptors: () => LineDescriptors;
+/** The descriptors one redirection binds: the number written in front of it, else the operator's own (`>` family: 1,
+ *  `<` family: 0, `&>`: both output streams). */
+export declare function descriptorsBoundBy(r: RedirectionBinding): readonly number[];
+export declare function bindDescriptors(into: LineDescriptors, r: RedirectionBinding): void;
+export declare const isNamedDescriptorWord: (raw: string) => boolean;
+/**
+ * THE predicate for a word and the text it stands in: is it a standard device (the table, as written) whose descriptor — if it
+ * names one — no redirection of the text rebinds? `self`: the descriptors the redirection that IS the use binds (a word that
+ * is not a redirection's target passes none).
+ */
+export declare function standardDeviceUnrebound(spelled: string, text: LineDescriptors, self: readonly number[]): boolean;
+/**
+ * The provenances whose word a program OPENS (or a redirection opens): a read operand or option value, an input
+ * redirection's source, an output redirection's target, and a word of a program the deployment did not list as a reader but
+ * whose row the station holds (`unlisted_word`, unless it waits for the filesystem — {@link ReadCandidate.speculative}: a
+ * program with no row may do anything with the word), and the root of a tree walk (`grep -r`, `diff`: a standard device is
+ * no directory to walk — an option that writes beyond the operands, `find -delete`, takes the exemption back, see
+ * `judgedCandidatesOf`). Not a directory a program changes into (`cd_target`), not a program, an assignment's value or a
+ * mount source.
+ */
+export declare const OPENED_PROVENANCES: ReadonlySet<ReadCandidateProvenance>;
+/**
+ * Does the containment question go unasked of this candidate? The one predicate every entry of the station reads: the plan
+ * marked the word a standard device no redirection of its text rebinds ({@link ReadCandidate.device}), and — for a word the
+ * program WRITES — the program writes its content through the path ({@link ReadCandidate.through}), not its entry.
+ */
+export declare function passesUnasked(candidate: ReadCandidate): boolean;
+/**
+ * What the whole text of a plan binds: every redirection of every segment — a single one, an `exec`'s, a `{name}` one included —
+ * and whether the text may bind more than it shows. The ONE computation behind the station's rebinding rule
+ * ({@link markStandardDevices}) and the shape tier's reading of a program's device operands (`tee /dev/fd/3`).
+ */
+export declare function descriptorsOfPlan(plan: ShellReadPlan): LineDescriptors;
+/**
+ * Mark every candidate of a whole plan (the nested plans included) that names a standard device the containment question
+ * is not asked of ({@link ReadCandidate.device}): the word is the table's, it is a word a program or a redirection opens,
+ * and no redirection of the text rebinds the descriptor it names. Computed once, over the text as a whole: whether a
+ * descriptor is rebound is a fact of the line, not of a segment.
+ */
+export declare function markStandardDevices(plan: ShellReadPlan): ShellReadPlan;

