@sema-agent/core 7.55.0 → 7.57.0

package/dist/stores/file/permission-rule-adopt.js

@@ -2,18 +2,19 @@ import { existsSync, renameSync } from "node:fs";
 import { join } from "node:path";
 import { writerOf } from "../../core/permission-rule-store.js";
 import { readRuleOwner, ruleOwnerText, sameRuleOwner } from "../../core/rule-owner.js";
+import { principalNameOf } from "../../core/principal-name.js";
 import { createPermissionRuleStoreProvider } from "../../core/permission-rule-provider.js";
 import { syncPermissionRules } from "../../core/permission-rule-sync.js";
 import { thrownText } from "../../core/thrown-value.js";
 import { FileStoreLockError } from "./fs-atomic.js";
 import { FileDurableRulePartitionProvider, LOCAL_OWNER_FILE, principalRuleFileName, readRuleAdoptionFile, writeRuleAdoptionFile, } from "./permission-rule-store.js";
 export async function adoptFilePermissionRuleStore(opts) {
-    if (typeof opts.toPrincipal !== "string" || opts.toPrincipal === "") {
-        throw new Error("adoptFilePermissionRuleStore requires the adopting principal — adoption is the act of giving this bucket an identity");
+    if (principalNameOf(opts.toPrincipal) === undefined) {
+        throw new Error("adoptFilePermissionRuleStore requires the adopting principal, a principal name — adoption is the act of giving this bucket an identity");
     }
     const from = readRuleOwner(opts.from);
     if (from === undefined) {
-        throw new Error("adoptFilePermissionRuleStore requires a source owner — a principal with a non-blank name, or the local owner");
+        throw new Error("adoptFilePermissionRuleStore requires a source owner — a principal owner whose principal is a principal name, or the local owner");
     }
     if (from.kind === "principal" && from.principal === opts.toPrincipal) {
         throw new Error(`the bucket already belongs to "${opts.toPrincipal}" — there is nothing to adopt`);

package/dist/stores/file/permission-rule-store.js

@@ -4,6 +4,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { isRuleBehavior } from "../../core/permission-rule-model.js";
 import { posixModeBitsMeaningful } from "../../core/posix-mode-face.js";
 import { readRuleOwner } from "../../core/rule-owner.js";
+import { principalNameOf, readPrincipal } from "../../core/principal-name.js";
 import { PERMISSION_RULES_LATER_GRAMMAR_CODE, PERMISSION_RULE_WRITER, applySyncJoin, applyTombstones, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, foldDelta, unknownRuleWriteDeltaError, } from "../../core/permission-rule-store.js";
 import { sameOrgPolicyContent } from "../../core/permission-rule-org.js";
 import { SESSION_RULES_GRAMMAR, readRuleGrammarStamp } from "../../core/session-policy-store.js";
@@ -66,7 +67,7 @@ function isRuleAdoptionFileShape(v) {
     const rec = (hasMarker ? v.marker : v.adopted);
     if (rec === null || typeof rec !== "object")
         return false;
-    if (readRuleOwner(rec.from) === undefined || typeof rec.toPrincipal !== "string" || rec.toPrincipal === "")
+    if (readRuleOwner(rec.from) === undefined || principalNameOf(rec.toPrincipal) === undefined)
         return false;
     return hasMarker ? rec.phase === 2 || rec.phase === 3 || rec.phase === 4 || rec.phase === 5 : typeof rec.atMs === "number" && Number.isFinite(rec.atMs);
 }
@@ -452,17 +453,22 @@ export class FileDurableRulePartitionProvider {
         this.lock = lock;
     };
     forPrincipal(principal) {
-        if (typeof principal !== "string" || principal === "") {
+        const reading = readPrincipal(principal);
+        if (reading.kind === "invalid") {
+            throw new Error(`the principal given is not a principal name (got ${reading.fault}) — refusing to resolve a bucket for it; a provided value that names nobody is not "no principal"`);
+        }
+        if (reading.kind === "absent") {
             return { list: async () => ({ ...EMPTY_READ }), durability: "process-local" };
         }
+        const name = reading.name;
         const adoption = this.adoptionMarker();
         if (adoption !== undefined) {
             const rec = "adopted" in adoption ? adoption.adopted : adoption.marker;
-            if (rec.from.kind === "principal" && rec.from.principal === principal) {
-                return this.readOnlySourceView(principalRuleFileName(principal), principalRuleFileName(rec.toPrincipal), "adopted" in adoption || adoption.marker.phase >= 4);
+            if (rec.from.kind === "principal" && rec.from.principal === name) {
+                return this.readOnlySourceView(principalRuleFileName(name), principalRuleFileName(rec.toPrincipal), "adopted" in adoption || adoption.marker.phase >= 4);
             }
         }
-        return new FileDurableRulePartition(this.dir, join(this.dir, principalRuleFileName(principal)), this.acquireWriteLock, this.onError, this.vetting);
+        return new FileDurableRulePartition(this.dir, join(this.dir, principalRuleFileName(name)), this.acquireWriteLock, this.onError, this.vetting);
     }
     readOnlySourceView(sourceName, targetName, flipped) {
         const pick = flipped ? targetName : existsSync(join(this.dir, sourceName)) ? sourceName : targetName;

