@sema-agent/core 7.55.0 → 7.56.0

package/dist/tools/fs/shell-read-plan.js

@@ -1,14 +1,14 @@
 import { expansionsInHeredocBody, lexShell, PARSE_FAILURE_SENTENCE, substitutionsInHeredocBody, literalTextOf, literalTildeSpelling, parameterRereadsValue, UNRESOLVED_SENTENCE, } from "../../shell/lex.js";
 import { programTextOf, readOfText, readsOf, rewritten, segmentReadingsOf, settledFieldsOf, spelledWithHome, unreadableSentenceOf } from "./shell-read-word.js";
 import { assignmentArithmetic, bare, listedVerbCandidates, pathSubcommandOf, programTextSentence, pushAssignment, roleReads, subscriptOnly, unlistedWords } from "./shell-read-argv.js";
-import { ARITHMETIC_TEST_OPERATORS, BindingThread, arithmeticSubstitutions, isArithmeticCommand, bindingEffectOf, joinRebound, loopListHeadAt, namesBoundIn, parameterBodySubstitutions, projectSegment, valueOf, } from "./shell-read-bindings.js";
+import { ARITHMETIC_TEST_OPERATORS, BindingThread, arithmeticSubstitutions, inheritedFunctionsOf, inheritedExportedFunctions, isArithmeticCommand, bindingEffectOf, joinRebound, loopListHeadAt, namesBoundIn, parameterBodySubstitutions, projectSegment, valueOf, } from "./shell-read-bindings.js";
 import { commandEnvironmentNames, isShellSyntaxWord, programBasename, programPositionRunsShell, readProgramPosition, shellScanDeclineOf, } from "./bash-program-position.js";
 import { WorkdirThread, baseShiftOf, textCalls, textMayMove, textMovesOf, textSetsPhysical, withCommandEnvironment } from "./shell-read-workdir.js";
 import { POLL_LOOP_MAX_BEATS, attachedOptionPayloads, resolveOperandLexically, isPathShapedToken, programTextSlotFiles, } from "./bash-readonly-classifier.js";
 import { BLOCK_WORD_NAMES, commandLineOf, commandLineOptionSpellings, declaredAttributes, isDeclarationBuiltin, isInertBuiltin, launcherOptionPathRole, launcherOptionStep, readOptionRole, programLanguageOf, programTextOpensOf, selectedOptions, movesBaseByStack, opensNoOperand, programDelivery, programRow, readArgRoles, runsShellText, } from "./program-read-model.js";
 import { shellWordsOf } from "../../shell/shell-words.js";
 import { isAbsoluteForFamily } from "./safety.js";
-import { codeBodies, launchedInput, reentryText, scriptFileAt, stdinTextsOf } from "./shell-reentry-text.js";
+import { codeBodies, launchedInput, reentersShell, reentryText, scriptFileAt, stdinTextsOf } from "./shell-reentry-text.js";
 import { heldAt, plannedOnce, rebasePlan, startedAt, stdinFeeds } from "./shell-read-start.js";
 import { markStandardDevices } from "./shell-read-device.js";
 export const READ_CANDIDATE_PROVENANCES = Object.freeze([
@@ -40,6 +40,7 @@ function planText(command, decl, depth, start, from) {
         return { plan: { segments: [], unreadable: PARSE_FAILURE_SENTENCE[lexed.parseFailure.reason], shape }, end: "unmodelled", physical: false };
     const unreadable = unreadableSentenceOf(lexed, command);
     const projected = lexed.segments.map((segment) => projectSegment(segment));
+    const exportedFunctions = inheritedFunctionsOf(projected, start?.exportedFunctions), exportedNames = new Set(exportedFunctions.keys());
     const named = projected.map((p, si) => bindingEffectOf(lexed.segments[si], p.argv, p, () => "unknown"));
     const boundHere = (name) => named.some((e) => e.all === "unknown" || e.bindings.some((b) => b.name === name));
     const boundAnywhere = (name) => boundHere(name) || start?.boundAnywhere(name) === true;
@@ -63,14 +64,15 @@ function planText(command, decl, depth, start, from) {
     }
     const names = new BindingThread(lexed.segments, named, initial, boundAnywhere, loopEndOf, start?.homeTouched === true, start?.inherited, start?.names);
     const laterStart = { initial: (name) => declared(name, boundAnywhere(name)), boundAnywhere, homeTouched: boundAnywhere("HOME"), inherited: names.inheritedAt() };
-    const nestedPlanner = (table, si) => (text, kind, at) => planShellReads(text, decl, depth + 1, kind === "substitution" ? { initial: (name) => table.stateOf(name), boundAnywhere, homeTouched: table.homeTouched, inherited: table.inherited, thread: heldThread(moves.functions), names: heldAt(table) } : startedAt(kind === "now" ? { ...laterStart, inherited: { ...laterStart.inherited, rebound: joinRebound(table.inherited.rebound, commandEnvironmentNames(projected[si].argv)) }, ...(readProgramPosition(projected[si].argv).program?.basename === "eval" ? { thread: heldThread(moves.unread), names: heldAt(table, names.functionBound()) } : {}) } : { ...laterStart, thread: heldThread(moves.functions, workdir.mayBePhysical || moves.physicalAt.some(Boolean)), names: names.heldAnywhere() }, at));
