@sema-agent/core 7.54.1 → 7.56.0

package/dist/tools/fs/read-deny.js

@@ -1,6 +1,7 @@
 import { sliceHeadSafe, sliceTailSafe } from "../../core/surrogate-safe-slice.js";
 import { isAbsoluteForFamily, normalizeAbsPathLexically, pathFamilyOf, pathIdentityOf, spellingOfIdentity } from "./safety.js";
 import { PROBE_REASON_MAX } from "../../core/untrusted-text.js";
+import { wildcardMatch } from "../../core/namespaced-rule-name.js";
 import { validatePath } from "../../core/effective-path-target.js";
 import { judgePathRows } from "../../core/path-guard-rows.js";
 export const READ_DENY_HOME_WORD = "~";
@@ -313,17 +314,54 @@ function asciiLower(s) {
     }
     return out;
 }
+let UNIT_FOLD;
+function foldedUnit(c) {
+    if (c < 0x80)
+        return c >= 0x61 && c <= 0x7a ? c - 0x20 : c;
+    const table = (UNIT_FOLD ??= new Int32Array(0x10000).fill(-1));
+    const known = table[c];
+    if (known >= 0)
+        return known;
+    const upper = String.fromCharCode(c).toUpperCase();
+    const folded = upper.length === 1 && upper.charCodeAt(0) >= 0x80 ? upper.charCodeAt(0) : c;
+    table[c] = folded;
+    return folded;
+}
+export function ignoreCaseFold(s) {
+    let out = "";
+    for (let from = 0; from < s.length; from += 4096) {
+        const codes = [];
+        for (let i = from, to = Math.min(from + 4096, s.length); i < to; i++)
+            codes.push(foldedUnit(s.charCodeAt(i)));
+        out += String.fromCharCode(...codes);
+    }
+    return out;
+}
+export const SEGMENT_FOLDS = { none: (s) => s, ascii: asciiLower, unicode: ignoreCaseFold };
+function foldSegments(fold, segs) {
+    return segs.map((s) => SEGMENT_FOLDS[fold](s));
+}
+function foldedViewsOf(views) {
+    const memo = new Map();
+    return (fold) => {
+        let folded = memo.get(fold);
+        if (folded === undefined)
+            memo.set(fold, (folded = fold === "none" ? views : views.map((segs) => foldSegments(fold, segs))));
+        return folded;
+    };
+}
+function segmentMatcher(pattern) {
+    return {
+        anything: /^\*+$/.test(pattern),
+        test: (segment) => !segment.includes("/") && wildcardMatch(pattern, segment),
+    };
+}
 export function compileSegmentPattern(raw, fold) {
-    const source = fold === "ascii" ? asciiLower(raw) : raw;
+    const source = SEGMENT_FOLDS[fold](raw);
     const parts = source.split("/").filter(Boolean);
     if (parts.length === 0)
         return null;
-    const flags = fold === "unicode" ? "i" : "";
-    const segments = parts.map((segment) => {
-        const escaped = segment.replace(/[.+^${}()|[\]\\?]/g, "\\$&").replace(/\*+/g, "[^/]*");
-        return new RegExp(`^${escaped}$`, flags);
-    });
-    return { raw, segments, foldAscii: fold === "ascii" };
+    return { raw, segments: parts.map(segmentMatcher), fold };
 }
 export function matchSegmentPatterns(path, compiled, opts) {
     const readings = segmentReadingsOf(path, opts?.aliasResolved === true);
@@ -339,7 +377,13 @@ function segmentReadingsOf(path, aliasResolved) {
     if (known !== undefined)
         return known;
     const views = segmentViewsOf(path, aliasResolved ? { aliasResolved } : undefined);
-    const readings = { views, lowered: views.map((v) => v.map(asciiLower)), rooted: isAbsoluteForFamily("own", path) };
+    let folded;
+    const readings = {
+        views,
+        lowered: views.map((v) => foldSegments("ascii", v)),
+        folded: () => (folded ??= views.map((v) => foldSegments("unicode", v))),
+        rooted: isAbsoluteForFamily("own", path),
+    };
     if (SEGMENT_READINGS.size >= 512)
         SEGMENT_READINGS.clear();
     SEGMENT_READINGS.set(key, readings);
@@ -347,7 +391,7 @@ function segmentReadingsOf(path, aliasResolved) {
 }
 function segmentRowMeets(pat, readings) {
     const n = pat.segments.length;
-    const views = pat.foldAscii ? readings.lowered : readings.views;
+    const views = pat.fold === "ascii" ? readings.lowered : pat.fold === "unicode" ? readings.folded() : readings.views;
     for (const segs of views) {
         const runAt = (i) => i + n <= segs.length && pat.segments.every((re, j) => re.test(segs[i + j] ?? ""));
         if (pat.anchors !== undefined && readings.rooted) {
@@ -406,16 +450,13 @@ function rowMeetsPath(pat, segs, rooted) {
     }
     return false;
 }
-function isAnySegment(re) {
-    return /^\^(\[\^\/\]\*)+\$$/.test(re.source);
-}
 function rowNamedByRoot(pat, segs, rooted) {
     if (pat.anchors !== undefined)
         return rooted && rowMeetsPath(pat, segs, rooted) ? "named" : "none";
     if (pat.rootedOnly === true)
         return "none";
     let k = 0;
