kairos-chain 3.88.1 → 3.88.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c37ee945277e2917d116b02aeb8b47957f97363d8428aae7b54e17a732ca0d94
-  data.tar.gz: 62df9a6d5f05afd01c3aae950959d6398a22e979270183a154e4fd211d2b78c8
+  metadata.gz: 8a785289fdb24dc921cad6c727b74168557a7dcf90593cb7ae267d2cb6b3501f
+  data.tar.gz: 422bb014ce8b479f765972b4f05fe57f86c71c09bae7c48277e8625b798767af
 SHA512:
-  metadata.gz: 74101139a4c243c77119530a5a723c0e1de9fdb6224c1b5f776f78b250040c1e4aade60b93cb75d5cbef3afac2609e2832763a079fc38bddd6ecac84e73f2c32
-  data.tar.gz: 0bf5337f8e6b5985967711300dfe64554e7ff55bb67f7f1dff1d3fca1aefa28fa74677477d5ed3c32cc9b843556434ca692a7254d26a74d68a32807408091621
+  metadata.gz: b399c8a6e440d323ce30c73fb1c62acbb6fcefe7c67e76b89bed4171a3a9bc57d3af48de2ffb4cfc9ac4a802498dde65a868e0435564824d1f29a638748f3e73
+  data.tar.gz: 6b2fc4894c4d52489bb86580386a50121c64ebcdc7f1e363e18813f0a9a548d2a9f974104206fc66d4255b00119cb6f9d4c4b3b81523776a365c4b37be58779b

data/CHANGELOG.md

@@ -4,6 +4,69 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.88.2] - 2026-10-06
+
+### Security — agent: the act and its LLM bodies stay inside their gates
+
+A design review of approval delegation found several ways for the agent to get
+around the gates it runs inside: the tool blacklist, the risk budget and the
+guard. Each was confirmed in code; none was observed in use. Four review rounds
+followed. **The act route is still deny-based. Do not run the agent unattended
+until an act-route allow-list lands** (next version, designed with approval
+delegation).
+
+**No LLM body launched for the agent carries tools in the project root.**
+- **Agent phases.** ORIENT, DECIDE, REFLECT and the persona reviews launched
+  `claude -p` in the project root. It read the project's instruction files and
+  inherited its permission rules (on one instance, `Bash(*)`, `Write` and
+  `Edit`). Every agent LLM call is now sandboxed.
+- **llm_call steps in the act.** The driver forces `sandbox_mode` on them. A
+  step whose provider carries tools (codex, cursor, codex_mcp), or any provider
+  outside claude_code / anthropic / openai / bedrock, is refused before the
+  act. This includes the instance's default provider when the step names
+  none, and the default provider used by `write_section`.
+- **`write_section`.** Its section writer now always calls the LLM sandboxed.
+- **multi_llm_review cursor seat.** It ran `agent -p` (every tool, write and
+  shell included) in the server's working directory. It now runs
+  `agent -p --trust --mode plan` (read-only) in an empty directory made for
+  each call. Cursor reviews therefore see only the artifact.
+
+**An act does not touch what constrains the agent or its operator.**
+- **Protected locations.** A step whose path arguments, at any depth and
+  whatever the tool, reach a protected location is refused before ACT. The
+  protected locations are:
+  - the KairosChain stores (`.kairos`: config, sessions, L1, the instruction
+    mode, the chain, the keys);
+  - `.claude` and `.codex`;
+  - `.mcp.json`, `CLAUDE.md` and `AGENTS.md`;
+  - anything outside the project (`$HOME` and `/` never count as the
+    project).
+- **How paths are judged.** Paths are resolved against the step's own root
+  arguments and against the tools' default roots, so a decoy root cannot move
+  the check. `..` segments, unresolvable paths and dangling symlinks are
+  refused. A symlink is judged by its target.
+- **Recording.** The refusal is recorded on the chain (`agent_act_refused`,
+  with the rule that fired) whether or not the guard is on.
+- **Record-store writers** (`chain_record`, attestation and state commits) are
+  now refused on the act route with the guard off as well. The record judges
+  the act, so the act may not write it.
+- **Configuration writers** (`llm_configure`, `mode_hooks_add` /
+  `mode_hooks_project`, `plugin_project`), `hermes_*` and `multi_llm_review*`
+  are refused on the act route. All of these are also hidden from DECIDE's
+  tool catalog, and DECIDE's norms name the rule.
+- **Instances whose `safety.yml` sets no `safe_root`.** The file tools resolve
+  relative paths inside the stores there, so the act refuses them. The refusal
+  says to set `safe_root`.
+
+**Not covered yet.**
+- `.git/hooks` and `.git/config`, `.cursor*`, `.gemini`,
+  `.github/copilot-instructions.md`, `.envrc` and `.vscode/tasks.json` are not
+  in the protected set.
+- A path-less tool not named above is not stopped (the allow-list will).
+- `agent_execute` remains unregistered.
+- In an operator's own multi_llm_review runs, the codex seat can still read
+  the repository.
+
 ## [3.88.1] - 2026-10-06
 
 ### Fixed — agent guard: the verdict reaches the record

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.88.1"
+  VERSION = "3.88.2"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/skillsets/agent/lib/agent/admission.rb

@@ -54,8 +54,208 @@ module KairosMcp
         # route, where the scratch area quarantines it until the verdict.
         LIVE_TREE_WRITE_TOOLS = %w[write_section sc_scaffold plugin_project].freeze
 