+    const nestedPlanner = (table, si) => (text, kind, at) => planShellReads(text, decl, depth + 1, kind === "substitution" ? { initial: (name) => table.stateOf(name), boundAnywhere, homeTouched: table.homeTouched, inherited: table.inherited, thread: heldThread(moves.functions), names: heldAt(table), ...(exportedFunctions.size > 0 ? { exportedFunctions } : {}) } : startedAt(kind === "now" ? { ...laterStart, inherited: { ...laterStart.inherited, rebound: joinRebound(table.inherited.rebound, commandEnvironmentNames(projected[si].argv)) }, ...(exportedFunctions.size > 0 ? { exportedFunctions } : {}), ...(readProgramPosition(projected[si].argv).program?.basename === "eval" ? { thread: heldThread(moves.unread), names: heldAt(table, names.functionBound()) } : exportedFunctions.size > 0 ? { thread: { physical: false, functions: exportedNames, unread: exportedNames }, names: inheritedExportedFunctions(exportedFunctions) } : {}) } : { ...laterStart, thread: heldThread(moves.functions, workdir.mayBePhysical || moves.physicalAt.some(Boolean)), names: names.heldAnywhere(), ...(exportedFunctions.size > 0 ? { exportedFunctions } : {}) }, at));
     const empty = lexed.segments.map((segment, si) => segmentIsEmpty(segment, projected[si]));
     const facts = projected.map(() => undefined);
     const tables = projected.map(() => undefined);
     const fedAt = stdinFeeds(lexed.segments, start?.stdin ?? [], (si) => [{ from: `${lexed.segments[si - 1].text.trim()} |` }]);
+    const inheritedFns = new Set([...(start?.exportedFunctions ?? [])].flatMap(([name, body]) => (body === "unread" ? [name] : [])));
     const factsAt = (si, table) => {
         tables[si] ??= table;
-        return (facts[si] ??= segmentFacts(lexed.segments[si], projected[si], decl, table, nestedPlanner(table, si), fedAt(si)));
+        return (facts[si] ??= segmentFacts(lexed.segments[si], projected[si], decl, table, nestedPlanner(table, si), fedAt(si), inheritedFns));
     };
     const basesOf = projected.map(() => new Set());
     const unmodelled = projected.map(() => false);
@@ -254,13 +256,13 @@ function segmentOpensNothing(f) {
     const inertProgram = program === undefined || (program.name === program.basename && isInertBuiltin(program.basename) && !(isDeclarationBuiltin(program.basename) && f.argv.slice(at + 1).some((w) => /^[-+]/.test(w.folded))));
     return inertProgram && f.argv.every((w) => !/[[\]$`]/.test(w.raw)) && f.nested.length === 0 && f.reentry === undefined && f.declines.length === 0 && f.launcherChain.length === 0 && f.redirects.every((r) => r.direction !== "in") && f.reads.every((c) => c.provenance === "env_assignment");
 }
-function segmentFacts(segment, p, decl, table, nestedPlan, fed) {
+function segmentFacts(segment, p, decl, table, nestedPlan, fed, inheritedFns = new Set()) {
     const targets = p.redirects.flatMap((r) => (r.target === undefined ? [] : [r.target]));
     const readings = segmentReadingsOf(p.argv, targets, table, decl.homeDir);
     if (readings.length === 1)
-        return readingFacts(segment, { ...p, argv: readings[0].argv }, decl, readings[0], nestedPlan, fed);
+        return readingFacts(segment, { ...p, argv: readings[0].argv }, decl, readings[0], nestedPlan, fed, inheritedFns);
     const once = plannedOnce(nestedPlan);
-    return readInSeveral(readings.map((reading) => readingFacts(segment, { ...p, argv: reading.argv }, decl, reading, once, fed)));
+    return readInSeveral(readings.map((reading) => readingFacts(segment, { ...p, argv: reading.argv }, decl, reading, once, fed, inheritedFns)));
 }
 function readInSeveral(each) {
     const first = each[0];
@@ -273,10 +275,10 @@ function readInSeveral(each) {
         readings: each.flatMap((f) => f.readings ?? [f]),
     };
 }
-function readingFacts(segment, p, decl, reading, nestedPlan, fed) {
+function readingFacts(segment, p, decl, reading, nestedPlan, fed, inheritedFns = new Set()) {
     const table = reading.table;
     const planner = (text, kind, at) => nestedPlan(text, kind, kind !== "substitution" ? { ...at, floors: reading.floors } : at);
-    const facts = segmentFactsRead(segment, p, decl, table, planner, fed, reading.reads);
+    const facts = segmentFactsRead(segment, p, decl, table, planner, fed, reading.reads, inheritedFns);
     const unresolvedRaw = new Set();
     for (const t of segment.tokens) {
         const w = t.kind === "word" ? t : t.kind === "redirect" ? t.target : undefined;
@@ -306,7 +308,7 @@ function readingFacts(segment, p, decl, reading, nestedPlan, fed) {
         ...(shift?.kind === "cd" && typeof shift.target !== "string" ? { shift: { ...shift, target: unsettle(shift.target) } } : {}),
     };
 }
-function segmentFactsRead(segment, p, decl, table, nestedPlan, fed, toks) {
+function segmentFactsRead(segment, p, decl, table, nestedPlan, fed, toks, inheritedFns = new Set()) {
     const nested = [];
     const elsewhere = new Set();
     const ctx = { table, reentered: [], programTextSeen: false };
@@ -378,10 +380,10 @@ function segmentFactsRead(segment, p, decl, table, nestedPlan, fed, toks) {
         const once = plannedOnce(nestedPlan);
