@sema-agent/core 7.54.1 → 7.56.0

package/dist/tools/fs/program-read-model.d.ts

@@ -59,6 +59,9 @@ export type ArgRole =
     /** The program expands `{a,b}` sets and `[a-z]` / `[1-9]` ranges in the value itself before it opens anything
      *  (curl's URL glob), unless the invocation carries an option marked {@link OptionSpec.literalValues}. */
     readonly programGlob?: true;
+    /** The program substitutes its own environment into the value (valgrind's `%q{NAME}`): a value carrying such a substitution
+     *  names a place the text does not settle. */
+    readonly programEnv?: true;
     /** A writing effect: the seats the program writes the path at (absent: where it lands). */
     readonly seats?: readonly WriteSeat[];
     /** A writing effect the program does NOT itself perform at every seat: the seats it does write (`[]`: none — a
@@ -177,13 +180,27 @@ export interface OptionSpec {
      *  reads the station cannot establish ({@link deliversOperands}); the list file itself is a read like any other and meets the deny
      *  rows as itself. */
     readonly delivers?: "operands";
-    /** The option's value is a PLACE the program's walk works in or compares (`tar -C DIR`, `diff --from-file=DIR`): a root of a
+    /** The option's value is a PLACE the program's walk works in or compares (`diff --from-file=DIR`): a root of a
      *  recursive form, whichever way the value is spelled. Absent: a path value is a file the program READS (a config, ignore or
      *  exclusion file, an archive, a pattern file) or an entry it examines — judged as itself, never a root, so it does not count
      *  as the root the walk was given (`rg --ignore-file ig pat` walks `.`). A list the operands come from ({@link delivers}) is a
      *  root of a recursive form too, in either spelling: the program works on what the list names, not on the working directory
      *  (and, the names not being in the text, the segment is not vouched: {@link deliversOperands}). */
     readonly walks?: true;
+    /** The option's value is the directory the program changes into before it opens the OPERANDS written after it (`tar -C DIR`,
+     *  both GNU tar and bsdtar): an ordered base — each relative operand after it resolves against it, a second one resolves
+     *  against the first, the operands before it and every option value (the archive, a list, an exclusion file) against the
+     *  working directory. The value itself is a place the program names, no root of the walk. */
+    readonly rebases?: true;
+    /** The option's value is a `KEY=VALUE` setting the program keeps, and the value of a key this table names is a command line the
+     *  program hands to a shell LATER (`git -c core.pager=…`, `git -c 'alias.x=!…'`): a code body of the program ({@link CodeBody}
+     *  `option-values`). `valueFrom: "environment"`: the setting's VALUE is the content of the environment variable the word names
+     *  (`git --config-env=core.pager=VAR`) — text the command does not spell. The table is read off the program's own
+     *  documentation, never off the command. */
+    readonly runsLater?: {
+        readonly keys: readonly LaterRunKey[];
+        readonly valueFrom?: "environment";
+    };
     /** The option's value bounds the program's output, in bytes or in lines (`head -c` / `head -n`). */
     readonly bounds?: "bytes" | "lines";
     /** The option's value is what the row's LAST operand would otherwise be (`cp -t <dir>`), so every operand is an
@@ -192,6 +209,10 @@ export interface OptionSpec {
     /** An enum option: selecting the value (case-folded, any unambiguous prefix of it) makes the operands roots of a
      *  tree walk (`grep -d recurse`). */
     readonly selectsWhenValue?: string;
+    /** Given exactly this value, the option RUNS what the program holds at once, whatever else is selected — as an
+     *  `effect: "executes"` option does (`fc -e -`: no editor, the stored line runs even beside `-l`); any other value is
+     *  read by the option's role alone (`fc -e vi -l` only lists). */
+    readonly executesWhenValue?: string;
     /** This option delivers what the row's first positional would otherwise be (grep's `-e`, sed's `-f`, an
      *  interpreter's `-c`), so the first operand is an ordinary operand after it. */
     readonly fillsSlot?: true;
@@ -217,6 +238,18 @@ export interface OptionSpec {
      *  the names, `declare -p`; names functions, `-f`; or a bash it runs on refuses the switch, bash 3.2's `declare -g`). */
     readonly assigns?: DeclaredAttribute;
 }
+/** One key of {@link OptionSpec.runsLater}: `key` the setting's name, case-folded, `*` standing for any run of characters (a
+ *  subsection, a variable name); `bang` — only a value led by `!` is a command line (the text after the `!`), any other value
+ *  names something the program resolves itself; `prefixed` — a value led by `!` is a shell snippet (the text after it), one led
+ *  by `/` the command as written, any other value is run with this text in front of it (git's credential helpers: `git
+ *  credential-<value>`); `orBoolean` — a boolean value (`true` / `false` / `yes` / `no` / `on` / `off` / `1` / `0`, or empty)
+ *  switches a behaviour and is no command line. */
