@sema-agent/core 7.51.2 → 7.53.0

package/dist/tools/fs/read-deny-home.js

@@ -260,6 +260,15 @@ async function readAuxiliaryHome(env, home, opts, signal) {
         sayAuxiliary("a probe did not answer", opts.configRoot === true ? "config_root" : "auxiliary");
     return reading;
 }
+export function homeViewUnreadSentence(subject, unread, face = "read") {
+    return `"${subject}" could not be judged against the ${face} deny list: "${unread}" cannot be identified against the home directories the home-anchored rows are placed under, so whether such a row covers it is unknown; refused — a deny judgment that did not finish is not a pass. Retry once the environment answers identity lookups.`;
+}
+export class HomeViewUnreadError extends Error {
+    constructor(subject, unread) {
+        super(homeViewUnreadSentence(subject, unread));
+        this.name = "HomeViewUnreadError";
+    }
+}
 function homeViewSourceOver(env, auxiliary) {
     const declared = declaredHomeOf(env);
     let declaredChain;
@@ -285,12 +294,10 @@ function homeViewSourceOver(env, auxiliary) {
             const at = judgmentEnv ?? env;
             const identity = at.fileIdentity;
             let index;
-            const unread = [];
             const indexOf = () => (index ??= (async () => {
-                const chains = [await readDeclared(at), ...(await Promise.all(auxiliary)).map((a) => a.chain)];
-                for (const at of chains.flatMap((c) => c.unread))
-                    if (!unread.includes(at))
-                        unread.push(at);
+                const declaredChain = await readDeclared(at);
+                const chains = [declaredChain, ...(await Promise.all(auxiliary)).map((a) => a.chain)];
+                const unread = declaredChain.unread[0];
                 const out = new Map();
                 for (const { own } of chains)
                     if (own !== undefined && !out.has(own.id))
@@ -299,7 +306,7 @@ function homeViewSourceOver(env, auxiliary) {
                     for (const { dir, id } of ancestors)
                         if (!out.has(id))
                             out.set(id, dir);
-                return out.size > 0 ? out : undefined;
+                return { ...(out.size > 0 ? { ids: out } : {}), ...(unread !== undefined ? { unread } : {}) };
             })());
             const views = new Map();
             const viewOf = (path, leafIsFile) => {
@@ -308,25 +315,26 @@ function homeViewSourceOver(env, auxiliary) {
                 if (v === undefined) {
                     v = (async () => {
                         const index = await indexOf();
-                        if (index === undefined || typeof identity !== "function")
-                            return undefined;
+                        const chain = index.unread !== undefined ? { unread: index.unread } : {};
+                        if (index.ids === undefined || typeof identity !== "function")
+                            return chain;
                         if (!leafIsFile) {
                             const id = await identityOf(at, identity, path, signal);
                             if (identityUnread(id))
-                                return void unread.push(path);
+                                return { unread: path };
                             if (id?.ok === true) {
-                                const at = index.get(id.value);
-                                if (at !== undefined)
-                                    return at;
+                                const dir = index.ids.get(id.value);
+                                if (dir !== undefined)
+                                    return { ...chain, view: dir };
                             }
                             else if (id?.error.code === "not_supported")
-                                return undefined;
+                                return chain;
                         }
                         const parent = normalizeAbsPathLexically(`${path}/..`);