package/dist/stores/file/session-store.d.ts

@@ -1,4 +1,4 @@
-import type { Session, SessionCreateOptions, SessionForkOptions, SessionHead, SessionMetadata, SessionPlacementRecord, SessionRepo, SessionTreeEntry } from "../../internal/harness.js";
+import type { Session, SessionCreateOptions, SessionForkOptions, SessionHead, SessionMetadata, SessionPlacementRecord, SessionRepo, SessionRow, SessionTreeEntry } from "../../internal/harness.js";
 import type { PlacedSessionRow } from "../../core/session.js";
 import { type CorruptReadInfo } from "./corrupt-read-sink.js";
 export interface FileSessionRepoOptions {
@@ -8,8 +8,9 @@ export interface FileSessionRepoOptions {
      * "corrupt read as missing" are one failure grammar, so they get one seat name.
      *
      * Fires for: an unreadable sessions DIRECTORY (the listing degrades to "no sessions"), a session log
-     * that could not be replayed during a listing (skipped from the result), and each corrupt interior JSONL
-     * record dropped on replay plus that replay's tally (turns missing from an otherwise healthy session).
+     * whose header could not be read during a listing (skipped from the result — a listing reads headers,
+     * it never replays a log), and each corrupt interior JSONL record dropped on replay plus that replay's
+     * tally (turns missing from an otherwise healthy session).
      *
      * Never fires on plain ENOENT / `not_found` — that is honest absence, and the torn TAIL stays silent
      * too (dying mid-write is the append log's documented crash-recovery shape, not corruption).
@@ -59,6 +60,15 @@ export declare class FileSessionRepo implements SessionRepo {
      * head does not see. A leaf entry naming an id the log does not hold is not checked here (a replay refuses that log on open).
      */
     headOf(sessionId: string): Promise<SessionHead | undefined>;
+    /**
+     * The row's {@link SessionRow} — its header cells and the newest write it holds, the log's modification time (every write to a row
+     * is an append to its log; the placed listing's age reads the same time) — in one read of the header, never a replay of the log.
+     * `undefined` = no row; a row whose header cannot be read rejects (`corrupt_session`).
+     */
+    private rowOf;
+    /** The one descriptor a by-id read of the row takes: its size and modification time and its header, from one inode (a file replaced
+     *  or removed while this reads is still the inode this descriptor opened); `undefined` = no file. */
+    private atRow;
     private storage;
     /**
      * RB-437 — release every shared authority this repo joined (LAST holder ⇒ evict + close the append fd).
@@ -75,12 +85,25 @@ export declare class FileSessionRepo implements SessionRepo {
     dispose(): Promise<void>;
     create(options?: SessionCreateOptions): Promise<Session>;
     open(metadata: SessionMetadata): Promise<Session>;
-    list(): Promise<SessionMetadata[]>;
+    /** Record activity on the row now: its log's modification time — the one time a listing reads, which every append moves too — is
+     *  set to now, the log's bytes untouched. A missing file is nothing to record; any other fault rejects. */
+    touch(sessionId: string): Promise<void>;
+    /** Every ordinary row with the newest write its log holds ({@link rowOf}): one header read per session file, no replay — what a
+     *  listing costs grows with the number of sessions, never with their history. Placed rows are the placed listing's. */
+    list(): Promise<SessionRow[]>;
+    /**
+     * Every row of the sessions directory, each read by {@link rowOf}. The listing degrades to "no sessions" so a
+     * browse face never throws — but "I could not read the directory" and "there are none" are different facts, and only the sink can
+     * tell them apart (ENOENT is honest absence: the constructor creates the directory, so it was removed underneath us). A session
+     * whose header cannot be read is skipped and disclosed — it exists and is missing from the listing — while a file that vanished
+     * between the directory read and its own is honest absence.
+     */
+    private rows;
     /**
      * Subagent transcript persistence — the PLACED partition's own enumeration (the joint reap's
      * partition-leg input; `TtlSessionStore` re-exposes it verbatim). Age (`olderThanMs`) is judged on
-     * the session FILE's mtime — the transcript's last append — falling back to `placedAt` when the
-     * stat fails (mtime is also the CC orphan-adoption window's basis, so the two age reads agree).
+     * the session FILE's mtime — the transcript's last append, the time the host listing reads too
+     * (mtime is also the CC orphan-adoption window's basis, so the age reads agree).
      * Rows missing either `(scope, handle)` join half return the honest `tupleIncomplete` variant
      * (consumers fail closed on it — never age-reaped, see the SessionStore contract).
      */

