@sema-agent/core 7.54.1 → 7.56.0

package/dist/tools/fs/fs-shared.d.ts

@@ -25,14 +25,14 @@ export declare const MAX_READ_BYTES: number;
  *  explicit slice, with guidance to stream a portion via bash (`sed -n` / `head -c`) instead, which
  *  never loads the whole file. */
 export declare const SLICED_READ_MAX_BYTES: number;
-/** The byte cap Edit refuses ABOVE (CC's own constant, verbatim). CC stats the target before touching
+/** The byte cap Edit refuses ABOVE. CC stats the target before touching
  *  it and refuses with a formatted-size message when it exceeds this. Without the gate, Edit goes
  *  straight to a whole-file `readBinaryFile` (twice: the `old_string:""` full-overwrite branch and the
  *  normal find/replace branch), so a multi-GB target is an unguarded OOM lever an ordinary Edit call
  *  can pull. The shape is Read's: a pre-read `env.fileInfo` stat plus a post-read TOCTOU recheck
  *  ({@link SLICED_READ_MAX_BYTES} above). */
 export declare const MAX_EDIT_BYTES: number;
-/** `Edit`'s human-readable byte-count formatter (CC `pl()` verbatim: bytes below 1KB, else
+/** `Edit`'s human-readable byte-count formatter (bytes below 1KB, else
  *  KB/MB/GB with one decimal, trailing ".0" stripped). */
 export declare function formatByteSize(n: number): string;
 /** Node's own string-length ceiling (`buffer.constants.MAX_STRING_LENGTH` — ~512MiB on V8/Node 24)
@@ -103,7 +103,7 @@ export interface RecordedEdit {
 export declare function applyRecordedEdit(text: string, edit: RecordedEdit): string;
 /** Render the read-before-edit refusal, appending the slice/bash escape hatch when the target is over
  *  the Read byte cap — a bare "read it first" is un-followable there (a default whole-file Read
- *  refuses such files). Best-effort: an un-stattable file keeps the bare CC-verbatim refusal.
+ *  refuses such files). Best-effort: an un-stattable file keeps the bare refusal.
  *
  *  `fallbackHint` is a caller-supplied parenthetical for the case NO branch below diagnosed anything
  *  (all three writing tools pass {@link READ_REFUSED_ESCAPE_HINT} — the Read-refuses-this-file
@@ -332,7 +332,7 @@ export declare function createShellOverflowSpoolFence(env: ExecutionEnv): (path:
  * executable. Full `bash` keeps the precise form.
  */
 export declare function shellRecoveryHint(path: string, readOnly: boolean | undefined): string;
-/** CC 2.1.198 live-verbatim Edit/Write success trailer — appended to every Edit/Write success message
+/** Edit/Write success trailer — appended to every Edit/Write success message
  *  (NOT NotebookEdit — CC ships it without the trailer). */
 export declare const FILE_STATE_TRAILER = " (file state is current in your context \u2014 no need to Read it back)";
 export declare const CWD_SENTINEL = "__cc_cwd_9f2c1b__";
@@ -383,11 +383,11 @@ export declare function ipynbRedirect(toolName: string, path: string): string |
  *  ends in "\n". Behavior is identical for content WITHOUT a trailing newline. Shared by read_file's
  *  `total`, edit_file/write_file's "N lines" report, and the persisted ReadFileState.totalLines. */
 export declare function countLines(s: string): number;
-/** CC 2.1.204 VERBATIM: the reminder served when a DEFAULT whole-file Read hits a startup-seeded,
+/** The reminder served when a DEFAULT whole-file Read hits a startup-seeded,
  *  unchanged file. `filePath` is the CANONICAL key (CC passes the resolved full path, matching the
  *  `Contents of <path>` header its context seeding emits — deployments seeding files should title the
  *  injected block the same way so the back-reference lands). Locked verbatim by test: the BODY and
- *  close tag stay CC-verbatim; the open tag alone is rendered by the mint home and carries the session
+ *  close tag stay fixed; the open tag alone is rendered by the mint home and carries the session
  *  mark when one is threaded (the recorded wire-form divergence). */
 export declare function seededFileUnchangedReminder(filePath: string, mark?: string): string;
 /**
@@ -404,7 +404,7 @@ export declare function seededFileUnchangedReminder(filePath: string, mark?: str
  */
 export declare function isReadDedupStubResult(resultText: string): boolean;
 /** Pre-seed the hands' read state for a file whose FULL, disk-verbatim text was injected into the
- *  model's context at startup (CC 2.1.204 `seededFromContext` seeding of the memory preload; sema:
+ *  model's context at startup (`seededFromContext` seeding of the memory preload; sema:
  *  ProjectMemoryLoad.seededFiles → prepare-task).