                         if (parent === path)
-                            return undefined;
+                            return chain;
                         const up = await viewOf(parent, false);
-                        return up === undefined ? undefined : joinForFamily(pathFamilyOf({ root: path }), up, path.slice(parent.length).replace(/^[\\/]+/, ""));
+                        return up.view === undefined ? up : { ...up, view: joinForFamily(pathFamilyOf({ root: path }), up.view, path.slice(parent.length).replace(/^[\\/]+/, "")) };
                     })();
                     views.set(key, v);
                 }
@@ -335,12 +343,11 @@ function homeViewSourceOver(env, auxiliary) {
             return {
                 async of(path, opts) {
                     if (typeof identity !== "function" || (declared === undefined && auxiliary.length === 0) || !isAbsoluteForFamily("own", path))
-                        return undefined;
+                        return {};
                     const spelled = normalizeAbsPathLexically(path);
-                    const view = await viewOf(spelled, opts?.leaf === "file");
-                    return view === undefined || view === spelled ? undefined : view;
+                    const { view, unread } = await viewOf(spelled, opts?.leaf === "file");
+                    return { ...(view !== undefined && view !== spelled ? { view } : {}), ...(unread !== undefined ? { unread } : {}) };
                 },
-                unread,
             };
         },
     };
@@ -379,6 +386,7 @@ export function readDenyOver(current, homeViews) {
             return current().rgProbeGlobs;
         },
         unexcludableUnder: (scope) => current().unexcludableUnder?.(scope) ?? false,
+        rowUnderRoot: (scope) => current().rowUnderRoot?.(scope) ?? null,
         rowAtOrBelow: (path) => current().rowAtOrBelow?.(path) ?? null,
         homeViews: homeViews ?? { views: (signal) => current().homeViews.views(signal) },
     };
@@ -464,15 +472,8 @@ export function readDenyPlacedLater(unplaced, place) {
     const homeViews = {
         views(signal, judgmentEnv) {
             let views;
-            const unread = [];
             return {
-                of: async (path, opts) => {
-                    const inner = await (views ??= settled().then((m) => m.homeViews.views(signal, judgmentEnv)));
-                    const view = await inner.of(path, opts);
-                    unread.splice(0, unread.length, ...inner.unread);
-                    return view;
-                },
-                unread,
+                of: async (path, opts) => (await (views ??= settled().then((m) => m.homeViews.views(signal, judgmentEnv)))).of(path, opts),
             };
         },
     };

package/dist/tools/fs/read-deny.d.ts

@@ -48,6 +48,17 @@ export interface ReadDenyHit {
      *  sends the reader chasing a path the pattern does not match. */
     matchedView?: string;
 }
+/** A recursive read's root relation to the table ({@link ReadDenyMatcher.rowUnderRoot}): the row the root NAMES or contains
+ *  (`unplaced` absent), or — when it names none — a home-anchored row compiled under no home (`unplaced: true`), which cannot be
+ *  placed and so may lie under any root. */
+export type ReadDenyRootHit = ReadDenyHit & {
+    readonly unplaced?: true;
+};
+/** The same relation as the shell read boundary takes it ({@link ReadDenySeat.denyUnder}): the pattern of the row the root
+ *  names (a deny), `{ unplaced }` for a row the root may hold that no home places, or null. */
+export type ReadDenyRootAnswer = string | {
+    readonly unplaced: string;
+} | null;
 /** The two faces of the deny table: what a READ must not reach, and what a WRITE must not reach. */
 export declare const DENY_FACES: readonly ["read", "write"];
 export type DenyFace = (typeof DENY_FACES)[number];
@@ -167,14 +178,11 @@ export interface ReadDenyMatcher {
     /** Judge ONE path view (segment-window semantics). Returns the first matching entry, or null.
