@sema-agent/core 7.56.0 → 7.57.0

package/dist/primitives/credential-ref.js

@@ -0,0 +1,125 @@
+export const CREDENTIAL_REF_KINDS = Object.freeze(["env", "vault", "handle", "assertion"]);
+export const CREDENTIAL_REF_TRUST = trustTable();
+function trustTable() {
+    const rows = Object.create(null);
+    rows.env = Object.freeze({ request: "refused" });
+    rows.vault = Object.freeze({ request: "own_entry" });
+    rows.handle = Object.freeze({ request: "refused" });
+    rows.assertion = Object.freeze({ request: "refused" });
+    return Object.freeze(rows);
+}
+export const CREDENTIAL_REF_TEXT_MAX = 2048;
+export const CREDENTIAL_REF_MAP_MAX = 64;
+export const CREDENTIAL_REF_PROBLEM_REASONS = Object.freeze(["not_a_record", "unknown_kind", "missing_field", "extra_field", "bad_value"]);
+const MEMBERS = {
+    env: ["headers", "env"],
+    vault: ["entry"],
+    handle: ["id"],
+    assertion: ["audience"],
+};
+const TEXT_MEMBER = { vault: "entry", handle: "id", assertion: "audience" };
+const HEADER_NAME = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const ECHO_MAX = 64;
+const UNSAFE = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\p{DI}\p{NChar}\p{Co}\ud800-\udfff]/u;
+const UNSAFE_ALL = new RegExp(UNSAFE.source, "gu");
+const ABSENT = Object.freeze({ found: "absent" });
+const ACCESSOR = Object.freeze({ found: "accessor" });
+const NOT_A_RECORD = Object.freeze({ ok: false, problem: Object.freeze({ reason: "not_a_record" }) });
+function isRecord(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === null || Object.getPrototypeOf(proto) === null;
+}
+function member(record, key) {
+    const descriptor = Object.getOwnPropertyDescriptor(record, key);
+    if (descriptor === undefined || descriptor.enumerable !== true)
+        return ABSENT;
+    return Object.hasOwn(descriptor, "value") ? { found: "value", value: descriptor.value } : ACCESSOR;
+}
+const echo = (text) => text.slice(0, ECHO_MAX).replace(UNSAFE_ALL, "?");
+const refused = (problem) => Object.freeze({ ok: false, problem: Object.freeze(problem) });
+const accepted = (ref) => Object.freeze({ ok: true, ref });
+const isText = (value) => typeof value === "string" && value.length > 0 && value.length <= CREDENTIAL_REF_TEXT_MAX && !UNSAFE.test(value) && value === value.trim();
+const isName = (value, form) => value.length <= CREDENTIAL_REF_TEXT_MAX && form.test(value);
+function nameMap(value, keyForm, foldCase) {
+    try {
+        if (!isRecord(value))
+            return undefined;
+        const names = Object.keys(value);
+        if (names.length === 0 || names.length > CREDENTIAL_REF_MAP_MAX)
+            return undefined;
+        const out = Object.create(null);
+        const folded = new Set();
+        for (const name of names) {
+            const found = member(value, name);
+            if (found.found !== "value" || typeof found.value !== "string")
+                return undefined;
+            if (!isName(name, keyForm) || !isName(found.value, ENV_NAME))
+                return undefined;
+            if (foldCase) {
+                const key = name.toLowerCase();
+                if (folded.has(key))
+                    return undefined;
+                folded.add(key);
+            }
+            out[name] = found.value;
+        }
+        return Object.freeze(out);
+    }
+    catch {
+        return undefined;
+    }
+}
+const mapOf = (found, keyForm, foldCase) => (found.found === "value" ? nameMap(found.value, keyForm, foldCase) : undefined);
+function envRef(record) {
+    const given = { headers: member(record, "headers"), env: member(record, "env") };
+    if (given.headers.found === "absent" && given.env.found === "absent")
+        return refused({ reason: "missing_field", kind: "env", field: "headers|env" });
+    const headers = mapOf(given.headers, HEADER_NAME, true);
+    if (given.headers.found !== "absent" && headers === undefined)
+        return refused({ reason: "bad_value", kind: "env", field: "headers" });
+    const env = mapOf(given.env, ENV_NAME, false);
+    if (given.env.found !== "absent" && env === undefined)
+        return refused({ reason: "bad_value", kind: "env", field: "env" });
+    return accepted(Object.freeze({ kind: "env", ...(headers === undefined ? {} : { headers }), ...(env === undefined ? {} : { env }) }));
+}
+function read(value) {
+    if (!isRecord(value))
+        return NOT_A_RECORD;
+    const named = member(value, "kind");
+    if (named.found === "absent")
+        return refused({ reason: "missing_field", field: "kind" });
+    if (named.found !== "value" || typeof named.value !== "string")
+        return refused({ reason: "bad_value", field: "kind" });
+    const text = named.value;
+    const kind = CREDENTIAL_REF_KINDS.find((k) => k === text);
+    if (kind === undefined)
+        return refused({ reason: "unknown_kind", kind: echo(text) });
+    for (const key of Object.keys(value)) {
+        if (key !== "kind" && !MEMBERS[kind].includes(key))
+            return refused({ reason: "extra_field", kind, field: echo(key) });
+    }
+    if (kind === "env")
+        return envRef(value);
+    const field = TEXT_MEMBER[kind];
+    const found = member(value, field);
+    if (found.found === "absent")
+        return refused({ reason: "missing_field", kind, field });
+    if (found.found !== "value" || !isText(found.value))
+        return refused({ reason: "bad_value", kind, field });
+    if (kind === "vault")
+        return accepted(Object.freeze({ kind, entry: found.value }));
+    if (kind === "handle")
+        return accepted(Object.freeze({ kind, id: found.value }));
+    return accepted(Object.freeze({ kind, audience: found.value }));
+}
+export function readCredentialRef(value) {
+    try {
+        return read(value);
+    }
+    catch {
+        return NOT_A_RECORD;
+    }
+}