         const tail = (from) => ({ ...p, argv: p.argv.slice(coproc + from) });
         const background = (f) => ({ ...f, backgrounds: true, ...(f.readings !== undefined ? { readings: f.readings.map((g) => ({ ...g, backgrounds: true })) } : {}) });
-        const first = segmentFacts(segment, tail(1), decl, table, once, fed);
+        const first = segmentFacts(segment, tail(1), decl, table, once, fed, inheritedFns);
         if (toks.length < coproc + 3 || isShellSyntaxWord(p.argv[coproc + 1], RESERVED) || readProgramPosition(tail(2).argv.slice(0, 1)).refusal !== undefined)
             return background(first);
-        return background(readInSeveral([first, segmentFacts(segment, tail(2), decl, table, once, fed)]));
+        return background(readInSeveral([first, segmentFacts(segment, tail(2), decl, table, once, fed, inheritedFns)]));
     }
     const loop = loopShapeOf(p);
     if (loopListHeadAt(p.argv) !== undefined)
@@ -407,6 +409,8 @@ function segmentFactsRead(segment, p, decl, table, nestedPlan, fed, toks) {
         declines.push(decline);
     const program = pos.program;
     const basename = program?.basename;
+    if (program?.name === basename && basename !== undefined && inheritedFns.has(basename) && !p.defines.includes(basename))
+        unread("runs a function this shell inherited from its environment, whose body is text the engine did not read");
     const listed = basename !== undefined && (decl.readers.has(basename) || basename === "cd");
     const verb = program === undefined ? undefined : { name: program.name, basename: program.basename, listed };
     for (const k of pos.assignments) {
@@ -511,7 +515,7 @@ function segmentFactsRead(segment, p, decl, table, nestedPlan, fed, toks) {
         return done({ empty: false, launcherChain, verb, reentry: "shell", declines, reads, moveProvable: false, ...(loopHead !== undefined ? { loopHead } : {}), ...(stdin.length > 0 ? { stdin } : {}), ...(shift !== undefined ? { shift } : {}) });
     };
     if (pos.refusal !== undefined) {
-        const owner = programRow(programBasename(pos.refusal.owner));
+        const owner = "owner" in pos.refusal ? programRow(programBasename(pos.refusal.owner)) : undefined;
         if (pos.refusal.kind === "option_at_program_position" && owner !== undefined && commandLineOptionSpellings(owner).length > 0) {
             const text = commandStringValue(owner, toks, pos.refusal.option);
             if (text !== undefined) {
@@ -533,7 +537,11 @@ function segmentFactsRead(segment, p, decl, table, nestedPlan, fed, toks) {
                 return done({ empty: false, launcherChain, reentry: "shell", declines, reads, moveProvable: false, ...(loopHead !== undefined ? { loopHead } : {}) });
             return reenterShell({ name: argvs[0].shell, basename: argvs[0].shell, listed: decl.readers.has(argvs[0].shell) }, argvs);
         }
-        const from = pos.launchers[0]?.index ?? written;
+        const from = pos.refusal.kind === "wildcard_program_word" ? pos.refusal.at + 1 : pos.launchers[0]?.index ?? written;
+        if (pos.refusal.kind === "wildcard_program_word") {
+            const c = bare(toks[pos.refusal.at], "program_path");
+            reads.push(c.expands === "unresolvable" ? c : { ...c, denyOnly: true });
+        }
         unlistedWords(reads, toks, from, launcherIndices, "unlisted_word", ctx);
         return done({ empty: false, launcherChain, ...(verb !== undefined ? { verb } : {}), ...(reentry !== undefined ? { reentry } : {}), declines, reads, moveProvable: false, ...(loopHead !== undefined ? { loopHead } : {}) });
     }
@@ -554,7 +562,7 @@ function segmentFactsRead(segment, p, decl, table, nestedPlan, fed, toks) {
         shift = argReads.every((r) => literalTextOf(r.word.pieces) !== undefined) && reentryText("eval", texts) !== undefined ? { kind: "eval", text: reentryText("eval", texts) } : { kind: "lost" };
     if (basename === "source" || basename === ".")
         shift = { kind: "lost" };
-    if (runsShellText(basename))
+    if (reentersShell(basename, args))
         return reenterShell(verb, [{ shell: basename, texts, args, words: argReads }]);
     const row = programRow(basename);
     const delivery = programDelivery(row, args);
@@ -610,7 +618,7 @@ function segmentFactsRead(segment, p, decl, table, nestedPlan, fed, toks) {
     const effectSub = pathSubcommandOf(row, args);
     const effectRow = effectSub?.row ?? row;
     const effectArgs = effectSub === undefined ? args : args.slice(effectSub.at + 1);
-    if (effectRow !== undefined && selectedOptions(effectRow, effectArgs).some((o) => o.effect === "executes"))
+    if (effectRow !== undefined && !runsShellText(basename) && selectedOptions(effectRow, effectArgs).some((o) => o.effect === "executes"))
         reentry = "shell";
     let unreadProgramText;
     const slot = row === undefined ? undefined : programTextSlotFiles(row, args);

