@sema-agent/core 7.49.3 → 7.49.5

package/dist/tools/fs/shell-read-write-targets.js

@@ -1,6 +1,7 @@
 import { denyFloorShadowsOf } from "./shell-read-judge.js";
+import { GENERATOR_DEVICES, OPENED_PROVENANCES, passesUnasked, standardDeviceUnrebound } from "./shell-read-device.js";
 import { renamed } from "./shell-read-word.js";
-import { implementationsOf, programRow, selectedOptions, writeReadings } from "./program-read-model.js";
+import { byteBoundIsSmall, implementationsOf, programRow, readArgRoles, selectedOptions, subcommandOf, writeReadings } from "./program-read-model.js";
 import { programBasename, readProgramPosition } from "./bash-program-position.js";
 export function programArgs(segment) {
     const words = segment.argv.map((w) => ({ raw: w.raw, spelled: w.folded }));
@@ -11,6 +12,25 @@ export function sedBackupNames(name, suffix) {
     const appended = `${name}${suffix}`;
     return suffix.includes("*") ? [suffix.replace(/\*/g, () => name), appended] : [appended];
 }
+export const anyOptionWord = (words) => words.some((w) => w.startsWith("-"));
+function writesThrough(roles, row, words) {
+    const args = words.map((w) => w.spelled);
+    if (roles.length === 0 || readArgRoles(row, args).some((e) => e.kind === "option" && e.reading === "speculative"))
+        return false;
+    return roles.every((role) => role.through === true || (role.through === "plain" && !anyOptionWord(args)));
+}
+export function writesOnlyStandardDevices(program, args, line) {
+    const row = programRow(program);
+    if (row === undefined)
+        return false;
+    const words = args.map((a) => ({ raw: a, spelled: a }));
+    const readings = writeReadings(row, [...args]);
+    return (readings.length > 0 &&
+        readings.every((r) => {
+            const written = r.written.filter((w) => w.role.writtenAt?.length !== 0);
+            return !r.unexplained && written.length > 0 && writesThrough(written.map((w) => w.role), row, words) && written.every((w) => standardDeviceUnrebound(w.value ?? args[w.at], line, []));
+        }));
+}
 const WORD_PROVENANCES = new Set(["operand", "unlisted_word", "option_value"]);
 function writeOwnersOf(segment) {
     const pos = readProgramPosition(segment.argv);
@@ -30,18 +50,19 @@ function writeOwnersOf(segment) {
 function writeTargetsOf(segment) {
     const out = [];
     const writeOnly = new Set();
-    const write = (c, seats, written, child, onlyIfExists) => void out.push({ candidate: { ...c, face: "write" }, ...(seats !== undefined ? { seats } : {}), ...(written !== undefined ? { written } : {}), ...(child === true ? { child } : {}), ...(onlyIfExists !== undefined ? { onlyIfExists } : {}) });
+    const write = (c, seats, written, child, onlyIfExists, through) => void out.push({ candidate: { ...c, face: "write", ...(through === true ? { through } : {}) }, ...(seats !== undefined ? { seats } : {}), ...(written !== undefined ? { written } : {}), ...(child === true ? { child } : {}), ...(onlyIfExists !== undefined ? { onlyIfExists } : {}) });
     for (const r of segment.redirects)
         if (r.direction === "out" && r.target !== undefined)
-            write(r.target);
+            write(r.target, undefined, undefined, undefined, undefined, true);
     for (const c of segment.reads)
         if (c.provenance === "write_redirect_target")
-            write(c);
+            write(c, undefined, undefined, undefined, undefined, true);
     const owners = writeOwnersOf(segment).map(({ row, words, program }) => {
         const args = words.map((w) => w.spelled);
         const all = writeReadings(row, args);
-        const moved = [...new Set(implementationsOf(row).flatMap((view) => selectedOptions(view, args, "one-implementation")).flatMap((o) => o.writesAt ?? []))];
-        return { words, program, all, readings: all.filter((r) => r.written.length > 0 || (r.unexplained && r.operandRole !== undefined)), override: moved.length > 0 ? moved : undefined };
+        const selected = implementationsOf(row).flatMap((view) => selectedOptions(view, args, "one-implementation"));
+        const moved = [...new Set(selected.flatMap((o) => o.writesAt ?? []))];
+        return { row, words, program, all, readings: all.filter((r) => r.written.length > 0 || (r.unexplained && r.operandRole !== undefined)), override: moved.length > 0 ? moved : undefined, beyondOperands: selected.some((o) => o.effect === "writes" || o.effect === "executes") };
     });
     const edited = new Map();
     for (const c of segment.reads) {
@@ -77,7 +98,7 @@ function writeTargetsOf(segment) {
             const seats = stated ? [...new Set(roles.flatMap((role) => o.override ?? role.seats ?? ["landing"]))] : undefined;
             const written = unexplained || roles.some((role) => role.writtenAt === undefined) ? undefined : [...new Set(roles.flatMap((role) => role.writtenAt ?? []))];
             const speculative = readings < o.all.length && roles.every((role) => role.effect === "edit-in-place") ? c : undefined;
-            write(c, seats, written, undefined, speculative);
+            write(c, seats, written, undefined, speculative, !unexplained && writesThrough(roles, o.row, o.words) ? true : undefined);