package/dist/primitives/index.d.ts

@@ -0,0 +1,2 @@
+/** The package entry of `@sema-agent/primitives`; core reads the same modules directly. */
+export { CREDENTIAL_REF_KINDS, CREDENTIAL_REF_TRUST, CREDENTIAL_REF_TEXT_MAX, CREDENTIAL_REF_MAP_MAX, CREDENTIAL_REF_PROBLEM_REASONS, readCredentialRef, type CredentialRef, type CredentialRefKind, type CredentialRefRequestAdmission, type CredentialRefProblem, type CredentialRefProblemReason, type CredentialRefReading, } from "./credential-ref.js";

package/dist/primitives/index.js

@@ -0,0 +1 @@
+export { CREDENTIAL_REF_KINDS, CREDENTIAL_REF_TRUST, CREDENTIAL_REF_TEXT_MAX, CREDENTIAL_REF_MAP_MAX, CREDENTIAL_REF_PROBLEM_REASONS, readCredentialRef, } from "./credential-ref.js";

package/dist/stores/file/checkpoint-store.d.ts

@@ -35,10 +35,6 @@ export declare class FileCheckpointStore implements CheckpointStore {
      *  same JSON reading as the ledger line); the declaration is what makes the loss visible to the mint BEFORE the
      *  row is filed. */
     readonly fidelity: "json";
-    /** F-012 L2: `reopen` here is a real resolved→pending CAS journaled to the ledger — declared, not sniffed. */
-    readonly redecision: {
-        readonly reopen: true;
-    };
     /** The execution-outcome record verb below is the contract's CAS (journaled), and `reopen` honours the record. */
     readonly execution: {
         readonly outcome: true;