  *  `content` MUST be the file's exact disk text at load time — the Read tool's seeded dedup treats a
  *  hash match as "unchanged"; a truncated/annotated variant must NOT be seeded (CC exempts those via
@@ -505,7 +505,7 @@ export type ReadFileStateShrink =
     transmissions: ReadonlyArray<string>;
 };
 export declare function applyContextShrinkToReadFileState(state: ReadFileState, shrink: ReadFileStateShrink): void;
-/** CC 2.1.198 verbatim skeleton: the ENOENT error body for a
+/** The ENOENT error body for a
  *  missing Read/Edit target — `File does not exist. Note: your current working directory is <cwd>.`
  *  plus a `Did you mean <sibling>?` correction when the parent directory holds a near-name (case
  *  variant / same stem different extension — the high-frequency self-heal path). Best-effort: a

package/dist/tools/fs/gh-rate-limit.d.ts

@@ -1,5 +1,5 @@
 /**
- * gh rate-limit hint (CC 2.1.198 parity).
+ * gh rate-limit hint.
  *
  * CC appends a one-shot <system-reminder> to a FOREGROUND Bash result when a `gh` invocation hits the
  * GitHub API rate limit, so the model sleeps/schedules instead of hammering retries. The command gate,

package/dist/tools/fs/notebook.d.ts

@@ -1,6 +1,6 @@
 import type { ImageContent } from "../../internal/llm.js";
 /**
- * The Read tool's Jupyter-notebook projection: `.ipynb` is rendered as cells with outputs (CC 2.1.220
+ * The Read tool's Jupyter-notebook projection: `.ipynb` is rendered as cells with outputs (reference
  * parity), never as raw JSON text. Raw-JSON rendering lets a notebook's base64 outputs overflow the
  * Read token cap, auto-paginate into an `isPartialView` entry, and thereby lock NotebookEdit out via
  * the requireRead gate — with the marker's own offset/limit hint pointing at a range that itself
@@ -80,7 +80,7 @@ export interface NotebookRender {
     imageChars: number;
 }
 /**
- * CC `eI_`/`tI_`/`Atd`: render projected cells to content blocks. Tag shape is CC-verbatim, including
+ * Render projected cells to content blocks. Tag shape is the reference's, including
  * the deliberately malformed closing tag `</cell id="X">`; `<cell_type>` only when not code,
  * `<language>` only for code cells whose language !== "python". Output text rides with a leading "\n"
  * and adjacent text blocks merge with "\n", so an all-text notebook collapses to a single text block.

package/dist/tools/fs/pattern-kill-guard.d.ts

@@ -0,0 +1,22 @@
+import type { ExecutionEnv } from "../../internal/harness.js";
+/** One killer the command spells and the questions to put to `pgrep` for it, or why the question cannot be put. */
+export interface PatternKillReading {
+    readonly text: string;
+    readonly probes: readonly (readonly string[])[];
+    /** Set when a word of the selector is decided only when the command runs. */
+    readonly computed?: string;
+    /** Set when the kill names every process the caller may signal — this agent's own among them — so there is nothing to ask. */
+    readonly everyProcess?: true;
+}
+/** The killers a command text spells, read off the plan the read station plans (nothing is read from disk or run). */
+export declare function patternKillReadings(command: string, cwd: string): PatternKillReading[];
+/**
+ * The refusal for a command whose pattern-kill would select this agent's own process or one above it — or undefined (run it).
+ * `cwd`: where the command stands, for the plan's read of its words (nothing is read from disk). Remote environments and
+ * Windows are not asked: their process table is not this one.
