@sema-agent/core 7.56.0 → 7.57.0

package/dist/tools/fs/pattern-kill-guard.js

@@ -1,15 +1,18 @@
 import { spawn } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { errorResult } from "../../core/tools.js";
-import { isRemoteExecutionEnv } from "../../core/remote-env.js";
+import { processTableOf } from "../../core/remote-env.js";
 import { inheritedHostEnv } from "../../core/secret-env.js";
 import { inlineUntrusted } from "../../core/untrusted-text.js";
 import { planShellReads } from "./shell-read-plan.js";
 import { programArgs } from "./shell-read-write-targets.js";
 const PROBE_TIMEOUT_MS = 5_000;
 const ANCESTOR_HOPS_MAX = 128;
-const SHELL_PID_WORD = /^\$(?:\$|\{\$\}|BASHPID|\{BASHPID\})$/;
+const SHELL_PID_SPELLING = String.raw `\$(?:\$|\{\$\})`;
+const SHELL_PID_WORD = new RegExp(`^${SHELL_PID_SPELLING}$`);
+const SHELL_PID_EXPANSION = new RegExp(SHELL_PID_SPELLING, "g");
 const NAME_SELECTION_KEEPS_ANCESTORS = process.platform === "linux" ? [] : ["-a"];
+const OPTIONS_END_AT_FIRST_OPERAND = process.platform !== "linux";
 const SIGNAL_ONLY_FIRST_ARGUMENT = process.platform !== "linux";
 const HANDLER_SELECTS_BY_SIGNAL = process.platform === "linux";
 const LONG_OPTIONS = new Map([
@@ -54,21 +57,28 @@ const isSignalWord = (w) => {
     const m = SIGNAL_WORD.exec(w);
     return m !== null && (m[1] === undefined || SIGNAL_NAMES.has(m[1].toUpperCase()));
 };
-function selectorWords(allWords, killer) {
+function readSelection(allWords, killer) {
     const signalAt = killer !== "pkill" ? -1 : SIGNAL_ONLY_FIRST_ARGUMENT ? (isSignalWord(allWords[0] ?? "") ? 0 : -1) : allWords.findIndex(isSignalWord);
     const signalWord = signalAt < 0 ? undefined : allWords[signalAt].slice(1);
     const words = signalAt < 0 ? allWords : allWords.filter((_, i) => i !== signalAt);
     const out = [];
+    const parentLists = [];
     let ended = false;
     let requireHandler = false;
+    let negated = false;
     let signalOption;
     let valueOf;
+    const valueGiven = (key, value) => {
+        if (key === "P")
+            parentLists.push(value.split(","));
+    };
     for (const w of words) {
         if (valueOf !== undefined) {
-            if (valueOf === "ask")
+            if (valueOf.fate === "ask")
                 out.push(w);
-            else if (valueOf === "signal")
+            else if (valueOf.fate === "signal")
                 signalOption = w;
+            valueGiven(valueOf.key, w);
             valueOf = undefined;
             continue;
         }
@@ -82,60 +92,75 @@ function selectorWords(allWords, killer) {
         if (key !== undefined && (takesValueKey(key) || longValue === undefined)) {
             if (key === "H")
                 requireHandler = true;
+            if (key === "v")
+                negated = true;
             const fate = fateOfKey(key);
             if (fate === "ask")
                 out.push(w);
             if (takesValueKey(key) && longValue === undefined)
-                valueOf = fate;
-            else if (fate === "signal" && longValue !== undefined)
-                signalOption = longValue;
+                valueOf = { fate, key };
+            else if (longValue !== undefined) {
+                if (fate === "signal")
+                    signalOption = longValue;
+                valueGiven(key, longValue);
+            }
             continue;
         }
         const letters = bundledLetters(w);
         if (letters === undefined) {
             out.push(w);
+            if (OPTIONS_END_AT_FIRST_OPERAND && (w === "-" || !w.startsWith("-")))
+                ended = true;
             continue;
         }
         if (letters.includes("H"))
             requireHandler = true;
+        if (letters.includes("v"))
+            negated = true;
         const last = letters[letters.length - 1];
         const fate = fateOfKey(last);
         const kept = letters.filter((ch) => fateOfKey(ch) === "ask").join("");