package/dist/stores/file/session-store.js

@@ -1,4 +1,4 @@
-import { closeSync, existsSync, fstatSync, openSync, readdirSync, rmSync, statSync } from "node:fs";
+import { closeSync, existsSync, fstatSync, openSync, readdirSync, rmSync, utimesSync } from "node:fs";
 import { join } from "node:path";
 import { BaseSessionStorage, StoredSession, SessionError, assertForkTarget, compareOccupants, forkRowCells, frozenRow, getEntriesToFork, importRowCells, incarnationCell, leafIdAfterEntry, ownerCell, readIncarnationCell, readOwnerCell, uuidv7, validateEntriesForImport, } from "../../internal/harness.js";
 import { canonicalStoreKey, AppendLog, atomicWriteFile, ensureDir, firstJsonlRecord, lastJsonlRecord, readJsonlRecords, sanitizePathComponent, writeThenLink } from "./fs-atomic.js";
@@ -125,6 +125,15 @@ export class FileSessionRepo {
         };
     }
     async headOf(sessionId) {
+        return this.atRow(sessionId, (fd, size, meta) => {
+            const last = lastJsonlRecord(fd, size, (r) => r.kind === "entry", SESSION_LINE_JUDGE);
+            return { owner: meta.owner ?? null, incarnation: meta.incarnation, leafId: last === undefined ? null : leafIdAfterEntry(last.entry) };
+        });
+    }
+    rowOf(sessionId) {
+        return this.atRow(sessionId, (_fd, _size, meta, mtimeMs) => ({ ...meta, lastActiveAt: Math.trunc(mtimeMs) }));
+    }
+    atRow(sessionId, read) {
         const path = this.pathFor(sessionId);
         let fd;
         try {
@@ -136,10 +145,8 @@ export class FileSessionRepo {
             throw err;
         }
         try {
-            const size = fstatSync(fd).size;
-            const meta = this.headerOf(sessionId, path, firstJsonlRecord(fd, size, SESSION_LINE_JUDGE));
-            const last = lastJsonlRecord(fd, size, (r) => r.kind === "entry", SESSION_LINE_JUDGE);
-            return { owner: meta.owner ?? null, incarnation: meta.incarnation, leafId: last === undefined ? null : leafIdAfterEntry(last.entry) };
+            const { size, mtimeMs } = fstatSync(fd);
+            return read(fd, size, this.headerOf(sessionId, path, firstJsonlRecord(fd, size, SESSION_LINE_JUDGE)), mtimeMs);
         }
         finally {
             closeSync(fd);
@@ -201,80 +208,65 @@ export class FileSessionRepo {
         const { meta, entries } = this.read(metadata.id);
         return new StoredSession(this.storage(meta, entries));
     }
-    async list() {
-        let names;
+    async touch(sessionId) {
+        const now = new Date();
         try {
-            names = readdirSync(this.dir);
+            utimesSync(this.pathFor(sessionId), now, now);
         }
         catch (err) {
-            if (err.code !== "ENOENT") {
-                this.disclose(this.dir, `session directory unreadable (${err.code ?? "unknown"}) — listed as empty`);
-            }
-            return [];
-        }
-        const out = [];
-        for (const name of names) {
-            if (!name.endsWith(SUFFIX))
-                continue;
-            const id = name.slice(0, -SUFFIX.length);
-            try {
-                const { createdAt, forkedFrom, placement } = this.read(id).meta;
-                if (placement !== undefined)
-                    continue;
-                out.push({ id, createdAt, ...(forkedFrom !== undefined ? { forkedFrom } : {}) });
-            }
-            catch (err) {
-                if (!(err instanceof SessionError && err.code === "not_found")) {
-                    this.disclose(this.pathFor(id), `session log unreadable (${thrownText(err)}) — skipped from the listing`, id);
-                }
-            }
+            if (err.code === "ENOENT")
+                return;
+            throw new SessionError("storage", `session ${sessionId}'s activity could not be recorded: ${thrownText(err)}`, err instanceof Error ? err : undefined);
         }
-        return out.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
     }
-    async listPlaced(kind, opts) {
+    async list() {
+        return this.rows("the listing")
+            .filter((row) => row.placement === undefined)
+            .sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+    }
+    rows(listing) {
         let names;
         try {
             names = readdirSync(this.dir);
         }
         catch (err) {
             if (err.code !== "ENOENT") {
-                this.disclose(this.dir, `session directory unreadable (${err.code ?? "unknown"}) — placed listing degraded to empty`);
+                this.disclose(this.dir, `session directory unreadable (${err.code ?? "unknown"}) — ${listing} degraded to empty`);
             }
             return [];
         }
-        const now = Date.now();
         const out = [];
         for (const name of names) {
             if (!name.endsWith(SUFFIX))
                 continue;
             const id = name.slice(0, -SUFFIX.length);
-            let placement;
+            let row;
             try {
-                placement = this.read(id).meta.placement;
+                row = this.rowOf(id);
             }
             catch (err) {
-                if (!(err instanceof SessionError && err.code === "not_found")) {
-                    this.disclose(this.pathFor(id), `session log unreadable (${thrownText(err)}) — skipped from the placed listing`, id);
-                }
+                this.disclose(this.pathFor(id), `session log unreadable (${thrownText(err)}) — skipped from ${listing}`, id);
                 continue;
             }
+            if (row !== undefined)
+                out.push(row);
+        }
+        return out;
+    }
+    async listPlaced(kind, opts) {
+        const now = Date.now();
+        const out = [];
+        for (const row of this.rows("the placed listing")) {
+            const placement = row.placement;
             if (placement === undefined || placement.kind !== kind)
                 continue;
             if (opts?.scope !== undefined && placement.scope !== opts.scope)
                 continue;
-            if (opts?.olderThanMs !== undefined) {
-                let ageAnchor = placement.placedAt;
-                try {
-                    ageAnchor = statSync(this.pathFor(id)).mtimeMs;
-                }
-                catch {
-                }
-                if (now - ageAnchor <= opts.olderThanMs)
-                    continue;
-            }
+            if (opts?.olderThanMs !== undefined && now - row.lastActiveAt <= opts.olderThanMs)
+                continue;
             out.push(placement.scope !== undefined && placement.handle !== undefined
-                ? { sessionId: id, placedAt: placement.placedAt, scope: placement.scope, handle: placement.handle }
-                : { sessionId: id, placedAt: placement.placedAt, tupleIncomplete: true });
+                ? { sessionId: row.id, placedAt: placement.placedAt, scope: placement.scope, handle: placement.handle }
+                : { sessionId: row.id, placedAt: placement.placedAt, tupleIncomplete: true });
         }
         return out;
     }