+ */
+export declare function patternKillRefusal(command: string, env: ExecutionEnv, cwd: string, signal?: AbortSignal): Promise<{
+    content: string;
+    isError: true;
+    details?: unknown;
+} | undefined>;

package/dist/tools/fs/pattern-kill-guard.js

@@ -0,0 +1,397 @@
+import { spawn } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { errorResult } from "../../core/tools.js";
+import { isRemoteExecutionEnv } from "../../core/remote-env.js";
+import { inheritedHostEnv } from "../../core/secret-env.js";
+import { inlineUntrusted } from "../../core/untrusted-text.js";
+import { planShellReads } from "./shell-read-plan.js";
+import { programArgs } from "./shell-read-write-targets.js";
+const PROBE_TIMEOUT_MS = 5_000;
+const ANCESTOR_HOPS_MAX = 128;
+const SHELL_PID_WORD = /^\$(?:\$|\{\$\}|BASHPID|\{BASHPID\})$/;
+const NAME_SELECTION_KEEPS_ANCESTORS = process.platform === "linux" ? [] : ["-a"];
+const SIGNAL_ONLY_FIRST_ARGUMENT = process.platform !== "linux";
+const HANDLER_SELECTS_BY_SIGNAL = process.platform === "linux";
+const LONG_OPTIONS = new Map([
+    ["signal", "signal"], ["ignore-ancestors", "A"], ["require-handler", "H"], ["count", "c"], ["cgroup", "cgroup"], ["delimiter", "d"], ["list-name", "l"],
+    ["list-full", "a"], ["full", "f"], ["pgroup", "g"], ["group", "G"], ["ignore-case", "i"], ["newest", "n"], ["oldest", "o"], ["older", "O"], ["parent", "P"],
+    ["session", "s"], ["terminal", "t"], ["euid", "u"], ["uid", "U"], ["inverse", "v"], ["lightweight", "w"], ["exact", "x"], ["pidfile", "F"], ["logpidfile", "L"],
+    ["echo", "e"], ["ns", "ns"], ["nslist", "nslist"], ["queue", "q"], ["runstates", "r"], ["help", "h"], ["version", "V"],
+]);
+function longKeyOf(name) {
+    if (!name.startsWith("--") || name.length < 3)
+        return undefined;
+    const word = name.slice(2);
+    const exact = LONG_OPTIONS.get(word);
+    if (exact !== undefined)
+        return exact;
+    const named = [...LONG_OPTIONS].filter(([o]) => o.startsWith(word));
+    return named.length === 1 ? named[0][1] : undefined;
+}
+const QUEUE_PAYLOAD = process.platform === "linux";
+const VALUED_LETTERS = new Set(["F", "g", "G", "P", "s", "t", "u", "U", "N", "T", "O", "d", "r", ...(QUEUE_PAYLOAD ? ["q"] : [])]);
+const VALUED_LONG_ONLY = new Set(["signal", "cgroup", "ns", "nslist"]);
+const OUTPUT_LETTERS = new Set(["c", "e", "d", ...(QUEUE_PAYLOAD ? ["q"] : [])]);
+const takesValueKey = (key) => VALUED_LETTERS.has(key) || VALUED_LONG_ONLY.has(key);
+const fateOfKey = (key) => (key === "signal" ? "signal" : OUTPUT_LETTERS.has(key) ? "drop" : "ask");
+function bundledLetters(w, valued = VALUED_LETTERS) {
+    if (!/^-[A-Za-z]/.test(w))
+        return undefined;
+    const letters = [];
+    for (const ch of w.slice(1)) {
+        letters.push(ch);
+        if (valued.has(ch))
+            break;
+    }
+    return letters;
+}
+const SIGNAL_NAMES = new Set([
+    "HUP", "INT", "QUIT", "ILL", "TRAP", "ABRT", "IOT", "EMT", "FPE", "KILL", "BUS", "SEGV", "SYS", "PIPE", "ALRM", "TERM", "URG", "STOP", "TSTP", "CONT",
+    "CHLD", "CLD", "TTIN", "TTOU", "IO", "POLL", "XCPU", "XFSZ", "VTALRM", "PROF", "WINCH", "INFO", "USR1", "USR2", "STKFLT", "PWR", "LOST", "UNUSED", "THR", "LIBRT",
+]);
+const SIGNAL_WORD = /^-(?:\d+|(?:SIG)?(?:RT(?:MIN|MAX)(?:[+-]\d+)?|([A-Z][A-Z0-9]*)))$/i;
+const isSignalWord = (w) => {
+    const m = SIGNAL_WORD.exec(w);
+    return m !== null && (m[1] === undefined || SIGNAL_NAMES.has(m[1].toUpperCase()));
+};
+function selectorWords(allWords, killer) {
+    const signalAt = killer !== "pkill" ? -1 : SIGNAL_ONLY_FIRST_ARGUMENT ? (isSignalWord(allWords[0] ?? "") ? 0 : -1) : allWords.findIndex(isSignalWord);
+    const signalWord = signalAt < 0 ? undefined : allWords[signalAt].slice(1);
+    const words = signalAt < 0 ? allWords : allWords.filter((_, i) => i !== signalAt);
+    const out = [];
+    let ended = false;
+    let requireHandler = false;
+    let signalOption;
+    let valueOf;
+    for (const w of words) {
+        if (valueOf !== undefined) {
+            if (valueOf === "ask")
