@sema-agent/core 7.53.0 → 7.54.1

package/dist/tools/fs/bash-program-position.d.ts

@@ -14,21 +14,9 @@ import { SHELL_CONTROL_PREFIXES, type LexedWord } from "../../shell/lex.js";
 export declare const NOT_AUTO_ALLOWED = "\u2014 not auto-allowed";
 /** argv[0] as the program bash will resolve it: `/usr/bin/cat` and `cat` are one name. */
 export declare function programBasename(word: string): string;
-/**
- * The `NAME=` / `NAME+=` prefix as WRITTEN in a whitespace-split token. This is NOT the position reader's grammar
- * — the reader reads the lexer's {@link LexedWord.assignment} fact — but the one reader that still walks the
- * command TEXT rather than its words (the activity summary) reads it here. It retires with it.
- */
-export declare const ASSIGNMENT_PREFIX: RegExp;
-/** The prefix a whitespace-split token BEGINS with, or `undefined` — the text readers' view of
- *  {@link ASSIGNMENT_PREFIX}; `name` is the variable before any subscript, `settlesWholeName` false for an
- *  append and for a subscript. */
-export declare function writtenAssignmentPrefix(token: string): {
-    readonly prefix: string;
-    readonly name: string;
-    readonly appends: boolean;
-    readonly settlesWholeName: boolean;
-} | undefined;
+/** A launcher's own `NAME=value` operand (`env`, `sudo`): any `=`-bearing non-option word, read DEQUOTED — the launcher's
+ *  grammar, not the shell's (`env 'F[1=2' cmd` sets `F[1`). The one spelling of it. */
+export declare function isLauncherAssignmentOperand(folded: string): boolean;
 /** The names a segment's COMMAND ENVIRONMENT sets for the program it starts: the assignment words in front of the
  *  program (the lexer's {@link LexedWord.assignment} fact, a launcher's `NAME=value` operand included) — or `all` where
  *  a launcher in front of it may set, clear or replace the environment (`env -u` / `-i`, `sudo`, `su`, …). */

package/dist/tools/fs/bash-program-position.js

@@ -5,15 +5,8 @@ export const NOT_AUTO_ALLOWED = "— not auto-allowed";
 export function programBasename(word) {
     return word.includes("/") ? (word.split("/").pop() ?? word) : word;
 }
-export const ASSIGNMENT_PREFIX = /^[A-Za-z_][A-Za-z0-9_]*(?:\[[^\]\s]*\])?\+?=/;
-export function writtenAssignmentPrefix(token) {
-    const prefix = ASSIGNMENT_PREFIX.exec(token)?.[0];
-    if (prefix === undefined)
-        return undefined;
-    const appends = prefix.endsWith("+=");
-    const written = prefix.slice(0, prefix.length - (appends ? 2 : 1));
-    const bracket = written.indexOf("[");
-    return { prefix, name: bracket < 0 ? written : written.slice(0, bracket), appends, settlesWholeName: !appends && bracket < 0 };
+export function isLauncherAssignmentOperand(folded) {
+    return !folded.startsWith("-") && folded.includes("=");
 }
 const ENVIRONMENT_KEEPING_LAUNCHERS = new Set(["nice", "nohup", "time", "timeout", "stdbuf", "ionice", "chrt", "taskset", "command", "builtin", "caffeinate"]);
 export function commandEnvironmentNames(argv) {
@@ -123,7 +116,7 @@ export function readProgramPosition(words) {
             owedOperands -= 1;
             continue;
         }
-        if (lastRow?.assignmentOperands === true && !t.startsWith("-") && t.includes("="))
+        if (lastRow?.assignmentOperands === true && isLauncherAssignmentOperand(t))
             continue;
         if (lastRow?.shellCommand !== undefined && !t.startsWith("-") && selectsShell(launchers[launchers.length - 1], j))
             return chain(undefined, shellRefusal(launchers[launchers.length - 1].index, j));

package/dist/tools/fs/bash-readonly-classifier.js

@@ -41,6 +41,8 @@ function expandsBeyondText(w) {
         const k = p.expansion?.kind;
         if (k === "parameter" || k === "command" || k === "process" || k === "arithmetic")
             return true;
+        if (p.expansion?.inner !== undefined)
+            return true;
         if (k === "tilde" && p.expansion?.body !== "~")
             return true;
         if (p.literal !== undefined && (p.quotedBy === undefined || p.quotedBy === '"') && /[$`]/.test(p.literal))