             if (roles.some((role) => role.effect === "edit-in-place") && c.expands === false)
                 edited.set(o, [...(edited.get(o) ?? []), { candidate: c, ...(speculative !== undefined ? { onlyIfExists: speculative } : {}) }]);
         }
@@ -85,11 +106,25 @@ function writeTargetsOf(segment) {
             writeOnly.add(c);
     }
     for (const o of owners) {
-        for (const c of copyDestinationChildren(segment, o.words, o.readings))
+        for (const c of copyDestinationChildren(segment, o.row, o.words, o.readings))
             write(c, ["landing", "entry"], undefined, true);
         out.push(...backupTargetsOf(edited.get(o) ?? [], o.readings, o.override));
     }
-    return { targets: out, writeOnly };
+    const readWords = new Set();
+    for (const o of owners) {
+        if (!o.program)
+            continue;
+        const args = o.words.map((w) => w.spelled);
+        const found = subcommandOf(o.row, args);
+        const sub = found !== undefined && found.row.operands !== undefined ? found : undefined;
+        const at = sub === undefined ? 0 : sub.at + 1;
+        for (const e of readArgRoles(sub?.row ?? o.row, args.slice(at))) {
+            const role = e.kind === "operand" || e.kind === "value" ? e.role : undefined;
+            if (role?.kind === "path" && (role.effect === "read" || role.writtenAt?.length === 0))
+                readWords.add(o.words[at + e.at].raw);
+        }
+    }
+    return { targets: out, writeOnly, beyondOperands: owners.some((o) => o.beyondOperands), boundedRead: owners.some((o) => o.program && byteBoundIsSmall(o.row, o.words.map((w) => w.spelled))), readWords };
 }
 function backupTargetsOf(edited, readings, override) {
     const suffixes = [...new Set(readings.flatMap((r) => r.suffixes))];
@@ -98,7 +133,7 @@ function backupTargetsOf(edited, readings, override) {
         ? [{ candidate: { ...renamed(f, `${f.spelled}${suffix}`), face: "write" }, seats: ["entry"], followed: { operand: f, suffix }, ...(onlyIfExists !== undefined ? { onlyIfExists } : {}) }]
         : sedBackupNames(f.spelled, suffix).map((spelled) => ({ candidate: { ...renamed(f, spelled), face: "write" }, seats: ["entry"], ...(onlyIfExists !== undefined ? { onlyIfExists } : {}) }))));
 }
-function copyDestinationChildren(segment, words, readings) {
+function copyDestinationChildren(segment, row, words, readings) {
     const candidateOf = (raw) => segment.reads.find((c) => c.raw === raw && WORD_PROVENANCES.has(c.provenance));
     const children = new Map();
     for (const r of readings) {
@@ -109,6 +144,9 @@ function copyDestinationChildren(segment, words, readings) {
         const destCandidate = candidateOf(dest.raw);
         if (destCandidate !== undefined && destCandidate.expands !== false)
             continue;
+        const destRole = r.written.find((w) => w.at === r.copy.destination.at)?.role;
+        if (destCandidate !== undefined && destRole !== undefined && passesUnasked({ ...destCandidate, face: "write", ...(writesThrough([destRole], row, words) ? { through: true } : {}) }))
+            continue;
         for (const at of r.copy.sources) {
             const src = words[at];
             const source = candidateOf(src.raw);
@@ -123,8 +161,21 @@ function copyDestinationChildren(segment, words, readings) {
     return [...children.values()];
 }
 export function judgedCandidatesOf(segment) {
-    const { targets: writes, writeOnly } = writeTargetsOf(segment);
-    const reads = segment.reads.flatMap((c) => (c.provenance === "write_redirect_target" ? [] : [writeOnly.has(c) ? { ...c, denyOnly: true } : c]));
+    const { targets: writes, writeOnly, beyondOperands, boundedRead, readWords } = writeTargetsOf(segment);
+    const throughWritten = new Set(writes.filter((w) => w.candidate.through === true && w.candidate.device === true).map((w) => w.candidate.raw));
+    const opened = (c) => {
+        if (c.provenance === "unlisted_word" && c.device === true && !readWords.has(c.raw) && !throughWritten.has(c.raw)) {
+            const { device: _unread, ...judged } = c;
+            return judged;
+        }
+        if (boundedRead && c.device !== true && c.expands === false && c.speculative === undefined && c.denyOnly !== true && GENERATOR_DEVICES.has(c.spelled) && OPENED_PROVENANCES.has(c.provenance) && (c.provenance !== "unlisted_word" || readWords.has(c.raw)))
+            return { ...c, device: true };
+        if (!beyondOperands || c.device !== true || c.provenance === "stdin_redirect")
+            return c;
+        const { device: _device, ...judged } = c;
+        return judged;
+    };
+    const reads = segment.reads.flatMap((c) => (c.provenance === "write_redirect_target" ? [] : [opened(writeOnly.has(c) ? { ...c, denyOnly: true } : c)]));
     const plain = (cs) => cs.map((candidate) => ({ candidate }));
     return [...plain(reads), ...plain(denyFloorShadowsOf(reads)), ...writes, ...plain(denyFloorShadowsOf(writes.map((w) => w.candidate)))];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.49.3",
+  "version": "7.49.5",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.49.4.json