package/dist/tools/fs/shell-read-start.d.ts

@@ -5,7 +5,7 @@
  * the segment it sits in ({@link rebasePlan}), unless it starts in a working directory of its own.
  */
 import type { LexedSegment } from "../../shell/lex.js";
-import type { BindingTable, FloorValue, InheritedFunctions, NameReader } from "./shell-read-bindings.js";
+import type { BindingTable, FloorValue, InheritedBody, InheritedFunctions, NameReader } from "./shell-read-bindings.js";
 import type { TargetUser } from "./program-read-model.js";
 import type { StdinText } from "./shell-reentry-text.js";
 import type { ReadCandidate, ShellReadPlan } from "./shell-read-plan.js";
@@ -31,6 +31,11 @@ export interface PlanStart {
     readonly names?: InheritedFunctions;
     /** What arrives on its own standard input (the input of the shell running it). */
     readonly stdin?: readonly StdinText[];
+    /** The functions the shell running this text inherited (`export -f`, an environment's `BASH_FUNC_*`), each with whether
+     *  its body is text the engine read ({@link InheritedBody}), inherited by it and by ITS child shells: a child adds its own
+     *  exports and passes the whole on, so a grandchild still sees a function exported two shells up (#1628). Only on a
+     *  child-shell start; a substitution / eval runs in the same shell and reads its functions whole. */
+    readonly exportedFunctions?: ReadonlyMap<string, InheritedBody>;
 }
 /** The thread of the shell that runs a text, at the segment that hands it on: a literal `eval` text is not a new plan but the next
  *  segment of the same thread, so it starts in all of it and hands the working directory and the physical mode back; a substitution

package/dist/tools/fs/shell-read-write-targets.d.ts

@@ -16,8 +16,12 @@ export type { WriteSeat } from "./program-read-model.js";
 export interface ArgWord {
     readonly raw: string;
     readonly spelled: string;
+    /** The program receives a text the spelling is not (an expansion, or a value the lexer left unresolved: `$'-\x72f'`). */
+    readonly rewritten?: true;
+    /** Nothing but expansions that may yield no word (an unquoted `$E` or `$(cmd)`, `"$@"`): it may not be an argument at all. */
+    readonly vanishes?: true;
 }
-/** The words a segment hands its program — the argv after the program word (a launcher's own words are not the program's). */
+/** The words a segment hands its program — the argv after the program word the program position names (a launcher's own words, whatever they are spelled, are not the program's). */
 export declare function programArgs(segment: ShellReadSegment): ArgWord[];
 /**
  * The BACKUP names an in-place `sed` gives the file it knows as `name` — both readings a suffix has: GNU sed replaces every

package/dist/tools/fs/shell-read-write-targets.js

@@ -4,9 +4,8 @@ import { renamed } from "./shell-read-word.js";
 import { byteBoundIsSmall, implementationsOf, programRow, readArgRoles, selectedOptions, subcommandOf, writeReadings } from "./program-read-model.js";
 import { programBasename, readProgramPosition } from "./bash-program-position.js";
 export function programArgs(segment) {
-    const words = segment.argv.map((w) => ({ raw: w.raw, spelled: w.folded }));
-    const at = words.findIndex((w) => w.spelled === segment.verb?.name);
-    return at < 0 ? [] : words.slice(at + 1);
+    const at = segment.verb === undefined ? undefined : readProgramPosition(segment.argv).program?.index;
+    return (at === undefined ? [] : segment.argv.slice(at + 1)).map((w) => ({ raw: w.raw, spelled: w.folded, ...(w.expansions.length > 0 || w.unresolved !== undefined ? { rewritten: true } : {}), ...(w.pieces.length > 0 && w.pieces.every((p) => p.expansion?.yields === "many") ? { vanishes: true } : {}) }));
 }
 export function sedBackupNames(name, suffix) {
     const appended = `${name}${suffix}`;