+        # What constrains the agent or its operator, and so may not be touched
+        # by an act (read or written) through any path argument of any tool:
+        # the KairosChain stores (the agent's own config and session files,
+        # L1, the instruction mode, the chain), the harness configuration
+        # (.claude: permission rules and hooks that run as the operator;
+        # .codex; .mcp.json) and the instruction files every agent body reads
+        # (CLAUDE.md, AGENTS.md). Checked by destination, not by tool name, so
+        # a tool that was not anticipated is covered by its arguments.
+        PROTECTED_SEGMENTS = %w[.kairos .claude .codex].freeze
+        PROTECTED_BASENAMES = %w[claude.md agents.md .mcp.json].freeze
+
+        # Argument names that carry a filesystem location, matched by word
+        # (split on '_' / '-') so 'profile' or 'output_format' is not a path.
+        # Tokens come from splitting on '_', '-' and camelCase. A token also
+        # matches when it ends in 'dir' or 'path' (workdir, outdir, filepath)
+        # — not 'file', or 'profile' would match.
+        PATH_TOKENS = %w[path paths file files filename filenames dir dirs dirname directory dest
+                         destination source target root workspace src dst cwd folder location].freeze
+        PATH_SUFFIXES = %w[dir path].freeze
+        ROOT_TOKENS = %w[root workspace cwd].freeze
+
+        # Tools an act may not call, with or without the guard: they rewrite
+        # the configuration that governs every later call (llm_configure:
+        # provider, endpoint and which key is sent; the mode-hook tools and
+        # plugin_project: .claude hooks and permission surfaces) without
+        # naming a path, or launch an external agent body (hermes_*).
+        # multi_llm_review is here too: its codex seat runs `codex exec` (read-
+        # only, but able to read files) in the project root, and its cursor
+        # seat may read absolute paths, so a plan-authored artifact could have
+        # a seat read the instance's keys. The driver's own review gate is not
+        # the act route and is unaffected.
+        ACT_CONFIG_WRITERS = %w[llm_configure mode_hooks_add mode_hooks_project plugin_project hermes_*
+                                multi_llm_review*].freeze
+
+        # llm_call providers an act may use: claude_code runs sandboxed (the
+        # driver forces sandbox_mode); the API providers carry no tools. CLI
+        # bodies that carry tools (codex, codex_mcp, cursor) and any provider
+        # not named here are refused.
+        # (openrouter is not listed: without a configured base_url it falls
+        # back to the OpenAI endpoint and would send the OpenRouter key there.)
+        ACT_SAFE_LLM_PROVIDERS = %w[claude_code anthropic openai bedrock].freeze
+
+        # Tools that call llm_call internally with the instance's default
+        # provider (no override possible from the plan).
+        DEFAULT_PROVIDER_LLM_TOOLS = %w[write_section].freeze
+
         module_function
 
+        # Steps of a plan that would touch a protected location or leave the
+        # project, as [{ 'step_id', 'tool_name', 'path' }].
+        #   protected_dirs  absolute protected directories (the stores,
+        #                   <project>/.claude, <project>/.codex)
+        #   roots           every directory a tool may resolve a relative path
+        #                   against
+        #   allowed_roots   where an act may touch anything at all (the
+        #                   project); a path or a root argument resolving
+        #                   outside them is refused, so an explicit
+        #                   workspace_root cannot turn the check into a
+        #                   deny-list over the whole disk
+        # Every argument at any depth whose name is path-like is checked.
+        # Fail-closed throughout: arguments that are not an object, a '..'
+        # segment, an unresolvable path and a dangling symlink are hits.
+        # Comparison ignores case (APFS is case-insensitive by default).
+        def protected_path_violations(task_json, protected_dirs, roots, allowed_roots = nil)
+          protected = Array(protected_dirs).map { |d| safe_canonical(d).downcase }
+          allowed = Array(allowed_roots).compact.map { |d| safe_canonical(d) }
+          steps = task_json.is_a?(Hash) ? task_json['steps'] : nil
+          return [] unless steps.is_a?(Array)
+
+          steps.flat_map do |step|
+            next [{ 'step_id' => nil, 'tool_name' => nil, 'path' => '(malformed step)' }] unless step.is_a?(Hash)
+
+            args = step['tool_arguments']
+            next [] if args.nil?
+            unless args.is_a?(Hash)
+              next [{ 'step_id' => step['step_id'], 'tool_name' => step['tool_name'], 'path' => '(arguments not an object)' }]
+            end
+
+            pairs = path_pairs(args)
+            explicit_roots = pairs.select { |k, _| (key_tokens(k) & ROOT_TOKENS).any? }.map(&:last)
+            # Resolve against the explicit roots AND the tools' default roots: a
+            # root argument in the plan is text the planner writes, while the
+            # tool decides where it actually resolves (some tools ignore the
+            # argument). Judging only at the plan's root would let a decoy
+            # 'workspace_root' move the check away from the real write. On an
+            # instance whose default root is the stores this over-refuses; the
+            # refusal tells the operator to set safe_root.
+            candidate_roots = (explicit_roots + Array(roots)).compact.map(&:to_s).reject(&:empty?)
+            # No root to resolve against means the check cannot be made.
+            next [{ 'step_id' => step['step_id'], 'tool_name' => step['tool_name'], 'path' => '(no root)',
+                    'rule' => 'unresolvable' }] if candidate_roots.empty? && !pairs.empty?
+            pairs.filter_map do |_key, raw|
+              rule = if protected_name?(raw) then 'protected'
+                     elsif raw.split(%r{[/\\]}).include?('..') then 'dotdot'
+                     else candidate_roots.lazy.map { |root| touch_rule(raw, root, protected, allowed) }.find(&:itself)
+                     end
+              { 'step_id' => step['step_id'], 'tool_name' => step['tool_name'], 'path' => raw, 'rule' => rule } if rule
+            end
+          end
+        end
+
+        def key_tokens(key)
+          key.to_s.gsub(/([a-z0-9])([A-Z])/, '\\1_\\2').downcase.split(/[_\-]/)
+        end
+
+        def path_key?(key)
+          key_tokens(key).any? do |t|
+            PATH_TOKENS.include?(t) || PATH_SUFFIXES.any? { |suf| t.end_with?(suf) }
+          end
+        end
+
+        # [key, string] for every path-like key at any depth; an array takes
+        # its key from the parent.
+        def path_pairs(node, key = nil)
+          case node
+          when Hash then node.flat_map { |k, v| path_pairs(v, k) }
+          when Array then node.flat_map { |v| path_pairs(v, key) }
+          when String
+            key && path_key?(key) && !node.strip.empty? ? [[key.to_s, node]] : []
+          else []
+          end
+        end
+
+        # llm_call steps whose provider would launch a tool-carrying body:
+        # [{ 'step_id', 'tool_name', 'path' => '(provider X)', 'rule' }].
+        # default_provider is the instance's configured provider (nil when it
+        # cannot be read, which refuses steps that do not name a safe one).
+        def unsafe_llm_steps(task_json, default_provider)
+          steps = task_json.is_a?(Hash) && task_json['steps'].is_a?(Array) ? task_json['steps'] : []
+          steps.filter_map do |step|
+            next unless step.is_a?(Hash)
+
+            tool = step['tool_name'].to_s
+            next unless tool == 'llm_call' || DEFAULT_PROVIDER_LLM_TOOLS.include?(tool)
+
+            args = step['tool_arguments'].is_a?(Hash) ? step['tool_arguments'] : {}
+            provider = tool == 'llm_call' ? args['provider_override'].to_s : ''
+            provider = default_provider.to_s if provider.empty?
+            next if ACT_SAFE_LLM_PROVIDERS.include?(provider)
+
+            { 'step_id' => step['step_id'], 'tool_name' => tool,
+              'path' => "(provider #{provider.empty? ? 'unknown' : provider})", 'rule' => 'unsafe_provider' }
+          end
+        end
+
+        # A protected segment or file name anywhere in the path refuses it,
+        # whatever root the tool resolves against.
+        def protected_name?(raw)
+          parts = raw.split(%r{[/\\]}).map(&:downcase)
+          parts.any? { |p| PROTECTED_SEGMENTS.include?(p) } || PROTECTED_BASENAMES.include?(parts.last)
+        end
+
+        # True when the path, resolved against root, lands in a protected
+        # directory, lies outside every allowed root, or has a protected name
+        # once symlinks are resolved. Names are checked only below the allowed
+        # root, so a project that itself lives under a protected segment (a
+        # Claude Code worktree under .claude/worktrees) is not refused wholesale.
+        # The rule a path breaks when resolved against root, or nil.
+        # Protected directories compare case-insensitively (fail-closed on
+        # case-insensitive filesystems); containment compares with case kept,
+        # so on a case-sensitive filesystem /srv/project is not inside
+        # /srv/Project. No allowed root at all means nothing is allowed.
+        def touch_rule(path, root, protected, allowed)
+          full = canonical(File.expand_path(path, root))
+          low = full.downcase
+          return 'protected' if protected.any? { |dir| low == dir || low.start_with?("#{dir}/") }
+          return 'outside' if allowed.empty?
+
+          base = allowed.select { |dir| full == dir || full.start_with?("#{dir}/") }.max_by(&:length)
+          return 'outside' unless base
+
+          below = full.delete_prefix(base).delete_prefix('/')
+          !below.empty? && protected_name?(below) ? 'protected' : nil
+        rescue StandardError
+          'unresolvable'
+        end
+
+        def touches?(path, root, protected, allowed)
+          !touch_rule(path, root, protected, allowed).nil?
+        end
+
+        # realpath of the deepest existing ancestor, with the rest appended,
+        # so a symlink inside the workspace that points at a protected
+        # location is seen. A symlink counts as existing even when its target
+        # does not, and its realpath then raises: a dangling link is a hit.
+        def canonical(path)
+          existing = path
+          rest = []
+          until File.exist?(existing) || File.symlink?(existing) || existing == File.dirname(existing)
+            rest.unshift(File.basename(existing))
+            existing = File.dirname(existing)
+          end
+          base = File.exist?(existing) || File.symlink?(existing) ? File.realpath(existing) : existing
+          rest.empty? ? base : File.join(base, *rest)
+        end
+
+        def safe_canonical(path)
+          canonical(File.expand_path(path.to_s))
+        rescue StandardError
+          File.expand_path(path.to_s)
+        end
+
         # Validate a declared layer surface fail-closed: unknown entries are
         # refused, and any attempt to declare the record store is refused with
         # its own message (AGT-5: never declarable).