-    while (k < pat.segments.length && isAnySegment(pat.segments[k]))
+    while (k < pat.segments.length && pat.segments[k].anything)
         k++;
     const run = pat.segments.slice(k);
     for (let i = 0; run.length > 0 && i < segs.length; i++) {
@@ -427,11 +468,11 @@ function rowNamedByRoot(pat, segs, rooted) {
 }
 function rowNamedByRootOf(rows, path) {
     const rooted = isAbsoluteForFamily("own", path);
-    const views = segmentViewsOf(path);
+    const foldedViews = foldedViewsOf(segmentViewsOf(path));
     let unplaced;
     for (const pat of rows) {
-        for (const view of views) {
-            const relation = rowNamedByRoot(pat, pat.foldAscii ? view.map(asciiLower) : view, rooted);
+        for (const view of foldedViews(pat.fold)) {
+            const relation = rowNamedByRoot(pat, view, rooted);
             if (relation === "named")
                 return { pattern: pat.raw };
             if (relation === "unplaced")
@@ -442,10 +483,10 @@ function rowNamedByRootOf(rows, path) {
 }
 function rowAtOrBelowOf(rows, path) {
     const rooted = isAbsoluteForFamily("own", path);
-    const views = segmentViewsOf(path);
+    const foldedViews = foldedViewsOf(segmentViewsOf(path));
     for (const pat of rows) {
-        for (const view of views)
-            if (rowMeetsPath(pat, pat.foldAscii ? view.map(asciiLower) : view, rooted))
+        for (const view of foldedViews(pat.fold))
+            if (rowMeetsPath(pat, view, rooted))
                 return pat.raw;
     }
     return null;
@@ -562,7 +603,7 @@ export function compileReadDeny(additions = [], layer = "additions", builtin, ru
             return { ...c, raw: e.pattern };
         if (homeSegments.length === 0)
             return { ...c, raw: e.pattern, unplacedHome: true };
-        return { ...c, raw: e.pattern, anchors: homeSegments.map((segs) => (fold === "ascii" ? segs.map(asciiLower) : segs)) };
+        return { ...c, raw: e.pattern, anchors: homeSegments.map((segs) => foldSegments(fold, segs)) };
     });
     if (!(linked instanceof Map))
         throw new Error(`readDenyHomeLinks: expected a Map from a row's pattern to its locations, got ${typeof linked}.`);
@@ -576,13 +617,13 @@ export function compileReadDeny(additions = [], layer = "additions", builtin, ru
         const rest = c.segments.slice(readDenyRunHead(run));
         for (const location of new Set(checkedReadDenyHomes(locations, "readDenyHomeLinks"))) {
             const segs = homeAnchorSegments(location);
-            linkedPlacements.push({ raw: e.pattern, segments: rest, foldAscii: c.foldAscii, anchors: [c.foldAscii ? segs.map(asciiLower) : segs], rootedOnly: true });
+            linkedPlacements.push({ raw: e.pattern, segments: rest, fold: c.fold, anchors: [foldSegments(c.fold, segs)], rootedOnly: true });
         }
     });
     const judged = linkedPlacements.length === 0 ? compiled : [...compiled, ...linkedPlacements];
     const segmentRows = judged.map((c) => {
         const col = columns.get(c.raw);
-        return segmentGuardRow(c, { faces: ["read"], polarity: "deny", exemptible: false, fold: c.foldAscii ? "ascii" : "exact", origin: col?.origin ?? "addition", ...(col?.tier !== undefined ? { tier: col.tier } : {}) });
+        return segmentGuardRow(c, { faces: ["read"], polarity: "deny", exemptible: false, fold: c.fold === "ascii" ? "ascii" : "exact", origin: col?.origin ?? "addition", ...(col?.tier !== undefined ? { tier: col.tier } : {}) });
     });
     const tableRows = [...segmentRows, ...ruleRows.map(ruleGuardRow)];
     const rgExclusionGlobs = [];

package/dist/tools/fs/removal-targets.d.ts

@@ -1,3 +1,4 @@
+import type { EstablishedRead } from "./shell-read-judge.js";
 import { type EstablishedPlan } from "./shell-read-establish.js";
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { ToolCallRequest } from "../../core/tool-policy.js";
@@ -22,7 +23,7 @@ export interface DangerousRemoval {
 }
 /**
  * The ONE dangerous-removal predicate: is removing this absolute path removing a protected location? The reference
- * implementation's set (cli 2.1.291 `dme` / `xW`) — the filesystem root (a drive root, a UNC share root), a home directory
+ * implementation's set — the filesystem root (a drive root, a UNC share root), a home directory
  * (every spelling the seat holds), a workspace directory or any of its ANCESTORS (the task root, the working directory, an
  * additional working directory — whether the home lies inside the task root or the task root inside the home), a top-level
  * directory (one segment below the root). `undefined` for a relative path or any other target.