      *  `aliasResolved` = the key's MINTER reports the real filesystem already collapsed any win32
      *  component alias in it (canonicalizeTarget's realpath arm); unset ⇒ both readings are judged,
-     *  which is the fail-closed default. `walked` = the path is a MEMBER a traversal enumerated below a
-     *  root the command's text names, not a spelling of the command: the rule-DSL rows do not judge it (a
-     *  `Read(<pattern>)` deny reaches what the command SPELLS — the reference implementation's best-effort
-     *  reading of a rule against a command's arguments), while the segment rows (the built-in tiers, the
-     *  deployment's patterns) reach every path a read can open. Unset ⇒ every row, the fail-closed default. */
+     *  which is the fail-closed default. Every row of the table judges the path — a segment row (built-in tier,
+     *  deployment pattern) and a rule row alike: a path is judged by what a command NAMES, never by a tree
+     *  enumerated below it. */
     matchPath(path: string, opts?: {
         readonly aliasResolved?: boolean;
-        readonly walked?: boolean;
     }): ReadDenyHit | null;
     /** §3.3 target judgment: canonical view + lexical view + every hop of the leaf symlink chain (`hops`,
      *  each an unresolved spelling some link wrote); ANY hit decides. `aliasResolved` applies to the
@@ -195,6 +203,16 @@ export interface ReadDenyMatcher {
      *  differently by whether the entry's content matched — so a search over such a scope takes the walker, which prunes
      *  by path before reading. A scope that is not rooted answers true. */
     unexcludableUnder?(scope: string): boolean;
+    /** The segment row the absolute directory `scope` NAMES or contains, judged on locations alone, never on what exists
+     *  there: a placed row (home-anchored or rooted, or where one of those really leads) whose location lies at or below the
+     *  scope, or a spelled row whose run — leading wildcards dropped — starts at the scope's own segments (`secrets/**`, with or
+     *  without a leading double-star segment, for `…/secrets` and for `…/secrets/sub`; not for `…/sub` that merely holds a `secrets` directory below
+     *  it, and a double-star-led `.env` row names no directory at all). A home-anchored row compiled under NO home names a root
+     *  where its spelled run does and otherwise answers `unplaced` (a row that cannot be placed holds wider: any root may hold
+     *  it), after every row the root names. Rule rows never answer here: a person's `Read(<path>)` rule judges explicit operands
+     *  only. `null` for a scope that is not rooted. The one answer a recursive read's root gets about the table
+     *  ({@link unexcludableUnder} asks the placed subset for the search faces). */
+    rowUnderRoot?(scope: string): ReadDenyRootHit | null;
     /** A row that lies AT or BELOW `path` — the path is inside one of the row's matches, or a match would run on below the
      *  path from its own segments ({@link rowMeetsPath}) — so moving, copying or removing the path changes what the row
      *  covers. A rule row's reach below a path is not enumerable: any rule row answers. */
@@ -216,10 +234,10 @@ export declare function seatReady(seat: unknown, signal?: AbortSignal): Promise<
  *  this module is the leaf every face depends on). `denyMatch` judges one LEXICALLY RESOLVED operand,
  *  returning the matched pattern or null; PRESENT-IFF there is something to judge. */
 export interface ReadDenySeat {
-    /** `walked` — the path is a traversal's enumerated member, not a spelling ({@link ReadDenyMatcher.matchPath}). */
-    denyMatch?: (resolvedPath: string, opts?: {
-        readonly walked?: boolean;
-    }) => string | null;
+    denyMatch?: (resolvedPath: string) => string | null;
+    /** {@link ReadDenyMatcher.rowUnderRoot} for one lexically resolved directory, as {@link ReadDenyRootAnswer}; present exactly
+     *  when `denyMatch` is. */
+    denyUnder?: (resolvedPath: string) => ReadDenyRootAnswer;
     /** {@link ReadDenyMatcher.rowAtOrBelow} for one lexically resolved path; present exactly when `denyMatch` is. */
     denyAtOrBelow?: (resolvedPath: string) => string | null;
     denyEntries: readonly string[];
@@ -306,6 +324,14 @@ export interface ReadDenyBuiltinRow {
  * and a false refusal on a fixture is the cheap direction (deny errs strict). A home-anchored row
  * (`~/…`, {@link READ_DENY_HOME_WORD}) is matched only below the home directory.
  *
+ * Two COLUMNS, one table: a name that is a credential wherever it is found is spelled unanchored (a key
+ * copied into a repo is as hot as the original); a name that is the PERSON's file in the home but the
+ * project's own configuration anywhere else is spelled home-anchored. `.npmrc` / `.pypirc` are the second
+ * kind: `~/.npmrc` holds the person's registry tokens, while a project's `.npmrc` is read on every install
+ * question and routinely carries an `${NPM_TOKEN}` placeholder — refusing it cost ordinary work in every mode
+ * and bought nothing the home row does not already hold. The same file read through a link from a project
+ * into the home still meets the home row on its canonical view.