package/dist/tools/artifact/artifact-tool.js

@@ -9,7 +9,7 @@ const ARTIFACT_ACTION_LEGS = {
     "local-stub": { publish: ["env"], list: [], read: [], list_files: [], read_file: [] },
 };
 import { ARTIFACT_TOOL_NAME, mountRuleFace, toolFace } from "../../core/tool-catalog-entries.js";
-import { resolveAsk } from "../../core/tool-policy.js";
+import { attest, resolveAsk } from "../../core/tool-policy.js";
 import { NOT_BINDABLE } from "../../core/skill-grant-binding.js";
 import { approvalCardOf } from "../../core/tool-roster.js";
 import { errorResult } from "../../core/tools.js";
@@ -328,7 +328,8 @@ export function createArtifactTool(opts) {
         if (sharedReadApproved.has(url))
             return Promise.resolve({ ok: true });
         if (permissionMode !== undefined) {
-            const verdict = arbitrateByMode(permissionMode(), classifyAsk({ action: "ask", requiresRealApproval: true, guards: ["artifact_shared_read"] }, { contentQuestion: false, markedUnresolvable: false, org: undefined, tightened: undefined, mandateMarks: {} }));
+            const call = { toolCallId: ctx.toolCallId, toolName: ARTIFACT_TOOL_NAME };
+            const verdict = arbitrateByMode(permissionMode(), classifyAsk(attest({ action: "ask", requiresRealApproval: true }, call, { guards: ["artifact_shared_read"] }), { call, contentQuestion: false, markedUnresolvable: false, org: undefined, tightened: undefined, mandateMarks: {} }));
             if (verdict.kind === "released") {
                 if (!releaseAnnounced && onNotice !== undefined) {
                     releaseAnnounced = true;