@@ -35,8 +36,8 @@ export declare function dangerousRemovalOf(path: string, seat: RemovalSeat): Dan
  *  (`rewritten`), the operands of a removal its argv stream fills in (`stream`), or an operand relative to the directory a
  *  launcher option moved the removal into (`relocated`); or a shell handed text the engine cannot read
  *  (`unverifiable_shell_text`) — a text a program produces (`produced`: what a pipe or a `<(…)` carries, an argv a stream
- *  fills in, a substitution), or a text nobody read (`unread`: one the lexer could not read at all, {@link unreadPlan}, or a
- *  segment whose program the walk could not name, {@link programUnread}). */
+ *  fills in, a substitution), a text nobody read (`unread`: one the lexer could not read at all, {@link unreadPlan}), or a
+ *  segment whose program the walk could not name (`position`, {@link programUnread}). */
 export type RemovalFinding = (DangerousRemoval & {
     readonly guard: "dangerous_delete";
     readonly untrackedFrom?: string;
@@ -49,7 +50,7 @@ export type RemovalFinding = (DangerousRemoval & {
     readonly guard: "unverifiable_shell_text";
     readonly program: string;
     readonly text: string;
-    readonly source: "produced" | "unread";
+    readonly source: "produced" | "unread" | "position";
 };
 /**
  * The names a removal target may be built on and still be verified: a root the SHELL provides, never one a command's
@@ -62,10 +63,12 @@ export type RemovalFinding = (DangerousRemoval & {
 export declare const KNOWN_SAFE_ROOTS: readonly string[];
 /**
  * The removal findings of an established plan — ONE walk, nested plans included (a `bash -c` / `sh -c` text, a substitution
- * body), two words. For every `rm` / `rmdir` segment, each of its OPERANDS (every write target that is not one of its
- * option words: a word some implementation's reading of the program's row writes, {@link writeReadings}) as the plan
- * established it on the WRITE face (the entry the program unlinks, and the deny-floor shadow of a home word the plan did
- * not place) is judged by {@link dangerousRemovalOf}. In a recursive forced removal ({@link recursiveForce}), an operand
+ * body), two words. For every removal segment ({@link removalProgramOf}: an `rm` / `rmdir` the text names, or a program it
+ * does not settle, read as `rm`) whose argv the program does not refuse outright ({@link optionsReceived}), each of its
+ * OPERANDS (every write target that is not one of its option words: a word some implementation's reading of the
+ * program's row writes, {@link writeReadings}) as the plan established it on the WRITE face (the entry the program
+ * unlinks, and the deny-floor shadow of a home word the plan did not place) is judged by {@link dangerousRemovalOf},
+ * save one the program refuses by its own first step ({@link refusedByRemoval}: `.`, `..`). In a recursive forced removal ({@link recursiveForce}), an operand
  * the shell rewrites from a value the plan's table does not settle — a name with no value here or one set in a form the
  * table cannot read, a substitution, a parameter operator, a positional parameter — is an unverifiable target, save a
  * literal path below a known-safe root the shell still provides there ({@link belowKnownSafeRoot}); so are the operands
@@ -80,6 +83,13 @@ export declare const KNOWN_SAFE_ROOTS: readonly string[];
  * own. The read-face copy of an operand is not judged: it follows a link the removal does not follow.