+                out.push(w);
+            else if (valueOf === "signal")
+                signalOption = w;
+            valueOf = undefined;
+            continue;
+        }
+        if (ended || w === "--") {
+            ended ||= w === "--";
+            out.push(w);
+            continue;
+        }
+        const [, longName, longValue] = /^(--[^=]*)(?:=(.*))?$/s.exec(w) ?? [];
+        const key = longName === undefined ? undefined : longKeyOf(longName);
+        if (key !== undefined && (takesValueKey(key) || longValue === undefined)) {
+            if (key === "H")
+                requireHandler = true;
+            const fate = fateOfKey(key);
+            if (fate === "ask")
+                out.push(w);
+            if (takesValueKey(key) && longValue === undefined)
+                valueOf = fate;
+            else if (fate === "signal" && longValue !== undefined)
+                signalOption = longValue;
+            continue;
+        }
+        const letters = bundledLetters(w);
+        if (letters === undefined) {
+            out.push(w);
+            continue;
+        }
+        if (letters.includes("H"))
+            requireHandler = true;
+        const last = letters[letters.length - 1];
+        const fate = fateOfKey(last);
+        const kept = letters.filter((ch) => fateOfKey(ch) === "ask").join("");
+        const attached = VALUED_LETTERS.has(last) ? w.slice(1 + letters.length) : "";
+        if (kept !== "")
+            out.push(`-${kept}${fate === "ask" ? attached : ""}`);
+        if (VALUED_LETTERS.has(last) && attached === "")
+            valueOf = fate;
+    }
+    const signal = signalOption ?? signalWord;
+    return HANDLER_SELECTS_BY_SIGNAL && requireHandler && signal !== undefined ? ["--signal", signal, ...out] : out;
+}
+const negatesSelection = (words) => words.some((w) => w === "--inverse" || (bundledLetters(w)?.includes("v") ?? false));
+function selectsOnlyShellChildren(words) {
+    return words.some((w, i) => {
+        if (w === "-P" || w === "--parent")
+            return SHELL_PID_WORD.test(words[i + 1] ?? "");
+        const attached = /^(?:-P|--parent=)(.+)$/.exec(w);
+        return attached !== null && SHELL_PID_WORD.test(attached[1]);
+    });
+}
+const literalName = (name) => name.replace(/[\\.[\]{}()*+?^$|]/g, "\\$&");
+function wordsOf(segment) {
+    const args = programArgs(segment);
+    const rewritten = args.find((a) => a.rewritten === true);
+    const computed = segment.reentry === "argv" ? "its arguments arrive on a stream" : rewritten === undefined ? undefined : `\`${inlineUntrusted(rewritten.raw, 60)}\` is expanded by the shell when the command runs`;
+    return { words: args.map((a) => a.spelled), ...(computed !== undefined ? { computed } : {}) };
+}
+const shown = (segment) => inlineUntrusted(segment.text, 200);
+function readPkill(segment) {
+    const { words, computed } = wordsOf(segment);
+    if (selectsOnlyShellChildren(words)) {
+        return negatesSelection(words) ? { text: shown(segment), probes: [], computed: "`-v` negates the selection, so `-P` of the shell's pid no longer limits it to the shell's children" } : undefined;
+    }
+    if (computed !== undefined)
+        return { text: shown(segment), probes: [], computed };
+    const selectors = selectorWords(words, "pkill");
+    return selectors.length === 0 ? undefined : { text: shown(segment), probes: [selectors] };
+}
+const OPT_FLAG = { does: "flag" };
+const OPT_FILTER = { does: "filter" };
+const OPT_VALUED = { does: "valued" };
+const OPT_CONTEXT = { does: "context" };
+const OPT_REGEX = { does: "regex" };
+const OPT_GROUP = { does: "group" };
+const OPT_USER = { does: "select", pgrep: "-u" };
+const OPT_TTY = { does: "select", pgrep: "-t" };
+const KILLALL_OPTIONS = new Map([
+    ["-u", OPT_USER], ["--user", OPT_USER], ["-t", OPT_TTY],
+    ["-Z", OPT_CONTEXT], ["--context", OPT_CONTEXT],
+    ["-r", OPT_REGEX], ["-m", OPT_REGEX], ["--regexp", OPT_REGEX],
+    ["-I", { does: "ignoreCase" }], ["--ignore-case", { does: "ignoreCase" }],