package/dist/tools/fs/shell-read-device.js

@@ -0,0 +1,109 @@
+const STANDARD_DEVICES = [
+    { spelled: /^\/dev\/null$/ },
+    { spelled: /^\/dev\/stdin$/, descriptor: () => 0 },
+    { spelled: /^\/dev\/stdout$/, descriptor: () => 1 },
+    { spelled: /^\/dev\/stderr$/, descriptor: () => 2 },
+    { spelled: /^\/dev\/tty$/ },
+    { spelled: /^\/dev\/fd\/(\d+)$/, descriptor: (m) => Number(m[1]) },
+    { spelled: /^\/proc\/self\/fd\/([0-2])$/, descriptor: (m) => Number(m[1]) },
+];
+export function standardDeviceOf(spelled) {
+    for (const row of STANDARD_DEVICES) {
+        const match = row.spelled.exec(spelled);
+        if (match !== null)
+            return row.descriptor === undefined ? {} : { descriptor: row.descriptor(match) };
+    }
+    return undefined;
+}
+export const GENERATOR_DEVICES = new Set(["/dev/zero", "/dev/random", "/dev/urandom", "/dev/full"]);
+export const newLineDescriptors = () => ({ unknown: false, named: false, bound: new Map() });
+export function descriptorsBoundBy(r) {
+    if (r.fd !== undefined)
+        return [r.fd];
+    if (r.op === "&>" || r.op === "&>>")
+        return [1, 2];
+    return [r.op === "<" || r.op === "<<<" || r.op === "<&" ? 0 : 1];
+}
+export function bindDescriptors(into, r) {
+    for (const fd of descriptorsBoundBy(r))
+        into.bound.set(fd, (into.bound.get(fd) ?? 0) + 1);
+}
+const NAMED_DESCRIPTOR_WORD = /^\{[A-Za-z_][A-Za-z0-9_]*\}$/;
+export const isNamedDescriptorWord = (raw) => NAMED_DESCRIPTOR_WORD.test(raw);
+function reboundBy(text, descriptor, self) {
+    if (text.unknown || (text.named && descriptor >= 3))
+        return true;
+    return (text.bound.get(descriptor) ?? 0) - (self.includes(descriptor) ? 1 : 0) > 0;
+}
+export function standardDeviceUnrebound(spelled, text, self) {
+    const device = standardDeviceOf(spelled);
+    return device !== undefined && (device.descriptor === undefined || !reboundBy(text, device.descriptor, self));
+}
+export const OPENED_PROVENANCES = new Set(["operand", "option_value", "stdin_redirect", "write_redirect_target", "unlisted_word", "traversal_root"]);
+export function passesUnasked(candidate) {
+    return candidate.device === true && (candidate.face !== "write" || candidate.through === true);
+}
+const SHELL_CODE_VERBS = new Set(["eval", "source", "."]);
+function collectDescriptors(plan, into) {
+    if (plan.unreadable !== undefined)
+        into.unknown = true;
+    for (const segment of plan.segments) {
+        if (segment.declines.length > 0 || segment.unreadProgramText !== undefined)
+            into.unknown = true;
+        if (segment.verb !== undefined && SHELL_CODE_VERBS.has(segment.verb.basename) && segment.nested.length === 0)
+            into.unknown = true;
+        if (segment.reads.some((c) => c.provenance === "program_path" && c.expands === "unresolvable"))
+            into.unknown = true;
+        for (const r of segment.redirects)
+            bindDescriptors(into, r);
+        if (segment.argv.some((w) => isNamedDescriptorWord(w.raw)))
+            into.named = true;
+        const text = segment.text.replace(/\\\r?\n/g, "");
+        if (/(?:^|[^<])<<(?!<)/.test(text)) {
+            if (/\d<<(?!<)/.test(text))
+                into.unknown = true;
+            else
+                into.bound.set(0, (into.bound.get(0) ?? 0) + 1);
+        }
+        for (const n of segment.nested)
+            collectDescriptors(n, into);
+    }
+}
+export function descriptorsOfPlan(plan) {
+    const into = newLineDescriptors();
+    collectDescriptors(plan, into);
+    return into;
+}
+export function markStandardDevices(plan) {
+    const text = descriptorsOfPlan(plan);
+    const mark = (c, self) => {
+        if (c.device === true || c.expands !== false || c.denyOnly === true || c.speculative !== undefined || !OPENED_PROVENANCES.has(c.provenance))
+            return c;
+        return standardDeviceUnrebound(c.spelled, text, self) ? { ...c, device: true } : c;
+    };
+    const marked = new Map();
+    const walk = (p) => {
+        const seen = marked.get(p);
+        if (seen !== undefined)
+            return seen;
+        const out = markedPlan(p);
+        marked.set(p, out);
+        return out;
+    };
+    const markedPlan = (p) => ({
+        ...p,
+        segments: p.segments.map((s) => {
+            const useOf = (c) => {
+                const r = s.redirects.find((x) => x.target !== undefined && x.target.raw === c.raw && x.target.provenance === c.provenance);
+                return r === undefined ? [] : descriptorsBoundBy(r);
+            };
+            return {
+                ...s,
+                reads: s.reads.map((c) => mark(c, c.provenance === "stdin_redirect" ? useOf(c) : [])),
+                redirects: s.redirects.map((r) => (r.target === undefined ? r : { ...r, target: mark(r.target, descriptorsBoundBy(r)) })),
+                nested: s.nested.map(walk),
+            };
+        }),
+    });
+    return walk(plan);
+}

package/dist/tools/fs/shell-read-establish.js

@@ -4,6 +4,7 @@ import { boundaryIsTheSandbox } from "../../core/remote-env.js";
 import { resolveOperandSpellings } from "./bash-readonly-classifier.js";
 import { judgedCandidatesOf, sedBackupNames } from "./shell-read-write-targets.js";
 import { movedReads, withHomeViews } from "./shell-read-identity.js";
+import { passesUnasked } from "./shell-read-device.js";
 const GLOB_METACHAR_RE = /[*?[]/;
 export const MAX_GLOB_DIRS = 256;
 export const MAX_GLOB_MATCHES = 8192;
@@ -569,7 +570,7 @@ function establishLegOver(seen, readRoots) {
                     out.push({ ...(await canonicalReadOf(candidate, m.path, [m.path], "expansion", folded, m.canonical, signal)), node: m.node, walked: true });
             };
             for (const [i, lexical] of lexicalReadsOf(candidate, boundary).entries()) {
-                if (lexical.established !== "lexical") {
+                if (lexical.established !== "lexical" || passesUnasked(candidate)) {
                     out.push(writtenAt(lexical, writtenSeats, writtenSeats.written.includes("landing") ? "landing" : "entry"));
                     continue;
                 }