+export interface LaterRunKey {
+    readonly key: string;
+    readonly bang?: true;
+    readonly prefixed?: string;
+    readonly orBoolean?: true;
+}
 /** What a declaration builtin does to the names it binds ({@link OptionSpec.assigns}). */
 export type DeclaredAttribute = "integer" | "reference" | "transformed" | "frozen" | "unsettled";
 /** One implementation's option grammar. `any` = every implementation the row was measured on reads it this way. */
@@ -338,11 +371,13 @@ export interface DeliverySpec {
     readonly stdinWhenUnnamed: boolean;
 }
 /** The shell text a re-entry program runs: `-c`'s value, its words joined (`eval`), its non-option words (`parallel`),
- *  or none (`source FILE` reads a file operand). `stdin: "script"`: where its argv names no text and no script file, it
- *  runs its STANDARD INPUT (`bash <<EOF`, `… | sh`, `parallel < commands`). */
+ *  none (`source FILE` reads a file operand), or a line of the shell's own HISTORY list (`fc -s`, `fc -e -`, bare `fc`: no word
+ *  of the command spells it, so it is a text built when the command runs — unless an option the row marks `banner` makes it
+ *  print instead, `fc -l`). `stdin: "script"`: where its argv names no text and no script file, it runs its STANDARD INPUT
+ *  (`bash <<EOF`, `… | sh`, `parallel < commands`). */
 export type ShellReentry = {
     readonly kind: "shell";
-    readonly text: "c-option" | "words" | "non-option-words" | "file-operand";
+    readonly text: "c-option" | "words" | "non-option-words" | "file-operand" | "history";
     readonly stdin?: "script";
 }
 /** Its operands arrive on a stream and it execs `defaultProgram` when the chain names none (`xargs`). */
@@ -350,8 +385,9 @@ export type ShellReentry = {
     readonly kind: "argv";
     readonly defaultProgram: string;
 };
-/** Where a builtin keeps shell text it runs later: its first operand after the options (`trap`), the values of its
- *  `NAME=VALUE` operands (`alias`), or the values of its shell-text options (`mapfile -C`). */
+/** Where a program keeps shell text it runs later: its first operand after the options (`trap`), the values of its
+ *  `NAME=VALUE` operands (`alias`), or the values of its shell-text options (`mapfile -C`) — and of a setting option whose key
+ *  names a command line ({@link OptionSpec.runsLater}: `git -c core.pager=…`). */
 export type CodeBody = "first-operand" | "assignment-values" | "option-values";
 /** How a row is checked against the program: the gate runs the binary, or the row says why it cannot. */
 export type Witness = "binary" | {
@@ -392,6 +428,10 @@ export interface ProgramRow {
     /** Modules the interpreter runs by name (`python -m <module>`) whose own argv tail is not argv: the role of every word
      *  after the module name (`timeit` compiles and runs it as program text). */
     readonly modules?: Readonly<Record<string, ArgRole>>;
+    /** Each grammar declares EVERY option its implementation takes (measured): a spelling one does not declare is an option
+     *  that implementation refuses — getopt reports it and the program runs nothing ({@link rowRefusesArgv}). Absent, an
+     *  undeclared spelling may be one the row does not model, and no reader concludes anything from it. */
+    readonly optionsComplete?: true;
     readonly witness: Witness;
 }
 /** The row bash runs for this basename: the exact key, or — for a row that declares versioned spellings — the name
@@ -518,7 +558,8 @@ export declare function programGlobExpansions(value: string): readonly string[]
  * the no. A plain path offers itself; an `indirect` one itself and what it names past an `@`; a `header` only a
  * whole-word `@<file>`; a `form` field spec the files after its `@` / `<`; a `url` the local path of a `file:` URL. A
  * `programGlob` value offers what each of its expansions offers (`globs: "literal"` = the invocation turned the glob
- * off); `undefined` = it expands past {@link PROGRAM_GLOB_MAX}: it names files the reader does not list.
+ * off); `undefined` = it expands past {@link PROGRAM_GLOB_MAX}, or it carries a substitution of the program's own environment
+ * (`programEnv`): it names files the reader does not list.
  */
 export declare function slotValueCandidates(value: string, role: ArgRole, globs?: "expanded" | "literal"): string[] | undefined;
 /** The paths an object name `<rev>:<path>` ({@link ArgRole} `object-path`) may spell: the text after each `:` (a stage
@@ -677,6 +718,10 @@ interface OptionScan {
         readonly name: string;
     }[];
     readonly operands: readonly number[];
+    /** ONE implementation's reading met an option word naming a spelling its grammar does not declare, where that
+     *  implementation certainly reads the word as an option: before the first operand, or anywhere in a grammar that
+     *  permutes (`afterFirstOperand: "options"`). Past `--` nothing is an option. */
+    readonly undeclared: boolean;
 }
 /**
  * Every option spec an argv selects. A short cluster is read as getopt reads it, scanning left to right: a declared
@@ -698,6 +743,11 @@ export declare function selectedSpellings(row: ProgramRow, args: readonly string
  *  declares (another implementation's) that this one does not? getopt calls it an invalid option: the program runs