+    ["-g", OPT_GROUP], ["--process-group", OPT_GROUP],
+    ["-s", OPT_VALUED], ["--signal", OPT_VALUED], ["-o", OPT_VALUED], ["--older-than", OPT_VALUED], ["-y", OPT_VALUED], ["--younger-than", OPT_VALUED],
+    ["-n", OPT_VALUED], ["--ns", OPT_VALUED], ["-c", OPT_FILTER],
+    ["-e", OPT_FLAG], ["--exact", OPT_FLAG], ["-i", OPT_FLAG], ["--interactive", OPT_FLAG], ["-l", OPT_FLAG], ["--list", OPT_FLAG], ["-q", OPT_FLAG], ["--quiet", OPT_FLAG],
+    ["-v", OPT_FLAG], ["--verbose", OPT_FLAG], ["-V", OPT_FLAG], ["--version", OPT_FLAG], ["-w", OPT_FLAG], ["--wait", OPT_FLAG], ["-d", OPT_FLAG], ["-z", OPT_FLAG], ["--help", OPT_FLAG],
+]);
+const takesValue = (opt) => opt !== undefined && (opt.does === "select" || opt.does === "context" || opt.does === "filter" || opt.does === "valued");
+const OPTIONS_END_AT_FIRST_NAME = process.platform !== "linux";
+const KILLALL_VALUED_LETTERS = new Set([...KILLALL_OPTIONS].filter(([spelling, opt]) => !spelling.startsWith("--") && takesValue(opt)).map(([spelling]) => spelling.slice(1)));
+function optionsOf(w) {
+    if (w.startsWith("--")) {
+        const eq = w.indexOf("=");
+        return [eq < 0 ? { opt: w } : { opt: w.slice(0, eq), attached: w.slice(eq + 1) }];
+    }
+    const letters = bundledLetters(w, KILLALL_VALUED_LETTERS);
+    if (letters === undefined)
+        return [{ opt: w }];
+    const rest = w.slice(1 + letters.length);
+    return letters.map((ch, i) => ({ opt: `-${ch}`, ...(i === letters.length - 1 && rest !== "" ? { attached: rest } : {}) }));
+}
+function readKillallWords(words) {
+    const names = [];
+    const selecting = new Map();
+    let filter;
+    let byContext = false;
+    let regex = false;
+    let ignoreCase = false;
+    for (let i = 0; i < words.length; i++) {
+        const w = words[i];
+        if (w === "--") {
+            names.push(...words.slice(i + 1));
+            break;
+        }
+        if (!w.startsWith("-") || w === "-") {
+            names.push(w);
+            if (OPTIONS_END_AT_FIRST_NAME) {
+                names.push(...words.slice(i + 1));
+                break;
+            }
+            continue;
+        }
+        if (isSignalWord(w))
+            continue;
+        for (const { opt: spelling, attached } of optionsOf(w)) {
+            const opt = KILLALL_OPTIONS.get(spelling);
+            if (opt === undefined || (attached !== undefined && !takesValue(opt)))
+                return { unreadable: `\`${inlineUntrusted(w, 60)}\` is not a form of a \`killall\` option this check reads` };
+            if (opt.does === "group")
+                return { unreadable: "`-g` signals the whole process group of each match, a set this check cannot list" };
+            const value = takesValue(opt) ? (attached ?? words[++i]) : undefined;
+            if (opt.does === "select" && value !== undefined)
+                selecting.set(opt.pgrep, value);
+            else if (opt.does === "filter" && value !== undefined)
+                filter = value;
+            else if (opt.does === "context")
+                byContext = true;
+            else if (opt.does === "regex")
+                regex = true;
+            else if (opt.does === "ignoreCase")
+                ignoreCase = true;
+        }
+    }
+    if (filter !== undefined && !names.includes(filter))
+        names.push(filter);
+    if (byContext && names.length === 0 && selecting.size === 0)
+        return { unreadable: "`-Z` selects by security context, a set this check cannot ask `pgrep` for" };
+    return { names, selecting: [...selecting].flat(), regex, ignoreCase };
+}
+function readKillall(segment) {
+    const read = wordsOf(segment);
+    if (read.computed !== undefined)
+        return { text: shown(segment), probes: [], computed: read.computed };
+    const sel = readKillallWords(read.words);
+    if ("unreadable" in sel)
+        return { text: shown(segment), probes: [], computed: sel.unreadable };
+    const narrow = sel.ignoreCase ? ["-i"] : [];
+    const pattern = (n) => [...(n.startsWith("-") ? ["--"] : []), sel.regex ? n : literalName(n)];