package/dist/tools/fs/bash-program-position.d.ts

@@ -39,14 +39,27 @@ export declare const LOOP_LIST_HEADS: ReadonlySet<string>;
  * over control words and earlier assignments re-traces). One fact, two readers that must agree.
  */
 export declare function isLeadingAssignmentWord(words: readonly LexedWord[], i: number): boolean;
-export declare const PROGRAM_POSITION_REFUSAL_KINDS: readonly ["option_at_program_position", "control_syntax_at_program_position"];
+export declare const PROGRAM_POSITION_REFUSAL_KINDS: readonly ["option_at_program_position", "control_syntax_at_program_position", "wildcard_program_word"];
 export type ProgramPositionRefusalKind = (typeof PROGRAM_POSITION_REFUSAL_KINDS)[number];
 /** Why the program could not be read — a closed set, each member minted into one sentence. `owner` is the word
  *  that took the offending token: the control word or the first launcher of the chain. */
-export type ProgramPositionRefusal = {
+export type ProgramPositionRefusal = 
+/** `endedBy`: the launcher whose bare `--` ended its options before this word — the word is then no option of anyone's
+ *  but a name spelled like one (`env -- -i ls` runs a program named `-i`), and the sentence says that, not "the option". */
+{
     readonly kind: "option_at_program_position";
     readonly owner: string;
     readonly option: string;
+    readonly endedBy?: string;
+}
+/** The program word carries an unquoted glob (`s[h]`, `s*h`, `./c?t`): the shell expands it against the filesystem,
+ *  so which program runs — a shell among them — is not readable from the text (`touch sh; s[h] -c '…'`). `word` is the
+ *  word as written, `at` its argv index (the words AFTER it are still handed over, so a deny operand still refuses).
+ *  Both faces ask, the same as any unreadable program position. */
+ | {
+    readonly kind: "wildcard_program_word";
+    readonly word: string;
+    readonly at: number;
 } | {
     readonly kind: "control_syntax_at_program_position";
     readonly owner: string;
@@ -130,3 +143,7 @@ export declare function programPositionRunsShell(pos: ProgramPosition, runsShell
 export declare function shellScanDeclineOf(pos: ProgramPosition, acceptsStreamTarget: (basename: string) => boolean): ShellScanDecline | undefined;
 /** ONE sentence per refusal kind, minted here and nowhere else. */
 export declare function programPositionRefusalSentence(refusal: ProgramPositionRefusal): string;
+/** The sentence a segment whose program the walk DECLINED carries, read off the segment's text — the program-position reader's own
+ *  refusal, the stream fact, or that no program could be named: the read station's account of the segment and the removal guard's
+ *  are this one sentence. */
+export declare function declinedProgramSentence(text: string): string;