         const attached = VALUED_LETTERS.has(last) ? w.slice(1 + letters.length) : "";
         if (kept !== "")
             out.push(`-${kept}${fate === "ask" ? attached : ""}`);
-        if (VALUED_LETTERS.has(last) && attached === "")
-            valueOf = fate;
+        if (VALUED_LETTERS.has(last)) {
+            if (attached === "")
+                valueOf = { fate, key: last };
+            else
+                valueGiven(last, attached);
+        }
     }
     const signal = signalOption ?? signalWord;
-    return HANDLER_SELECTS_BY_SIGNAL && requireHandler && signal !== undefined ? ["--signal", signal, ...out] : out;
+    return { words: HANDLER_SELECTS_BY_SIGNAL && requireHandler && signal !== undefined ? ["--signal", signal, ...out] : out, parentLists, negated };
 }
-const negatesSelection = (words) => words.some((w) => w === "--inverse" || (bundledLetters(w)?.includes("v") ?? false));
-function selectsOnlyShellChildren(words) {
-    return words.some((w, i) => {
-        if (w === "-P" || w === "--parent")
-            return SHELL_PID_WORD.test(words[i + 1] ?? "");
-        const attached = /^(?:-P|--parent=)(.+)$/.exec(w);
-        return attached !== null && SHELL_PID_WORD.test(attached[1]);
-    });
+const LAST_PARENT_LIST_WINS = process.platform === "linux";
+function boundedToShellChildren(read, unread) {
+    if (unread !== undefined)
+        return false;
+    const standing = LAST_PARENT_LIST_WINS ? read.parentLists.slice(-1) : read.parentLists;
+    return standing.length > 0 && standing.every((list) => list.every((pid) => SHELL_PID_WORD.test(pid)));
 }
 const literalName = (name) => name.replace(/[\\.[\]{}()*+?^$|]/g, "\\$&");
 function wordsOf(segment) {
     const args = programArgs(segment);
-    const rewritten = args.find((a) => a.rewritten === true);
-    const computed = segment.reentry === "argv" ? "its arguments arrive on a stream" : rewritten === undefined ? undefined : `\`${inlineUntrusted(rewritten.raw, 60)}\` is expanded by the shell when the command runs`;
-    return { words: args.map((a) => a.spelled), ...(computed !== undefined ? { computed } : {}) };
+    const expands = (a) => `\`${inlineUntrusted(a.raw, 60)}\` is expanded by the shell when the command runs`;
+    const stream = segment.reentry === "argv" ? "its arguments arrive on a stream" : undefined;
+    const opaque = args.find((a) => a.rewritten === true && /[$`*?[~{\\]/.test(a.raw.replace(SHELL_PID_EXPANSION, "0")));
+    const first = args.find((a) => a.rewritten === true);
+    const unread = stream ?? (opaque === undefined ? undefined : expands(opaque));
+    const computed = unread ?? (first === undefined ? undefined : expands(first));
+    return { words: args.map((a) => a.spelled), ...(computed !== undefined ? { computed } : {}), ...(unread !== undefined ? { unread } : {}) };
 }
 const shown = (segment) => inlineUntrusted(segment.text, 200);
 function readPkill(segment) {
-    const { words, computed } = wordsOf(segment);
-    if (selectsOnlyShellChildren(words)) {
-        return negatesSelection(words) ? { text: shown(segment), probes: [], computed: "`-v` negates the selection, so `-P` of the shell's pid no longer limits it to the shell's children" } : undefined;
+    const { words, computed, unread } = wordsOf(segment);
+    const read = readSelection(words, "pkill");
+    if (boundedToShellChildren(read, unread)) {
+        return read.negated ? { text: shown(segment), probes: [], computed: "the selection is negated (`-v` / `--inverse`), so `-P` of the shell's pid no longer limits it to the shell's children" } : undefined;
     }
     if (computed !== undefined)
         return { text: shown(segment), probes: [], computed };
-    const selectors = selectorWords(words, "pkill");
-    return selectors.length === 0 ? undefined : { text: shown(segment), probes: [selectors] };
+    return read.words.length === 0 ? undefined : { text: shown(segment), probes: [read.words] };
 }
 const OPT_FLAG = { does: "flag" };