data/templates/skillsets/agent/lib/agent/cognitive_loop.rb

@@ -160,6 +160,15 @@ module KairosMcp
         # switch provider, compress, disable thinking).
         # Falls back to legacy auth_error-only handling when disabled.
         def call_llm_with_fallback(arguments)
+          # Every agent phase reasons; none acts. The agent's tools run through
+          # this loop's own tool_use handling, under the session's blacklist.
+          # Without sandbox_mode a claude_code provider launches `claude -p`
+          # in the project root, where it reads the project's instruction
+          # files and inherits its permission rules (a project allowing Bash
+          # or Write let a planning call run commands outside every gate).
+          # The retry and fallback paths reuse these arguments, so they are
+          # sandboxed too.
+          arguments = arguments.merge('sandbox_mode' => true)
           llm_result = @caller.invoke_tool('llm_call', arguments,
                                             context: @session.invocation_context)
           parsed = JSON.parse(llm_result.map { |b| b[:text] || b['text'] }.compact.join)

data/templates/skillsets/agent/plugin/SKILL.md

@@ -48,8 +48,15 @@ the agent to write design drafts to `docs/drafts/` or other project paths.
 
 ### MCP Tool Access
 
-All KairosChain MCP tools (`context_save`, `multi_llm_review`, `chain_record`,
-`knowledge_get`, etc.) are available via `invoke_tool` in the Act phase.
+KairosChain MCP tools (`context_save`, `knowledge_get`, etc.) are available via
+`invoke_tool` in the Act phase, except what the act route always refuses:
+record-store writers such as `chain_record` (the record judges the act, so the
+act may not write it); configuration writers (`llm_configure`, `mode_hooks_*`,
+`plugin_project`), `hermes_*` and `multi_llm_review*`; `llm_call` with a provider
+that carries tools (codex, cursor); and any step whose path arguments reach the
+KairosChain stores, `.claude/`, `.codex/`, `.mcp.json`, `CLAUDE.md`, `AGENTS.md`
+or anywhere outside the project. LLM calls made by the agent or its act run
+sandboxed. The act route is still deny-based: do not run the agent unattended.
 