+    const probes = sel.names.length > 0 ? sel.names.map((n) => [...NAME_SELECTION_KEEPS_ANCESTORS, ...(sel.regex ? [] : ["-x"]), ...narrow, ...sel.selecting, ...pattern(n)]) : sel.selecting.length === 0 ? [] : [[...NAME_SELECTION_KEEPS_ANCESTORS, ...sel.selecting]];
+    return { text: shown(segment), probes };
+}
+function readSelector(segment) {
+    const read = wordsOf(segment);
+    if (read.computed !== undefined)
+        return { text: shown(segment), probes: [], computed: read.computed };
+    if (segment.verb?.basename === "pidof") {
+        const names = read.words.filter((w, i) => !w.startsWith("-") && read.words[i - 1] !== "-o");
+        return { text: shown(segment), probes: names.map((n) => [...NAME_SELECTION_KEEPS_ANCESTORS, "-x", literalName(n)]) };
+    }
+    return { text: shown(segment), probes: [selectorWords(read.words, "pgrep")] };
+}
+const SELECTORS = new Set(["pgrep", "pidof"]);
+const EVERY_PROCESS_PID = /^-0*1$/;
+function readKill(segment) {
+    const { words } = wordsOf(segment);
+    const slot = words[0] === "-s" || words[0] === "-n" ? 2 : words[0]?.startsWith("-") === true && words[0] !== "--" ? 1 : 0;
+    const rest = words.slice(slot);
+    const pids = rest[0] === "--" ? rest.slice(1) : rest;
+    return pids.some((w) => EVERY_PROCESS_PID.test(w)) ? { text: shown(segment), probes: [], everyProcess: true } : undefined;
+}
+const isFedKill = (s) => s.verb?.basename === "kill" && (s.reentry === "argv" || programArgs(s).some((a) => a.rewritten === true));
+const feedsKill = (plan) => plan.segments.some((s) => isFedKill(s) || s.nested.some(feedsKill));
+function selectorsIn(plan) {
+    return plan.segments.flatMap((s) => [...(SELECTORS.has(s.verb?.basename ?? "") ? [s] : []), ...s.nested.flatMap(selectorsIn)]);
+}
+function readingsOf(plan, seen = new Set()) {
+    const out = [];
+    const take = (s, read) => {
+        if (seen.has(s))
+            return;
+        seen.add(s);
+        const r = read();
+        if (r !== undefined)
+            out.push(r);
+    };
+    for (const s of plan.segments) {
+        const program = s.verb?.basename;
+        if (program === "pkill")
+            take(s, () => readPkill(s));
+        else if (program === "killall")
+            take(s, () => readKillall(s));
+        else if (program === "kill")
+            take(s, () => readKill(s));
+        for (const n of s.nested)
+            out.push(...readingsOf(n, seen));
+    }
+    if (feedsKill(plan))
+        for (const s of selectorsIn(plan))
+            take(s, () => readSelector(s));
+    return out;
+}
+export function patternKillReadings(command, cwd) {
+    return readingsOf(planShellReads(command, { readers: new Set(), cwd, roots: [cwd], cdPath: "unknown" }));
+}
+function runProbe(program, args, signal) {
+    return new Promise((resolve) => {
+        let stdout = "";
+        let stderr = "";
+        let settled = false;
+        const settle = (r) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            signal?.removeEventListener("abort", onAbort);
+            resolve(r);
+        };
+        const child = spawn(program, [...args], { env: inheritedHostEnv("scrub"), stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+        const stop = (why) => {
+            child.kill("SIGKILL");
+            settle({ ok: false, why });
+        };
+        const timer = setTimeout(() => stop(`${program} did not answer within ${PROBE_TIMEOUT_MS / 1000}s`), PROBE_TIMEOUT_MS);
+        const onAbort = () => stop("the call was cancelled");
+        signal?.addEventListener("abort", onAbort, { once: true });
+        child.stdout.on("data", (c) => { stdout += c.toString("utf8"); });
+        child.stderr.on("data", (c) => { stderr += c.toString("utf8"); });
+        child.on("error", (e) => settle({ ok: false, why: e.code === "ENOENT" ? `${program} is not available here` : `${program} could not start (${e.code ?? e.message})` }));