package/dist/stores/file/checkpoint-store.js

@@ -88,7 +88,6 @@ const checkpointLedgers = new SharedLedgerTable({
 export class FileCheckpointStore {
     durability = "durable";
     fidelity = "json";
-    redecision = { reopen: true };
     execution = { outcome: true };
     holderIsCurrent;
     fsyncEnabled;

package/dist/stores/file/file-history-store.js

@@ -1147,6 +1147,14 @@ export class FileFileHistoryStore {
             const shaped = validateFileHistoryExport(data);
             if (!shaped.ok)
                 return shaped;
+            for (const b of data.boundaries) {
+                try {
+                    historyPathComponent(b.entryId);
+                }
+                catch (err) {
+                    return { ok: false, error: { code: "unsupported_format", message: `importHistory refused a boundary entry id this backend cannot hold as a record name: ${thrownText(err)} — nothing was fetched or published` } };
+                }
+            }
             const target = await this.importTargetOf(scope, data, "before");
             if (typeof target === "object")
                 return target;
@@ -1164,7 +1172,7 @@ export class FileFileHistoryStore {
             return await this.runImport(scope, data, srcGetBlob, importJournal, identicalRepublish);
         }
         catch (err) {
-            return { ok: false, error: { code: "unsupported_format", message: `importHistory failed: ${thrownText(err)}`, ...caughtFault(err) } };
+            return { ok: false, error: { code: "adopt_failed", message: `importHistory failed: ${thrownText(err)}`, ...caughtFault(err) } };
         }
     }
     async runImport(scope, data, srcGetBlob, importJournal, identicalRepublish) {
@@ -1191,12 +1199,12 @@ export class FileFileHistoryStore {
                         bytes = await srcGetBlob(v.blobHash);
                     }
                     catch (err) {
-                        return { ok: false, error: { code: "unsupported_format", message: `source blob ${v.blobHash} fetch failed: ${thrownText(err)}`, ...caughtFault(err) } };
+                        return { ok: false, error: { code: "adopt_failed", message: `source blob ${v.blobHash} fetch failed: ${thrownText(err)}`, ...caughtFault(err) } };
                     }
                     if (bytes === undefined)
                         return { ok: false, error: { code: "adopt_failed", message: `source blob ${v.blobHash} is missing — the envelope's graph cannot be completed, so nothing is published` } };
                     if (createHash("sha256").update(bytes).digest("hex") !== v.blobHash) {
-                        return { ok: false, error: { code: "unsupported_format", message: `source blob ${v.blobHash} fails content-address integrity — refused, nothing published` } };
+                        return { ok: false, error: { code: "adopt_failed", message: `source blob ${v.blobHash} fails content-address integrity — refused, nothing published` } };
                     }
                     this.putBlob(v.blobHash, bytes);
                 }
@@ -1250,7 +1258,7 @@ export class FileFileHistoryStore {
             return { ok: true };
         }
         catch (err) {
-            return { ok: false, error: { code: "unsupported_format", message: `importHistory failed: ${thrownText(err)}`, ...caughtFault(err) } };
+            return { ok: false, error: { code: "adopt_failed", message: `importHistory failed: ${thrownText(err)}`, ...caughtFault(err) } };
         }
         finally {
             safeRm(importJournal);

package/dist/stores/file/mailbox-store.d.ts

@@ -1,4 +1,4 @@
-import { type MailboxAckResult, type MailboxAppendMessage, type MailboxLease, type MailboxStore } from "../../core/mailbox-store.js";
+import { type MailboxAckResult, type MailboxAppendMessage, type MailboxLease, type MailboxDecisionOutcome, type MailboxDecision, type MailboxStore } from "../../core/mailbox-store.js";
 import { type CorruptReadInfo } from "./corrupt-read-sink.js";
 /** The waiter's refusal when a box lock stays held by a LIVE process past `lockWaitMs`. Carried as
  *  `.code` on a plain Error (consumers branch on the string); the message names the lock and the holder. */
@@ -113,6 +113,7 @@ export declare class FileMailboxStore implements MailboxStore {
     append(scope: string, handle: string, msg: MailboxAppendMessage): Promise<number>;
     claimLease(scope: string, handle: string, owner: string, ttlMs: number, now?: number): Promise<MailboxLease | null>;
     ack(scope: string, handle: string, owner: string, upToSeq: number): Promise<MailboxAckResult>;
+    moveDecision(scope: string, handle: string, seq: number, expect: MailboxDecision | undefined, next: MailboxDecision): Promise<MailboxDecisionOutcome>;
     releaseLease(scope: string, handle: string, owner: string): Promise<void>;
     peekCount(scope: string, handle: string): Promise<number>;
     drop(scope: string, handle: string): Promise<void>;