  */
 export declare function removalFindingsOf(established: EstablishedPlan, seat: RemovalSeat, safeRoots?: readonly string[], enclosingRelocated?: boolean): RemovalFinding[];
+/** Does the removal program refuse this operand by its own first step — its last path component is `.` or `..`, trailing
+ *  separators stripped (POSIX `rm` step 1, which GNU, BSD and BusyBox `rm` keep; `rmdir(2)` fails on such a component
+ *  too)? It removes nothing there, wherever the name lands. The name is the one the program RECEIVES: a pattern's match
+ *  (the spelling an expansion carries beside its origin: `.*` hands it `.` and `..` beside the dotfiles, and only those two
+ *  are refused), else the word as the plan spells it; a word the shell rewrites from a value the plan does not settle
+ *  names nothing known, and is never refused here. */
+export declare function refusedByRemoval(read: EstablishedRead): boolean;
 /** Does this plan (nested plans included) run a removal program, hand a shell a script built when it runs, or hold text
  *  nobody could read ({@link unreadPlan}, {@link programUnread})? The guard establishes nothing for a command that does none. */
 export declare function planRunsRemoval(plan: EstablishedPlan["plan"]): boolean;

package/dist/tools/fs/removal-targets.js

@@ -2,11 +2,11 @@ import { planShellReads } from "./shell-read-plan.js";
 import { literalTextOf } from "../../shell/lex.js";
 import { createShellReadEstablisher, establishShellReadsLexically } from "./shell-read-establish.js";
 import { isAbsoluteForFamily, isWinFormPath, normalizeAbsPathLexically } from "./safety.js";
-import { launchedCommands, launchedReadings, reentryText, scriptFileAt, spellLaunched } from "./shell-reentry-text.js";
-import { readProgramPosition } from "./bash-program-position.js";
+import { launchedCommands, launchedReadings, reentryText, runsStoredLine, scriptFileAt, spellLaunched } from "./shell-reentry-text.js";
+import { declinedProgramSentence, readProgramPosition } from "./bash-program-position.js";
 import { bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
 import { programArgs } from "./shell-read-write-targets.js";
-import { implementationsOf, programRow, runsShellText, selectedOptions, writeReadings } from "./program-read-model.js";
+import { declaresOption, implementationsOf, programRow, rowRefusesArgv, runsShellText, selectedOptions, writeReadings } from "./program-read-model.js";
 import { inlineUntrusted } from "../../core/untrusted-text.js";
 export const SHELL_REMOVAL_COMMANDS = Object.freeze(["rm", "rmdir"]);
 const REMOVAL_COMMAND_SET = new Set(SHELL_REMOVAL_COMMANDS);
@@ -68,10 +68,19 @@ function belowKnownSafeRoot(word, safe, segment) {
     const below = rest.map((p) => p.literal).join("");
     return /^\/[^*?[\]]+$/.test(below) && !below.split("/").includes("..");
 }
-function recursiveForce(row, args) {
+function optionsReceived(row, args) {
+    const rewrittenAt = args.findIndex((w) => w.rewritten === true);
+    const asWritten = (rewrittenAt < 0 ? args : args.slice(0, rewrittenAt)).map((w) => w.spelled);
+    const present = args.filter((w) => w.vanishes !== true);
+    const chosenAt = present.findIndex((w) => w.rewritten === true);
+    const shellChooses = chosenAt >= 0 && writeReadings(row, present.slice(0, chosenAt + 1).map((w) => w.spelled)).some((r) => r.written.length === 0);
+    return { refused: rowRefusesArgv(row, asWritten), shellChooses };
+}
+function recursiveForce(row, args, shellChooses) {
     return implementationsOf(row).some((view) => {
         const selected = selectedOptions(view, args, "one-implementation");
-        return selected.some((o) => o.selects === "traversal") && selected.some((o) => o.mode === "forced");
+        const selects = (has) => selected.some(has) || (shellChooses && declaresOption(view, has));
+        return selects((o) => o.selects === "traversal") && selects((o) => o.mode === "forced");
     });
 }
 export function removalFindingsOf(established, seat, safeRoots = KNOWN_SAFE_ROOTS, enclosingRelocated = false) {
@@ -81,23 +90,27 @@ export function removalFindingsOf(established, seat, safeRoots = KNOWN_SAFE_ROOT
     const safe = new Set(safeRoots);
     for (const segment of established.plan.segments) {
         const program = segment.verb?.basename;
-        const row = program !== undefined && REMOVAL_COMMAND_SET.has(program) ? programRow(program) : undefined;
-        if (program !== undefined && row !== undefined) {
-            const args = programArgs(segment);
-            const spelled = args.map((w) => w.spelled);
+        const removal = removalProgramOf(segment);
+        const args = removal === undefined ? [] : programArgs(segment);
+        const spelled = args.map((w) => w.spelled);
+        const received = removal === undefined ? undefined : optionsReceived(removal.row, args);
+        if (removal !== undefined && received?.refused === false) {