package/dist/tools/fs/fs-bash.d.ts

@@ -36,9 +36,9 @@ export declare function bashReversibilityProbe(allow?: readonly string[], bounda
  */
 export { FULL_SHELL_CONTRACT_ID } from "../../core/tool-catalog-entries.js";
 /** The CC-verbatim exit-1 interpretation for `command`, or undefined when exit 1 means a real error.
- *  Conservative parse: last `;`/`&&`/`||`/newline statement → last `|` pipeline segment → leading
- *  command name (env-assignments skipped, path prefix stripped); `git grep`/`git diff` special-cased
- *  (CC `cLp`). Exported for its unit tests. */
+ *  Read off the lexer's segments: the last one (the last `;`/`&&`/`||`/newline statement's last `|` piece) → its
+ *  written command word past the leading assignments bash strips, path prefix stripped;
+ *  `git grep`/`git diff` special-cased (CC `cLp`). Exported for its unit tests. */
 export declare function bashExitOneInterpretation(command: string): string | undefined;
 export declare function canAutoBackground(command: string, depth?: number): boolean;
 /** One observation of a running command, handed to {@link runShell}'s caller once per

package/dist/tools/fs/fs-bash.js

@@ -18,6 +18,8 @@ import { backgroundLifetimeNote } from "./fs-bash-background-text.js";
 import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, shellRecoveryHint, CWD_SENTINEL, stripCwdSentinel, } from "./fs-shared.js";
 import { bashClassifyDefaultAllow, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed } from "./bash-readonly-classifier.js";
 import { toolFace } from "../../core/tool-catalog-entries.js";
+import { argvOf, compoundValueHidesRun, expansionHidesRun, expansionsInHeredocBody, lexShell } from "../../shell/lex.js";
+import { arithmeticAssignedNames } from "./shell-read-bindings.js";
 import { thrownText } from "../../core/thrown-value.js";
 function shellCommandOf(args) {
     const command = args?.command;
@@ -55,19 +57,15 @@ const EXIT1_INTERPRETATION = {
     "[": "Condition is false",
 };
 export function bashExitOneInterpretation(command) {
-    const stmts = command.split(/\n|;|&&|\|\|/);
-    let lastStmt = "";
-    for (let i = stmts.length - 1; i >= 0; i--) {
-        if (stmts[i].trim().length > 0) {
-            lastStmt = stmts[i];
-            break;
-        }
-    }
-    const lastSeg = lastStmt.split("|").at(-1)?.trim() ?? "";
-    const tokens = lastSeg.split(/\s+/).filter(Boolean);
+    const lexed = lexShell(command);
+    if ("parseFailure" in lexed)
+        return undefined;
+    const last = [...lexed.segments].reverse().find((s) => s.tokens.length > 0);
+    const argv = last === undefined ? [] : argvOf(last);
     let i = 0;
-    while (i < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i]))
+    while (i < argv.length && argv[i].assignment?.bare === true && argv[i].atCommandPosition)
         i++;
+    const tokens = argv.map((w) => w.folded);
     const name = tokens[i]?.split("/").pop() ?? "";
     if (name === "git") {
         for (let j = i + 1; j < tokens.length; j++) {
@@ -103,31 +101,41 @@ function dataUriImageFromStdout(stdout) {
     return undefined;
 }
 const AUTO_BACKGROUND_BLOCKED_FIRST_WORDS = new Set(["sleep"]);
-function stripAutoBackgroundWrapperPrefixes(segment) {
-    let s = segment.trim();
-    const wrappers = [
-        /^timeout\s+(?:-[A-Za-z]\S*\s+)*\d+(?:\.\d+)?[smhd]?\s+/,
-        /^time\s+/,
-        /^nice(?:\s+-n?\s*-?\d+)?\s+/,
-        /^nohup\s+/,
-        /^command\s+/,
-        /^builtin\s+/,
-        /^stdbuf(?:\s+-[ioe]\S+)+\s+/,
-        /^noglob\s+/,
-        /^[A-Za-z_][A-Za-z0-9_]*=\S+\s+/,
-    ];
-    let changed = true;
-    while (changed) {
-        changed = false;
-        for (const re of wrappers) {
-            const stripped = s.replace(re, "");
-            if (stripped !== s) {