package/dist/tools/fs/bash-program-position.js

@@ -1,4 +1,4 @@
-import { SHELL_CONTROL_PREFIXES } from "../../shell/lex.js";
+import { SHELL_CONTROL_PREFIXES, argvOf, lexShellText } from "../../shell/lex.js";
 import { shellWordsOf } from "../../shell/shell-words.js";
 import { BLOCK_WORD_NAMES, LAUNCHER_NAMES, feedsArgvFromStdin, launcherOptionMovesBase, launcherOptionQueries, launcherOptionStep, launcherRunsShell, programRow, selectedOptions, streamDefaultProgram } from "./program-read-model.js";
 export const NOT_AUTO_ALLOWED = "— not auto-allowed";
@@ -31,7 +31,7 @@ function launcherRowOf(name) {
     const row = programRow(name);
     return row?.launcher !== undefined ? row : undefined;
 }
-function pastLauncherOptions(launcher, folded, i, moved, queried) {
+function pastLauncherOptions(launcher, folded, i, moved, queried, ended) {
     const row = launcherRowOf(launcher);
     if (row === undefined)
         return i;
@@ -53,14 +53,19 @@ function pastLauncherOptions(launcher, folded, i, moved, queried) {
         if (launcherOptionQueries(row, tok))
             queried?.();
         i += step;
-        if (tok === "--")
+        if (tok === "--") {
+            ended?.();
             return i;
+        }
     }
 }
-export const PROGRAM_POSITION_REFUSAL_KINDS = Object.freeze(["option_at_program_position", "control_syntax_at_program_position"]);
+export const PROGRAM_POSITION_REFUSAL_KINDS = Object.freeze(["option_at_program_position", "control_syntax_at_program_position", "wildcard_program_word"]);
 export function readProgramPosition(words) {
     const folded = words.map((w) => w.folded);
     const controlWords = [];
+    const ended = { by: undefined };
+    const endsOptions = (name) => () => { ended.by = name; };
+    const optionShaped = (owner, option) => ({ kind: "option_at_program_position", owner, option, ...(ended.by !== undefined ? { endedBy: ended.by } : {}) });
     let i = 0;
     while (i < folded.length && isBareControlWord(words, i, SHELL_CONTROL_PREFIXES)) {
         const controlWord = folded[i];
@@ -68,6 +73,23 @@ export function readProgramPosition(words) {
         i = pastLauncherOptions(controlWord, folded, i + 1);
     }
     const none = (written, assignments, refusal) => ({ controlWords, written, assignments, launchers: [], argvFromStdin: false, runsDefaultProgram: false, program: undefined, refusal, launcherMovesBase: false });
+    const globProgramRefusal = (idx) => {
+        let glob = false;
+        for (const p of words[idx].pieces) {
+            const k = p.expansion?.kind;
+            if (k === "process" || k === "brace")
+                return undefined;
+            if (k === "glob")
+                glob = true;
+            if (p.literal !== undefined) {
+                if (p.quotedBy === undefined && /[{}$`]/.test(p.literal))
+                    return undefined;
+                if (p.quotedBy === '"' && /[$`]/.test(p.literal))
+                    return undefined;
+            }
+        }
+        return glob ? { kind: "wildcard_program_word", word: folded[idx], at: idx } : undefined;
+    };
     if (i >= folded.length)
         return none(undefined, []);
     const written = i;
@@ -82,9 +104,12 @@ export function readProgramPosition(words) {
     const basename = programBasename(head);
     if (basename.startsWith("-") && basename !== "-") {
         const owner = controlWords.length > 0 ? folded[controlWords[controlWords.length - 1]] : head;
-        return none(written, assignments, { kind: "option_at_program_position", owner, option: head });
+        return none(written, assignments, optionShaped(owner, head));
     }
     if (!LAUNCHER_NAMES.has(basename)) {
+        const glob = globProgramRefusal(i);
+        if (glob !== undefined)
+            return none(written, assignments, glob);
         return { controlWords, written, assignments, launchers: [], argvFromStdin: false, runsDefaultProgram: false, program: { index: i, name: head, basename }, refusal: undefined, launcherMovesBase: false };
     }
     const launchers = [{ index: i, name: basename }];
@@ -107,7 +132,7 @@ export function readProgramPosition(words) {
         return { controlWords, written, assignments, launchers, argvFromStdin, runsDefaultProgram, ...(runsDefaultProgram && reentryDefault !== undefined ? { defaultProgram: reentryDefault } : {}), program, refusal, launcherMovesBase };
     };
     const selectsShell = (l, end) => selectedOptions(launcherRowOf(l.name), folded.slice(l.index + 1, end)).some((o) => o.mode === "interactive");
-    const first = pastLauncherOptions(basename, folded, i + 1, moved, queried);
+    const first = pastLauncherOptions(basename, folded, i + 1, moved, queried, endsOptions(basename));
     if (looksUp)
         return chain(undefined);
     for (let j = first; j < folded.length; j++) {
@@ -127,6 +152,7 @@ export function readProgramPosition(words) {
             reentryDefault = streamDefaultProgram(wordBasename);
             lastRow = undefined;
             owedOperands = 0;
+            ended.by = undefined;
             continue;
         }
         if (LAUNCHER_NAMES.has(wordBasename)) {
@@ -135,16 +161,20 @@ export function readProgramPosition(words) {
             if (launcherRunsShell(launcherRowOf(wordBasename), folded.slice(j + 1)))
                 return chain(undefined, shellRefusal(j, j + 1));
             owedOperands = lastRow?.requiredOperands ?? 0;
-            j = pastLauncherOptions(wordBasename, folded, j + 1, moved, queried) - 1;
+            ended.by = undefined;
+            j = pastLauncherOptions(wordBasename, folded, j + 1, moved, queried, endsOptions(wordBasename)) - 1;
             if (looksUp)
                 return chain(undefined);
             continue;
         }
         if (t.startsWith("-"))
-            return chain(undefined, { kind: "option_at_program_position", owner, option: t });
+            return chain(undefined, optionShaped(owner, t));
         if (SHELL_CONTROL_PREFIXES.has(wordBasename) || BLOCK_WORD_NAMES.has(wordBasename)) {
             return chain(undefined, { kind: "control_syntax_at_program_position", owner, word: wordBasename });
         }
+        const glob = globProgramRefusal(j);
+        if (glob !== undefined)
+            return chain(undefined, glob);
         return chain({ index: j, name: t, basename: wordBasename });
     }
     const last = launchers[launchers.length - 1];
@@ -173,12 +203,29 @@ export function shellScanDeclineOf(pos, acceptsStreamTarget) {
 export function programPositionRefusalSentence(refusal) {
     switch (refusal.kind) {
         case "option_at_program_position":
-            return `"${refusal.owner}" is given the option "${refusal.option}" where the program it runs would be — which program runs is not readable without that word's option table ${NOT_AUTO_ALLOWED}`;
+            return refusal.endedBy !== undefined
+                ? `"${refusal.endedBy} --" ends the options, and "${refusal.option}" after it is a name spelled like an option where the program it runs would be — which program runs is not read from such a word ${NOT_AUTO_ALLOWED}`
+                : `"${refusal.owner}" is given the option "${refusal.option}" where the program it runs would be — which program runs is not readable without that word's option table ${NOT_AUTO_ALLOWED}`;
         case "control_syntax_at_program_position":
             return `"${refusal.owner}" is given shell control syntax ("${refusal.word}") where the program it runs would be ${NOT_AUTO_ALLOWED}`;
+        case "wildcard_program_word":
+            return `the program word "${refusal.word}" carries an unquoted filename pattern, so the shell expands it against the filesystem and which program runs is not readable from the text ${NOT_AUTO_ALLOWED}`;
         default: {
             const exhaustive = refusal;
             return exhaustive;
         }
     }
 }
+export function declinedProgramSentence(text) {
+    const lexed = lexShellText(text);
+    if (!("reject" in lexed) && lexed.segments[0] !== undefined) {
+        const pos = readProgramPosition(argvOf(lexed.segments[0]));
+        if (pos.refusal !== undefined)
+            return programPositionRefusalSentence(pos.refusal);
+        if (pos.argvFromStdin) {
+            const runs = pos.program?.basename ?? "the program it runs";
+            return `"${text.trim()}" hands ${runs} its operands on its standard input, which this station does not read ${NOT_AUTO_ALLOWED}`;
+        }
+    }
+    return `"${text.trim()}" runs a program this station cannot name ${NOT_AUTO_ALLOWED}`;
+}