package/dist/tools/fs/shell-reentry-text.d.ts

@@ -21,6 +21,15 @@ import type { BoundValue } from "./shell-read-bindings.js";
  * taken: a display option (`trap -p SIG`) and a lone operand (`trap SIG`) still count their operand as the body.
  */
 export declare function codeBodies(basename: string, args: readonly string[]): readonly string[];
+/** Does this program, handed `args`, run a line of the shell's HISTORY list (`fc -s`, `fc -e -`, `fc -e vi`, bare `fc`)? Its
+ *  row's text is `history`, and either an option it selects RUNS at once — `effect: "executes"` (`-s`) or its
+ *  `executesWhenValue` value (`-e -`), which win over a printing one (bash 5.3 runs `fc -l -s`, `fc -le -`) — or none it selects
+ *  only prints (`fc -e vi` edits then runs; `fc -l`, `fc -ln -1`, `fc -e vi -l` list). What runs is a line no word of the
+ *  command spells — a text built when the command runs, as a stream-fed or substituted script is. */
+export declare function runsStoredLine(basename: string, args: readonly string[]): boolean;
+/** Does this program, handed `args`, re-enter the shell — a shell re-entry row, unless its text is the history list and these
+ *  options only print it (`fc -l`: a listing runs nothing)? */
+export declare function reentersShell(basename: string, args: readonly string[]): boolean;
 /** The shell text a re-entry program runs, by its row: the shell-text value its walk reads for a shell (`-c`'s), its
  *  words joined for `eval`, its non-option words for `parallel`; none for `source` / `.` (a script file operand), for a
  *  shell whose first operand (a script file) or `--` comes before any text, or for a program that is no re-entry. Where

package/dist/tools/fs/shell-reentry-text.js

@@ -1,6 +1,6 @@
 import { literalHeredocBody, literalTextOf } from "../../shell/lex.js";
 import { programBasename, readProgramPosition } from "./bash-program-position.js";
-import { implementationRejects, implementationsOf, programRow, readArgRoles, selectedOptions, targetUserOf } from "./program-read-model.js";
+import { implementationRejects, implementationsOf, programRow, readArgRoles, selectedOptions, selectedSpellings, targetUserOf } from "./program-read-model.js";
 import { namesStandardInput } from "./safety.js";
 export function codeBodies(basename, args) {
     const row = programRow(basename);
@@ -43,8 +43,46 @@ function shellTextOf(e, args) {
         return args[e.at];
     if (e.kind === "option" && typeof e.reading === "object" && e.reading.role?.kind === "shell-text")
         return e.reading.attached;
+    if (e.kind === "value" && e.spec?.runsLater !== undefined)
+        return laterCommandLine(e.spec.runsLater, args[e.at]);
+    if (e.kind === "option" && typeof e.reading === "object" && e.reading.spec?.runsLater !== undefined)
+        return laterCommandLine(e.reading.spec.runsLater, e.reading.attached);
     return undefined;
 }
+const BOOLEAN_SPELLINGS = new Set(["", "true", "false", "yes", "no", "on", "off", "1", "0"]);
+function laterCommandLine(table, setting) {
+    const eq = setting.indexOf("=");
+    if (eq <= 0)
+        return undefined;
+    const key = setting.slice(0, eq).toLowerCase();
+    const value = setting.slice(eq + 1);
+    const entry = table.keys.find((k) => new RegExp(`^${k.key.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`).test(key));
+    if (entry === undefined)
+        return undefined;
+    if (table.valueFrom === "environment")
+        return /^[A-Za-z_][A-Za-z0-9_]*$/.test(value) ? `"$${value}"` : undefined;
+    if (value.trim() === "")
+        return undefined;
+    if (entry.orBoolean === true && BOOLEAN_SPELLINGS.has(value.toLowerCase()))
+        return undefined;
+    if (entry.bang === true)
+        return value.startsWith("!") ? value.slice(1) : undefined;
+    if (entry.prefixed !== undefined)
+        return value.startsWith("!") ? value.slice(1) : value.startsWith("/") ? value : `${entry.prefixed}${value}`;
+    return value;
+}
+export function runsStoredLine(basename, args) {
+    const row = programRow(basename);
+    if (row?.reentry?.kind !== "shell" || row.reentry.text !== "history")
+        return false;
+    const selected = selectedOptions(row, args, "one-implementation");
+    const runsAtOnce = selected.some((o) => o.effect === "executes") || selectedSpellings(row, args).values.some((v) => v.spec.executesWhenValue !== undefined && (v.value ?? args[v.at]) === v.spec.executesWhenValue);
+    return runsAtOnce || !selected.some((o) => o.mode === "banner");
+}
+export function reentersShell(basename, args) {
+    const r = programRow(basename)?.reentry;
+    return r?.kind === "shell" && (r.text !== "history" || runsStoredLine(basename, args));
+}
 export function reentryText(basename, args, stdin) {
     const row = programRow(basename);
     const r = row?.reentry;
@@ -61,7 +99,7 @@ function argvText(row, at, args) {
         return args.length === 0 ? undefined : args.join(" ");
     if (at === "non-option-words")
         return args.filter((a) => !a.startsWith("-")).join(" ") || undefined;
-    if (at === "file-operand")
+    if (at === "file-operand" || at === "history")
         return undefined;
     for (const e of optionSection(readArgRoles(row, args))) {
         const text = shellTextOf(e, args);