-                s = stripped.trim();
-                changed = true;
-            }
+function pastAutoBackgroundWrapperPrefixes(words) {
+    const folded = words.map((w) => w.folded);
+    let i = 0;
+    for (;;) {
+        const w = folded[i];
+        let next = i;
+        if (words[i]?.assignment?.bare === true && words[i].atCommandPosition && words[i].assignment.value.raw !== "")
+            next = i + 1;
+        else if (w === "time" || w === "nohup" || w === "command" || w === "builtin" || w === "noglob")
+            next = i + 1;
+        else if (w === "timeout") {
+            let j = i + 1;
+            while (/^-[A-Za-z]/.test(folded[j] ?? ""))
+                j++;
+            if (/^\d+(?:\.\d+)?[smhd]?$/.test(folded[j] ?? ""))
+                next = j + 1;
+        }
+        else if (w === "nice") {
+            next = i + 1;
+            if (folded[next] === "-n" && /^-?\d+$/.test(folded[next + 1] ?? ""))
+                next += 2;
+            else if (/^-n?-?\d+$/.test(folded[next] ?? ""))
+                next += 1;
+        }
+        else if (w === "stdbuf") {
+            let j = i + 1;
+            while (/^-[ioe]./.test(folded[j] ?? ""))
+                j++;
+            if (j > i + 1)
+                next = j;
         }
+        if (next === i || next >= folded.length)
+            return words.slice(i);
+        i = next;
     }
-    return s;
 }
 function commandBasename(token) {
     const idx = token.lastIndexOf("/");
@@ -141,84 +149,47 @@ function commandStringPayload(tokens) {
     if (!COMMAND_STRING_SHELLS.has(word))
         return undefined;
     const flagIdx = tokens.findIndex((t, i) => i > 0 && /^-[A-Za-z]*c[A-Za-z]*$/.test(t));
-    return flagIdx === -1 ? undefined : tokens.slice(flagIdx + 1).join(" ");
-}
-function unquotePayload(payload) {
-    const s = payload.trim();
-    const ansiC = /^\$'([\s\S]*)'$/.exec(s);
-    if (ansiC)
-        return (ansiC[1] ?? "").replace(/\\n/g, "\n").replace(/\\t/g, "\t");
-    const quoted = /^(['"])([\s\S]*)\1$/.exec(s);
-    return quoted ? (quoted[2] ?? "") : s;
+    return flagIdx === -1 ? undefined : tokens[flagIdx + 1];
 }
 const AUTO_BACKGROUND_MAX_WRAPPER_DEPTH = 3;
-function splitTopLevelStatements(command) {
-    const out = [];
-    let cur = "";
-    let quote;
-    for (let i = 0; i < command.length; i++) {
-        const c = command[i];
-        if (quote !== undefined) {
-            cur += c;
-            if (c === quote)
-                quote = undefined;
-            continue;
-        }
-        if (c === '"' || c === "'") {
-            quote = c;
-            cur += c;
-            continue;
-        }
-        if (c === ";" || c === "\n" || c === "|" || (c === "&" && command[i + 1] === "&")) {
-            if ((c === "&" || c === "|") && command[i + 1] === c)
-                i++;
-            out.push(cur);
-            cur = "";
-            continue;
-        }
-        if (c === "\r" && command[i + 1] === "\n") {
-            out.push(cur);
-            cur = "";
-            i++;
-            continue;
-        }
-        cur += c;
-    }
-    out.push(cur);
-    return out.map((s) => s.trim()).filter((s) => s.length > 0);
+function arithmeticInFront(text, depth) {
+    return arithmeticAssignedNames(text).length > 0 || (expansionsInHeredocBody(text)?.some((x) => x.unresolved !== undefined || x.expansion.kind === "command" || (x.expansion.kind === "arithmetic" ? depth >= AUTO_BACKGROUND_MAX_WRAPPER_DEPTH || arithmeticInFront(x.expansion.body ?? "", depth + 1) : expansionHidesRun(x.expansion))) ?? true);
 }
 export function canAutoBackground(command, depth = 0) {
-    if (depth < AUTO_BACKGROUND_MAX_WRAPPER_DEPTH) {
-        for (const stmt of splitTopLevelStatements(command)) {