 const OPT_FILTER = { does: "filter" };
@@ -157,7 +182,6 @@ const KILLALL_OPTIONS = new Map([
     ["-v", OPT_FLAG], ["--verbose", OPT_FLAG], ["-V", OPT_FLAG], ["--version", OPT_FLAG], ["-w", OPT_FLAG], ["--wait", OPT_FLAG], ["-d", OPT_FLAG], ["-z", OPT_FLAG], ["--help", OPT_FLAG],
 ]);
 const takesValue = (opt) => opt !== undefined && (opt.does === "select" || opt.does === "context" || opt.does === "filter" || opt.does === "valued");
-const OPTIONS_END_AT_FIRST_NAME = process.platform !== "linux";
 const KILLALL_VALUED_LETTERS = new Set([...KILLALL_OPTIONS].filter(([spelling, opt]) => !spelling.startsWith("--") && takesValue(opt)).map(([spelling]) => spelling.slice(1)));
 function optionsOf(w) {
     if (w.startsWith("--")) {
@@ -185,7 +209,7 @@ function readKillallWords(words) {
         }
         if (!w.startsWith("-") || w === "-") {
             names.push(w);
-            if (OPTIONS_END_AT_FIRST_NAME) {
+            if (OPTIONS_END_AT_FIRST_OPERAND) {
                 names.push(...words.slice(i + 1));
                 break;
             }
@@ -238,7 +262,7 @@ function readSelector(segment) {
         const names = read.words.filter((w, i) => !w.startsWith("-") && read.words[i - 1] !== "-o");
         return { text: shown(segment), probes: names.map((n) => [...NAME_SELECTION_KEEPS_ANCESTORS, "-x", literalName(n)]) };
     }
-    return { text: shown(segment), probes: [selectorWords(read.words, "pgrep")] };
+    return { text: shown(segment), probes: [readSelection(read.words, "pgrep").words] };
 }
 const SELECTORS = new Set(["pgrep", "pidof"]);
 const EVERY_PROCESS_PID = /^-0*1$/;
@@ -358,12 +382,8 @@ const SENTENCE = {
     computed: (f) => `Error (Bash): refusing to run \`${f.text}\` — which processes it selects is decided when the command runs (${f.why}), so it cannot first be checked against this agent's own process and the processes above it. Write the pattern into the command as a literal, ${WAY_OUT}.`,
     unavailable: (f) => `Error (Bash): refusing to run \`${f.text}\` — the check that its selection holds neither this agent's own process nor a process above it could not run (${f.why}). Stop the process by its PID, or target your own children with \`pkill -P $$ ...\`.`,
 };
-export async function patternKillRefusal(command, env, cwd, signal) {
-    if (process.platform === "win32" || isRemoteExecutionEnv(env))
-        return undefined;
-    const readings = patternKillReadings(command, cwd);
-    if (readings.length === 0)
-        return undefined;
+const UNDECLARED_TABLE = "the execution environment does not declare whether its commands run on this agent's process table — `capabilities.sharesProcessTable` is missing or not a boolean";
+async function findingsOnThisTable(readings, signal) {
     const found = [];
     const asked = await Promise.all(readings.map(async (r) => ({ r, answers: await Promise.all(r.probes.map((p) => selected(p, signal))) })));
     let ancestry;
@@ -389,6 +409,18 @@ export async function patternKillRefusal(command, env, cwd, signal) {
                 found.push({ kind: "hit", text: r.text, pid, own: pid === process.pid });
         }
     }
+    return found;
+}
+export async function patternKillRefusal(command, env, cwd, signal) {
+    if (process.platform === "win32")
+        return undefined;
+    const readings = patternKillReadings(command, cwd).filter((r) => r.probes.length > 0 || r.computed !== undefined || r.everyProcess === true);
+    if (readings.length === 0)
+        return undefined;
+    const table = processTableOf(env);
+    if (table === "other")
+        return undefined;
+    const found = table === "this" ? await findingsOnThisTable(readings, signal) : [{ kind: "unavailable", text: readings[0].text, why: UNDECLARED_TABLE }];
     const f = found.find((x) => x.kind === "hit") ?? found.find((x) => x.kind === "computed") ?? found[0];
     if (f === undefined || signal?.aborted === true)
         return undefined;