+ *
  * NOT listed, deliberately: `.env`/`.env.*` (ruled out — workspace material; the WRITE guard still
  * covers them; the ENGINE's own `.env` under its data root is a different file and IS listed, see the
  * agent-config tier); `*.pem`/`*.key`/`*.p12`/`*.pfx` (repo certificates/test keys are routinely
@@ -403,6 +429,9 @@ export interface CompiledSegmentPattern {
      *  itself rooted (anchored at the filesystem root, {@link ReadDenyEntry}). A view that is not rooted cannot be placed: a
      *  home-anchored row's own run is held anywhere in it (the row cannot be placed, so it holds wider); these two judge it not. */
     rootedOnly?: true;
+    /** A home-anchored row compiled under NO home: it cannot be placed, so it holds wider on both relations a path has to it —
+     *  its run matches anywhere in a path, and any recursive read's root may hold it ({@link rowNamedByRoot}). */
+    unplacedHome?: true;
 }
 /**
  * Compile one segment-glob pattern (shared engine). `fold`:
@@ -457,7 +486,8 @@ export declare function checkedReadDenyHomes(homes: unknown, seat?: string): rea
  * ({@link READ_DENY_HOME_WORD}) is placed under: the declared home, the account home and, where the environment's
  * canonical spelling of one differs, that one too (the faces judge canonical keys beside the spelled views). Absolute
  * spellings only — any other shape refuses loudly, naming `readDenyHomes`. EMPTY = the environment declares no
- * home: a home-anchored entry then matches its run anywhere — a row that cannot be placed holds wider, never narrower.
+ * home: a home-anchored entry then matches its run anywhere and any recursive read's root may hold it
+ * ({@link ReadDenyMatcher.rowUnderRoot}) — a row that cannot be placed holds wider, never narrower, on both relations.
  *
  * `linked` — where a home-anchored or a rooted row's LITERAL HEAD ({@link readDenyRunHead}) really leads, keyed by the row's
  * pattern: the canonical locations a mount resolved (`readDenyLinksOf`, read-deny-home.ts) where

package/dist/tools/fs/read-deny.js

@@ -166,7 +166,11 @@ export function readDenySeat(matcher) {
     if (matcher === undefined || entries.length === 0)
         return { denyEntries: entries };
     return {
-        denyMatch: (p, opts) => matcher.matchPath(p, opts)?.pattern ?? null,
+        denyMatch: (p) => matcher.matchPath(p)?.pattern ?? null,
+        denyUnder: (p) => {
+            const hit = matcher.rowUnderRoot?.(p) ?? null;
+            return hit === null ? null : hit.unplaced === true ? { unplaced: hit.pattern } : hit.pattern;
+        },
         denyAtOrBelow: (p) => (matcher.rowAtOrBelow !== undefined ? (matcher.rowAtOrBelow(p)?.pattern ?? null) : entries[0]),
         denyEntries: entries,
     };
@@ -211,8 +215,8 @@ export const READ_FACE_BUILTIN_DENY_TABLE = [
     { pattern: ".git-credentials", tier: "credentials" },
     { pattern: ".docker/config.json", tier: "credentials" },
     { pattern: ".config/gh", tier: "credentials" },
-    { pattern: ".npmrc", tier: "credentials" },
-    { pattern: ".pypirc", tier: "credentials" },
+    { pattern: "~/.npmrc", tier: "credentials" },
+    { pattern: "~/.pypirc", tier: "credentials" },
     { pattern: ".local/share/keyrings", tier: "credentials" },
     { pattern: "Library/Keychains", tier: "credentials" },
     { pattern: ".credentials.json", tier: "credentials" },
@@ -402,6 +406,40 @@ function rowMeetsPath(pat, segs, rooted) {
     }
     return false;
 }
+function isAnySegment(re) {
+    return /^\^(\[\^\/\]\*)+\$$/.test(re.source);
+}
+function rowNamedByRoot(pat, segs, rooted) {
+    if (pat.anchors !== undefined)
+        return rooted && rowMeetsPath(pat, segs, rooted) ? "named" : "none";
+    if (pat.rootedOnly === true)
+        return "none";
+    let k = 0;
+    while (k < pat.segments.length && isAnySegment(pat.segments[k]))
+        k++;
+    const run = pat.segments.slice(k);
+    for (let i = 0; run.length > 0 && i < segs.length; i++) {
+        const m = Math.min(run.length, segs.length - i);
+        if (run.slice(0, m).every((re, j) => re.test(segs[i + j])))
+            return "named";
+    }