-            const tokens = stripAutoBackgroundWrapperPrefixes(stmt).split(/\s+/);
+    const lexed = lexShell(command);
+    if ("parseFailure" in lexed)
+        return false;
+    const segments = lexed.segments;
+    const hidden = (e) => e !== undefined && e.kind !== "command" && e.kind !== "process" && e.kind !== "arithmetic" && expansionHidesRun(e);
+    const words = segments.flatMap((s) => s.tokens.flatMap((t) => (t.kind === "word" ? [t] : t.kind === "redirect" && t.target !== undefined ? [t.target] : [])));
+    if (words.some((w) => w.unresolved === "parameter_text" || compoundValueHidesRun(w) || w.expansions.some((p) => hidden(p.expansion))))
+        return false;
+    const heredocs = segments.flatMap((s) => s.tokens.flatMap((t) => (t.kind === "heredoc" && !t.quoted ? [expansionsInHeredocBody(t.body)] : [])));
+    if (heredocs.some((b) => b === undefined || b.some((x) => x.unresolved !== undefined || hidden(x.expansion))))
+        return false;
+    const arithmetic = [...words.flatMap((w) => w.expansions), ...heredocs.flatMap((b) => b ?? [])].flatMap((p) => (p.expansion?.kind === "arithmetic" ? [p.expansion.body ?? ""] : []));
+    const bodies = [...segments.flatMap((s) => s.substitutions), ...heredocs.flatMap((b) => (b ?? []).flatMap((x) => (x.expansion.kind === "command" ? [x.expansion.body ?? ""] : [])))].filter(((left) => (b) => { const k = left.indexOf(b); if (k < 0)
+        return true; left.splice(k, 1); return false; })([...arithmetic]));
+    if ((bodies.length > 0 && depth >= AUTO_BACKGROUND_MAX_WRAPPER_DEPTH) || bodies.some((b) => !canAutoBackground(b, depth + 1)) || arithmetic.some((b) => arithmeticInFront(b, depth + 1)))
+        return false;
+    const runs = segments.map((s) => pastAutoBackgroundWrapperPrefixes(argvOf(s)).map((w) => w.folded)).filter((t) => t.length > 0);
+    if (runs.length === 0)
+        return true;
+    for (const tokens of runs) {
+        const word = commandBasename(tokens[0]);
+        if (word === "git")
+            return false;
+        if (depth < AUTO_BACKGROUND_MAX_WRAPPER_DEPTH) {
             for (let i = 0; i < tokens.length; i++) {
-                const stmtPayload = commandStringPayload(tokens.slice(i));
-                if (stmtPayload !== undefined && stmtPayload.trim() !== "" && !canAutoBackground(unquotePayload(stmtPayload), depth + 1))
+                const payload = commandStringPayload(tokens.slice(i));
+                if (payload !== undefined && payload.trim() !== "" && !canAutoBackground(payload, depth + 1))
                     return false;
             }
         }
-    }
-    const segments = command
-        .split(/&&|\|\||;|\||\r?\n/)
-        .map((s) => s.trim())
-        .filter((s) => s.length > 0);
-    if (segments.length === 0)
-        return true;
-    for (const seg of segments) {
-        const tokens = stripAutoBackgroundWrapperPrefixes(seg).split(/\s+/);
-        const word = commandBasename(tokens[0] ?? "");
-        if (word === "git")
-            return false;
-        const payload = depth < AUTO_BACKGROUND_MAX_WRAPPER_DEPTH ? commandStringPayload(tokens) : undefined;
-        if (payload !== undefined && payload.trim() !== "" && !canAutoBackground(unquotePayload(payload), depth + 1))
-            return false;
         if (word === "xargs" && tokens.slice(1).some((t) => commandBasename(t) === "git"))
             return false;
     }
-    const firstWord = commandBasename(stripAutoBackgroundWrapperPrefixes(segments[0]).split(/\s+/)[0] ?? "");
-    if (AUTO_BACKGROUND_BLOCKED_FIRST_WORDS.has(firstWord))
-        return false;
-    return true;
+    return !AUTO_BACKGROUND_BLOCKED_FIRST_WORDS.has(commandBasename(runs[0][0]));
 }
 function msTimeoutToRequestedSec(timeoutMs) {
     if (timeoutMs === undefined || !Number.isFinite(timeoutMs))