+        child.on("close", (code) => settle(code === 0 || code === 1 ? { ok: true, stdout, code } : { ok: false, why: `${program} exited ${code ?? "by signal"}${stderr.trim() === "" ? "" : `: ${inlineUntrusted(stderr, 120)}`}` }));
+    });
+}
+async function selected(args, signal) {
+    const run = await runProbe("pgrep", args, signal);
+    if (!run.ok)
+        return { why: run.why };
+    return { pids: run.code === 1 ? [] : run.stdout.split("\n").flatMap((line) => { const m = /^\s*(\d+)\b/.exec(line); return m === null ? [] : [Number(m[1])]; }) };
+}
+async function selfAndAncestors(signal) {
+    const chain = [process.pid];
+    if (process.platform === "linux") {
+        for (let pid = process.pid; chain.length <= ANCESTOR_HOPS_MAX && pid > 1;) {
+            let stat;
+            try {
+                stat = await readFile(`/proc/${pid}/stat`, "utf8");
+            }
+            catch {
+                return tableAncestors(signal);
+            }
+            const parent = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[1]);
+            if (!(parent > 0) || parent === pid)
+                break;
+            chain.push(parent);
+            pid = parent;
+        }
+        return { pids: chain };
+    }
+    return tableAncestors(signal);
+}
+async function tableAncestors(signal) {
+    const run = await runProbe("ps", ["-A", "-o", "pid=", "-o", "ppid="], signal);
+    if (!run.ok)
+        return { why: run.why };
+    const parentOf = new Map();
+    for (const line of run.stdout.split("\n")) {
+        const m = /^\s*(\d+)\s+(\d+)\s*$/.exec(line);
+        if (m !== null)
+            parentOf.set(Number(m[1]), Number(m[2]));
+    }
+    const chain = [process.pid];
+    for (let pid = parentOf.get(process.pid); pid !== undefined && pid > 0 && !chain.includes(pid) && chain.length <= ANCESTOR_HOPS_MAX; pid = parentOf.get(pid))
+        chain.push(pid);
+    return chain.length > 1 ? { pids: chain } : { why: "this process's parent could not be read from the process table" };
+}
+const WAY_OUT = "or stop the process by its PID, or target your own children with `pkill -P $$ ...`";
+const SENTENCE = {
+    hit: (f) => `Error (Bash): refusing to run \`${f.text}\` — its selection includes ${f.own ? "this agent's own process" : "a process above this agent (the shell or program that started it)"} (PID ${f.pid}), so running it would terminate the session that is running this command. Narrow the pattern (a word that is in your launcher's command line matches the launcher), ${WAY_OUT}.`,
+    computed: (f) => `Error (Bash): refusing to run \`${f.text}\` — which processes it selects is decided when the command runs (${f.why}), so it cannot first be checked against this agent's own process and the processes above it. Write the pattern into the command as a literal, ${WAY_OUT}.`,
+    unavailable: (f) => `Error (Bash): refusing to run \`${f.text}\` — the check that its selection holds neither this agent's own process nor a process above it could not run (${f.why}). Stop the process by its PID, or target your own children with \`pkill -P $$ ...\`.`,
+};
+export async function patternKillRefusal(command, env, cwd, signal) {
+    if (process.platform === "win32" || isRemoteExecutionEnv(env))
+        return undefined;
+    const readings = patternKillReadings(command, cwd);
+    if (readings.length === 0)
+        return undefined;
+    const found = [];
+    const asked = await Promise.all(readings.map(async (r) => ({ r, answers: await Promise.all(r.probes.map((p) => selected(p, signal))) })));
+    let ancestry;
+    for (const { r, answers } of asked) {
+        if (r.computed !== undefined)
+            found.push({ kind: "computed", text: r.text, why: r.computed });
+        if (r.everyProcess === true)
+            found.push({ kind: "hit", text: r.text, pid: process.pid, own: true });
+        for (const a of answers) {
+            if ("why" in a) {
+                found.push({ kind: "unavailable", text: r.text, why: a.why });
+                continue;
+            }
+            if (a.pids.length === 0)
+                continue;