package/dist/stores/file/mailbox-store.js

@@ -2,7 +2,7 @@ import { join, resolve, sep } from "node:path";
 import { createHash, randomBytes } from "node:crypto";
 import { assertRetentionPolicy } from "../../core/retention-policy.js";
 import { existsSync, linkSync, readdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
-import { detachMailboxMessage, newestSentAt, readMailboxPeerMeta, } from "../../core/mailbox-store.js";
+import { assertMailboxDecisionMove, detachMailboxMessage, newestSentAt, readStoredMailboxDecision, readMailboxPeerMeta, } from "../../core/mailbox-store.js";
 import { AppendLog, atomicWriteFile, canonicalStoreKey, ensureDir, readJsonlRecords, sanitizeScope, sanitizePathComponent } from "./fs-atomic.js";
 import { guardCorruptSink } from "./corrupt-read-sink.js";
 import { physicalPathOf } from "../../core/physical-path.js";
@@ -478,6 +478,19 @@ export class FileMailboxStore {
             return { acked: true };
         });
     }
+    async moveDecision(scope, handle, seq, expect, next) {
+        assertMailboxDecisionMove(seq, expect, next);
+        return this.withBox(this.lockKey(scope, handle), this.boxPath(scope, handle), () => {
+            const b = this.load(scope, handle);
+            const m = b.messages.find((x) => x.seq === seq);
+            if (m === undefined)
+                return { ok: false, current: "gone" };
+            if (m.decision !== expect)
+                return { ok: false, current: m.decision ?? "unset" };
+            this.commit(b, this.boxPath(scope, handle), { t: "decision", seq, state: next });
+            return { ok: true };
+        });
+    }
     async releaseLease(scope, handle, owner) {
         return this.withBox(this.lockKey(scope, handle), this.boxPath(scope, handle), () => {
             const b = this.load(scope, handle);
@@ -592,12 +605,19 @@ const MAILBOX_EVENT_JUDGE = {
             return typeof ev.owner === "string" && num(ev.maxSeq) && num(ev.expiresAt);
         if (ev.t === "ack")
             return num(ev.upToSeq);
+        if (ev.t === "decision")
+            return num(r.seq) && typeof r.state === "string";
         return ev.t === "release" && typeof ev.owner === "string";
     },
     what: "a mailbox record is not one of this box's events — an unknown tag, or a known tag whose payload is missing",
 };
 function applyEvent(b, ev) {
     if (ev.t === "append") {
+        const decision = readStoredMailboxDecision(ev.m.decision);
+        if (decision === undefined)
+            delete ev.m.decision;
+        else
+            ev.m.decision = decision;
         b.messages.push(ev.m);
         if (ev.m.seq >= b.nextSeq)
             b.nextSeq = ev.m.seq + 1;
@@ -613,6 +633,11 @@ function applyEvent(b, ev) {
         if (b.lease !== undefined && b.lease.maxSeq <= ev.upToSeq)
             b.lease = undefined;
     }
+    else if (ev.t === "decision") {
+        const m = b.messages.find((x) => x.seq === ev.seq);
+        if (m !== undefined)
+            m.decision = readStoredMailboxDecision(ev.state) ?? "held";
+    }
     else if (b.lease?.owner === ev.owner) {
         b.lease = undefined;
     }