+    return pat.unplacedHome === true && rooted ? "unplaced" : "none";
+}
+function rowNamedByRootOf(rows, path) {
+    const rooted = isAbsoluteForFamily("own", path);
+    const views = segmentViewsOf(path);
+    let unplaced;
+    for (const pat of rows) {
+        for (const view of views) {
+            const relation = rowNamedByRoot(pat, pat.foldAscii ? view.map(asciiLower) : view, rooted);
+            if (relation === "named")
+                return { pattern: pat.raw };
+            if (relation === "unplaced")
+                unplaced ??= pat.raw;
+        }
+    }
+    return unplaced === undefined ? null : { pattern: unplaced, unplaced: true };
+}
 function rowAtOrBelowOf(rows, path) {
     const rooted = isAbsoluteForFamily("own", path);
     const views = segmentViewsOf(path);
@@ -517,8 +555,10 @@ export function compileReadDeny(additions = [], layer = "additions", builtin, ru
             throw new Error(`readDenyPatterns: pattern ${JSON.stringify(e.pattern)} compiled to zero segments.`);
         if (isRootedReadDenyPattern(e.pattern))
             return { ...c, raw: e.pattern, anchors: [[]], rootedOnly: true };
-        if (!homeAnchored || homeSegments.length === 0)
+        if (!homeAnchored)
             return { ...c, raw: e.pattern };
+        if (homeSegments.length === 0)
+            return { ...c, raw: e.pattern, unplacedHome: true };
         return { ...c, raw: e.pattern, anchors: homeSegments.map((segs) => (fold === "ascii" ? segs.map(asciiLower) : segs)) };
     });
     if (!(linked instanceof Map))
@@ -560,8 +600,13 @@ export function compileReadDeny(additions = [], layer = "additions", builtin, ru
             return { pattern: hit };
         return ruleRows.length === 0 ? null : { pattern: ruleRows[0].rule };
     };
+    const rowUnderRoot = (scope) => {
+        if (judged.length === 0 || !isAbsoluteForFamily("own", scope))
+            return null;
+        return rowNamedByRootOf(judged, normalizeAbsPathLexically(scope));
+    };
     const matchPath = (path, opts) => {
-        const hit = denyTableHit(opts?.walked === true ? segmentRows : tableRows, { views: [{ path, kind: "lexical", ...(opts?.aliasResolved === true ? { aliasResolved: true } : {}) }] });
+        const hit = denyTableHit(tableRows, { views: [{ path, kind: "lexical", ...(opts?.aliasResolved === true ? { aliasResolved: true } : {}) }] });
         return hit === null ? null : { pattern: hit.pattern };
     };
     return {
@@ -572,6 +617,7 @@ export function compileReadDeny(additions = [], layer = "additions", builtin, ru
         rgExclusionGlobs,
         rgProbeGlobs,
         unexcludableUnder,
+        rowUnderRoot,
         rowAtOrBelow,
     };
 }

package/dist/tools/fs/safety.d.ts

@@ -3,24 +3,9 @@ import { type HomeViewSource } from "./read-deny-home.js";
 import type { AssertAllKeysHandled } from "../../core/ask-origin.js";
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { protectivePathTargetOf, type ToolCallLike } from "../../core/tool-registry.js";
-/**
- * CC parity: Read/Edit/Write take the file path as `file_path`. Read the target the same way
- * EVERYWHERE the path is consumed from a tool-call's args — not just the tool body but ALSO every gate that
- * extracts the write target to confine it (sensitive-path, session allowDirs, the fs-write gate). A gate that only
- * read `args.path` would see `undefined` for a `file_path` call and either fail-OPEN (circumvent the guard — a real
- * hole) or fail-closed (deny a legitimate write). Single source.
- *
- * The `path` arm is deliberately BROADER than what Read/Edit/Write accept: their schema requires
- * `file_path` (fs-shared.ts FILE_PATH_PARAMS; Write alone repairs the `path` spelling onto it BEFORE validation,
- * `coerceWriteArguments`, so a gate never sees the alias there), but this reader is
- * shared with gates that judge OTHER tool vocabularies — Glob's real `path` parameter, deployment-authored tools —
- * and a gate must never see LESS than the tool it is confining might act on. So the asymmetry is the design: the
- * schema decides what a caller may send, this decides what gets judged, and this side over-reads on purpose.