package/dist/tools/fs/shell-read-check.d.ts

@@ -20,6 +20,7 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { violationDetails } from "./safety.js";
 import { type ShellReadPlan } from "./shell-read-plan.js";
+import { type ReadLanding } from "./shell-read-identity.js";
 import { type HomeViewSource } from "./read-deny-home.js";
 import { type EstablishedRead, type ShellReadBoundary, type ShellReadDisposition, type ShellReadFinding, type ShellReadSeat } from "./shell-read-judge.js";
 import type { ReadRootGrantCandidate } from "../../core/tool-spec.js";
@@ -169,9 +170,18 @@ export type ShellReadAdmission = (toolName: string, toolCallId: string | undefin
     isError: true;
     details?: unknown;
 } | undefined>;
+/** Where the station's last non-refused judgment of a call found its reads land (`readLandingsOf`): the judgment its
+ *  admission holds for the call id — the one the spawn re-establishes — read without consuming it. `undefined` ⇒ the
+ *  station holds none (a refused judgment records nothing). Its readers take it right where the latest judgment is a
+ *  non-refused one of the bytes they hold: the park when the filed bytes are the judged ones, the resumed leg's execution
+ *  station after its belt. A judgment that settles after a newer one replaced it is what the spawn would re-establish too:
+ *  the spawn then refuses bytes the entry does not describe, and a row bound to it vetoes the resume wherever the two
+ *  commands' reads differ (fail-closed either way). */
+export type ShellReadLandings = (toolCallId: string) => readonly ReadLanding[] | undefined;
 export interface ShellReadStation {
     readonly check: ShellReadCheck;
     readonly admit: ShellReadAdmission;
+    readonly landings: ShellReadLandings;
 }
 export interface ShellReadStationOptions {
     readonly env: ExecutionEnv;

package/dist/tools/fs/shell-read-check.js

@@ -7,6 +7,7 @@ import { NOT_AUTO_ALLOWED, declinedProgramSentence } from "./bash-program-positi
 import { bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
 import { planShellReads } from "./shell-read-plan.js";
 import { createShellReadEstablisher, establishShellReadsLexically } from "./shell-read-establish.js";
+import { readLandingsOf } from "./shell-read-identity.js";
 import { declaredReadDenyHomes, homeViewsAt } from "./read-deny-home.js";
 import { anyOptionWord, programArgs } from "./shell-read-write-targets.js";
 import { shellReadFaceWords } from "./shell-read-face.js";
@@ -395,6 +396,7 @@ export function createShellReadStation(opts) {
     };
     const admissions = new Map();
     const remember = (toolCallId, a) => {
+        admissions.delete(toolCallId);
         if (admissions.size >= ADMISSION_MAX) {
             const oldest = admissions.keys().next().value;
             if (oldest !== undefined)
@@ -478,5 +480,9 @@ export function createShellReadStation(opts) {
         const r = refusalOf(toolName, identity, a.boundary, []);
         return refused(errorResult(r.sentence, containmentDetails(changed.map((c) => c.target).filter((t) => t !== undefined))));
     };
-    return { check, admit };
+    const landings = (toolCallId) => {
+        const a = admissions.get(toolCallId);
+        return a !== undefined ? readLandingsOf(a.established) : undefined;
+    };
+    return { check, admit, landings };
 }