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -2,15 +2,15 @@ import { type LexedCommand, type LexedSegment, type LexedWord, type ShellLex, ty
 import { type ProgramRow } from "./program-read-model.js";
 /**
  * Bare command names `bash_readonly` permits out of the box, ALSO the default reversible set for the
- * The {@link import("./fs-bash.js").bashReversibilityProbe} classifier. **Coarse first filter, NOT a security
- * boundary**: {@link coarseReadonlyCheck} matches only the command NAME, so a listed command with a
- * writing flag (e.g. `find -delete`, `sort -o`, `tee`) would still write. Such commands are therefore
- * kept OFF this default — the list is curated to commands with NO write/mutation mode under ANY args, so
- * the `effect:"read"` declaration (relied on by wake/resume reconcile + the verifier read-only boundary)
- * AND the classifier's "reversible" promise both stay truthful. The deployment's tool-policy gate is the
- * authoritative control (council blocker #1); anything that can mutate state or run arbitrary
- * code belongs on the full `bash` (effect:write, gated), not here. A deployment may widen this list,
- * accepting that responsibility.
+ * {@link import("./fs-bash.js").bashReversibilityProbe} classifier. On the read-only face and in the transcript gate the
+ * list only NARROWS the read-only reader ({@link import("../../core/read-only-shell.js").readOnlyShellVerdict}'s
+ * `readers`): a listed program runs there only in a call the reader reads as read-only, so a deployment that widens the
+ * list with `sort` still has `sort -o out f` refused. The reversibility classifier reads the list as its allowlist: a
+ * listed program with a program-model row has its writing options refused by the row; one without a row is admitted
+ * by its name. The default is curated to commands with NO write/mutation mode under ANY args, so the `effect:"read"`
+ * declaration (relied on by wake/resume reconcile + the verifier read-only boundary) AND the classifier's
+ * "reversible" promise both stay truthful. The deployment's tool-policy gate is the authoritative control;
+ * anything that can mutate state or run arbitrary code belongs on the full `bash` (effect:write, gated), not here.
  *
  * Deliberately ABSENT: `date` (`-s`/`--set` → CLOCK_SETTIME), `hostname` (`<name>` → kernel
  * hostname), and `file` (`-C -m` → compiles/writes a magic file) were REMOVED — each is read-only by NAME
@@ -112,7 +112,7 @@ export interface LeadingCommandNameOptions {
     pathPrefixedNameIsText?: boolean;
 }
 /**
- * The SINGLE fail-closed simple-command parser shared by `bash_readonly` ({@link coarseReadonlyCheck}), the
+ * The SINGLE fail-closed simple-command parser shared by `bash_readonly`'s single-command admission, the
  * `bash` reversibility classifier ({@link import("./fs-bash.js").bashReversibilityProbe}), and the coarse command-name policy
  * ({@link import("../../core/tool-policy.js").createCoarseCommandNamePolicy}). It extracts the leading
  * `argv[0]` command NAME of a SINGLE simple command, rejecting anything that could chain past or escape an
@@ -131,13 +131,9 @@ export declare function parseLeadingCommandName(command: string, options?: Leadi
 } | {
     reject: string;
 };
-/** Coarse pre-execution check for `bash_readonly`: the command must be a single bare allowlisted command
- *  with no shell operators. It validates the NAME only (+ blocks operators/path-prefix/env-assignment); it
- *  does NOT inspect arguments for write flags — keeping the allowlist free of write-capable commands and
- *  the policy gate are what make `effect:"read"` truthful. Returns a reason when rejected, else undefined.
- *  This `effect:"read"` DECLARATION face deliberately stays strict-single-command; only the
- *  classify face ({@link classifyCompoundReadonly} via {@link import("./fs-bash.js").bashReversibilityProbe}) segments compounds. */
-export declare function coarseReadonlyCheck(command: string, allow: ReadonlySet<string>, options?: LeadingCommandNameOptions): string | undefined;
+/** The one sentence for a program a face's list of programs does not name — the compound classifier's list check and
+ *  the read-only reader's `readers` narrowing both mint it here. */
+export declare function unlistedReaderSentence(program: string): string;
 /**
  * Does this text carry a bare redirection operator — the ONE metacharacter family
  * {@link splitShellCompoundSegments} can be asked to tolerate at its whole-string gate
@@ -226,7 +222,7 @@ export declare function splitShellCompoundSegments(source: string, options?: {
 /**
  * Compound read-only classification for the `bash` full-shell face (the shape tier).
  * Splits a command on the connector set `;` `&&` `||` `|` and passes every segment through
- * {@link coarseReadonlyCheck} (the single {@link parseLeadingCommandName} parser + bare-name allowlist).
+ * the single {@link parseLeadingCommandName} parser and the bare-name allowlist.
  * All segments green ⇒ read-only. Returns a reason when rejected, else undefined.
  *
  * G2 — the split CARRIES QUOTE STATE (the one lexer): a connector character inside a quoted region is
@@ -548,7 +544,7 @@ export declare const POLL_LOOP_MAX_SLEEP_SECONDS = 600;
  *     -f`, unbounded devices all reject), and `sleep` must be a literal ≤
  *     {@link POLL_LOOP_MAX_SLEEP_SECONDS}. Bounded beats × terminating body ⇒ the loop halts.
  *  G2 NO WRITE OR EGRESS CHANNEL. Every non-`sleep` body segment must pass the SAME
- *     {@link coarseReadonlyCheck} parser + allowlist as the plain face (one parser, no drift);
+ *     {@link parseLeadingCommandName} parser + allowlist the compound classifier reads (one parser, no drift);
  *     `sleep` touches neither filesystem nor network. No redirection (`>` `<`), no `$`/backtick
  *     substitution, no subshell exists anywhere: the body bans them wholesale
  *     ({@link POLL_BODY_HARD_REJECT}), and the head's single `$(seq <int> <int>)` exemption is an