+            const { row, named } = removal;
             const removed = new Set(writeReadings(row, spelled).flatMap((r) => r.written.map((w) => w.at)));
             const options = new Set(args.filter((_, at) => !removed.has(at)).map((w) => w.raw));
-            const forced = recursiveForce(row, spelled);
+            const forced = recursiveForce(row, spelled, received.shellChooses);
             if (forced && segment.reentry === "argv")
-                out.push({ guard: "unverifiable_delete", program, operand: segment.text.trim(), source: "stream" });
+                out.push({ guard: "unverifiable_delete", program: removal.program, operand: segment.text.trim(), source: "stream" });
             const relocated = enclosingRelocated || readProgramPosition(segment.argv).launcherMovesBase;
             for (const read of established.reads.get(segment) ?? []) {
-                if (read.candidate.face !== "write" || options.has(read.candidate.raw))
+                if ((named && read.candidate.face !== "write") || read.candidate.provenance === "program_path" || options.has(read.candidate.raw))
+                    continue;
+                if (refusedByRemoval(read))
                     continue;
                 const kind = removalKindOf(read, seat);
                 if (kind !== undefined) {
                     const untracked = read.candidate.bases === "unmodelled" ? established.plan.segments.find((s) => s.bases === "unmodelled")?.text.trim() : undefined;
-                    out.push({ guard: "dangerous_delete", kind, program, operand: read.candidate.raw, target: read.target ?? read.candidate.floorSpelled ?? read.candidate.spelled, ...(untracked !== undefined ? { untrackedFrom: untracked } : {}) });
+                    out.push({ guard: "dangerous_delete", kind, program: removal.program, operand: read.candidate.raw, target: read.target ?? read.candidate.floorSpelled ?? read.candidate.spelled, ...(untracked !== undefined ? { untrackedFrom: untracked } : {}) });
                     continue;
                 }
                 if (!forced || read.established !== "unestablishable" || (read.candidate.expands !== "unresolvable" && !relocated))
@@ -105,14 +118,14 @@ export function removalFindingsOf(established, seat, safeRoots = KNOWN_SAFE_ROOT
                 const word = segment.argv.find((w) => w.raw === read.candidate.raw);
                 if (word !== undefined && belowKnownSafeRoot(word, safe, segment))
                     continue;
-                out.push({ guard: "unverifiable_delete", program, operand: read.candidate.raw, source: read.candidate.expands === "unresolvable" ? "rewritten" : "relocated" });
+                out.push({ guard: "unverifiable_delete", program: removal.program, operand: read.candidate.raw, source: read.candidate.expands === "unresolvable" ? "rewritten" : "relocated" });
             }
         }
         const script = runtimeScriptOf(segment);
         if (script !== undefined && program !== undefined)
             out.push({ guard: "unverifiable_shell_text", program, text: script, source: "produced" });
         if (programUnread(segment))
-            out.push({ guard: "unverifiable_shell_text", program: segment.launcherChain[0] ?? segment.text.trim(), text: segment.text.trim(), source: "unread" });
+            out.push({ guard: "unverifiable_shell_text", program: segment.launcherChain[0] ?? segment.text.trim(), text: segment.text.trim(), source: "position" });
         const handedRelocated = enclosingRelocated || readProgramPosition(segment.argv).launcherMovesBase;
         for (const nested of segment.nested) {
             if (unreadPlan(nested)) {
@@ -143,7 +156,7 @@ function runtimeScriptOf(segment) {
         const source = file === undefined ? undefined : argv[file];
         if (source !== undefined && source.pieces.length === 1 && source.pieces[0].expansion?.kind === "process")
             return source.raw;
-        if (pos.argvFromStdin)
+        if (pos.argvFromStdin || runsStoredLine(program.basename, argv.map((w) => w.folded)))
             return segment.text.trim();
     }
     const named = pos.program !== undefined && pos.refusal === undefined ? [{ shell: program.basename, words: segment.argv.slice(pos.program.index + 1).map((_, k) => spell(pos.program.index + 1 + k)) }] : [];
@@ -157,8 +170,21 @@ function runtimeScriptOf(segment) {
 }
 const unreadPlan = (plan) => plan.unreadable !== undefined && plan.segments.length === 0;
 const programUnread = (s) => s.declines.includes("unreadable_program_position");
+const programNameUnsettled = (s) => s.verb !== undefined && s.reads.some((c) => c.provenance === "program_path" && c.expands === "unresolvable");
+const RM_REMOVAL_ROW = programRow("rm");
+function removalProgramOf(s) {
+    const basename = s.verb?.basename;