 ## Sub-Agents
 

data/templates/skillsets/agent/test/test_agent_act_hardening.rb

@@ -0,0 +1,488 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Three side doors around the agent's gates, closed (found 2026-10-06 in the
+# delegation design review):
+#   1. every agent LLM phase runs `claude -p` sandboxed (no project
+#      instruction files, no inherited permission rules, no built-in tools);
+#   2. record-store writers (chain_record, ...) are denied on the act route
+#      with the guard off, not only with it on;
+#   3. a plan whose path arguments reach what constrains the agent or its
+#      operator (KairosChain stores, .claude, .codex, .mcp.json, CLAUDE.md,
+#      AGENTS.md) is refused before ACT, whatever the tool, and the refusal
+#      is recorded on the chain;
+#   4. LLM bodies the act launches run sandboxed (llm_call steps,
+#      write_section's section writer).
+#
+# Drives the REAL agent_start / agent_step through the registry; stubs only
+# llm_call, autoexec_plan/run and knowledge_get.
+# Usage: ruby test_agent_act_hardening.rb
+
+$LOAD_PATH.unshift File.expand_path('../../lib', __dir__)
+$LOAD_PATH.unshift File.expand_path('../../../../lib', __dir__)
+
+require 'json'
+require 'yaml'
+require 'fileutils'
+require 'tmpdir'
+require 'digest'
+require 'time'
+require 'securerandom'
+require 'kairos_mcp/invocation_context'
+require 'kairos_mcp/tools/base_tool'
+require 'kairos_mcp/tool_registry'
+require_relative '../lib/agent'
+require_relative '../tools/agent_start'
+require_relative '../tools/agent_step'
+
+$pass = 0
+$fail = 0
+
+def assert(description)
+  result = yield
+  if result
+    $pass += 1
+    puts "  PASS: #{description}"
+  else
+    $fail += 1
+    puts "  FAIL: #{description}"
+  end
+rescue StandardError => e
+  $fail += 1
+  puts "  FAIL: #{description} (#{e.class}: #{e.message})"
+  puts "        #{e.backtrace.first(3).join("\n        ")}"
+end
+
+def section(title)
+  puts "\n#{'=' * 60}\nTEST: #{title}\n#{'=' * 60}"
+end
+
+TMPDIR = Dir.mktmpdir('agent_act_hardening')
+PROJECT = File.join(TMPDIR, 'proj')
+STORES = File.join(PROJECT, '.kairos')
+FileUtils.mkdir_p(File.join(STORES, 'skillsets', 'agent', 'config'))
+FileUtils.mkdir_p(File.join(PROJECT, 'docs'))
+# Production runs the server with Dir.pwd = the project root.
+ORIG_PWD = Dir.pwd
+Dir.chdir(PROJECT)
+
+module Autonomos
+  @storage_base = TMPDIR
+  def self.storage_path(subpath)
+    path = File.join(@storage_base, subpath)
+    FileUtils.mkdir_p(path)
+    path
+  end
+
+  def self.config
+    {}
+  end
+end
+
+require File.expand_path('../autonomos/lib/autonomos/mandate', File.dirname(__dir__))
+require File.expand_path('../autonomos/lib/autonomos/ooda', File.dirname(__dir__))
+
+# The driver locates the stores through KairosMcp.data_dir.
+module KairosMcp
+  def self.data_dir = STORES
+end
+# The ordinary configuration: safety.yml points the tools' root at the
+# project. The stores-root configuration is simulated where tested.
+FileUtils.mkdir_p(File.join(STORES, 'config'))
+File.write(File.join(STORES, 'config', 'safety.yml'), "safe_root: #{PROJECT}\n")
+# The instance's llm_client default provider (claude_code, as shipped).
+FileUtils.mkdir_p(File.join(STORES, 'skillsets', 'llm_client', 'config'))
+File.write(File.join(STORES, 'skillsets', 'llm_client', 'config', 'llm_client.yml'), "provider: claude_code\n")
+
+Session = KairosMcp::SkillSets::Agent::Session
+Admission = KairosMcp::SkillSets::Agent::Admission
+
+module Autoexec
+  class TaskDsl
+    def self.from_json(json_str)
+      parsed = JSON.parse(json_str)
+      raise ArgumentError, 'Missing task_id' unless parsed['task_id']
+
+      parsed
+    end
+  end
+end
+
+class MockLlmCall < KairosMcp::Tools::BaseTool
+  @@responses = []
+  @@seen = []
+  def self.queue(r) = @@responses << r
+  def self.seen = @@seen
+
+  def self.clear!
+    @@responses.clear
+    @@seen.clear
+  end
+
+  def name = 'llm_call'
+  def description = 'mock'
+  def input_schema = { type: 'object', properties: {} }
+
+  def call(arguments)
+    @@seen << arguments
+    resp = @@responses.shift || { 'content' => 'default', 'tool_use' => nil, 'stop_reason' => 'end_turn' }
+    text_content(JSON.generate({ 'status' => 'ok', 'provider' => 'mock', 'model' => 'mock-1',
+                                 'response' => resp,
+                                 'usage' => { 'input_tokens' => 1, 'output_tokens' => 1 },
+                                 'snapshot' => { 'model' => 'mock-1', 'timestamp' => Time.now.iso8601 } }))
+  end
+end
+
+class MockAutoexecPlan < KairosMcp::Tools::BaseTool
+  @@calls = 0
+  def self.calls = @@calls
+  def name = 'autoexec_plan'
+  def description = 'mock'
+  def input_schema = { type: 'object', properties: {} }
+
+  @@last = nil
+  def self.last = @@last
+
+  def call(arguments)
+    @@calls += 1
+    task_json = JSON.parse(arguments['task_json'])
+    @@last = task_json
+    text_content(JSON.generate({ 'status' => 'ok', 'task_id' => task_json['task_id'],
+                                 'plan_hash' => Digest::SHA256.hexdigest(arguments['task_json'])[0..15],
+                                 'steps' => task_json['steps']&.length || 0 }))
+  end
+end
+
+# Keeps the act context it was handed, so the test can ask what it allows.
+class MockAutoexecRun < KairosMcp::Tools::BaseTool
+  @@ctx_json = nil
+  def self.ctx_json = @@ctx_json
+  def name = 'autoexec_run'
+  def description = 'mock'
+  def input_schema = { type: 'object', properties: {} }
+
+  def call(arguments)
+    @@ctx_json = arguments['invocation_context_json']
+    text_content(JSON.generate({ 'task_id' => 'mock_task', 'mode' => 'internal_execute',
+                                 'outcome' => 'internal_execute_complete', 'steps_processed' => 1, 'steps' => [] }))
+  end
+end
+
+class MockChainRecord < KairosMcp::Tools::BaseTool
+  @@logs = []
+  def self.logs = @@logs
+  def name = 'chain_record'
+  def description = 'mock'
+  def input_schema = { type: 'object', properties: {} }
+
+  def call(arguments)
+    @@logs.concat(Array(arguments['logs']))
+    text_content("Block ##{@@logs.size} recorded successfully.\nHash: #{'ab' * 32}")