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -2,15 +2,15 @@ import { type LexedCommand, type LexedSegment, type LexedWord, type ShellLex, ty
 import { type ProgramRow } from "./program-read-model.js";
 /**
  * Bare command names `bash_readonly` permits out of the box, ALSO the default reversible set for the
- * The {@link import("./fs-bash.js").bashReversibilityProbe} classifier. **Coarse first filter, NOT a security
- * boundary**: {@link coarseReadonlyCheck} matches only the command NAME, so a listed command with a
- * writing flag (e.g. `find -delete`, `sort -o`, `tee`) would still write. Such commands are therefore
- * kept OFF this default — the list is curated to commands with NO write/mutation mode under ANY args, so
- * the `effect:"read"` declaration (relied on by wake/resume reconcile + the verifier read-only boundary)
- * AND the classifier's "reversible" promise both stay truthful. The deployment's tool-policy gate is the
- * authoritative control (council blocker #1); anything that can mutate state or run arbitrary
- * code belongs on the full `bash` (effect:write, gated), not here. A deployment may widen this list,
- * accepting that responsibility.
+ * {@link import("./fs-bash.js").bashReversibilityProbe} classifier. On the read-only face and in the transcript gate the
+ * list only NARROWS the read-only reader ({@link import("../../core/read-only-shell.js").readOnlyShellVerdict}'s
+ * `readers`): a listed program runs there only in a call the reader reads as read-only, so a deployment that widens the
+ * list with `sort` still has `sort -o out f` refused. The reversibility classifier reads the list as its allowlist: a
+ * listed program with a program-model row has its writing options refused by the row; one without a row is admitted
+ * by its name. The default is curated to commands with NO write/mutation mode under ANY args, so the `effect:"read"`
+ * declaration (relied on by wake/resume reconcile + the verifier read-only boundary) AND the classifier's
+ * "reversible" promise both stay truthful. The deployment's tool-policy gate is the authoritative control;
+ * anything that can mutate state or run arbitrary code belongs on the full `bash` (effect:write, gated), not here.
  *
  * Deliberately ABSENT: `date` (`-s`/`--set` → CLOCK_SETTIME), `hostname` (`<name>` → kernel
  * hostname), and `file` (`-C -m` → compiles/writes a magic file) were REMOVED — each is read-only by NAME
@@ -112,7 +112,7 @@ export interface LeadingCommandNameOptions {
     pathPrefixedNameIsText?: boolean;
 }
 /**
- * The SINGLE fail-closed simple-command parser shared by `bash_readonly` ({@link coarseReadonlyCheck}), the
+ * The SINGLE fail-closed simple-command parser shared by `bash_readonly`'s single-command admission, the
  * `bash` reversibility classifier ({@link import("./fs-bash.js").bashReversibilityProbe}), and the coarse command-name policy
  * ({@link import("../../core/tool-policy.js").createCoarseCommandNamePolicy}). It extracts the leading
  * `argv[0]` command NAME of a SINGLE simple command, rejecting anything that could chain past or escape an
@@ -131,13 +131,9 @@ export declare function parseLeadingCommandName(command: string, options?: Leadi
 } | {
     reject: string;
 };
-/** Coarse pre-execution check for `bash_readonly`: the command must be a single bare allowlisted command
- *  with no shell operators. It validates the NAME only (+ blocks operators/path-prefix/env-assignment); it
- *  does NOT inspect arguments for write flags — keeping the allowlist free of write-capable commands and
- *  the policy gate are what make `effect:"read"` truthful. Returns a reason when rejected, else undefined.
- *  This `effect:"read"` DECLARATION face deliberately stays strict-single-command; only the
- *  classify face ({@link classifyCompoundReadonly} via {@link import("./fs-bash.js").bashReversibilityProbe}) segments compounds. */
-export declare function coarseReadonlyCheck(command: string, allow: ReadonlySet<string>, options?: LeadingCommandNameOptions): string | undefined;
+/** The one sentence for a program a face's list of programs does not name — the compound classifier's list check and
+ *  the read-only reader's `readers` narrowing both mint it here. */
+export declare function unlistedReaderSentence(program: string): string;
 /**
  * Does this text carry a bare redirection operator — the ONE metacharacter family
  * {@link splitShellCompoundSegments} can be asked to tolerate at its whole-string gate
@@ -226,7 +222,7 @@ export declare function splitShellCompoundSegments(source: string, options?: {
 /**
  * Compound read-only classification for the `bash` full-shell face (the shape tier).
  * Splits a command on the connector set `;` `&&` `||` `|` and passes every segment through
- * {@link coarseReadonlyCheck} (the single {@link parseLeadingCommandName} parser + bare-name allowlist).
+ * the single {@link parseLeadingCommandName} parser and the bare-name allowlist.
  * All segments green ⇒ read-only. Returns a reason when rejected, else undefined.
  *
  * G2 — the split CARRIES QUOTE STATE (the one lexer): a connector character inside a quoted region is
@@ -548,7 +544,7 @@ export declare const POLL_LOOP_MAX_SLEEP_SECONDS = 600;
  *     -f`, unbounded devices all reject), and `sleep` must be a literal ≤
  *     {@link POLL_LOOP_MAX_SLEEP_SECONDS}. Bounded beats × terminating body ⇒ the loop halts.
  *  G2 NO WRITE OR EGRESS CHANNEL. Every non-`sleep` body segment must pass the SAME
- *     {@link coarseReadonlyCheck} parser + allowlist as the plain face (one parser, no drift);
+ *     {@link parseLeadingCommandName} parser + allowlist the compound classifier reads (one parser, no drift);
  *     `sleep` touches neither filesystem nor network. No redirection (`>` `<`), no `$`/backtick
  *     substitution, no subshell exists anywhere: the body bans them wholesale
  *     ({@link POLL_BODY_HARD_REJECT}), and the head's single `$(seq <int> <int>)` exemption is an