  *  nothing. */
 export declare function implementationRejects(row: ProgramRow, view: ProgramRow, words: readonly string[]): boolean;
+/** Does EVERY implementation of a row whose grammars declare all its options ({@link ProgramRow.optionsComplete}) refuse
+ *  this argv — an option word it certainly reads as an option names a spelling it does not declare
+ *  ({@link OptionScan.undeclared})? getopt reports the invalid option and the program runs nothing (`rm -m pytest .`,
+ *  `rm -rfE .`). One implementation that takes the argv is enough for it to run; a row that is not complete refuses nothing. */
+export declare function rowRefusesArgv(row: ProgramRow, args: readonly string[]): boolean;
 /** A path role whose effect writes. */
 export type WritingRole = Extract<ArgRole, {
     kind: "path";

package/dist/tools/fs/program-read-model.js

@@ -404,6 +404,8 @@ export function slotValueCandidates(value, role, globs = "expanded") {
         return [value];
     if (role.kind !== "path")
         return [];
+    if (role.programEnv === true && value.includes("%q{"))
+        return undefined;
     if (role.kind === "path" && role.programGlob === true && globs === "expanded") {
         const values = programGlobExpansions(value);
         if (values === undefined)
@@ -782,13 +784,16 @@ function scanOptions(row, args, one) {
     const values = [];
     const operands = [];
     const select = (spec, name) => { specs.push(spec); names.push(name); };
+    const permutes = row.grammars[0]?.afterFirstOperand === "options";
     let endOfOptions = false;
+    let undeclared = false;
     for (let k = 0; k < args.length; k++) {
         const t = args[k];
         if (endOfOptions) {
             operands.push(k);
             continue;
         }
+        const certain = one && (operands.length === 0 || permutes);
         const traditional = k === 0 || !one ? obsolete.filter((o) => o.signs.includes(t[0] ?? "") && /^.\d+[A-Za-z]*$/.test(t)) : [];
         if (traditional.length > 0) {
             for (const o of traditional)
@@ -827,6 +832,7 @@ function scanOptions(row, args, one) {
             const eq = t.indexOf("=");
             const exact = longs.get(name);
             const hits = exact !== undefined ? [[name, exact]] : [...longs].filter(([full, m]) => isLongOptionSpellingOf(name, full, m.abbreviable));
+            undeclared ||= certain && hits.length === 0;
             for (const [full, m] of hits)
                 select(m.spec, `--${full}`);
             const [full, only] = hits[0] ?? [];
@@ -849,6 +855,7 @@ function scanOptions(row, args, one) {
         for (let i = 1; i < t.length; i++) {
             const m = shorts.get(t[i]);
             if (m === undefined) {
+                undeclared ||= certain;
                 if (/[A-Za-z0-9]/.test(t[i]))
                     continue;
                 break;
@@ -864,7 +871,10 @@ function scanOptions(row, args, one) {
             break;
         }
     }
-    return { specs, names, values, operands };
+    return { specs, names, values, operands, undeclared };
+}
+export function rowRefusesArgv(row, args) {
+    return row.optionsComplete === true && implementationsOf(row).every((view) => scanOptions(view, args, true).undeclared);
 }
 export function writesPath(role) {
     return role?.kind === "path" && WRITING_EFFECTS.has(role.effect);

package/dist/tools/fs/program-read-model.rows.js

@@ -33,6 +33,7 @@ const OBJECT_PATH = { kind: "object-path" };
 const text = (language) => ({ kind: "program-text", language });
 const file = (language) => ({ kind: "program-file", language });
 const WALKS = { walks: true };
+const REBASES = { rebases: true };
 const SWITCH = { arity: 0 };
 const QUERY = { arity: 0, mode: "queries" };
 const val = (value, extra = {}) => ({ arity: 1, ...(value !== undefined ? { value } : {}), ...extra });
@@ -164,8 +165,8 @@ const date = {
 };
 const tar = {
     key: "tar",
-    grammars: [grammar({ b: val(COUNT), C: val(NAMES, WALKS), f: val(READ), T: val(READ, { delivers: "operands" }), X: val(READ), g: val(), ...switches("adhjJkmOpPStvwWxzZ"), ...switches("cru", { selects: "traversal" }) }, {
-            "blocking-factor": val(COUNT), directory: val(NAMES, WALKS), exclude: val(NAME_PATTERN), "exclude-from": val(READ), file: val(READ), "files-from": val(READ, { delivers: "operands" }), "strip-components": val(COUNT),
+    grammars: [grammar({ b: val(COUNT), C: val(NAMES, REBASES), f: val(READ), T: val(READ, { delivers: "operands" }), X: val(READ), g: val(), ...switches("adhjJkmOpPStvwWxzZ"), ...switches("cru", { selects: "traversal" }) }, {
+            "blocking-factor": val(COUNT), directory: val(NAMES, REBASES), exclude: val(NAME_PATTERN), "exclude-from": val(READ), file: val(READ), "files-from": val(READ, { delivers: "operands" }), "strip-components": val(COUNT),
             ...longSwitches(["absolute-names", "dereference", "extract", "get", "interactive", "keep-old-files", "list", "preserve-permissions", "sparse", "to-stdout", "touch", "verbose", "verify"]), ...BANNERS,
             ...longSwitches(["append", "create", "update"], { selects: "traversal" }),
         })],
@@ -176,6 +177,7 @@ const find = {