package/dist/tools/todo.js

@@ -12,69 +12,69 @@ export function createTodoWriteTool() {
             '- Each todo has `content`, `status` ("pending" | "in_progress" | "completed"), and `activeForm` (present-tense label shown while in progress).\n' +
             "- Send the full list each call; it replaces the previous one.\n" +
             "- Keep one item `in_progress` at a time and mark it `completed` when done.",
-        descriptionClassic: "Use this tool to create and manage a structured task list for your current coding session. This helps you track progress, organize complex tasks, and demonstrate thoroughness to the user.\n" +
-            "It also helps the user understand the progress of the task and overall progress of their requests.\n" +
-            "\n" +
-            "## When to Use This Tool\n" +
-            "Use this tool proactively in these scenarios:\n" +
-            "\n" +
-            "1. Complex multi-step tasks - When a task requires 3 or more distinct steps or actions\n" +
-            "2. Non-trivial and complex tasks - Tasks that require careful planning or multiple operations\n" +
-            "3. User explicitly requests todo list - When the user directly asks you to use the todo list\n" +
-            "4. User provides multiple tasks - When users provide a list of things to be done (numbered or comma-separated)\n" +
-            "5. After receiving new instructions - Immediately capture user requirements as todos\n" +
-            "6. When you start working on a task - Mark it as in_progress BEFORE beginning work. Ideally you should only have one todo as in_progress at a time\n" +
-            "7. After completing a task - Mark it as completed and add any new follow-up tasks discovered during implementation\n" +
-            "\n" +
-            "## When NOT to Use This Tool\n" +
-            "\n" +
-            "Skip using this tool when:\n" +
-            "1. There is only a single, straightforward task\n" +
-            "2. The task is trivial and tracking it provides no organizational benefit\n" +
-            "3. The task can be completed in less than 3 trivial steps\n" +
-            "4. The task is purely conversational or informational\n" +
-            "\n" +
-            "NOTE that you should not use this tool if there is only one trivial task to do. In this case you are better off just doing the task directly.\n" +
-            "\n" +
-            "## Task States and Management\n" +
-            "\n" +
-            "1. **Task States**: Use these states to track progress:\n" +
-            "   - pending: Task not yet started\n" +
-            "   - in_progress: Currently working on (limit to ONE task at a time)\n" +
-            "   - completed: Task finished successfully\n" +
-            "\n" +
-            "   **IMPORTANT**: Task descriptions must have two forms:\n" +
-            '   - content: The imperative form describing what needs to be done (e.g., "Run tests", "Build the project")\n' +
-            '   - activeForm: The present continuous form shown during execution (e.g., "Running tests", "Building the project")\n' +
-            "\n" +
-            "2. **Task Management**:\n" +
-            "   - Update task status in real-time as you work\n" +
-            "   - Mark tasks complete IMMEDIATELY after finishing (don't batch completions)\n" +
-            "   - Exactly ONE task must be in_progress at any time (not less, not more)\n" +
-            "   - Complete current tasks before starting new ones\n" +
-            "   - Remove tasks that are no longer relevant from the list entirely\n" +
-            "\n" +
-            "3. **Task Completion Requirements**:\n" +
-            "   - ONLY mark a task as completed when you have FULLY accomplished it\n" +
-            "   - If you encounter errors, blockers, or cannot finish, keep the task as in_progress\n" +
-            "   - When blocked, create a new task describing what needs to be resolved\n" +
-            "   - Never mark a task as completed if:\n" +
-            "     - Tests are failing\n" +
-            "     - Implementation is partial\n" +
-            "     - You encountered unresolved errors\n" +
-            "     - You couldn't find necessary files or dependencies\n" +
-            "\n" +
-            "4. **Task Breakdown**:\n" +
-            "   - Create specific, actionable items\n" +
-            "   - Break complex tasks into smaller, manageable steps\n" +
-            "   - Use clear, descriptive task names\n" +
-            "   - Always provide both forms:\n" +
-            '     - content: "Fix authentication bug"\n' +
-            '     - activeForm: "Fixing authentication bug"\n' +
-            "\n" +
-            "When in doubt, use this tool. Being proactive with task management demonstrates attentiveness and ensures you complete all requirements successfully.\n" +
-            "\n" +
-            "Pass the COMPLETE todo list each call — it replaces the prior list.",
+        descriptionVariants: [{ id: "classic", traits: { noneOf: ["lean_prompt"] }, text: "Use this tool to create and manage a structured task list for your current coding session. This helps you track progress, organize complex tasks, and demonstrate thoroughness to the user.\n" +