package/dist/tools/fs/shell-read-judge.js

@@ -1,6 +1,7 @@
 import { hasWin32AliasedComponent, normalizeAbsPathLexically, withinAnyRoot } from "./safety.js";
 import { globInWord } from "./bash-readonly-classifier.js";
 import { readOfText } from "./shell-read-word.js";
+import { passesUnasked } from "./shell-read-device.js";
 import { skipsRootsContainment } from "./containment-face.js";
 export const SHELL_READ_FINDINGS = Object.freeze(["deny_hit", "outside_roots", "unestablishable", "declined", "identity_changed", "unanswered", "none"]);
 export const SHELL_READ_SEATS = Object.freeze(["full_shell", "readonly", "rejudge"]);
@@ -57,6 +58,8 @@ export function judgeRead(read, boundary) {
     const containment = containmentOf(read, boundary);
     if (read.candidate.denyOnly === true)
         return { read, kind: "none", containment };
+    if (passesUnasked(read.candidate))
+        return { read, kind: "none", containment: "open" };
     const provenance = read.candidate.provenance;
     if (provenance === "env_assignment" || (provenance === "program_path" && read.candidate.expands !== "unresolvable"))
         return { read, kind: "none", containment };
@@ -84,10 +87,8 @@ function containmentOf(read, boundary) {
         return "unknown";
     return withinAnyRoot(boundary.roots, read.target) ? "inside" : "outside";
 }
-const NULL_DEVICE = "/dev/null";
 function writeContainmentOf(read, boundary) {
-    const device = read.written?.seat === "landing" && read.candidate.expands === false && read.candidate.spelled === NULL_DEVICE;
-    if (read.written === undefined || read.candidate.denyOnly === true || device)
+    if (read.written === undefined || read.candidate.denyOnly === true || passesUnasked(read.candidate))
         return "open";
     const roots = boundary.writeRoots;
     if (roots === undefined || read.target === undefined)

package/dist/tools/fs/shell-read-plan.d.ts

@@ -84,6 +84,10 @@ export interface ReadCandidate {
      *  word) that is a candidate at all only where it exists as a file. Where the filesystem confirms it is not there (and
      *  nothing in the text writes or creates it), it is no read; a lexical establishment keeps it whole. */
     readonly speculative?: "containment" | "whole";
+    /** A standard device a program or redirection OPENS, its descriptor (if any) unrebound by the text ({@link markStandardDevices}). */
+    readonly device?: true;
+    /** Only beside `face: "write"`: the program writes the word's CONTENT through the path, not its ENTRY ({@link passesUnasked}). */
+    readonly through?: true;
 }
 /** How the shell reached one segment — what the base-candidate walk needs from the connectors. */
 export interface SegmentReach {
@@ -97,6 +101,7 @@ export interface SegmentReach {
 export interface ShellReadRedirect {
     readonly op: LexedRedirect["op"];
     readonly direction: "in" | "out" | "dup";
+    readonly fd?: number;
     readonly target?: ReadCandidate;
 }
 export interface ShellReadSegment {