+    const row = basename !== undefined && REMOVAL_COMMAND_SET.has(basename) ? programRow(basename) : undefined;
+    if (row !== undefined)
+        return { program: basename, row, named: true };
+    return programNameUnsettled(s) && RM_REMOVAL_ROW !== undefined ? { program: s.verb.name, row: RM_REMOVAL_ROW, named: false } : undefined;
+}
+export function refusedByRemoval(read) {
+    const name = read.established === "expansion" ? read.spellings.find((s) => s !== read.origin) : read.candidate.expands === "unresolvable" ? undefined : read.candidate.spelled;
+    return name !== undefined && /(?:^|\/)\.\.?\/*$/.test(name);
+}
 export function planRunsRemoval(plan) {
-    return unreadPlan(plan) || plan.segments.some((s) => (s.verb !== undefined && REMOVAL_COMMAND_SET.has(s.verb.basename)) || runtimeScriptOf(s) !== undefined || programUnread(s) || s.nested.some(planRunsRemoval));
+    return unreadPlan(plan) || plan.segments.some((s) => removalProgramOf(s) !== undefined || runtimeScriptOf(s) !== undefined || programUnread(s) || s.nested.some(planRunsRemoval));
 }
 const DANGEROUS_REMOVAL_SENTENCE = {
     filesystem_root: (p, t) => `\`${p}\` would remove the filesystem root (${t})`,
@@ -172,8 +198,9 @@ const UNVERIFIABLE_REMOVAL_SENTENCE = {
     relocated: (p, o) => `\`${p}\` recursive+force target ${o} is relative to a directory a launcher option moved the program into, which this command does not settle — the deleted path cannot be verified from this command`,
 };
 const UNREADABLE_TEXT_SENTENCE = {
-    produced: (p, t) => `\`${p}\` runs shell text that is built only when the command runs (${t}) — the text this shell will run cannot be read by the engine, so whether it removes anything is unknown`,
-    unread: (p, t) => `\`${p}\` runs shell text this guard cannot read (${t}) — the text this shell will run cannot be read by the engine, so whether it removes anything is unknown`,
+    produced: (p, t) => `\`${p}\` runs shell text that is built only when the command runs (${inlineUntrusted(t, 200)}) — the text this shell will run cannot be read by the engine, so whether it removes anything is unknown; write the text into the command itself (a \`-c\` string, a here-document or a here-string) and the engine reads it as it reads any command`,
+    unread: (p, t) => `\`${p}\` runs shell text this guard cannot read (${inlineUntrusted(t, 200)}) — the text this shell will run cannot be read by the engine, so whether it removes anything is unknown`,
+    position: (_p, t) => inlineUntrusted(declinedProgramSentence(t), 400),
 };
 function verdictOf(findings) {
     for (const f of findings) {
@@ -187,7 +214,7 @@ function verdictOf(findings) {
             return { guard: f.guard, text: UNVERIFIABLE_REMOVAL_SENTENCE[f.source](f.program, inlineUntrusted(f.operand, 200)) };
     for (const f of findings)
         if (f.guard === "unverifiable_shell_text")
-            return { guard: f.guard, text: UNREADABLE_TEXT_SENTENCE[f.source](f.program, inlineUntrusted(f.text, 200)) };
+            return { guard: f.guard, text: UNREADABLE_TEXT_SENTENCE[f.source](f.program, f.text) };
     return undefined;
 }
 const REMOVAL_RESOLVE_TIMEOUT_MS = 10_000;

package/dist/tools/fs/safety.d.ts

@@ -57,7 +57,7 @@ export interface ReadEntry {
      *  attachment picks the most RECENTLY read files, the way CC sorts readFileState by timestamp.
      *  Optional/additive: undefined (an entry seeded from an older checkpoint) sorts last, never breaks. */
     lastReadAt?: number;
-    /** CC 2.1.204 parity: TRUE when the Runner pre-seeded this entry because the file's FULL
+    /** TRUE when the Runner pre-seeded this entry because the file's FULL
      *  disk-verbatim text was injected into the model's context at startup
      *  (ProjectMemoryLoad.seededFiles — CC's own memory preload). A DEFAULT whole-file Read of an
      *  UNCHANGED seeded file
@@ -84,7 +84,7 @@ export declare function sha256(content: string): string;
 export interface FsViolation {
     code: "path_not_in_root" | "not_read" | "stale" | "ambiguous_edit" | "invalid" | "read_path_denied" | "write_path_denied";
     /** Set on the `not_read` violation raised by an AUTO-TRUNCATED read
-     *  ({@link ReadEntry.isPartialView}) rather than by a never-read file. Both carry the same CC-verbatim
+     *  ({@link ReadEntry.isPartialView}) rather than by a never-read file. Both carry the same
      *  message; only this one needs {@link PARTIAL_VIEW_READ_ESCAPE_HINT} appended, because for it a plain
      *  re-read is a fixpoint. */
     partialView?: true;
@@ -238,7 +238,7 @@ export declare function binaryMagicFormat(bytes: Uint8Array): string | undefined
  */
 export declare function isBinaryContent(sample: string): boolean;
 /**
- * CC's own UNC/network-path predicate, verbatim (`n.startsWith("\\\\") || n.startsWith("//")`). Pure.
+ * The UNC/network-path predicate (`n.startsWith("\\\\") || n.startsWith("//")`). Pure.