package/dist/tools/fs/bash-readonly-classifier.js

@@ -71,13 +71,8 @@ export function parseLeadingCommandName(command, options) {
         return { reject: "the command name must be a bare token (no quotes, braces, globs, or ~)" };
     return { name: first };
 }
-export function coarseReadonlyCheck(command, allow, options) {
-    const parsed = parseLeadingCommandName(command, options);
-    if ("reject" in parsed)
-        return parsed.reject;
-    if (!allow.has(parsed.name))
-        return `command "${parsed.name}" is not in the read-only allowlist`;
-    return undefined;
+export function unlistedReaderSentence(program) {
+    return `command "${program}" is not in the read-only allowlist`;
 }
 const SHELL_SEGMENT_QUOTE_BLIND_REJECT = /[<>()`\n\r\\]/;
 const SHELL_EXPANSION_CHARS = /[$]/;
@@ -761,7 +756,7 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
             return { reason: "`coproc` backgrounds a command — a backgrounded process outlives the command" };
         if (isBareControlWord(words, from, BLOCK_WORD_NAMES)) {
             unlistedSegments.add(si);
-            nameRefusal ??= `command "${written}" is not in the read-only allowlist`;
+            nameRefusal ??= unlistedReaderSentence(written);
             continue;
         }
         const program = pos.program;
@@ -783,10 +778,10 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
             if (pathPrefixed || from > 0)
                 reheaded.set(si, { from, head: name });
             if (from > 0)
-                nameRefusal ??= `command "${folded[0]}" is not in the read-only allowlist`;
+                nameRefusal ??= unlistedReaderSentence(folded[0]);
             continue;
         }
-        nameRefusal ??= `command "${parsed.name}" is not in the read-only allowlist`;
+        nameRefusal ??= unlistedReaderSentence(parsed.name);
         if (runsShellText(name))
             return { reason: unjudgedProgramTextRefusal(parsed.name, "runs its argument as shell text") };
         if (pos.launchers.length > 0) {