package/dist/tools/fs/shell-read-plan.js

@@ -10,6 +10,7 @@ import { shellWordsOf } from "../../shell/shell-words.js";
 import { isAbsoluteForFamily } from "./safety.js";
 import { codeBodies, launchedInput, reentryText, scriptFileAt, stdinTextsOf } from "./shell-reentry-text.js";
 import { heldAt, plannedOnce, rebasePlan, startedAt, stdinFeeds } from "./shell-read-start.js";
+import { markStandardDevices } from "./shell-read-device.js";
 export const READ_CANDIDATE_PROVENANCES = Object.freeze([
     "operand",
     "option_value",
@@ -27,7 +28,8 @@ export const READ_CANDIDATE_PROVENANCES = Object.freeze([
 const NESTING_MAX = 4;
 const LOOP_END = shellWordsOf("loop_end"), LOOP_CONDITION = shellWordsOf("loop_condition"), COPROC = shellWordsOf("background"), RESERVED = shellWordsOf("rule_reserved");
 export function planShellReads(command, decl, depth = 0, start) {
-    return planText(command, decl, depth, start).plan;
+    const plan = planText(command, decl, depth, start).plan;
+    return depth === 0 ? markStandardDevices(plan) : plan;
 }
 function planText(command, decl, depth, start, from) {
     const shape = { grouped: false, backgrounded: false, strayRedirection: false };
@@ -209,7 +211,7 @@ function planText(command, decl, depth, start, from) {
                 ...(f.stdin !== undefined ? { stdin: f.stdin } : {}),
                 declines: f.declines,
                 reads: dedupe(f.reads).map(programRead),
-                redirects: f.redirects.map((r) => (r.target === undefined ? { op: r.op, direction: r.direction } : { op: r.op, direction: r.direction, target: withBases(r.target) })),
+                redirects: f.redirects.map((r) => ({ op: r.op, direction: r.direction, ...(r.fd !== undefined ? { fd: r.fd } : {}), ...(r.target !== undefined ? { target: withBases(r.target) } : {}) })),
                 ...(move !== undefined ? { baseMove: { target: typeof move.target === "string" ? move.target : withBases(move.target) } } : {}),
                 bases,
                 nested: f.nested.map((n) => (f.elsewhere?.has(n) === true ? n : rebasePlan(n, decl.cwd, moved && f.shellSide?.has(n) !== true ? "unmodelled" : bases, bases === "unmodelled" ? floor : bases))),
@@ -669,13 +671,14 @@ function relativeSpelling(spelled) {
     return !(isAbsoluteForFamily("own", spelled) || spelled.startsWith("~"));
 }
 function redirectFact(r, table, homeDir) {
+    const fd = r.fd !== undefined ? { fd: r.fd } : {};
     if (r.target === undefined)
-        return { op: r.op, direction: "dup" };
+        return { op: r.op, direction: "dup", ...fd };
     if (r.op === "<")
-        return { op: r.op, direction: "in", target: bare(readsOf([r.target], table, homeDir)[0], "stdin_redirect") };
+        return { op: r.op, direction: "in", ...fd, target: bare(readsOf([r.target], table, homeDir)[0], "stdin_redirect") };
     if (r.op === "<<<")
-        return { op: r.op, direction: "in" };
-    return { op: r.op, direction: "out", target: bare(readsOf([r.target], table, homeDir)[0], "write_redirect_target") };
+        return { op: r.op, direction: "in", ...fd };
+    return { op: r.op, direction: "out", ...fd, target: bare(readsOf([r.target], table, homeDir)[0], "write_redirect_target") };
 }
 function commandStringValue(row, toks, option) {
     const at = toks.findIndex((r) => r.folded === option);

package/dist/tools/fs/shell-read-write-targets.d.ts

@@ -9,6 +9,7 @@
  * program writes is its row's.
  */
 import type { ReadCandidate, ShellReadSegment } from "./shell-read-plan.js";
+import { type LineDescriptors } from "./shell-read-device.js";
 import { type WriteSeat } from "./program-read-model.js";
 export type { WriteSeat } from "./program-read-model.js";
 /** A word of a program's argv: its raw spelling (the plan's candidates are keyed by it) and its folded spelling. */
@@ -46,6 +47,19 @@ export interface JudgedCandidate {
     };
     readonly onlyIfExists?: ReadCandidate;
 }
+/** Is any of these words an option word (one starting with `-`)? The reference implementation's reading of a copy or a move: a
+ *  command with flags is not one whose paths it can validate (`--target-directory`, `--remove-destination`, a backup suffix
+ *  all change what is written where). */
+export declare const anyOptionWord: (words: readonly string[]) => boolean;
+/**
+ * Does this invocation write ONLY standard devices — what the shape tier reads as "writes nothing durable" for a PROGRAM (a
+ * redirection is the reader's own)? Every word any implementation's reading of the row writes ({@link writeReadings}; a word the
+ * reading names written at no seat, a copy's source, is read) is one the program writes THROUGH ({@link writesThrough}) and
+ * is a standard device no redirection of the line rebinds ({@link standardDeviceUnrebound}) — the station's own predicate
+ * (`passesUnasked`) over the same row facts, for the one entry a text-only reader has: `tee /dev/tty`, `cp a.txt /dev/stdout`.
+ * No program is named here: which programs may ask this is the caller's.
+ */
+export declare function writesOnlyStandardDevices(program: string, args: readonly string[], line: LineDescriptors): boolean;
 /** Every candidate a segment hands the judge: its reads minus the write targets, plus its `cd` target (the plan already
  *  lists it among the reads), plus its WRITE targets for the write face ({@link writeTargetsOf}), plus the deny-floor
  *  shadow of every unplaced home word ({@link denyFloorShadowsOf}) on both faces. A word the program only writes keeps