     key: "find",
     grammars: implementations(grammar({ D: val(LABEL), O: val(COUNT), f: val(NAMES), ...switches("HLPdsx") }, BANNERS, {
         afterFirstOperand: "options",
+        acceptsAbbreviations: false,
         dashWords: {
             amin: val(COUNT), anewer: val(NAMES), atime: val(COUNT), cmin: val(COUNT), cnewer: val(NAMES), context: val(LABEL),
             ctime: val(COUNT), fstype: val(LABEL), gid: val(COUNT), group: val(LABEL), ilname: val(NAMES), iname: val(NAME_PATTERN),
@@ -306,7 +308,7 @@ function interpreterGrammar(language, g) {
         put(s, val(file(language), { fillsSlot: true, ...(g.fileEndsOptions === true ? { endsOptions: true } : {}) }));
     for (const s of g.longText ?? [])
         put(s, val(text(language), { fillsSlot: true }));
-    return { dialect: "any", short, long, dashWords, afterFirstOperand: "either" };
+    return { dialect: "any", short, long, dashWords, afterFirstOperand: "either", ...(g.exactLongNames === true ? { acceptsAbbreviations: false } : {}) };
 }
 const interpreter = (key, language, g, program, stdinWhenUnnamed, extra = {}, departures) => ({
     key,
@@ -317,9 +319,9 @@ const interpreter = (key, language, g, program, stdinWhenUnnamed, extra = {}, de
     witness: BINARY,
     ...extra,
 });
-const PERL = { text: "eEmM", separated: "I", attached: "iCFxDV", plain: "nplawcsStTUWX", banner: "vVh" };
-const RUBY = { text: "e", separated: "IrECKT", attached: "F", plain: "nplawcsSU", banner: "vh" };
-const PYTHON = { text: "c", module: "m", separated: "WXQ", plain: "uBEIsSqbdvxOtR", banner: "Vh?", interactive: "i", fileEndsOptions: true };
+const PERL = { text: "eEmM", separated: "I", attached: "iCFxDV", plain: "nplawcsStTUWX", banner: "vVh", exactLongNames: true };
+const RUBY = { text: "e", separated: "IrECKT", attached: "F", plain: "nplawcsSU", banner: "vh", exactLongNames: true };
+const PYTHON = { text: "c", module: "m", separated: "WXQ", plain: "uBEIsSqbdvxOtR", banner: "Vh?", interactive: "i", fileEndsOptions: true, exactLongNames: true };
 const NODE = {
     longText: ["--eval", "--print"], text: "ep",
     longModules: ["--import", "--loader", "--experimental-loader", "--require"],
@@ -327,25 +329,25 @@ const NODE = {
     longAttached: ["--max-old-space-size"],
     longNamesProgram: ["--test"],
     longPlain: ["--inspect", "--inspect-brk", "--no-warnings", "--trace-warnings", "--watch", "--enable-source-maps", "--experimental-modules", "--no-deprecation", "--check"],
-    modules: "r", plain: "c", banner: "vh", interactive: "i",
+    modules: "r", plain: "c", banner: "vh", interactive: "i", exactLongNames: true,
 };
-const PHP = { longText: ["--run", "--process-begin", "--process-code", "--process-end"], text: "rRBE", file: "fF", separated: "dcz", plain: "nqswl", banner: "vhi", interactive: "a" };
+const PHP = { longText: ["--run", "--process-begin", "--process-code", "--process-end"], text: "rRBE", file: "fF", separated: "dcz", plain: "nqswl", banner: "vhi", interactive: "a", exactLongNames: true };
 const LUA = { text: "e", separated: "l", banner: "vh", interactive: "i" };
 const EXPECT = { text: "c", separated: "Db", plain: "dN", banner: "vh", interactive: "i" };
 const AWK = { longText: ["--source"], text: "e", longFile: ["--file", "--exec"], file: "fE", separated: "F", assignment: "v", banner: "V" };
 const POSIX_AWK = { file: "f", separated: "F", assignment: "v" };
 const AWK_IMPLEMENTATIONS = { gnu: {}, bsd: { lacks: ["-E", "--file", "--exec", "--source"] } };
-const JQ = { longFile: ["--from-file"], file: "f", separated: "L", plain: "nrjcsSaCMRe", banner: "h" };
+const JQ = { longFile: ["--from-file"], file: "f", separated: "L", plain: "nrjcsSaCMRe", banner: "h", exactLongNames: true };
 const BC = { longText: ["--expression"], text: "e", plain: "lqsw", banner: "vh", interactive: "i" };
 const DC = { longText: ["--expression"], text: "e", longFile: ["--file"], file: "f", banner: "hV" };
-const SQLITE = { longText: ["-cmd"], longSupplemental: ["-init"] };
+const SQLITE = { longText: ["-cmd"], longSupplemental: ["-init"], exactLongNames: true };
 const PSQL = { longText: ["--command"], text: "c", longFile: ["--file"], file: "f", separated: "hpUdoF", plain: "aeEqtxXwW", banner: "lV?" };
 const OSASCRIPT = { text: "e", separated: "ls", plain: "i", banner: "h" };
 const RSCRIPT = { text: "e", banner: "h" };
 const JULIA = { longText: ["--eval", "--print"], text: "eE", separated: "JLp", plain: "q", banner: "vh", interactive: "i" };
 const GHCI = { text: "e", separated: "io" };
 const GROOVY = { text: "e", separated: "Dcl", plain: "n", banner: "vh", interactive: "i" };
-const BUN = { longText: ["--eval", "--print"], text: "ep", modules: "r", banner: "vh" };
+const BUN = { longText: ["--eval", "--print"], text: "ep", modules: "r", banner: "vh", exactLongNames: true };
 const launcher = (key, spec = {}, g, extra = {}) => ({
     key,
     grammars: g === undefined ? [] : [g],
@@ -396,6 +398,47 @@ const SU_OPTIONS = {
     programs: ["-m", "-p", "--preserve-environment"],
 };
 const SU = launcherGrammar(SU_OPTIONS, { stepsDashDash: true });
+const VALGRIND_FLAGS = [
+    "trace-children", "trace-children-skip", "trace-children-skip-by-arg", "child-silent-after-fork", "vgdb", "vgdb-stop-at", "track-fds", "time-stamp",