+  end
+end
+
+class MockLlmConfigure < KairosMcp::Tools::BaseTool
+  def name = 'llm_configure'
+  def description = 'mock'
+  def input_schema = { type: 'object', properties: {} }
+  def call(_a) = text_content('{}')
+end
+
+class MockKnowledgeGet < KairosMcp::Tools::BaseTool
+  def name = 'knowledge_get'
+  def description = 'mock'
+  def input_schema = { type: 'object', properties: {} }
+  def call(args) = text_content(JSON.generate({ 'name' => args['name'], 'content' => 'mock' }))
+end
+
+def build_registry
+  registry = KairosMcp::ToolRegistry.allocate
+  registry.instance_variable_set(:@safety, KairosMcp::Safety.new)
+  KairosMcp::ToolRegistry.clear_gates!
+  registry.instance_variable_set(:@tools, {
+    'llm_call' => MockLlmCall.new(nil, registry: registry),
+    'knowledge_get' => MockKnowledgeGet.new(nil, registry: registry),
+    'autoexec_plan' => MockAutoexecPlan.new(nil, registry: registry),
+    'autoexec_run' => MockAutoexecRun.new(nil, registry: registry),
+    'chain_record' => MockChainRecord.new(nil, registry: registry),
+    'llm_configure' => MockLlmConfigure.new(nil, registry: registry),
+    'agent_start' => KairosMcp::SkillSets::Agent::Tools::AgentStart.new(nil, registry: registry),
+    'agent_step' => KairosMcp::SkillSets::Agent::Tools::AgentStep.new(registry.instance_variable_get(:@safety), registry: registry)
+  })
+  registry
+end
+
+REGISTRY = build_registry
+START_TOOL = REGISTRY.instance_variable_get(:@tools)['agent_start']
+STEP_TOOL = REGISTRY.instance_variable_get(:@tools)['agent_step']
+
+def plan(tool_name, args)
+  JSON.generate({
+    'summary' => "plan via #{tool_name}",
+    'task_json' => {
+      'task_id' => "t_#{SecureRandom.hex(3)}", 'meta' => { 'description' => 't', 'risk_default' => 'low' },
+      'steps' => [{ 'step_id' => 's1', 'action' => 'do it', 'tool_name' => tool_name,
+                    'tool_arguments' => args, 'risk' => 'low', 'depends_on' => [],
+                    'requires_human_cognition' => false }]
+    },
+    'review_hint' => { 'needed' => false, 'reason' => nil, 'urgency' => nil },
+    'complexity_hint' => { 'level' => 'low', 'signals' => [] }
+  })
+end
+
+# risk_budget medium: the file tools are medium-risk, and under the default
+# 'low' budget the plan would pause before ever reaching the store check.
+def run_plan(plan_json)
+  sid = JSON.parse(START_TOOL.call({ 'goal_name' => "hardening_#{SecureRandom.hex(3)}",
+                                     'risk_budget' => 'medium' })[0][:text])['session_id']
+  MockLlmCall.clear!
+  MockLlmCall.queue({ 'content' => 'orient', 'tool_use' => nil, 'stop_reason' => 'end_turn' })
+  MockLlmCall.queue({ 'content' => plan_json, 'tool_use' => nil, 'stop_reason' => 'end_turn' })
+  STEP_TOOL.call({ 'session_id' => sid, 'action' => 'approve' })
+  MockLlmCall.queue({ 'content' => '{"confidence":0.5}', 'tool_use' => nil, 'stop_reason' => 'end_turn' })
+  JSON.parse(STEP_TOOL.call({ 'session_id' => sid, 'action' => 'approve' })[0][:text])
+end
+
+# ------------------------------------------------------------------
+
+section 'Door 1: every agent LLM phase is sandboxed'
+
+run_plan(plan('knowledge_get', { 'name' => 'x' }))
+assert('ORIENT, DECIDE and REFLECT all reached llm_call') { MockLlmCall.seen.size >= 3 }
+assert('every agent llm_call carries sandbox_mode: true') do
+  MockLlmCall.seen.all? { |a| a['sandbox_mode'] == true }
+end
+
+section 'Door 2: record-store writers are denied on the act route with the guard off'
+
+r2 = run_plan(plan('knowledge_get', { 'name' => 'x' }))
+ctx = KairosMcp::InvocationContext.from_json(MockAutoexecRun.ctx_json)
+assert('the guard is off in this session (shipped agent.yml)') { r2['status'] != 'guard_halt' }
+assert('chain_record is refused on the act context') { !ctx.allowed?('chain_record') }
+assert('every record-store writer is refused on the act context') do
+  Admission::RECORD_STORE_TOOLS.none? { |t| ctx.allowed?(t) }
+end
+assert('an ordinary tool is still allowed') { ctx.allowed?('knowledge_get') }
+assert('configuration writers are refused on the act context') do
+  %w[llm_configure mode_hooks_add mode_hooks_project plugin_project hermes_ask].none? { |t| ctx.allowed?(t) }
+end
+
+section 'Door 3: a plan naming a protected location is refused before ACT, and recorded'
+
+before = MockAutoexecPlan.calls
+logs_before = MockChainRecord.logs.size
+r3 = run_plan(plan('safe_file_edit', { 'path' => '.kairos/skillsets/agent/config/agent.yml',
+                                       'old_string' => 'a', 'new_string' => 'b' }))
+assert('the act did not reach autoexec, and not because of a risk pause') do
+  MockAutoexecPlan.calls == before && r3['state'] != 'paused_risk'
+end
+assert('the response says a protected location was refused') do
+  r3['act_summary'] == 'failed' && r3['act_error'].to_s.include?('protected location')
+end
+assert('the refusal is recorded on the chain (guard off), with the rule that fired') do
+  rec = MockChainRecord.logs[logs_before..].map { |l| JSON.parse(l) }.find { |r| r['kind'] == 'agent_act_refused' }
+  rec && rec['reason'] == ['protected'] && rec['steps'].first['rule'] == 'protected'
+end
+
+before_ws = MockAutoexecPlan.calls
+r_ws = run_plan(plan('write_section', { 'section_name' => 'x', 'instructions' => 'y',
+                                        'output_file' => '.kairos/skills/masa.md' }))
+assert('write_section into the instruction mode is refused (low-risk tool, default budget path)') do
+  MockAutoexecPlan.calls == before_ws && r_ws['act_error'].to_s.include?('protected location')
+end
+
+before_ok = MockAutoexecPlan.calls
+r_ok = run_plan(plan('safe_file_write', { 'path' => 'docs/note.md', 'content' => 'x', 'workspace_root' => PROJECT }))
+assert('a write outside the protected locations still runs') do
+  MockAutoexecPlan.calls == before_ok + 1 && r_ok['act_error'].nil?
+end
+
+before_out = MockAutoexecPlan.calls
+r_out = run_plan(plan('safe_file_write', { 'workspace_root' => Dir.home, 'path' => '.zshrc', 'content' => 'x' }))
+assert('end to end: a write outside the project via an explicit workspace_root is refused') do