@@ -0,0 +1,69 @@
+{
+  "repo": "core",
+  "version": "7.49.4",
+  "from": "33e4b503cea033b8c08b96103e4707a5f8a34573",
+  "to": "18d7fa8fa5f2d2949a3848397709cdf60920dbca",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 223,
+  "signatures": [],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.classes",
+      "assertions": [
+        "G1.a",
+        "G2.a",
+        "G7.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.mandated",
+      "assertions": [
+        "G1.a",
+        "G7.a",
+        "G8.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.requiresRealApproval",
+      "assertions": [
+        "G8.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RedactionReport.findings",
+      "assertions": [
+        "G4.a",
+        "G5.a",
+        "G6.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ShellReadVerdict.finding",
+      "assertions": [
+        "G3.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@26456d2d server@a0533487 sdk@f1b30d4 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}

package/wire-changes/core@7.49.5.json

@@ -0,0 +1,104 @@
+{
+  "repo": "core",
+  "version": "7.49.5",
+  "from": "40a79ac3341fc6750aae1664c64840a44abaa205",
+  "to": "9ba02c33f3eea253894b0132dca7ed98c390fb08",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 223,
+  "signatures": [
+    {
+      "name": "FileDurableRulePartitionProvider.constructor",
+      "at": [
+        "src/stores/file/permission-rule-store.ts:671"
+      ],
+      "from": [
+        "(dir: string, onError?: (message: string) => void, opts?: { dataRoot?: string; })"
+      ],
+      "to": [
+        "(dir: string, onError?: (message: string) => void, opts?: { dataRoot?: string; platform?: NodeJS.Platform; })"
+      ],
+      "changes": [
+        {
+          "aspect": "param",
+          "detail": "param 3 `opts` type widened: { dataRoot?: string; [ -> platform?: NodeJS.Platform; ]}",
+          "breaking": false
+        }
+      ],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "name": "judgePeerRecordFile",
+      "at": [
+        "src/agents/peer-directory.ts:484"
+      ],
+      "from": [
+        "(stat: { uid?: number; mode: number; isFile: boolean; size: number; }, selfUid: number | undefined): { ok: false; code: \"not_regular\" | \"foreign_owner\" | \"group_or_world_writable\" | \"too_large\"; } | { ok: true; }"
+      ],
+      "to": [
+        "(stat: { uid?: number; mode: number; isFile: boolean; size: number; }, selfUid: number | undefined, platform?: NodeJS.Platform): { ok: false; code: \"not_regular\" | \"foreign_owner\" | \"group_or_world_writable\" | \"too_large\"; } | { ok: true; }"
+      ],
+      "changes": [
+        {
+          "aspect": "param",
+          "detail": "+optional param `platform?: NodeJS.Platform`",
+          "breaking": false
+        }
+      ],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "name": "vetPeerRegistryDirectory",
+      "at": [
+        "src/agents/peer-directory.ts:452"
+      ],
+      "from": [
+        "(dir: string, opts?: { uid?: number; stopAt?: string; }): Promise<PeerRegistryDirectoryVerdict>"
+      ],
+      "to": [
+        "(dir: string, opts?: { uid?: number; stopAt?: string; platform?: NodeJS.Platform; }): Promise<PeerRegistryDirectoryVerdict>"
+      ],
+      "changes": [
+        {
+          "aspect": "param",
+          "detail": "param 2 `opts` type widened: …umber; stopAt?: string; [ -> platform?: NodeJS.Platform; ]}",
+          "breaking": false
+        }
+      ],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.classes",
+      "assertions": [
+        "G1.a",
+        "G2.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [
+      "FileDurableRulePartitionProvider"
+    ],
+    "server": [
+      "FileDurableRulePartitionProvider"
+    ],
+    "sdk": [],
+    "note": "scanned cli@7006be65 server@72f3abe9 sdk@f1b30d4 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it. Ledger files (**/docs/core-consumption/**, **/docs/wire-consumption/**, **/*LEDGER*.json) are not evidence of use — server: 2 name(s) matched ONLY in bookkeeping files and were set aside (judgePeerRecordFile, vetPeerRegistryDirectory)"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}