package/dist/tools/fs/fs-read.d.ts

@@ -155,6 +155,18 @@ export interface ReadForModelOptions {
         key: string;
         object: BoundFileObject;
     };
+    /** The read state the two dedup answers (unchanged since the last read, already in context) are judged against —
+     *  absent ⇒ the reader's own live state. A carrier that delivers the read into a context other than the live one
+     *  passes the state that context will hold (a compaction's restore: what the landed summary leaves); such a read is
+     *  not held back by the disclosure throttle either (the disclosure the window remembers left with that context). */
+    dedupAgainst?: ReadonlyMap<string, ReadEntry>;
+    /** A carrier that presents the read as file data (an attachment frame) takes a PDF as a reference — its size and page
+     *  count, no pipeline run — since the Read projection interleaves engine text with the file's. A bound read always does. */
+    pdfAsReference?: boolean;
+    /** The canonical key the carrier's judgment of this path landed on, for a carrier that judged it without holding the
+     *  object (a bound read carries it as `bound.key`): a path whose final resolution is elsewhere is refused, the refusal
+     *  marked `details.type: "target_moved"` so a frame says it in the attachment's own words. */
+    judgedKey?: string;
 }
 export interface ModelFileReaderOptions {
     env: ExecutionEnv;

package/dist/tools/fs/fs-read.js

@@ -30,8 +30,8 @@ export function createModelFileReader(opts) {
         refusal: envelope,
         effects: NO_EFFECTS(),
     });
-    const disclosureOf = (segments, outlet, key) => {
-        const plan = planReminderDisclosure({ segments, mark: reminderMark, outlet, defuseExactMark: false, throttle: { key, windows } });
+    const disclosureOf = (segments, outlet, key, throttled = true) => {
+        const plan = planReminderDisclosure({ segments, mark: reminderMark, outlet, defuseExactMark: false, ...(throttled ? { throttle: { key, windows } } : {}) });
         const verdict = plan.verdict;
         return { ...(verdict.reminder !== undefined || verdict.envelopeTags !== undefined ? { note: { kind: "disclosure", verdict } } : {}), effects: plan.effects };
     };
@@ -57,8 +57,9 @@ export function createModelFileReader(opts) {
         const r = await resolve(path, ctx);
         if (!r.ok)
             return refuse(errorResult(violationText("Read", r.violation), violationDetails(r.violation)));
-        if (opts?.bound !== undefined && r.key !== opts.bound.key) {
-            return refuse(errorResult(`Error (Read): "${path.slice(0, 300)}" resolved to a different file while it was being checked, so it was not read.`));
+        const judgedKey = opts?.bound?.key ?? opts?.judgedKey;
+        if (judgedKey !== undefined && r.key !== judgedKey) {
+            return refuse(errorResult(`Error (Read): "${path.slice(0, 300)}" resolved to a different file while it was being checked, so it was not read.`, { type: "target_moved" }));
         }
         const bound = opts?.bound;
         const readBytes = (key, laneCap) => bound === undefined ? env.readBinaryFile(key, ctx.signal) : bound.object.readBytes(laneCap, ctx.signal);
@@ -114,7 +115,7 @@ export function createModelFileReader(opts) {
             };
         }
         const pdfOf = async (preRead) => {
-            if (bound !== undefined) {
+            if (bound !== undefined || opts?.pdfAsReference === true) {
                 if (!info.ok)
                     return refuse(errorResult(`Error (Read): cannot size PDF "${path.slice(0, 300)}": ${info.error.message.slice(0, 200)}`), "pdf");
                 let held = preRead;
@@ -232,7 +233,7 @@ export function createModelFileReader(opts) {
                         `  cat "${path}" | jq '.cells | length' # Count total cells\n` +
                         `  cat "${path}" | jq '.cells[] | select(.cell_type=="code") | .source' # All code sources`), "notebook");
                 }
-                const prevNb = state.get(r.key);
+                const prevNb = (opts?.dedupAgainst ?? state).get(r.key);
                 if (prevNb?.seededFromContext && !prevNb.isPartialView && prevNb.hash === hash) {
                     return unchanged({ kind: "already_in_context", key: r.key }, "notebook", "already-in-context", 1, total, total);
                 }
@@ -242,7 +243,7 @@ export function createModelFileReader(opts) {
                 const observation = { key: r.key, entry: { hash, totalLines: countLines(content), truncated: false, view: { start: 1, end: total } } };
                 if (rendered.blocks.length === 0)
                     notes.push({ kind: "notebook_no_cells" });
-                const disclosure = disclosureOf(rendered.blocks.filter((b) => b.type === "text").map((b) => b.text), "notebook", r.key);
+                const disclosure = disclosureOf(rendered.blocks.filter((b) => b.type === "text").map((b) => b.text), "notebook", r.key, opts?.dedupAgainst === undefined);
                 if (disclosure.note !== undefined)
                     notes.push(disclosure.note);
                 return {
@@ -292,7 +293,7 @@ export function createModelFileReader(opts) {
             }
         }
         const truncated = start > 1 || end < total || partial !== undefined;
-        const prev = state.get(r.key);
+        const prev = (opts?.dedupAgainst ?? state).get(r.key);
         if (total > 0 && prev?.seededFromContext && !prev.isPartialView && start === 1 && effLimit === undefined && prev.hash === hash) {
             return unchanged({ kind: "already_in_context", key: r.key }, "text", "already-in-context", 1, total, total);
         }
@@ -309,7 +310,7 @@ export function createModelFileReader(opts) {
             notes.push(partial);
         else if (truncated)
             notes.push({ kind: "range", path, start, end, total });
-        const disclosure = disclosureOf([body], "read", r.key);
+        const disclosure = disclosureOf([body], "read", r.key, opts?.dedupAgainst === undefined);
         if (disclosure.note !== undefined)
             notes.push(disclosure.note);
         return {