+                    "It also helps the user understand the progress of the task and overall progress of their requests.\n" +
+                    "\n" +
+                    "## When to Use This Tool\n" +
+                    "Use this tool proactively in these scenarios:\n" +
+                    "\n" +
+                    "1. Complex multi-step tasks - When a task requires 3 or more distinct steps or actions\n" +
+                    "2. Non-trivial and complex tasks - Tasks that require careful planning or multiple operations\n" +
+                    "3. User explicitly requests todo list - When the user directly asks you to use the todo list\n" +
+                    "4. User provides multiple tasks - When users provide a list of things to be done (numbered or comma-separated)\n" +
+                    "5. After receiving new instructions - Immediately capture user requirements as todos\n" +
+                    "6. When you start working on a task - Mark it as in_progress BEFORE beginning work. Ideally you should only have one todo as in_progress at a time\n" +
+                    "7. After completing a task - Mark it as completed and add any new follow-up tasks discovered during implementation\n" +
+                    "\n" +
+                    "## When NOT to Use This Tool\n" +
+                    "\n" +
+                    "Skip using this tool when:\n" +
+                    "1. There is only a single, straightforward task\n" +
+                    "2. The task is trivial and tracking it provides no organizational benefit\n" +
+                    "3. The task can be completed in less than 3 trivial steps\n" +
+                    "4. The task is purely conversational or informational\n" +
+                    "\n" +
+                    "NOTE that you should not use this tool if there is only one trivial task to do. In this case you are better off just doing the task directly.\n" +
+                    "\n" +
+                    "## Task States and Management\n" +
+                    "\n" +
+                    "1. **Task States**: Use these states to track progress:\n" +
+                    "   - pending: Task not yet started\n" +
+                    "   - in_progress: Currently working on (limit to ONE task at a time)\n" +
+                    "   - completed: Task finished successfully\n" +
+                    "\n" +
+                    "   **IMPORTANT**: Task descriptions must have two forms:\n" +
+                    '   - content: The imperative form describing what needs to be done (e.g., "Run tests", "Build the project")\n' +
+                    '   - activeForm: The present continuous form shown during execution (e.g., "Running tests", "Building the project")\n' +
+                    "\n" +
+                    "2. **Task Management**:\n" +
+                    "   - Update task status in real-time as you work\n" +
+                    "   - Mark tasks complete IMMEDIATELY after finishing (don't batch completions)\n" +
+                    "   - Exactly ONE task must be in_progress at any time (not less, not more)\n" +
+                    "   - Complete current tasks before starting new ones\n" +
+                    "   - Remove tasks that are no longer relevant from the list entirely\n" +
+                    "\n" +
+                    "3. **Task Completion Requirements**:\n" +
+                    "   - ONLY mark a task as completed when you have FULLY accomplished it\n" +
+                    "   - If you encounter errors, blockers, or cannot finish, keep the task as in_progress\n" +
+                    "   - When blocked, create a new task describing what needs to be resolved\n" +
+                    "   - Never mark a task as completed if:\n" +
+                    "     - Tests are failing\n" +
+                    "     - Implementation is partial\n" +
+                    "     - You encountered unresolved errors\n" +
+                    "     - You couldn't find necessary files or dependencies\n" +
+                    "\n" +
+                    "4. **Task Breakdown**:\n" +
+                    "   - Create specific, actionable items\n" +
+                    "   - Break complex tasks into smaller, manageable steps\n" +
+                    "   - Use clear, descriptive task names\n" +
+                    "   - Always provide both forms:\n" +
+                    '     - content: "Fix authentication bug"\n' +
+                    '     - activeForm: "Fixing authentication bug"\n' +
+                    "\n" +
+                    "When in doubt, use this tool. Being proactive with task management demonstrates attentiveness and ensures you complete all requirements successfully.\n" +
+                    "\n" +
+                    "Pass the COMPLETE todo list each call — it replaces the prior list." }],
         parameters: Type.Object({
             todos: Type.Array(Type.Object({
                 content: Type.String({ description: "The task, in imperative form (e.g. \"Run the tests\")." }),