package/dist/tools/fs/bash-readonly-classifier.js

@@ -71,13 +71,8 @@ export function parseLeadingCommandName(command, options) {
         return { reject: "the command name must be a bare token (no quotes, braces, globs, or ~)" };
     return { name: first };
 }
-export function coarseReadonlyCheck(command, allow, options) {
-    const parsed = parseLeadingCommandName(command, options);
-    if ("reject" in parsed)
-        return parsed.reject;
-    if (!allow.has(parsed.name))
-        return `command "${parsed.name}" is not in the read-only allowlist`;
-    return undefined;
+export function unlistedReaderSentence(program) {
+    return `command "${program}" is not in the read-only allowlist`;
 }
 const SHELL_SEGMENT_QUOTE_BLIND_REJECT = /[<>()`\n\r\\]/;
 const SHELL_EXPANSION_CHARS = /[$]/;
@@ -761,7 +756,7 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
             return { reason: "`coproc` backgrounds a command — a backgrounded process outlives the command" };
         if (isBareControlWord(words, from, BLOCK_WORD_NAMES)) {
             unlistedSegments.add(si);
-            nameRefusal ??= `command "${written}" is not in the read-only allowlist`;
+            nameRefusal ??= unlistedReaderSentence(written);
             continue;
         }
         const program = pos.program;
@@ -783,10 +778,10 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
             if (pathPrefixed || from > 0)
                 reheaded.set(si, { from, head: name });
             if (from > 0)
-                nameRefusal ??= `command "${folded[0]}" is not in the read-only allowlist`;
+                nameRefusal ??= unlistedReaderSentence(folded[0]);
             continue;
         }
-        nameRefusal ??= `command "${parsed.name}" is not in the read-only allowlist`;
+        nameRefusal ??= unlistedReaderSentence(parsed.name);
         if (runsShellText(name))
             return { reason: unjudgedProgramTextRefusal(parsed.name, "runs its argument as shell text") };
         if (pos.launchers.length > 0) {