package/dist/tools/fs/fs-shared.d.ts

@@ -1,6 +1,6 @@
 import { Type } from "typebox";
 import type { ExecutionEnv } from "../../internal/harness-types.js";
-import { type FsViolation, type ReadFileState } from "./safety.js";
+import { type FsViolation, type ReadEntry, type ReadFileState } from "./safety.js";
 import { type DecodedTextFile } from "./encoding.js";
 import { type HomeViewsCarrier } from "./read-deny-home.js";
 import { type ImageDownsampler } from "../../core/mcp.js";
@@ -426,8 +426,10 @@ export declare function seedReadFileStateFromContext(state: ReadFileState, key:
  *    the context, which a continuation (or a compaction inside it) cannot promise.
  *  - no `seededFromContext`: that flag means the text lives in the system-prompt lane and survives
  *    compaction. This text lives in the transcript and does not.
+ * A Read result's text carries that result's call id (`transmission`), as the live read's entry does, so a trim that
+ * drops the result retires the entry; a Write's post-condition rode no result body and carries none.
  */
-export declare function seedReadFileStateFromTranscript(state: ReadFileState, key: string, content: string, lastReadAt: number): void;
+export declare function seedReadFileStateFromTranscript(state: ReadFileState, key: string, content: string, lastReadAt: number, transmission?: string): void;
 /**
  * Copy a SESSION-inherited read-file state into a new task's map, under the new task's
  * own containment judgment (CC parity: readFileState is session-scoped — minted once per REPL session,
@@ -459,30 +461,28 @@ export declare function inheritSessionReadFileState(target: ReadFileState, inher
  * Two deliberate divergences from CC's bare clear(), each from sema's own structure:
  *  - SEEDED entries survive: their content lives in the system-prompt lane, which compaction never touches,
  *    so their dedup remains CORRECT (CC re-seeds the same family right after its clear — equivalent end state).
- *  - Files re-attached WHOLE into the summary re-register (content genuinely re-entered the context — same
- *    principle as CC re-registering restored file attachments); a TRUNCATED attachment does not (a partial
- *    view must not answer a whole-file read with a stub).
- * The read-before-edit gate tightens as a consequence, matching CC: after a compaction the model must
- * re-Read a summarized-away file before editing it, instead of blind-editing from a stale recollection.
- *
- * A THIRD category besides seeded/re-attached: a file whose most recent Read is still visible
- * verbatim in the compaction's KEPT tail is deliberately left OUT of
- * `attachedComplete` (re-attaching it would just duplicate content already in context), but its
- * existing read-state entry must survive unmodified for the SAME reason a seeded entry does: the
- * model's view of it did not change. Wiping it breaks two things for exactly these files — the
- * read-before-edit gate would reject an Edit the model could visibly justify from its own kept-tail
- * Read, and a next Read would miss the dedup stub and retransmit the whole file, recreating the exact
- * waste this dedup exists to remove. `preserveKeys` is the caller's kept-tail set
- * (see `maybeCompact`'s `candidateFiles` computation) — passed as keys already in `state`'s own
- * coordinate (canonicalized the same way the Read/Edit/Write tools populate it), so a plain lookup
- * suffices; no re-hash/re-register needed since the entry's content genuinely has not changed.
+ *  - A file still visible in the compaction's KEPT tail (its read or its attachment frame is there) survives
+ *    unmodified, for the same reason: the model's view of it did not change. Wiping it would make the
+ *    read-before-edit gate reject an Edit the model can visibly justify, and the next Read retransmit the file.
+ *    `preserveKeys` is that set, in `state`'s own coordinate.
+ * A file the compaction restores re-registers through its restore frame's own delivery (the reader's commit,
+ * after this clear), never here. The read-before-edit gate tightens as a consequence, matching CC: after a
+ * compaction the model must re-Read a summarized-away file before editing it.
+ */
+/**
+ * What the read state holds once a landed summary has taken its reads out of view — the ONE answer to "which entries
+ * survive a compaction": the seeded entries and `preserveKeys`. The summarized clear applies it to the live state; the
+ * restore's reads dedup against it (the context they deliver into is the one the summary leaves).
  */
+export declare function readFileStateAfterSummary(state: ReadonlyMap<string, ReadEntry>, preserveKeys: ReadonlyArray<string>): ReadFileState;
 /**
- * The SECOND way a transmission leaves the model's view, and why this function is named for context
+ * The OTHER ways a transmission leaves the model's view, and why this function is named for context
  * SHRINK rather than compaction: the request-layer stale-result pass replaces an old tool result's
- * content with a cleared marker — no summary, no re-attachment, nothing changed in the session — and
- * for a Read result the effect on the entry is identical: the body its dedup stub points at is no
- * longer anywhere the model can see, so the entry must retire with it.
+ * content with a cleared marker, and the request guard's last-resort trim drops old messages — a Read's
+ * result or an attachment frame among them — from the request; no summary, no re-attachment, nothing changed in the
+ * session — and for a read the effect on the entry is identical: the body its dedup stub points at is no
+ * longer anywhere the model can see, so the entry must retire with it. A transmission is named by the
+ * tool call that carried it, or by the attachment frame (`attachmentTransmissionId`).
  *
  * Selection is by the TRANSMISSION, not by path — an entry a LATER Read re-transmitted carries that
  * later call's id and so survives a clear of the earlier one, which a path-keyed retirement could not
@@ -494,19 +494,15 @@ export declare function inheritSessionReadFileState(target: ReadFileState, inher
  * carries the id of the last Read that transmitted it, so if that result was cleared its id is in the list.
  */
 export type ReadFileStateShrink = 
-/** A landed compaction: `attachedComplete` re-entered the context whole; `preserveKeys` stayed visible in the kept tail. */
+/** A landed compaction: everything but {@link readFileStateAfterSummary} retires (`preserveKeys` stayed visible in the kept tail). */
 {
     kind: "summarized";
-    attachedComplete: ReadonlyArray<{
-        path: string;
-        content: string;
-    }>;
     preserveKeys?: ReadonlyArray<string>;
 }
-/** A request-layer stale-result clear: these tool calls' results are markers now. Nothing re-entered. */
+/** These transmissions left the request (a stale-result clear's markers, a trim's dropped messages). Nothing re-entered. */
  | {
-    kind: "tool-results-cleared";
-    clearedToolCallIds: ReadonlyArray<string>;
+    kind: "transmissions-gone";
+    transmissions: ReadonlyArray<string>;
 };
 export declare function applyContextShrinkToReadFileState(state: ReadFileState, shrink: ReadFileStateShrink): void;
 /** CC 2.1.198 verbatim skeleton: the ENOENT error body for a