+  MockAutoexecPlan.calls == before_out && r_out['act_error'].to_s.include?('[outside]')
+end
+
+PROTECTED = [STORES, File.join(PROJECT, '.claude'), File.join(PROJECT, '.codex')].freeze
+v = lambda do |tool, args, roots: [PROJECT]|
+  Admission.protected_path_violations({ 'steps' => [{ 'step_id' => 's1', 'tool_name' => tool, 'tool_arguments' => args }] },
+                                      PROTECTED, roots, [PROJECT])
+end
+refused = {
+  'an absolute path inside the stores' => ['safe_file_write', { 'path' => File.join(STORES, 'skillsets', 'agent', 'config', 'agent.yml') }],
+  'workspace_root pointing into the stores' => ['safe_file_write', { 'path' => 'skillsets/agent/config/agent.yml', 'workspace_root' => STORES }],
+  'harness settings (.claude) where hooks live' => ['safe_file_write', { 'path' => '.claude/settings.local.json' }],
+  'the project CLAUDE.md' => ['write_section', { 'output_file' => 'CLAUDE.md' }],
+  'a CLAUDE.md in a subdirectory' => ['write_section', { 'output_file' => 'docs/CLAUDE.md' }],
+  'AGENTS.md' => ['safe_file_write', { 'path' => 'AGENTS.md' }],
+  '.mcp.json' => ['safe_file_write', { 'path' => '.mcp.json' }],
+  'a different case (.KAIROS)' => ['safe_file_write', { 'path' => '.KAIROS/skills/masa.md' }],
+  'backslash separators' => ['safe_file_write', { 'path' => '.kairos\\skills\\masa.md' }],
+  'a git tool whose workspace_root is the stores repo' => ['safe_git_commit', { 'workspace_root' => '.kairos', 'message' => 'x' }],
+  'sc_scaffold output_path into the stores' => ['sc_scaffold', { 'output_path' => '.kairos/skillsets/evil' }],
+  'copy out of the stores (source)' => ['safe_file_copy', { 'source' => '.kairos/storage/key.pem', 'destination' => 'docs/key.pem' }],
+  'a read of the stores' => ['safe_file_read', { 'path' => '.kairos/storage/key.pem' }],
+  'an explicit workspace_root outside the project' => ['safe_file_write', { 'workspace_root' => Dir.home, 'path' => '.zshrc' }],
+  'an absolute path outside the project' => ['safe_file_write', { 'path' => '/tmp/elsewhere.txt' }],
+  'a .. segment' => ['safe_file_write', { 'path' => 'docs/../../outside.txt' }],
+  'a nested path argument' => ['some_tool', { 'options' => { 'path' => '.kairos/x' } }],
+  'a path inside an array of objects' => ['some_tool', { 'files' => [{ 'path' => 'CLAUDE.md' }] }],
+  'a home harness file via src' => ['some_tool', { 'src' => File.join(Dir.home, '.claude.json') }],
+  'a camelCase path key (filePath)' => ['some_tool', { 'filePath' => '/tmp/elsewhere.txt' }],
+  'a joined path key (workdir)' => ['some_tool', { 'workdir' => '/tmp/elsewhere' }],
+  'a joined path key (outdir)' => ['some_tool', { 'outdir' => '/tmp/elsewhere' }]
+}
+refused.each do |label, (tool, args)|
+  assert("refused: #{label}") { v.call(tool, args).size >= 1 }
+end
+assert('refused: a relative path when the tool root is the stores (safety.yml without safe_root)') do
+  v.call('safe_file_edit', { 'path' => 'skillsets/agent/config/agent.yml' }, roots: [PROJECT, STORES]).size == 1
+end
+File.symlink(STORES, File.join(PROJECT, 'cfg'))
+assert('refused: a symlink in the workspace that points at the stores') do
+  v.call('safe_file_edit', { 'path' => 'cfg/skillsets/agent/config/agent.yml' }).size == 1
+end
+File.write(File.join(PROJECT, 'CLAUDE.md'), '# instructions')
+File.symlink(File.join(PROJECT, 'CLAUDE.md'), File.join(PROJECT, 'docs', 'innocent.md'))
+assert('refused: an innocent-looking symlink whose target is CLAUDE.md') do
+  v.call('safe_file_write', { 'path' => 'docs/innocent.md' }).size == 1
+end
+File.symlink(File.join(STORES, 'not_yet.json'), File.join(PROJECT, 'dangling'))
+assert('refused: a dangling symlink') do
+  v.call('safe_file_write', { 'path' => 'dangling' }).size == 1
+end
+assert('refused: arguments that are not an object') do
+  Admission.protected_path_violations({ 'steps' => [{ 'step_id' => 's1', 'tool_name' => 'safe_file_write', 'tool_arguments' => '{"path":".kairos/x"}' }] }, PROTECTED, [PROJECT]).size == 1
+end
+assert('no allowed root at all refuses even an ordinary path (fail-closed)') do
+  Admission.protected_path_violations({ 'steps' => [{ 'step_id' => 's1', 'tool_name' => 'safe_file_write',
+                                                       'tool_arguments' => { 'path' => 'docs/note.md' } }] },
+                                      PROTECTED, [PROJECT], []).first&.dig('rule') == 'outside'
+end
+home_step = KairosMcp::SkillSets::Agent::Tools::AgentStep.allocate
+home_step.define_singleton_method(:project_root_for_merge) { Dir.home }
+saved_ws = ENV.delete('KAIROS_WORKSPACE')
+assert('the home directory never counts as the project') { home_step.send(:allowed_roots_for_admission).empty? }
+ENV['KAIROS_WORKSPACE'] = saved_ws if saved_ws
+assert('no root to resolve against is refused, not skipped') do
+  Admission.protected_path_violations({ 'steps' => [{ 'step_id' => 's1', 'tool_name' => 'safe_file_write',
+                                                       'tool_arguments' => { 'path' => 'docs/note.md' } }] },
+                                      PROTECTED, [], [PROJECT]).first&.dig('rule') == 'unresolvable'
+end
+
+WT = File.join(TMPDIR, 'repo', '.claude', 'worktrees', 'wt')
+FileUtils.mkdir_p(File.join(WT, 'docs'))
+wt_protected = [File.join(WT, '.kairos'), File.join(WT, '.claude'), File.join(WT, '.codex')]
+wt = lambda do |args|
+  Admission.protected_path_violations({ 'steps' => [{ 'step_id' => 's1', 'tool_name' => 'safe_file_write', 'tool_arguments' => args }] },
+                                      wt_protected, [WT], [WT])
+end
+assert('a project inside a Claude Code worktree (.claude/worktrees) is not refused wholesale') do
+  wt.call({ 'path' => 'docs/note.md' }).empty?
+end
+assert('inside such a worktree, its own stores are still refused') do
+  wt.call({ 'path' => '.kairos/skills/masa.md' }).size == 1
+end
+
+allowed = {
+  'docs/kairos_notes.md' => ['safe_file_write', { 'path' => 'docs/kairos_notes.md' }],
+  'a report under docs' => ['write_section', { 'output_file' => 'docs/report.md' }],
+  'a non-path argument' => ['knowledge_get', { 'name' => 'kairoschain_meta_philosophy' }],