- */
-export declare function fileArgPath(args: unknown): string | undefined;
 /**
  * The WRITE TARGET of a path-confinable write call, tool-aware — single source for every gate that
- * confines a write target, same discipline as {@link fileArgPath} above:
+ * confines a write target, same discipline as {@link fileArgPath} (core/tool-registry.ts):
  *
  *  · canonical `NotebookEdit` → `notebook_path` FIRST, `file_path`/`path` only as fallback. The tool
  *    itself writes `notebook_path`; its schema tolerates extra keys, so a stray/decoy `file_path` on a
@@ -111,7 +96,8 @@ export interface FsViolation {
      *  then additionalDirectories), canonical form. */
     roots?: readonly string[];
     /** Set ONLY on `read_path_denied` — the deny-list pattern (verbatim entry text)
-     *  the judged target matched. */
+     *  the judged target matched. Absent on the refusal of a deny judgment that could not finish (a home view nobody could
+     *  read, read-deny-home.ts `HomeView.unread`): no row matched, so none is named and no deny card is minted. */
     pattern?: string;
     message: string;
 }
@@ -194,10 +180,6 @@ export declare function hasBinaryExtension(path: string): boolean;
 /** The MIME type to return an image file AS (a visual `ImageContent` block), or `undefined` if `path` is not a
  *  Read-supported image. Pure — no I/O. */
 export declare function imageMimeForRead(path: string): string | undefined;
-/** Verify the raw bytes actually ARE the image format the extension claims (magic-number sniff). Extension alone
- *  is forgeable: a `.png` holding text / an empty file / a truncated blob would otherwise become a malformed
- *  `ImageContent` that makes the NEXT provider request fail (400). Pure — no I/O. */
-export declare function imageMagicMatches(bytes: Uint8Array, mimeType: string): boolean;
 /** One contiguous byte pattern that must appear at a fixed offset for its signature to match. */
 export interface BinaryMagicSegment {
     /** Byte offset the pattern starts at — 0 for a leading signature, 257 for tar's `ustar`, and so on. */
@@ -217,7 +199,7 @@ export interface BinaryMagicSignature {
 /**
  * Magic-byte criteria for the formats {@link hasBinaryExtension} names. That list carries 103
  * extensions; without this table only PDF (`pdfMagicMatches`, in the PDF lane) and the four API image
- * formats ({@link imageMagicMatches}) have a content criterion, so for every other listed format the
+ * formats (`imageMagicMatches`, core/image-admission.ts) have a content criterion, so for every other listed format the
  * NAME is the only evidence available. Where the content IS reachable that leaves identification to
  * the statistical fallback ({@link isBinaryContent}),
  * which samples the first 8192 decoded characters and passes anything whose control-character ratio
@@ -295,10 +277,6 @@ export declare function pathFamilyOf(bases: {
     readonly root?: string | undefined;
     readonly cwd?: string | undefined;
 }): PathFamily | undefined;
-/** UNC under the win family: two leading separators, a host, a share — either separator, as `path.win32`
- *  reads it. The ONE UNC recognizer behind {@link isAbsoluteForFamily}, {@link pathIdentityOf} and
- *  {@link joinForFamily}. */
-export declare function isUncSpelling(p: string): boolean;
 /** Where a reading takes its family from: a tree's ({@link PathFamily}), or `"own"` — an address with no tree to place
  *  it reads its OWN spelling as the family source (the {@link pathFamilyOf} of that spelling), so a treeless `C:\x` and a
  *  treeless `/x` are each read in their own family rather than one of them being declared relative. */

package/dist/tools/fs/safety.js

@@ -1,20 +1,13 @@
 import { createHash } from "node:crypto";
 import { readDenySentence } from "./read-deny.js";
-import { homeViewsOf } from "./read-deny-home.js";
+import { homeViewsOf, homeViewUnreadSentence } from "./read-deny-home.js";