+    "xml", "xml-user-comment", "demangle", "error-limit", "exit-on-first-error", "error-markers", "show-error-list", "keep-debuginfo", "show-below-main",
+    "default-suppressions", "gen-suppressions", "dsymutil", "xtree-memory", "fullpath-after", "allow-mismatched-debuginfo", "smc-check", "read-inline-info",
+    "read-var-info", "run-libc-freeres", "run-cxx-freeres", "fair-sched", "sigill-diagnostics", "show-emwarns", "vgdb-shadow-registers", "sim-hints",
+    "kernel-variant", "soname-synonyms", "resync-filter", "tool",
+    "leak-check", "leak-resolution", "show-leak-kinds", "errors-for-leak-kinds", "leak-check-heuristics", "show-reachable", "show-possibly-lost", "xtree-leak",
+    "undef-value-errors", "track-origins", "partial-loads-ok", "expensive-definedness-checks", "workaround-gcc296-bugs", "ignore-ranges", "ignore-range-below-sp",
+    "malloc-fill", "free-fill", "keep-stacktraces", "show-mismatched-frees",
+];
+const VALGRIND_COUNTS = [
+    "vgdb-error", "log-fd", "xml-fd", "num-callers", "error-exitcode", "input-fd", "max-stackframe", "main-stacksize", "alignment", "redzone-size",
+    "max-threads", "merge-recursive-frames", "num-transtab-sectors", "avg-transtab-entry-size", "valgrind-stacksize", "vgdb-poll",
+    "unw-stack-scan-thresh", "unw-stack-scan-frames", "freelist-vol", "freelist-big-blocks",
+];
+const VALGRIND_OUTPUT_FILES = ["log-file", "xml-file", "xtree-memory-file", "xtree-leak-file", "callgrind-out-file", "cachegrind-out-file", "massif-out-file", "dhat-out-file"];
+const VALGRIND_WRITE = { kind: "path", effect: "write", programEnv: true };
+const VALGRIND_READ = { kind: "path", effect: "read", programEnv: true };
+const VALGRIND = launcherGrammar({
+    switches: ["-q", "-v", "-s", "--quiet", "--verbose", "-h", "--help", "--help-debug", "--help-dyn-options", "--version"],
+    banners: ["-h", "--help", "--help-debug", "--help-dyn-options", "--version"],
+    optional: {
+        ...Object.fromEntries(VALGRIND_FLAGS.map((n) => [`--${n}`, LABEL])),
+        ...Object.fromEntries(VALGRIND_COUNTS.map((n) => [`--${n}`, COUNT])),
+        ...Object.fromEntries(VALGRIND_OUTPUT_FILES.map((n) => [`--${n}`, VALGRIND_WRITE])),
+        "--suppressions": VALGRIND_READ,
+    },
+}, { acceptsAbbreviations: false, stepsDashDash: true });
+const SETPRIV = launcherGrammar({
+    switches: ["--nnp", "--no-new-privs", "--clear-groups", "--keep-groups", "--init-groups", "--reset-env", "-d", "--dump", "-h", "--help", "-V", "--version"],
+    banners: ["-d", "--dump", "-h", "--help", "-V", "--version"],
+    values: Object.fromEntries(["ambient-caps", "inh-caps", "bounding-set", "ruid", "euid", "rgid", "egid", "reuid", "regid", "groups", "securebits", "pdeathsig", "selinux-label", "apparmor-profile"].map((n) => [`--${n}`, LABEL])),
+}, { stepsDashDash: true });
+const CHROOT_GRAMMARS = implementations(launcherGrammar({ switches: ["--skip-chdir", "--help", "--version"], values: { "--userspec": LABEL, "--groups": LABEL, "-u": LABEL, "-g": LABEL, "-G": LABEL } }, { stepsDashDash: true }), { lacks: ["-u", "-g", "-G"] }, { lacks: ["--skip-chdir", "--help", "--version", "--userspec", "--groups"] });
+const PRLIMIT_RESOURCES = { c: "core", d: "data", e: "nice", f: "fsize", i: "sigpending", l: "memlock", m: "rss", n: "nofile", q: "msgqueue", r: "rtprio", s: "stack", t: "cpu", u: "nproc", v: "as", x: "locks", y: "rttime" };
+const PRLIMIT = launcherGrammar({
+    switches: ["--noheadings", "--raw", "--verbose", "-h", "--help", "-V", "--version"],
+    banners: ["-h", "--help", "-V", "--version"],
+    values: { "-p": COUNT, "--pid": COUNT, "-o": LABEL, "--output": LABEL },
+    optional: Object.fromEntries(Object.entries(PRLIMIT_RESOURCES).flatMap(([letter, name]) => [[`-${letter}`, LABEL], [`--${name}`, LABEL]])),
+}, { stepsDashDash: true });
 const SU_LINUX_ONLY = [...SU_OPTIONS.switches, ...Object.keys(SU_OPTIONS.values), ...SU_OPTIONS.shellText, ...SU_OPTIONS.programs].filter((s) => !["-f", "-l", "-m"].includes(s));
 const launchers = [
     { key: "env", grammars: implementations(launcherGrammar({
@@ -427,8 +470,8 @@ const launchers = [
     launcher("pkexec", { whenNoProgram: "shell" }, launcherGrammar({ switches: ["--disable-internal-agent", "--keep-cwd", "--version", "--help"], values: { "--user": LABEL } }), { witness: PRIVILEGED }),
     { key: "su", grammars: implementations(SU, { afterFirstOperand: "options" }, { lacks: SU_LINUX_ONLY, afterFirstOperand: "operands" }), launcher: { shellText: "user", asUser: { home: "target", loginWith: ["-l", "--login"] } }, witness: PRIVILEGED },
     { key: "runuser", grammars: [launcherGrammar({ ...SU_OPTIONS, values: { ...SU_OPTIONS.values, "-u": LABEL, "--user": LABEL } }, { afterFirstOperand: "options", stepsDashDash: true })], launcher: { shellText: "user", programWith: ["-u", "--user"], asUser: { home: "target", loginWith: ["-l", "--login"] } }, witness: PRIVILEGED },
-    launcher("chroot", { requiredOperands: 1, whenNoProgram: "shell" }, undefined, { witness: PRIVILEGED }),
-    launcher("setpriv", {}, undefined, { witness: PRIVILEGED }),
+    { key: "chroot", grammars: CHROOT_GRAMMARS, launcher: { requiredOperands: 1, whenNoProgram: "shell" }, witness: PRIVILEGED },