package/dist/tools/fs/shell-read-identity.d.ts

@@ -1,18 +1,21 @@
-/**
- * The pre-spawn identity comparison: which established reads of one plan resolve somewhere else now.
- *
- * Compared PER CANDIDATE, never as one pooled set of targets: a candidate is keyed by where it stands in the plan
- * (segment, nested plan) and by what it is (deny-only or a read, provenance, spelling, expansion, raw word), and its
- * set of established targets is compared with the same candidate's set from the re-establishment. A pooled set let
- * one candidate's targets hide another's move — `head linkx` retargeted onto a path some other word's pattern already
- * matched, or onto a home shadow's target, left the pool unchanged and the call was admitted unjudged.
- */
 import type { EstablishedPlan } from "./shell-read-establish.js";
 import type { ObservedEnvironment } from "./shell-read-environment.js";
 import type { EstablishedRead } from "./shell-read-judge.js";
 import { type HomeViewsCarrier } from "./read-deny-home.js";
 /** Every read of either establishment whose candidate's settled target set differs between the two. */
 export declare function movedReads(previous: EstablishedPlan, again: EstablishedPlan): EstablishedRead[];
+/** One read candidate's landing: its key and where it settled, each as a sha256 hex digest (the key's raw tuple joins on
+ *  NUL and follows the command's length; a pattern lands on up to thousands of entries), with the raw word and the
+ *  settled targets kept for the sentence that names a moved one. */
+export interface ReadLanding {
+    readonly key: string;
+    readonly landing: string;
+    readonly raw: string;
+    readonly targets: readonly string[];
+}
+/** Every read candidate of the establishment (nested plans included) with where it landed, in plan order. A candidate
+ *  that settled nowhere (a lexical or unestablishable read) lands on the empty set — placed later, that is a move. */
+export declare function readLandingsOf(e: EstablishedPlan): ReadLanding[];
 /**
  * The establishment with every read that landed carrying its HOME VIEW (read-deny-home.ts) among its spellings, nested
  * plans included: the deny judge then places a home-anchored row wherever the target IS below the home, whatever it is

package/dist/tools/fs/shell-read-identity.js

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { homeViewsOf } from "./read-deny-home.js";
 export function movedReads(previous, again) {
     const before = targetsByCandidate(previous);
@@ -6,12 +7,19 @@ export function movedReads(previous, again) {
     for (const key of new Set([...before.keys(), ...after.keys()])) {
         const b = before.get(key);
         const a = after.get(key);
-        if (b !== undefined && a !== undefined && sameTargets(b.targets, a.targets))
+        if (b !== undefined && a !== undefined && landingOf(b.targets) === landingOf(a.targets))
             continue;
         changed.push(...(b?.reads ?? []), ...(a?.reads ?? []));
     }
     return changed.filter((r) => r.target !== undefined);
 }
+export function readLandingsOf(e) {
+    return [...targetsByCandidate(e)].map(([key, l]) => ({ key: digest(key), landing: landingOf(l.targets), raw: l.reads[0]?.candidate.raw ?? "", targets: [...l.targets].sort() }));
+}
+function landingOf(targets) {
+    return digest(JSON.stringify([...targets].sort()));
+}
+const digest = (s) => createHash("sha256").update(s, "utf8").digest("hex");
 function targetsByCandidate(e) {
     const out = new Map();
     const walk = (p, at) => {
@@ -35,9 +43,6 @@ function targetsByCandidate(e) {
     walk(e, "");
     return out;
 }
-function sameTargets(a, b) {
-    return a.size === b.size && [...a].every((t) => b.has(t));
-}
 export async function withHomeViews(door, placed, established, signal) {
     const views = homeViewsOf(door.fs, placed, signal);
     const unread = [];