package/dist/tools/fs/fs-bash.js

@@ -16,7 +16,8 @@ import { boundaryIsTheSandbox, hasDestroy, isIsolated } from "../../core/remote-
 import { ghRateLimitHint } from "./gh-rate-limit.js";
 import { backgroundLifetimeNote } from "./fs-bash-background-text.js";
 import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, shellRecoveryHint, CWD_SENTINEL, stripCwdSentinel, } from "./fs-shared.js";
-import { bashClassifyDefaultAllow, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed } from "./bash-readonly-classifier.js";
+import { bashClassifyDefaultAllow, BASH_READONLY_DEFAULT_ALLOW, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed, parseLeadingCommandName } from "./bash-readonly-classifier.js";
+import { readOnlyShellVerdict } from "../../core/read-only-shell.js";
 import { mountRuleFace, toolFace } from "../../core/tool-catalog-entries.js";
 import { argvOf, compoundValueHidesRun, expansionHidesRun, expansionsInHeredocBody, lexShell } from "../../shell/lex.js";
 import { arithmeticAssignedNames } from "./shell-read-bindings.js";
@@ -26,6 +27,12 @@ function shellCommandOf(args) {
     const command = args?.command;
     return typeof command === "string" ? command : undefined;
 }
+const CONCURRENT_READERS = new Set(BASH_READONLY_DEFAULT_ALLOW);
+function readOnlyFaceRefusal(command, allow) {
+    const parsed = parseLeadingCommandName(command);
+    const verdict = "reject" in parsed ? { readOnly: false, reason: parsed.reject } : readOnlyShellVerdict(command, { readers: allow });
+    return verdict.readOnly ? undefined : verdict.reason;
+}
 function isBackgroundShellCall(args) {
     return args?.run_in_background === true;
 }
@@ -578,7 +585,7 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
             const command = shellCommandOf(args);
             if (command === undefined || isBackgroundShellCall(args))
                 return false;
-            return coarseReadonlyCheck(command, new Set(BASH_READONLY_DEFAULT_ALLOW)) === undefined;
+            return readOnlyShellVerdict(command, { readers: CONCURRENT_READERS }).readOnly;
         },
         execute: async (args, ctx) => {
             const { command, timeout, run_in_background, description } = args;
@@ -797,7 +804,7 @@ export function createBashReadonlyTool(env, rootCanonical, allow, opts) {
             const timeoutRefusal = bashTimeoutArgRefusal(timeout, timeoutCaps);
             if (timeoutRefusal !== undefined)
                 return errorResult(timeoutRefusal, { type: "bash_invalid_timeout", code: "bash_invalid_timeout" });
-            const reason = coarseReadonlyCheck(command, allow);
+            const reason = readOnlyFaceRefusal(command, allow);
             if (reason)
                 return errorResult(`Error (Bash): ${reason}`);
             const refused = await opts?.shellReadAdmission?.("Bash", ctx.toolCallId, command, ctx.signal);

package/dist/tools/fs/pattern-kill-guard.d.ts

@@ -12,8 +12,9 @@ export interface PatternKillReading {
 export declare function patternKillReadings(command: string, cwd: string): PatternKillReading[];
 /**
  * The refusal for a command whose pattern-kill would select this agent's own process or one above it — or undefined (run it).
- * `cwd`: where the command stands, for the plan's read of its words (nothing is read from disk). Remote environments and
- * Windows are not asked: their process table is not this one.
+ * `cwd`: where the command stands, for the plan's read of its words (nothing is read from disk). Where the question is put is
+ * the env's own declaration ({@link processTableOf}): this process's table is asked, another table is not, and an env that does
+ * not say is refused. Windows is not asked: this process's table is not read there.
  */
 export declare function patternKillRefusal(command: string, env: ExecutionEnv, cwd: string, signal?: AbortSignal): Promise<{
     content: string;