+    launcher("setpriv", {}, SETPRIV, { witness: PRIVILEGED }),
     launcher("nohup", {}, grammar({}, BANNERS, { stepsDashDash: true })),
     { key: "nice", grammars: implementations(grammar({ n: val(COUNT) }, { adjustment: val(COUNT), ...BANNERS }, { stepsDashDash: true }), {}, { lacks: ["--adjustment", "--help", "--version"] }), launcher: { negativeIntegerIsOwnArgument: true }, witness: BINARY },
     launcher("ionice", {}, launcherGrammar({
@@ -470,7 +513,7 @@ const launchers = [
     }), { witness: LINUX_NAMESPACE }),
     launcher("script", { shellText: "joined" }, launcherGrammar({ shellText: ["-c", "--command"] }), { witness: SHELL_TEXT_LAUNCHER }),
     launcher("numactl", {}, undefined, { witness: LINUX_NAMESPACE }),
-    launcher("prlimit", {}, undefined, { witness: LINUX_NAMESPACE }),
+    launcher("prlimit", {}, PRLIMIT, { witness: LINUX_NAMESPACE }),
     launcher("systemd-run", {}, undefined, { witness: { declared: "hands the program to a service manager" } }),
     launcher("strace", {}, launcherGrammar({
         switches: ["-f", "-c", "-C", "-d", "-D", "-h", "-i", "-k", "-q", "-r", "-t", "-T", "-v", "-V", "-w", "-x", "-y", "-z", "-Z", "-F", "--follow-forks", "--summary-only", "--summary", "--debug", "--help", "--version"],
@@ -486,7 +529,7 @@ const launchers = [
         banners: ["-V"],
         values: { "-a": COUNT, "-A": COUNT, "-e": LABEL, "-l": NAMES, "-n": COUNT, "-o": WRITE, "-p": COUNT, "-s": COUNT, "-u": LABEL, "-x": LABEL, "-D": LABEL, "-F": READ, "-w": COUNT, "--align": COUNT, "--config": READ, "--debug": LABEL, "--indent": COUNT, "--library": NAMES, "--output": WRITE, "--string-max": COUNT, "--where": COUNT },
     }), { witness: LINUX_NAMESPACE }),
-    launcher("valgrind"),
+    launcher("valgrind", {}, VALGRIND),
     launcher("firejail", { whenNoProgram: "shell" }, undefined, { witness: LINUX_NAMESPACE }),
     launcher("bwrap", {}, undefined, { witness: LINUX_NAMESPACE }),
 ];
@@ -507,12 +550,25 @@ const GIT_GREP = {
     traversal: { discloses: "contents", always: true },
 };
 const gitObjectSubcommand = (short = {}, long = {}) => ({ grammar: grammar(short, long), operands: { rest: OBJECT_PATH } });
+const GIT_RUNS_LATER = [
+    ...["core.pager", "core.editor", "sequence.editor", "core.sshcommand", "core.gitproxy", "core.askpass", "core.alternaterefscommand",
+        "diff.external", "diff.*.command", "diff.*.textconv", "merge.*.driver", "filter.*.clean", "filter.*.smudge", "filter.*.process",
+        "difftool.*.cmd", "difftool.*.path", "mergetool.*.cmd", "mergetool.*.path", "interactive.difffilter",
+        "gpg.program", "gpg.*.program", "gpg.ssh.defaultkeycommand", "browser.*.cmd", "browser.*.path", "man.*.cmd", "man.*.path",
+        "guitool.*.cmd", "instaweb.httpd", "trailer.*.cmd", "trailer.*.command", "uploadpack.packobjectshook", "gc.recentobjectshook",
+        "remote.*.receivepack", "remote.*.uploadpack",
+        "sendemail.*tocmd", "sendemail.*cccmd", "sendemail.*headercmd", "sendemail.*sendmailcmd", "sendemail.*smtpserver"].map((key) => ({ key })),
+    { key: "pager.*", orBoolean: true }, { key: "core.fsmonitor", orBoolean: true },
+    { key: "alias.*", bang: true }, { key: "credential.helper", prefixed: "git credential-" }, { key: "credential.*.helper", prefixed: "git credential-" },
+];
 const git = {
     key: "git",
-    grammars: [grammar({ p: SWITCH, P: SWITCH, C: val(WORKDIR), c: val() }, {
+    grammars: [grammar({ p: SWITCH, P: SWITCH, C: val(WORKDIR), c: val(undefined, { runsLater: { keys: GIT_RUNS_LATER } }) }, {
             ...longSwitches(["paginate", "no-pager", "bare", "no-replace-objects", "literal-pathspecs", "glob-pathspecs", "noglob-pathspecs", "icase-pathspecs", "no-optional-locks"]),
-            "git-dir": val(WORKDIR), "work-tree": val(WORKDIR), namespace: val(), "config-env": val(), "super-prefix": val(),
-        })],
+            "git-dir": val(WORKDIR), "work-tree": val(WORKDIR), namespace: val(), "config-env": val(undefined, { runsLater: { keys: GIT_RUNS_LATER, valueFrom: "environment" } }), "super-prefix": val(),
+            version: { arity: 0, mode: "banner" },
+        }, { acceptsAbbreviations: false })],
+    body: "option-values",
     subcommands: {
         commit: gitSubcommand("apsnvqeioz", "Su", "mFCct", ["message", "file", "template", "pathspec-from-file", "author", "date", "cleanup", "fixup", "squash", "trailer", "reuse-message", "reedit-message"]),
         tag: gitSubcommand("asfdvle", "n", "mFu", ["message", "file", "local-user", "cleanup", "trailer", "sort", "format", "contains", "no-contains", "points-at", "merged", "no-merged"]),
@@ -562,7 +618,7 @@ const CONTAINER_RUN = {
 };
 const containerRuntime = (key) => ({
     key,
-    grammars: [grammar({ H: val(LABEL), c: val(LABEL), l: val(LABEL), D: SWITCH }, { host: val(LABEL), context: val(LABEL), "log-level": val(LABEL), config: val(READ), tlscacert: val(READ), tlscert: val(READ), tlskey: val(READ), ...longSwitches(["debug", "tls", "tlsverify"]) })],
+    grammars: [grammar({ H: val(LABEL), c: val(LABEL), l: val(LABEL), D: SWITCH }, { host: val(LABEL), context: val(LABEL), "log-level": val(LABEL), config: val(READ), tlscacert: val(READ), tlscert: val(READ), tlskey: val(READ), ...longSwitches(["debug", "tls", "tlsverify"]) }, { acceptsAbbreviations: false })],