 import { skipsRootsContainment } from "./containment-face.js";
 import { sliceHeadSafe } from "../../core/surrogate-safe-slice.js";
-import { pathTargetValue, protectivePathTargetOf } from "../../core/tool-registry.js";
+import { fileArgPath, pathTargetValue, protectivePathTargetOf } from "../../core/tool-registry.js";
 import { readPath } from "../../core/effective-path-target.js";
+import { isUncSpelling } from "../../core/unc-spelling.js";
 import { withGateTimeout, DEFAULT_GATE_AWAIT_TIMEOUT_MS } from "../../core/gate-bounded-await.js";
 import { thrownText } from "../../core/thrown-value.js";
-export function fileArgPath(args) {
-    const a = args;
-    const fp = a?.file_path;
-    if (typeof fp === "string" && fp.length > 0)
-        return fp;
-    const p = a?.path;
-    return typeof p === "string" && p.length > 0 ? p : undefined;
-}
 export function writeTargetPath(call, pt = protectivePathTargetOf(call)) {
     if (pt !== undefined)
         return pathTargetValue(call.args, pt);
@@ -152,21 +145,6 @@ export function imageMimeForRead(path) {
         return undefined;
     return IMAGE_MIME_BY_EXT[path.slice(dot).toLowerCase()];
 }
-export function imageMagicMatches(bytes, mimeType) {
-    const b = bytes;
-    switch (mimeType) {
-        case "image/png":
-            return b.length >= 8 && b[0] === 0x89 && b[1] === 0x50 && b[2] === 0x4e && b[3] === 0x47 && b[4] === 0x0d && b[5] === 0x0a && b[6] === 0x1a && b[7] === 0x0a;
-        case "image/jpeg":
-            return b.length >= 3 && b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff;
-        case "image/gif":
-            return b.length >= 6 && b[0] === 0x47 && b[1] === 0x49 && b[2] === 0x46 && b[3] === 0x38 && (b[4] === 0x37 || b[4] === 0x39) && b[5] === 0x61;
-        case "image/webp":
-            return b.length >= 12 && b[0] === 0x52 && b[1] === 0x49 && b[2] === 0x46 && b[3] === 0x46 && b[8] === 0x57 && b[9] === 0x45 && b[10] === 0x42 && b[11] === 0x50;
-        default:
-            return false;
-    }
-}
 const asciiBytes = (s) => Array.from(s, (c) => c.charCodeAt(0));
 export const BINARY_MAGIC_SIGNATURES = [
     { format: "ZIP archive", segments: [{ offset: 0, bytes: [0x50, 0x4b, 0x03, 0x04] }] },
@@ -312,9 +290,6 @@ export function pathFamilyOf(bases) {
     const tree = bases.root ?? bases.cwd;
     return tree === undefined ? undefined : isWinFormPath(tree) ? "win" : "posix";
 }
-export function isUncSpelling(p) {
-    return /^[\\/]{2}[^\\/]+[\\/]+[^\\/]/.test(p);
-}
 export function familyFor(source, p) {
     return source === "own" ? (isWinFormPath(p) ? "win" : "posix") : source;
 }
@@ -481,13 +456,16 @@ export async function resolveKey(env, rootCanonical, path, signal, baseCwd, addi
         const judged = { aliasResolved: canon.aliasResolved === true, hops: views.hops };
         const lexical = views.lexical?.kind === "path" ? spellingOfIdentity(views.lexical.identity, views.lexical.family) : undefined;
         let hit = readDeny.matchTarget(key, lexical, judged);
+        const write = readDeny.face === "write";
         if (hit === null) {
-            const homeView = await homeViewsOf(env, readDeny, signal).of(key);
-            if (homeView !== undefined)
-                hit = readDeny.matchTarget(key, homeView, judged);
+            const home = await homeViewsOf(env, readDeny, signal).of(key);
+            if (home.view !== undefined)
+                hit = readDeny.matchTarget(key, home.view, judged);
+            if (hit === null && home.unread !== undefined) {
+                return { ok: false, violation: { code: write ? "write_path_denied" : "read_path_denied", message: homeViewUnreadSentence(path, home.unread, write ? "write" : "read"), target: key } };
+            }
         }
         if (hit !== null) {
-            const write = readDeny.face === "write";
             return {
                 ok: false,
                 violation: {