+  'a URI-like resource' => ['resource_read', { 'uri' => 'knowledge://x' }],
+  "a non-path key that contains 'file' as a substring" => ['some_tool', { 'profile' => 'a/b' }],
+  'an output_format value' => ['some_tool', { 'output_format' => '/tmp/not_a_path_here' }],
+  "profile is not a path key even with a path-shaped value" => ['some_tool', { 'profile' => '/tmp/elsewhere' }]
+}
+allowed.each do |label, (tool, args)|
+  assert("allowed: #{label}") { v.call(tool, args).empty? }
+end
+
+# An instance whose safety.yml sets no safe_root resolves file tools against
+# the data dir itself. Simulate that root and plan a path with no protected
+# name in it: only resolving against the tools' own root can catch it.
+safety = STEP_TOOL.instance_variable_get(:@safety)
+raise 'the step tool must hold a real Safety' unless safety.is_a?(KairosMcp::Safety)
+safety.define_singleton_method(:safe_root) { STORES }
+before_sr = MockAutoexecPlan.calls
+r_sr = run_plan(plan('safe_file_edit', { 'path' => 'skillsets/agent/config/agent.yml', 'old_string' => 'a', 'new_string' => 'b' }))
+safety.singleton_class.send(:remove_method, :safe_root)
+assert("a relative path is judged where the tool would write it (tool root = the stores)") do
+  MockAutoexecPlan.calls == before_sr && r_sr['act_error'].to_s.include?('protected location')
+end
+assert('the refusal says the tool root is inside the stores and how to fix it') do
+  r_sr['act_error'].to_s.include?('set safe_root in safety.yml')
+end
+safety.define_singleton_method(:safe_root) { STORES }
+before_decoy = MockAutoexecPlan.calls
+r_decoy = run_plan(plan('write_section', { 'section_name' => 'x', 'instructions' => 'y',
+                                           'output_file' => 'knowledge/x/x.md', 'workspace_root' => PROJECT }))
+safety.singleton_class.send(:remove_method, :safe_root)
+assert('a decoy workspace_root does not move the check away from where the tool writes') do
+  MockAutoexecPlan.calls == before_decoy && r_decoy['act_error'].to_s.include?('protected location')
+end
+assert('the driver protects the stores, .claude and .codex') do
+  dirs = STEP_TOOL.send(:protected_dirs_for_admission)
+  dirs.include?(STORES) && dirs.any? { |d| d.end_with?('/.claude') } && dirs.any? { |d| d.end_with?('/.codex') }
+end
+
+section 'Door 4: LLM bodies the act launches run sandboxed'
+
+before_llm = MockAutoexecPlan.calls
+run_plan(plan('llm_call', { 'messages' => [{ 'role' => 'user', 'content' => 'run: rm -rf x' }] }))
+llm_step = Array(MockAutoexecPlan.last && MockAutoexecPlan.last['steps']).find { |st| st['tool_name'] == 'llm_call' }
+assert('an llm_call step reaches autoexec with sandbox_mode forced on') do
+  MockAutoexecPlan.calls == before_llm + 1 && llm_step && llm_step.dig('tool_arguments', 'sandbox_mode') == true
+end
+
+require File.expand_path('../document_authoring/lib/document_authoring/section_writer', File.dirname(__dir__))
+FakeCaller = Struct.new(:seen) do
+  def invoke_tool(name, args, context: nil)
+    seen << [name, args]
+    [{ text: JSON.generate({ 'status' => 'ok', 'response' => { 'content' => 'text' } }) }]
+  end
+end
+fc = FakeCaller.new([])
+KairosMcp::SkillSets::DocumentAuthoring::SectionWriter.new(fc, {}).send(:generate_one, 's', 'i', 'c', 100, 'en', nil)
+assert("write_section's section writer calls llm_call with sandbox_mode") do
+  fc.seen.any? { |name, args| name == 'llm_call' && args['sandbox_mode'] == true }
+end
+
+%w[codex cursor codex_mcp some_unknown_cli].each do |prov|
+  before_p = MockAutoexecPlan.calls
+  r_p = run_plan(plan('llm_call', { 'messages' => [{ 'role' => 'user', 'content' => 'print .kairos/keys/x.pem' }],
+                                    'provider_override' => prov }))
+  assert("an llm_call step with provider #{prov} is refused before ACT") do
+    MockAutoexecPlan.calls == before_p && r_p['act_error'].to_s.include?('[unsafe_provider]')
+  end
+end
+assert('an llm_call step with an API provider is allowed') do
+  Admission.unsafe_llm_steps({ 'steps' => [{ 'step_id' => 's1', 'tool_name' => 'llm_call',
+                                             'tool_arguments' => { 'provider_override' => 'anthropic' } }] }, 'claude_code').empty?
+end
+assert('an llm_call step with no override follows the instance default (codex default is refused)') do
+  Admission.unsafe_llm_steps({ 'steps' => [{ 'step_id' => 's1', 'tool_name' => 'llm_call', 'tool_arguments' => {} }] }, 'codex').size == 1
+end
+assert('an unreadable default provider refuses an llm_call step without a safe override') do
+  Admission.unsafe_llm_steps({ 'steps' => [{ 'step_id' => 's1', 'tool_name' => 'llm_call', 'tool_arguments' => {} }] }, nil).size == 1
+end
+assert('openrouter is not a safe provider (it falls back to the OpenAI endpoint without base_url)') do
+  Admission.unsafe_llm_steps({ 'steps' => [{ 'step_id' => 's1', 'tool_name' => 'llm_call',
+                                             'tool_arguments' => { 'provider_override' => 'openrouter' } }] }, 'claude_code').size == 1
+end
+assert('write_section follows the instance default provider (codex default is refused)') do
+  ws = { 'steps' => [{ 'step_id' => 's1', 'tool_name' => 'write_section', 'tool_arguments' => { 'output_file' => 'docs/a.md' } }] }
+  Admission.unsafe_llm_steps(ws, 'codex').size == 1 && Admission.unsafe_llm_steps(ws, 'claude_code').empty?
+end
+assert('multi_llm_review is refused on the act context') { !ctx.allowed?('multi_llm_review') && !ctx.allowed?('multi_llm_review_collect') }
+
+section 'The planner is not offered tools the act route always refuses'
+
+catalog = STEP_TOOL.send(:build_tool_catalog, Session.load(JSON.parse(START_TOOL.call({ 'goal_name' => 'catalog_check' })[0][:text])['session_id']))
+assert('chain_record is absent from the DECIDE catalog') { !catalog.include?('**chain_record**') }
+assert('llm_configure is absent from the DECIDE catalog') { !catalog.include?('**llm_configure**') }
+assert('an ordinary tool is present in the DECIDE catalog') { catalog.include?('**knowledge_get**') }
+
+Dir.chdir(ORIG_PWD)
+FileUtils.rm_rf(TMPDIR)
+puts "\n#{'=' * 60}\nRESULT: #{$pass} passed, #{$fail} failed\n#{'=' * 60}"
+exit($fail.zero? ? 0 : 1)