     operands: { assignmentArguments: "not-paths" },
     subcommands: { run: CONTAINER_RUN, create: CONTAINER_RUN },
     witness: { declared: "a build tool / container client: what a NAME=value argument means is the build's or the container's" },
@@ -595,8 +651,8 @@ const copyGrammars = (bsdSuffixSwitch, destination) => implementations(grammar({
 const writerRows = [
     { key: "mkdir", grammars: [], operands: { rest: CREATED, dash: "file" }, witness: BINARY },
     { key: "touch", grammars: implementations(grammar({ h: { arity: 0, writesAt: ["landing", "entry"] } }, { "no-dereference": { arity: 0, writesAt: ["landing", "entry"] } }), {}, { lacks: ["--no-dereference"] }), operands: { rest: TOUCHED, dash: "file" }, witness: BINARY },
-    { key: "rm", grammars: implementations(grammar({ ...switches("rR", { selects: "traversal" }), f: { arity: 0, mode: "forced" } }, { ...longSwitches(["recursive"], { selects: "traversal" }), force: { arity: 0, mode: "forced" } }), {}, { lacks: ["--recursive", "--force"] }), operands: { rest: REMOVED, dash: "file" }, witness: BINARY },
-    { key: "rmdir", grammars: implementations(grammar({ p: { arity: 0, effect: "writes" } }, { parents: { arity: 0, effect: "writes" } }), {}, { lacks: ["--parents"] }), operands: { rest: REMOVED, dash: "file" }, witness: BINARY },
+    { key: "rm", grammars: implementations(grammar({ ...switches("rR", { selects: "traversal" }), f: { arity: 0, mode: "forced" }, ...switches("diIvPWx", { effect: "none" }) }, { ...longSwitches(["recursive"], { selects: "traversal" }), force: { arity: 0, mode: "forced" }, ...longSwitches(["dir", "verbose", "one-file-system", "no-preserve-root", "-presume-input-tty"], { effect: "none" }), interactive: { arity: "attached", value: LABEL, effect: "none" }, "preserve-root": { arity: "attached", value: LABEL, effect: "none" }, ...BANNERS }), { lacks: ["-P", "-W", "-x"] }, { lacks: ["--recursive", "--force", "--dir", "--verbose", "--one-file-system", "--no-preserve-root", "---presume-input-tty", "--interactive", "--preserve-root", "--help", "--version"] }), operands: { rest: REMOVED, dash: "file" }, optionsComplete: true, witness: BINARY },
+    { key: "rmdir", grammars: implementations(grammar({ p: { arity: 0, effect: "writes" }, v: { arity: 0, effect: "none" } }, { parents: { arity: 0, effect: "writes" }, ...longSwitches(["verbose", "ignore-fail-on-non-empty"], { effect: "none" }), ...BANNERS }), {}, { lacks: ["--parents", "--verbose", "--ignore-fail-on-non-empty", "--help", "--version"] }), operands: { rest: REMOVED, dash: "file" }, optionsComplete: true, witness: BINARY },
     { key: "tee", grammars: [], operands: { rest: WRITE_THROUGH, dash: "file" }, witness: BINARY },
     { key: "cp", grammars: copyGrammars(true, COPY_DESTINATION), operands: { rest: COPY_SOURCE, last: COPY_DESTINATION, dash: "file" }, witness: BINARY },
     { key: "mv", grammars: copyGrammars(false, MOVE_DESTINATION), operands: { rest: MOVE_SOURCE, last: MOVE_DESTINATION, dash: "file" }, witness: BINARY },
@@ -651,6 +707,7 @@ export const PROGRAM_ROWS = [
     ...[...shellWordsOf("stack_mover")].map((key) => ({ key, grammars: [], movesBase: "stack", witness: BUILTIN_ONLY })),
     ...SHELLS.map((s) => shellRow(s, "c-option", BINARY, [SHELL_GRAMMARS[s]], "script")),
     shellRow("eval", "words", BUILTIN_ONLY), shellRow("source", "file-operand", BUILTIN_ONLY), shellRow(".", "file-operand", BUILTIN_ONLY), shellRow("parallel", "non-option-words", BINARY, [], "script"),
+    shellRow("fc", "history", BUILTIN_ONLY, [grammar({ ...switches("nr"), s: { arity: 0, effect: "executes" }, ...switches("l", { mode: "banner" }), e: val(COMMAND, { executesWhenValue: "-" }) }, {}, { afterFirstOperand: "operands" })]),
     ...codeBodyRows,
     ...[...shellWordsOf("block")].map((k) => block(k, BLOCK_GRAMMARS[k])),
 ];

package/dist/tools/fs/read-deny-home.js

@@ -5,6 +5,7 @@ import { thrownText } from "../../core/thrown-value.js";
 import { agentConfigDirTail } from "../../core/agent-config-dir.js";
 import { validatePath } from "../../core/effective-path-target.js";
 import { readDenyPatternRun, readDenyRowAnchor, readDenyRunHead } from "./read-deny.js";
+import { isAbsence } from "./shell-read-environment.js";
 export const AUXILIARY_HOME_PROBE_MS = 2_000;
 const said = new Set();
 function sayOnce(kind, line) {
@@ -75,7 +76,7 @@ async function homeSpellingsOf(env, home, signal) {
         const canonical = await env.canonicalPath(home, signal);
         if (canonical.ok)
             return { spellings: canonical.value !== home ? [home, canonical.value] : [home], canonical: canonical.value, answered: true };
-        return { spellings: [home], answered: canonical.error.code === "not_found" || canonical.error.code === "not_directory" };
+        return { spellings: [home], answered: isAbsence(canonical.error.code) };
     }
     catch {
         return { spellings: [home], answered: false };
@@ -202,7 +203,7 @@ export async function whereItsAnsweredPrefixLeads(env, at, family = pathFamilyOf
 }
 const NO_CHAIN = { ancestors: [], whole: false, unread: [] };