+            ancestry ??= await selfAndAncestors(signal);
+            if ("why" in ancestry) {
+                found.push({ kind: "unavailable", text: r.text, why: ancestry.why });
+                continue;
+            }
+            const pid = ancestry.pids.find((p) => a.pids.includes(p));
+            if (pid !== undefined)
+                found.push({ kind: "hit", text: r.text, pid, own: pid === process.pid });
+        }
+    }
+    const f = found.find((x) => x.kind === "hit") ?? found.find((x) => x.kind === "computed") ?? found[0];
+    if (f === undefined || signal?.aborted === true)
+        return undefined;
+    const text = f.kind === "hit" ? SENTENCE.hit(f) : f.kind === "computed" ? SENTENCE.computed(f) : SENTENCE.unavailable(f);
+    return errorResult(inlineUntrusted(text, 1_200), { type: "bash_self_kill_refused", code: "bash_self_kill_refused", finding: f.kind, ...(f.kind === "hit" ? { pid: f.pid, relation: f.own ? "engine" : "ancestor" } : {}) });
+}

package/dist/tools/fs/pdf.d.ts

@@ -54,19 +54,22 @@ export declare function getPdfPageCount(env: ExecutionEnv, absPath: string, byte
 export declare const PDF_FALLBACK_RENDER_PAGES = 5;
 /**
  * PDF capability profile of the SERVING model, consumed by the Read tool's degradation chain (v2):
- * - `document` — the brain path can forward a native `{type:"document"}` block (today: anthropic-messages
- *   WITH vision — anthropic.ts drops document blocks for no-vision models — or an explicit `input`
- *   declaration containing "document" for a future capability bit).
- * - `vision` — `Model.input` contains "image" (absent metadata fails open = today's behavior).
+ * - `document` — the brain path can forward a native `{type:"document"}` block: the anthropic-messages lane on a
+ *   model that holds image input (anthropic.ts drops document blocks exactly when it withholds images).
+ * - `vision` — the model holds image input (`capabilityHeld`, the one capability reading; an undeclared `input`
+ *   is held, as every request reads it).
  * Structural parameter (no deep Model import): `prepare-task` passes the task's resolved Model.
  */
 export interface PdfModelCapabilities {
     document: boolean;
     vision: boolean;
 }
-/** Derive {@link PdfModelCapabilities} from a Model-shaped object. `undefined` model = fully capable
- *  (fail-open: no metadata ⇒ preserve the native document-block behavior, brain-level placeholder guards). */
+/** Derive {@link PdfModelCapabilities} from a Model-shaped object. `undefined` model, or a value with neither `api` nor
+ *  `input` = fully capable (fail-open: no metadata ⇒ preserve the native document-block behavior, brain-level placeholder
+ *  guards) — the one reader that looks at the absence itself. A value with an `input` and no `api` is read by its declaration:
+ *  `vision` follows the image capability and `document` is false (only the anthropic-messages lane forwards a document block). */
 export declare function pdfModelCapabilitiesOf(model?: {
+    id?: string;
     api?: string;
     input?: readonly string[];
 }): PdfModelCapabilities;

package/dist/tools/fs/pdf.js

@@ -1,4 +1,5 @@
 import { isTimeCutCode } from "../../internal/harness.js";
+import { capabilityHeld } from "../../brain/model-capability.js";
 export const PDF_MAX_PAGES_PER_READ = 20;
 export const PDF_INLINE_PAGE_THRESHOLD = 10;
 export const PDF_MAX_EXTRACT_SIZE = 100 * 1024 * 1024;
@@ -52,9 +53,8 @@ export const PDF_FALLBACK_RENDER_PAGES = 5;
 export function pdfModelCapabilitiesOf(model) {
     if (!model || (model.api === undefined && model.input === undefined))
         return { document: true, vision: true };
-    const vision = model.input === undefined ? true : model.input.includes("image");
-    const document = model.input?.includes("document") === true || (model.api === "anthropic-messages" && vision);
-    return { document, vision };
+    const vision = capabilityHeld(model, "image");
+    return { document: model.api === "anthropic-messages" && vision, vision };
 }
 export const PDF_EXEC_TIMEOUT_SEC = 120;
 function cutOf(e) {