package/dist/tools/web.d.ts

@@ -1,12 +1,10 @@
 import type { AgentTool } from "../internal/harness-types.js";
 import type { Brain, ToolSpec } from "../core/types.js";
+import { type HostFloor } from "../core/host-floor.js";
 import type { Model } from "../internal/llm.js";
+/** WebFetch's factory options. Which hosts it may reach is not one of them: that is the deployment's host floor (`RunnerDeps.hostFloor`),
+ *  which the Runner hands every call through its context — a product used outside a Runner holds the private-network floor alone. */
 export interface WebFetchConfig {
-    /** If set, ONLY these hostnames may be fetched (exact host match) — and the allowlist is enforced on
-     *  **every redirect hop**, not just the initial URL (a redirect to a non-allowlisted host is refused
-     *  before the request is made). Omitted ⇒ no host restriction (the deployment's tool-policy gate is then
-     *  the only control — wire one for a multi-tenant deployment). */
-    allowHosts?: string[];
     /** Injectable fetch (tests / a proxy). Defaults to the global `fetch`. */
     fetchImpl?: typeof fetch;
     /** Max response bytes to read (default 2 MB). */
@@ -80,14 +78,11 @@ export declare function webFetchToolSpec(config?: WebFetchConfig): ToolSpec;
 /** Defined (harness) form of web_fetch — back-compat (RL-1336-webfetch-factory) for direct execution / tests. For `spec.tools`, use the raw
  *  {@link webFetchToolSpec} (prepare-task defineTool-wraps spec.tools entries).
  *
- *  ⚠️ CTX-DEPENDENT BEHAVIOR: this factory takes no `enrichCtx`, so the product it returns is sealed
- *  around the pre-RB-409 minimal `{toolCallId, signal}` ctx. Fed into `TaskSpec.tools`, a finished
- *  product is mounted AS-IS (prepare-task's brand branch — there is no ctx seat on
- *  `AgentTool.execute` to inject through), so every `ctx.*` read inside {@link webFetchToolSpec}
- *  reads absent — including `reminderMark`/`reminderDisclosureCounts`, i.e. the design/319 exact-mark
- *  DEFUSE and its observation counters silently do not run for that mount. Two ways to keep them:
- *  hand `spec.tools` the raw {@link webFetchToolSpec} (the Runner then wraps it with its own trusted
- *  ctx builder), or call `defineTool(webFetchToolSpec(config), { enrichCtx })` yourself. */
+ *  ⚠️ CTX-DEPENDENT BEHAVIOR: this factory takes no `enrichCtx`, so the product it returns runs on the minimal
+ *  `{toolCallId, signal}` ctx when executed directly — every `ctx.*` read inside {@link webFetchToolSpec} reads absent:
+ *  the deployment's host floor (`ctx.hostFloor` — the private-network floor alone then holds) and the design/319 exact-mark
+ *  defuse with its counters. Fed into `TaskSpec.tools`, the Runner rebinds the product to its own trusted ctx builder
+ *  (`rebindProductEntry`, caller-roster.ts), exactly as it wraps the raw {@link webFetchToolSpec}. */
 export declare function createWebFetchTool(config?: WebFetchConfig): AgentTool;
 /** {@link createWebFetchSummarizer}'s truncation bound — CC's `MAX_MARKDOWN_LENGTH`
  *  (WebFetchTool/utils.ts:128). Exported so a deployment wiring the reference summarizer doesn't need
@@ -216,10 +211,14 @@ export interface WebSearchConfig {
      * `site:` query) can apply them up front. A backend MAY ignore `opts` — core re-enforces the domain
      * constraint on the returned results as a floor (see `createWebSearchTool`), so honoring it is an
      * optimization, not a correctness requirement. A backend declaring fewer parameters is accepted as is.
+     * `opts.hostFloor` is the run's compiled deployment host floor (`RunnerDeps.hostFloor`), present only when one is declared: a backend
+     * that connects to a host judges each request URL by it before sending (`createSearxngSearchBackend` does, on every hop); a backend
+     * that is not an engine executor (a provider-native search) holds its own egress and may ignore it.
      */
     search: (query: string, signal?: AbortSignal, opts?: {
         allowedDomains?: string[];
         blockedDomains?: string[];
+        hostFloor?: HostFloor;
     }) => Promise<Array<{
         title: string;
         url: string;
@@ -241,7 +240,8 @@ export declare function clipCodePoints(s: string, max: number): string;
 export declare function createWebSearchTool(config: WebSearchConfig): ToolSpec;
 /** Options for {@link createSearxngSearchBackend}. */
 export interface SearxngBackendOptions {
-    /** Injected fetch (tests / exotic runtimes). Defaults to `globalThis.fetch`. */
+    /** Injected fetch (tests / exotic runtimes). Defaults to `globalThis.fetch`. Called once per hop (the backend follows redirects itself):
+     *  an implementation that adds a credential header must scope it to the origin it is for. */
     fetchImpl?: typeof fetch;
     /** Per-request wall clock in ms before the request is aborted. Defaults to 10 000 — well inside
      *  WebSearchConfig's own 30 s budget so the tool-level race never fires first on a healthy instance. */
@@ -263,6 +263,11 @@ export interface SearxngBackendOptions {
  *
  * Result mapping keeps the strict {title, url, snippet} shape: SearXNG's `content` field is the
  * snippet; rows missing a url are dropped (an engine-side info box, not a citable result).
+ *
+ * The deployment's host floor (`opts.hostFloor`, the run's `RunnerDeps.hostFloor`) binds the request the way it binds the fetch tool:
+ * the base URL and every redirect target are judged by the one hop judge before they are requested, and a refused hop is never
+ * contacted (the search rejects with `config.host_floor_refused`). The private-network floor is not applied: the instance is the
+ * deployment's own declaration.
  */
 export declare function createSearxngSearchBackend(baseUrl: string, options?: SearxngBackendOptions): WebSearchConfig["search"];
 /**