package/dist/tools/fs/fs-shared.js

@@ -320,9 +320,9 @@ export function isReadDedupStubResult(resultText) {
 export function seedReadFileStateFromContext(state, key, content) {
     state.set(key, { hash: sha256(normalizeFileText(content)), totalLines: countLines(content), truncated: false, lastReadAt: Date.now(), seededFromContext: true });
 }
-export function seedReadFileStateFromTranscript(state, key, content, lastReadAt) {
+export function seedReadFileStateFromTranscript(state, key, content, lastReadAt, transmission) {
     const text = normalizeFileText(content);
-    state.set(key, { hash: sha256(text), totalLines: countLines(text), truncated: false, lastReadAt });
+    state.set(key, { hash: sha256(text), totalLines: countLines(text), truncated: false, lastReadAt, ...(transmission !== undefined ? { transmittedByToolCallId: transmission } : {}) });
 }
 export async function inheritSessionReadFileState(target, inherited, judgeKey) {
     for (const [key, entry] of inherited) {
@@ -333,28 +333,25 @@ export async function inheritSessionReadFileState(target, inherited, judgeKey) {
             target.set(judged, entry);
     }
 }
+export function readFileStateAfterSummary(state, preserveKeys) {
+    const preserve = new Set(preserveKeys);
+    return new Map([...state].filter(([k, v]) => v.seededFromContext === true || preserve.has(k)));
+}
 export function applyContextShrinkToReadFileState(state, shrink) {
-    if (shrink.kind === "tool-results-cleared") {
-        if (shrink.clearedToolCallIds.length === 0)
+    if (shrink.kind === "transmissions-gone") {
+        if (shrink.transmissions.length === 0)
             return;
-        const cleared = new Set(shrink.clearedToolCallIds);
+        const cleared = new Set(shrink.transmissions);
         for (const [k, v] of [...state]) {
             if (v.transmittedByToolCallId !== undefined && cleared.has(v.transmittedByToolCallId))
                 state.delete(k);
         }
         return;
     }
-    const { attachedComplete, preserveKeys = [] } = shrink;
-    const preserve = new Set(preserveKeys);
-    for (const [k, v] of [...state]) {
-        if (v.seededFromContext !== true && !preserve.has(k))
+    const surviving = readFileStateAfterSummary(state, shrink.preserveKeys ?? []);
+    for (const k of [...state.keys()])
+        if (!surviving.has(k))
             state.delete(k);
-    }
-    for (const f of attachedComplete) {
-        const totalLines = countLines(f.content);
-        const displayLines = f.content.length === 0 ? 0 : f.content.split("\n").length;
-        state.set(f.path, { hash: sha256(f.content), totalLines, truncated: false, view: { start: 1, end: displayLines }, lastReadAt: Date.now() });
-    }
 }
 export async function enoentMessage(env, key, cwd, signal, readDeny) {
     let msg = `File does not exist. Note: your current working directory is ${cwd}.`;

package/dist/tools/fs/fs-write.js

@@ -40,7 +40,7 @@ async function envFinalWrite(env, key, content, signal, opts) {
     fireEdited();
     return r;
 }
-const NOTHING_WAS_WRITTEN = new Set(["already_exists", "precondition_failed"]);
+const NOTHING_WAS_WRITTEN = new Set(["already_exists", "precondition_failed", "target_unavailable"]);
 async function writeThroughEnv(env, key, content, signal, opts) {
     if (env.writeFileGuarded !== undefined) {
         const r = await env.writeFileGuarded(key, content, { canonicalPath: key, ...(opts?.exclusive === true ? { exclusive: true } : {}) }, signal);