package/dist/tools/fs/search.js

@@ -1,7 +1,8 @@
+import { isTimeCutCode } from "../../internal/harness.js";
 import { delimitUntrusted } from "../../core/untrusted-text.js";
 import { MAX_EXEC_OUTPUT_BYTES } from "../../core/exec-output-tail.js";
 import { anchorSpelling, hasBinaryExtension, isWinFormPath, pathFamilyOf } from "./safety.js";
-import { homeViewsOf } from "./read-deny-home.js";
+import { HomeViewUnreadError, homeViewsOf } from "./read-deny-home.js";
 import { createEntryDenyJudge } from "./dir-entries.js";
 import { thrownText } from "../../core/thrown-value.js";
 const WALK_MAX_FILES = 5000;
@@ -1163,9 +1164,11 @@ async function rgOutputDenyTripwireAt(env, stdout, mode, deny, opts, signal) {
         const path = absolute(record.path);
         if (placed.has(path))
             continue;
-        const view = await views.of(path, { leaf: "file" });
-        if (view !== undefined)
-            placed.set(path, view);
+        const home = await views.of(path, { leaf: "file" });
+        if (home.view !== undefined)
+            placed.set(path, home.view);
+        if (home.unread !== undefined && deny.matchPath(path) === null && (home.view === undefined || deny.matchPath(home.view) === null))
+            throw new HomeViewUnreadError(path, home.unread);
     }
     const judge = placed.size === 0 ? deny : { matchPath: (p) => deny.matchPath(p) ?? (placed.has(p) ? deny.matchPath(placed.get(p)) : null) };
     return rgOutputDenyTripwire(stdout, mode, judge, opts);
@@ -1235,7 +1238,7 @@ export async function rgGrepDetailed(env, root, p, signal, deny) {
         const err = res.error;
         if (err.code === "aborted" || signal?.aborted === true)
             throw err;
-        if (err.code === "timeout") {
+        if (isTimeCutCode(err.code)) {
             const partial = err.partialStdout ?? "";
             if (partial.trim().length > 0) {
                 if (deny !== undefined) {
@@ -1337,12 +1340,14 @@ async function rgDenyExistenceProbe(env, root, deny, target, signal) {
 export async function runGrepDetailed(env, root, p, signal, deny) {
     const scope = p.path ? anchorSpelling(pathFamilyOf({ root }), root, p.path) : root;
     const unexcludableUnder = async () => {
-        if (deny?.unexcludableUnder === undefined)
+        if (deny === undefined)
             return false;
-        if (deny.unexcludableUnder(scope))
-            return true;
-        const view = await homeViewsOf(env, deny, signal).of(scope);
-        return view !== undefined && deny.unexcludableUnder(view);
+        const home = await homeViewsOf(env, deny, signal).of(scope);
+        if (home.unread !== undefined)
+            throw new HomeViewUnreadError(scope, home.unread);
+        if (deny.unexcludableUnder === undefined)
+            return false;
+        return deny.unexcludableUnder(scope) || (home.view !== undefined && deny.unexcludableUnder(home.view));
     };
     if (!(await unexcludableUnder()) && (await detectRipgrep(env)))
         return rgGrepDetailed(env, root, p, signal, deny);

package/dist/tools/fs/shell-read-argv.d.ts

@@ -21,8 +21,9 @@ export interface WordContext {
     readonly table: BindingTable;
     /** Shell text the arithmetic evaluator runs (a substitution in a subscript it evaluates): the segment re-enters it. */
     readonly reentered: string[];
-    /** Program text the station does not read — inline text in a language that may open files, or a program read from
-     *  standard input: why the segment's reads are not established. */
+    /** Why the segment's reads are not established — program text the station does not read (inline text in a language that
+     *  may open files, or a program read from standard input), or the list its operands come from
+     *  ({@link deliveredOperandsSentence}). */
     programText?: string;
     /** Some program text was found in a slot (whether or not it may open files). */
     programTextSeen: boolean;