 const unreadChain = (at) => ({ ancestors: [], whole: false, unread: [at] });
-const identityUnread = (id) => id === undefined || (!id.ok && id.error.code !== "not_found" && id.error.code !== "not_directory" && id.error.code !== "not_supported");
+const identityUnread = (id) => id === undefined || (!id.ok && !isAbsence(id.error.code) && id.error.code !== "not_supported");
 async function chainAbove(env, identity, canonical, signal, deadline) {
     let own;
     const ancestors = [];

package/dist/tools/fs/read-deny.d.ts

@@ -115,7 +115,7 @@ export declare function ruleHeadParts(rows: readonly Pick<PathRuleDenyRow, "head
  * below that part. Every part, not the head alone: a link inside the rule's literal prefix that is re-pointed after the
  * rows were placed still meets the row through the parts above it. One rule for every row form and every judge (the
  * gate's lanes and the deny tables): the reference compiles the same "physical twin" of every deny / ask rule's literal
- * prefix (cli280.js `ei` 9766583, compiled in `mt` 9767083). `leads` is the leg's resolution of each part (absent or
+ * prefix. `leads` is the leg's resolution of each part (absent or
  * `undefined` = no twin there); a part that only extends its parent's resolution adds no row. A twin is the row's own
  * kind (it keeps every member but the head), so a judgment reports the rule the twin stands for.
  */
@@ -416,12 +416,32 @@ export declare function activeReadDenyBuiltinTiers(config?: ReadDenyBuiltinConfi
  * renders "what COULD be switched on".
  */
 export declare const READ_FACE_DEFAULT_DENY_ENTRIES: readonly ReadDenyEntry[];
+/**
+ * The fold the "unicode" mode applies — the one a RegExp `i` flag without `u` applies, one UTF-16 code unit at a time: the
+ * upper-case mapping when it is a single unit and does not step from a non-ASCII unit down into ASCII (`ı` and `ſ` stay
+ * themselves, `ß` stays `ß`). Both sides of a comparison go through it.
+ */
+export declare function ignoreCaseFold(s: string): string;
+/** How a compiled pattern compares: `none` byte for byte; `ascii` and `unicode` through the fold of that name, both sides —
+ *  the pattern's side at compile, the segments' side by whoever tests (once per path: {@link segmentReadingsOf}). */
+export type SegmentFold = "none" | "ascii" | "unicode";
+/** The function that folds a string as each fold folds — the one place that says which function that is (the pattern at compile,
+ *  a path's segments in the readings, an anchor's segments all read it, at the time they fold). */
+export declare const SEGMENT_FOLDS: Record<SegmentFold, (s: string) => string>;
+/** One compiled segment of a pattern: `*` stands for any run of characters but a separator, every other character for itself. */
+export interface SegmentMatcher {
+    /** Does the whole of `segment` match? The segment is folded as the pattern's fold folds ({@link CompiledSegmentPattern.fold}) —
+     *  by the caller; a segment that holds a separator never matches. */
+    test(segment: string): boolean;
+    /** The pattern is stars only: it matches every one segment. */
+    readonly anything: boolean;
+}
 /** A compiled segment-run pattern (shared engine — the write guard delegates here too). */
 export interface CompiledSegmentPattern {
     raw: string;
-    segments: RegExp[];
-    /** Fold BOTH sides through {@link asciiLower} before testing (compile lowered the pattern side). */
-    foldAscii: boolean;
+    segments: SegmentMatcher[];
+    /** Fold BOTH sides before testing: compile folded the pattern side; the segments tested are folded the same way. */
+    fold: SegmentFold;
     /** The segment lists of the directories the run is ANCHORED at (folded as the pattern folds): the run must start
      *  right after one of them. Absent = the run matches anywhere. */
     anchors?: readonly (readonly string[])[];
@@ -437,12 +457,14 @@ export interface CompiledSegmentPattern {
  * Compile one segment-glob pattern (shared engine). `fold`:
  *  · "none"    — byte-exact segments;
  *  · "ascii"   — ASCII-case-insensitive (deny-set contract);
- *  · "unicode" — RegExp `i` flag (the write guard's historical host-keyed behavior — kept for it
- *    byte-identically; NOT used by the deny set).
+ *  · "unicode" — the fold a RegExp `i` flag applies, {@link ignoreCaseFold} (the write guard's historical host-keyed
+ *    behavior — kept for it answer for answer; NOT used by the deny set).
+ * The pattern is folded here, once; the segments a row is tested on are folded by whoever tests, once per path
+ * ({@link segmentReadingsOf}) — never once per row per test.
  * Returns null when the pattern reduces to zero segments — the CALLER owns its loud path (the two
  * consumers refuse with their own surface-specific texts).
  */
-export declare function compileSegmentPattern(raw: string, fold: "none" | "ascii" | "unicode"): CompiledSegmentPattern | null;
+export declare function compileSegmentPattern(raw: string, fold: SegmentFold): CompiledSegmentPattern | null;
 /**
  * Does the path contain a compiled pattern as a CONTIGUOUS run of full path segments? (Shared engine:
  * `.git/hooks` matches `/repo/.git/hooks/pre-commit`; `.ssh` matches any `.ssh` segment.) An ANCHORED pattern