package/dist/tools/fs/index.js

@@ -14,7 +14,7 @@ export * from "./read-deny.js";
 export { readDenyHomesOf } from "./read-deny-home.js";
 import { BASH_READONLY_DEFAULT_ALLOW } from "./bash-readonly-classifier.js";
 export { BASH_CLASSIFY_EXTRA_ALLOW, bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
-import { checkedReadDenyHomes, compileReadDeny, compileWriteDeny, isRootedReadDenyPattern, readDenyBuiltinConfigOf, readDenyPatternRun } from "./read-deny.js";
+import { checkedReadDenyHomes, compileReadDeny, compileWriteDeny, readDenyBuiltinConfigOf, readDenyRowAnchor } from "./read-deny.js";
 import { withGateTimeout } from "../../core/gate-bounded-await.js";
 import { carriedReadFaceOf, carryHomeViews, homeViewsAt, placeReadDenyAtHome, placementViewsOf, readDenyPlacedLater, sayPlacementLost } from "./read-deny-home.js";
 import { deploymentFaceClampNotice, resolveContainmentFace } from "./containment-face.js";
@@ -142,7 +142,7 @@ function bandOwnTables(env, opts) {
     const carriedViews = carried ? placementViewsOf(opts.readDenyHomes) : undefined;
     if (carried && carriedViews === undefined)
         sayPlacementLost();
-    const placesNothing = !unplaced.entries.some((e) => readDenyPatternRun(e.pattern).homeAnchored || isRootedReadDenyPattern(e.pattern));
+    const placesNothing = !unplaced.entries.some((e) => readDenyRowAnchor(e.pattern) !== "none");
     const late = carried || placesNothing ? undefined : readDenyPlacedLater(carryHomeViews(unplaced, homeViewsAt(env, [])), () => placeReadDenyAtHome(env, compileAt, readDenyHomes));
     const readDeny = late?.matcher ??
         (carried

package/dist/tools/fs/read-deny-home.d.ts

@@ -41,7 +41,7 @@ export declare function readDenyLinksOf(env: ExecutionEnv, entries: readonly {
 /**
  * Which rows one placement reads, and where their heads are spelled:
  *  · `home` — the home-anchored rows (`~/…`), under each home; the row's run anchors it there;
- *  · `root` — the ROOTED rows (`/app/config-lkg.json`, {@link isRootedReadDenyPattern}), under the filesystem root; the run
+ *  · `root` — the ROOTED rows (`/app/config-lkg.json`, {@link readDenyRowAnchor} `root`), under the filesystem root; the run
  *    anchors it there. A root is no home: read whether or not a home answered;
  *  · `unanchored` — the rows that open with the configuration directory's name (`~/.sema/…`, {@link agentConfigDirTail})
  *    under each spelling of the root the host declares for that directory (`RunnerDeps.agentConfigDir`): the head BELOW

package/dist/tools/fs/read-deny-home.js

@@ -4,7 +4,7 @@ import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, withGateTimeout } from "../../core/gate-
 import { thrownText } from "../../core/thrown-value.js";
 import { agentConfigDirTail } from "../../core/agent-config-dir.js";
 import { validatePath } from "../../core/effective-path-target.js";
-import { isRootedReadDenyPattern, readDenyPatternRun, readDenyRunHead } from "./read-deny.js";
+import { readDenyPatternRun, readDenyRowAnchor, readDenyRunHead } from "./read-deny.js";
 export const AUXILIARY_HOME_PROBE_MS = 2_000;
 const said = new Set();
 function sayOnce(kind, line) {
@@ -126,13 +126,14 @@ function anchoredRowsOf(entries, anchor) {
     return rows;
 }
 function rowHeadOf(pattern, caseSensitive, anchor) {
+    const rowAnchor = readDenyRowAnchor(pattern);
     if (anchor.at === "root") {
-        const head = isRootedReadDenyPattern(pattern) ? literalHeadOf(pattern) : "";
+        const head = rowAnchor === "root" ? literalHeadOf(pattern) : "";
         return head.length > 0 ? head : undefined;
     }
-    const { homeAnchored, run } = readDenyPatternRun(pattern);
-    if (!homeAnchored)
+    if (rowAnchor !== "home")
         return undefined;
+    const { run } = readDenyPatternRun(pattern);
     if (anchor.at === "unanchored") {
         const tail = agentConfigDirTail(run, caseSensitive);
         return tail === undefined ? undefined : literalHeadOf(tail);