package/dist/tools/web.js

@@ -3,6 +3,7 @@ import { defineTool, errorResult } from "../core/tools.js";
 import { delimitUntrusted, inlineUntrusted } from "../core/untrusted-text.js";
 import { discloseReminderShaped, observeReminderMarkEcho } from "../core/reminder-disclosure.js";
 import { egressThrownText } from "../core/untrusted-egress.js";
+import { remoteWords } from "../core/protocol-http-auth.js";
 import { fetchFollowing, hopRefusal, HOST_FLOOR_REFUSED_CODE } from "../core/host-floor.js";
 import { hostOfUrl } from "../core/host-target.js";
 import { assertNoRetiredKeys } from "../core/retired-keys.js";
@@ -210,12 +211,13 @@ function isPermittedRedirectHop(from, to) {
     const there = hostOfUrl(to.toString());
     return "host" in here && "host" in there && here.host === there.host;
 }
+const reasonPhrase = (res) => remoteWords(res.statusText, []);
 async function fetchUnderFloor(doFetch, start, floor, userAgent, signal, onResponse) {
     const out = await fetchFollowing(doFetch, start, { method: "GET", headers: { Accept: WEBFETCH_ACCEPT, "User-Agent": userAgent }, ...(signal !== undefined ? { signal } : {}) }, {
         refusal: (url) => hopRefusal(url, floor, true),
         follows: isPermittedRedirectHop,
         maxRedirects: MAX_REDIRECTS,
-        onResponse: (res) => onResponse?.(res.status, res.statusText),
+        onResponse: (res) => onResponse?.(res.status, reasonPhrase(res)),
     });
     switch (out.kind) {
         case "answered":
@@ -328,7 +330,7 @@ export function webFetchToolSpec(config = {}) {
                     return failure(`Error (WebFetch): ${fr.error}`, connectedMeta ? { code: connectedMeta.status, codeText: connectedMeta.statusText } : {});
                 }
                 res = fr.res;
-                connectedMeta = { status: res.status, statusText: res.statusText };
+                connectedMeta = { status: res.status, statusText: reasonPhrase(res) };
                 finalResponse = true;
                 const stream = res.body;
                 if (stream && typeof stream.getReader === "function") {
@@ -449,7 +451,7 @@ export function webFetchToolSpec(config = {}) {
                             : {}),
             };
             if (!res.ok) {
-                const headline = `Error (WebFetch): HTTP ${res.status} ${res.statusText} for ${parsed.toString()}`;
+                const headline = `Error (WebFetch): HTTP ${res.status} ${reasonPhrase(res)} for ${parsed.toString()}`;
                 const looksBinary = bodyBytes !== undefined && sniffBinarySignature(bodyBytes) !== undefined;
                 const errText = looksBinary
                     ? ""
@@ -476,7 +478,7 @@ export function webFetchToolSpec(config = {}) {
                         type: "web-fetch",
                         url: parsed.toString(),
                         code: res.status,
-                        codeText: res.statusText,
+                        codeText: reasonPhrase(res),
                         bytes: bodyBytes ? bodyBytes.length : raw.length,
                         durationMs: Date.now() - startedAt,
                         ...transferStateDetails,
@@ -508,7 +510,7 @@ export function webFetchToolSpec(config = {}) {
                             type: "web-fetch",
                             url: parsed.toString(),
                             code: res.status,
-                            codeText: res.statusText,
+                            codeText: reasonPhrase(res),
                             bytes: bodyBytes.length,
                             durationMs: Date.now() - startedAt,
                             ...transferStateDetails,
@@ -634,7 +636,7 @@ export function webFetchToolSpec(config = {}) {
                     type: "web-fetch",
                     url: parsed.toString(),
                     code: res.status,
-                    codeText: res.statusText,
+                    codeText: reasonPhrase(res),
                     bytes: bodyBytes ? bodyBytes.length : raw.length,
                     result: out.length > RESULT_PREVIEW_CHARS ? `${out.slice(0, RESULT_PREVIEW_CHARS)}\n…[${out.length - RESULT_PREVIEW_CHARS} chars truncated — full text in the tool output]` : out,
                     durationMs: Date.now() - startedAt,
@@ -990,7 +992,7 @@ export function createSearxngSearchBackend(baseUrl, options = {}) {
             throw new Error(`SearXNG was redirected more than ${SEARXNG_MAX_REDIRECTS} times`);
         const res = followed.res;
         if (!res.ok)
-            throw new Error(`SearXNG ${res.status} ${res.statusText} from ${url.origin}${url.pathname}`);
+            throw new Error(`SearXNG ${res.status} ${reasonPhrase(res)} from ${url.origin}${url.pathname}`);
         const body = (await res.json());
         if (!Array.isArray(body.results))
             throw new Error(`SearXNG returned no results array from ${url.origin}${url.pathname} — is format=json enabled on this instance?`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.56.0",
+  "version": "7.57.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",