  *
  * In CC this test is an EARLY ALLOW — it skips the binary-extension and device checks that follow it —
  * and CC applies it to the NORMALIZED path, not the raw argument. See {@link canonicalizeTarget} for
@@ -572,7 +572,7 @@ export declare function rootAdmittingArtifactStore(storePhysical: string, rootsC
  */
 export declare const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories \u2014 or additionalReadDirectories for read-only access; a deployment that wants reads or writes open everywhere can declare readFace / writeFace: \"open\" instead of listing directories.)";
 /** inv 1 (read-before-edit): a file must have been read this task before it can be edited/overwritten.
- *  Message is CC 2.1.198 live-verbatim (all-tools-live-probe 2026-07-08 §2.1/§3.1/§5.1 — one message for
+ *  Message as probed (all-tools-live-probe 2026-07-08 §2.1/§3.1/§5.1 — one message for
  *  Edit/Write/NotebookEdit: "before writing to it", not the old sema "before editing").
  *
  * CC parity (Edit and Write spell the read gate identically, `!p || p.isPartialView`): an
@@ -594,7 +594,7 @@ export declare function requireRead(state: ReadFileState, key: string): FsViolat
  * Escape-hatch parenthetical appended to the read-before-edit refusal when the target file is over
  * the Read tool's whole-file byte cap: a bare "read it first" would be un-followable there (a default
  * whole-file Read refuses such files → refusal loop). Same parenthetical pattern as the Write tool's
- * encoding-deadlock hint; the CC-verbatim sentence stays untouched for the normal-size case.
+ * encoding-deadlock hint; the base sentence stays untouched for the normal-size case.
  */
 export declare const OVERSIZE_READ_ESCAPE_HINT = "(This file is over the Read tool's whole-file byte cap, so a default Read is refused \u2014 read it in slices with explicit offset/limit to satisfy the read-first rule, or inspect/transform it with bash (e.g. `sed -n`, `grep`) instead.)";
 /**
@@ -623,7 +623,7 @@ export declare const READ_REFUSED_ESCAPE_HINT = "(If the Read tool refuses this
 /**
  * Edit "no-op" guard (CC FileEditTool parity): refuse an edit whose `old_string`
  * equals `new_string` — without it the edit passes the match check and writes the file back unchanged (a
- * silent no-op that wastes a turn and dirties mtime). Verbatim CC message so a CC-trained model recognizes it.
+ * silent no-op that wastes a turn and dirties mtime). The message is worded so a CC-trained model recognizes it.
  */
 export declare function checkNoChange(oldString: string, newString: string): FsViolation | undefined;
 /** inv 2 (staleness): the file's current content hash must match what was recorded at read time.
@@ -667,7 +667,7 @@ export declare function resolveQuoteMatch(content: string, oldString: string): s
  */
 export declare function resolveEscapeMatch(content: string, oldString: string): string | undefined;
 /**
- * CC `YZu` verbatim: rewrite `newString` into the SAME spelling the matched
+ * Rewrite `newString` into the SAME spelling the matched
  * span uses. Without this, a match found through {@link resolveEscapeMatch} would replace an escaped
  * span with a literal-character replacement (or vice versa) and silently change the file's encoding
  * convention at that spot. Hex case follows what the file itself used, per-character where known and by
@@ -677,7 +677,7 @@ export declare function adaptNewStringEscapes(oldString: string, matchedOld: str
 /** CC `KZu` (@366558): the old_string shapes for which the escape layers above were even attempted —
  *  gates the explanatory note appended to a no-match refusal so it is never a false claim. */
 export declare function escapeMatchWasAttempted(oldString: string): boolean;
-/** CC `KZu`'s note, verbatim. */
+/** The escape-match miss note. */
 export declare const ESCAPE_MATCH_MISS_NOTE = "\n(note: Edit also tried swapping \\uXXXX escapes and their characters; neither form matched, so the mismatch is likely elsewhere in old_string. Re-read the file and copy the exact surrounding text.)";
 /**
  * When the quote-forgiving match resolved to a curly-quoted file span, convert the straight quotes in
@@ -697,7 +697,7 @@ export declare function deletionOldString(content: string, oldString: string, ne
 /**
  * inv 3 (edit uniqueness): `oldString` must match exactly once unless `replaceAll`. Zero → not found;
  * >1 without replaceAll → ambiguous. `truncated` adds a hint that unseen content may hold more matches (S2).
- * Messages are CC 2.1.198 live-verbatim (all-tools-live-probe 2026-07-08 §2.1): first sentence(s) byte-exact,
+ * Messages as probed (all-tools-live-probe 2026-07-08 §2.1): first sentence(s) byte-exact,
  * then a `String: <needle>` echo line (CC form). The sema truncated-read hint survives as a parenthetical
  * appended to the sentence (probe verdict: "truncated 提示可并入括注保留").
  */

package/dist/tools/fs/search.d.ts

@@ -1,5 +1,6 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { type HomeViewsCarrier } from "./read-deny-home.js";
+import { type FsGlob } from "./fs-glob.js";
 /** The JS scanner's own output ceiling, in bytes of emitted content rows. Pinned to the
  *  ripgrep leg's figure ({@link MAX_EXEC_OUTPUT_BYTES}, the exec pipe's rolling-tail bound) so the two
  *  legs cannot disagree about how much one search may return; see the collection site in {@link jsGrep}
@@ -11,7 +12,7 @@ export declare const JS_GREP_OUTPUT_MAX_BYTES: number;
  *  "any dot-prefixed name is invisible" rule beside it. */
 export declare const DEFAULT_IGNORE_DIRS: ReadonlySet<string>;
 export interface GrepParams {
-    /** Regular expression (ripgrep semantics) — CC 2.1.209 parity: the pattern is ALWAYS a regex; the
+    /** Regular expression (ripgrep semantics) — the pattern is ALWAYS a regex; the
      *  old `regex?: boolean` literal-by-default switch is retired (a legacy `regex` argument sent by an
      *  old caller is tolerated and ignored at the tool layer, never a failure). */
     pattern: string;
@@ -24,7 +25,7 @@ export interface GrepParams {
      *  line (rg -o / --only-matching). content mode only; ignored otherwise (CC parity). With
      *  `multiline` the JS fallback emits the matched SEGMENT's lines (rg -U -o shape). */
     only_matching?: boolean;
-    /** content: `path:line:text`. files_with_matches (default, CC 2.1.209): `path`. count: `path:count`. */
+    /** content: `path:line:text`. files_with_matches (default): `path`. count: `path:count`. */
     output_mode?: "content" | "files_with_matches" | "count";
     /** Lines of context around a match (content mode only) — CC's `-C`. */
     context?: number;
@@ -44,10 +45,10 @@ export interface GrepParams {
     /** Skip the first N output lines — CC's `offset` (pagination partner of head_limit). */
     offset?: number;
 }
-/** CC 2.1.198 Grep parity: split the `glob` param into individual glob
+/** Split the `glob` param into individual glob
  *  tokens — whitespace-separated first; a token WITHOUT braces is further split on commas
  *  (`"*.ts,*.tsx"` → two globs), while a brace token (`*.{ts,tsx}`) is kept whole (its commas are
- *  alternation syntax, not separators). CC-verbatim splitting rules. */
+ *  alternation syntax, not separators). */
 export declare function splitGlobParam(glob: string): string[];
 /**
  * POSIX-safe single-quote so an arbitrary model-supplied string can't break out of the shell command that
@@ -56,6 +57,15 @@ export declare function splitGlobParam(glob: string): string[];
  * Exported for direct injection testing.
  */
 export declare function shellQuote(s: string): string;
+/** Out-parameter for {@link compileGlobToken}: set to `true` when a glob-syntax construct
+ *  could NOT be compiled and silently fell back to matching the metacharacter LITERALLY. Only the
+ *  glob-syntax lane (`glob = true`) can set it; the gitignore lane has no such syntax to fail at. */
+export interface GlobCompileReport {
+    degraded: boolean;
+}
+/** Compile a gitignore/glob token to a matcher tested against a relative posix path. The matcher is the engine in
+ *  `fs-glob.ts`: its cost is bounded by the token's length times the path's, whatever the arrangement of the stars. */
+export declare function compileGlobToken(token: string, anchored: boolean, glob?: boolean, report?: GlobCompileReport): FsGlob;
 /**
  * The tokens of a `glob` argument that this engine CANNOT compile as glob syntax, i.e. the ones whose
  * metacharacter would silently degrade to a literal match.
@@ -111,7 +121,7 @@ export interface WalkResult {
     skippedUnreadable: number;
     /** The walk was cut short by an abort — the result is a prefix, not a survey. */
     aborted: boolean;
-    /** CC 2.1.209 Glob parity: modification time (ms epoch) per walked path (files AND
+    /** Modification time (ms epoch) per walked path (files AND
      *  name-only entries), captured from the listing that discovered them — so glob can sort by mtime
      *  without a second stat pass. An env whose listings carry no numeric `mtimeMs` simply leaves
      *  entries out of this map (consumers fall back to name order). */
@@ -317,7 +327,7 @@ export declare function runGlob(env: ExecutionEnv, root: string, pattern: string
  *  shell renders (`filenames`/`numFiles`/`truncated`/`durationMs`/`totalMatches`/`countIsComplete`)
  *  without re-parsing the text.
  *
- *  CC207 backlog P2-2 (CC 2.1.206:397761-398004 = 2.1.207:342454-342633, node-sliced verbatim):
+ *  Backlog P2-2:
  *   · `totalMatches` — "Total number of matching files before truncation. A lower bound when
  *     countIsComplete is false." (CC: `totalMatches: g.length`)
  *   · `countIsComplete` — "Whether totalMatches is the exact total (true) or a floor because the