data/templates/skillsets/agent/tools/agent_step.rb

@@ -2,6 +2,7 @@
 
 require 'json'
 require 'digest'
+require 'yaml'
 require_relative '../lib/agent'
 
 module KairosMcp
@@ -836,6 +837,121 @@ module KairosMcp
             act_result['summary'] = 'failed'
           end
 
+          # Protected directories and the roots a tool may resolve a relative
+          # path against, for the pre-ACT protected-path check. The roots
+          # include the tools' own defaults (@safety's workspace and safe
+          # roots — the latter is the data dir when safety.yml sets none), so
+          # a relative path is judged where the tool would actually write it.
+          def stores_dir_for_admission
+            if defined?(KairosMcp) && KairosMcp.respond_to?(:data_dir) && KairosMcp.data_dir
+              return KairosMcp.data_dir
+            end
+            File.join(Dir.pwd, '.kairos')
+          end
+
+          def protected_dirs_for_admission
+            root = project_root_for_merge
+            [stores_dir_for_admission, File.join(root, '.claude'), File.join(root, '.codex')]
+          end
+
+          def workspace_roots_for_admission
+            safety_roots = %i[workspace_root safe_root].filter_map do |m|
+              @safety.respond_to?(m) ? @safety.public_send(m) : nil
+            rescue StandardError
+              nil
+            end
+            (safety_roots + [ENV['KAIROS_WORKSPACE'], Dir.pwd, project_root_for_merge]).compact.map(&:to_s).uniq
+          end
+
+          # Arguments forced on steps that launch an LLM body. Returns
+          # [copy, rewritten_step_ids]; the recorded decision is left as the
+          # plan's author wrote it.
+          LAUNCHER_ARGS = {
+            'llm_call' => { 'sandbox_mode' => true }
+          }.freeze
+
+          def confine_launcher_steps(task_json)
+            return [task_json, []] unless task_json.is_a?(Hash) && task_json['steps'].is_a?(Array)
+
+            copy = JSON.parse(JSON.generate(task_json))
+            rewritten = []
+            copy['steps'].each do |step|
+              forced = step.is_a?(Hash) ? LAUNCHER_ARGS[step['tool_name'].to_s] : nil
+              next unless forced
+
+              step['tool_arguments'] = (step['tool_arguments'].is_a?(Hash) ? step['tool_arguments'] : {}).merge(forced)
+              rewritten << step['step_id'].to_s
+            end
+            [copy, rewritten]
+          end
+
+          # Where an act may touch anything at all: the project (and an
+          # explicitly configured workspace). The home directory or the
+          # filesystem root never counts as a project (a global install whose
+          # data dir is ~/.kairos would otherwise allow ~/.zshrc and ~/.ssh);
+          # with no project left, nothing is allowed and the act is refused.
+          def allowed_roots_for_admission
+            home = begin
+              Dir.home
+            rescue StandardError
+              nil
+            end
+            too_broad = [home, '/'].compact.map { |d| ::KairosMcp::SkillSets::Agent::Admission.safe_canonical(d) }
+            [project_root_for_merge, ENV['KAIROS_WORKSPACE']].compact.map(&:to_s).reject(&:empty?)
+              .reject { |d| too_broad.include?(::KairosMcp::SkillSets::Agent::Admission.safe_canonical(d)) }
+          end
+
+          # The instance's default llm_call provider, read from llm_client's
+          # config; nil when unreadable (steps without a safe override are then
+          # refused).
+          # Read the way llm_call reads it (llm_call.rb load_config): Symbol
+          # permitted, and 'anthropic' when the file does not exist.
+          def configured_llm_provider
+            path = File.join(stores_dir_for_admission, 'skillsets', 'llm_client', 'config', 'llm_client.yml')
+            return 'anthropic' unless File.exist?(path)
+
+            (YAML.safe_load(File.read(path), permitted_classes: [Symbol]) || {})['provider']&.to_s
+          rescue StandardError
+            nil
+          end
+
+          # When the file tools' own root is inside the stores (safety.yml sets
+          # no safe_root), every relative path lands there and is refused; say so.
+          def stores_root_hint
+            stores = ::KairosMcp::SkillSets::Agent::Admission.safe_canonical(stores_dir_for_admission).downcase
+            inside = workspace_roots_for_admission.any? do |r|
+              c = ::KairosMcp::SkillSets::Agent::Admission.safe_canonical(r).downcase
+              c == stores || c.start_with?("#{stores}/")
+            end
+            inside ? ' (this instance resolves tool paths inside the KairosChain stores: set safe_root in safety.yml)' : ''
+          rescue StandardError
+            ''
+          end
+
+          # A refused act is a security-relevant event: record it on the chain
+          # (driver context) whether or not the guard is on. Non-blocking —
+          # the refusal stands even if the record does not land.
+          def record_act_refusal(session, violations)
+            record = {
+              'kind' => 'agent_act_refused',
+              'session_id' => session.session_id,
+              'mandate_id' => session.mandate_id,
+              'cycle' => session.cycle_number + 1,
+              'reason' => violations.map { |v| v['rule'] }.compact.uniq,
+              'steps' => violations.first(10).map { |v|
+                { 'step_id' => v['step_id'].to_s[0, 40], 'tool_name' => v['tool_name'].to_s[0, 60], 'rule' => v['rule'] }
+              },
+              'recorded_at' => Time.now.utc.iso8601
+            }
+            out = invoke_tool('chain_record', { 'logs' => [JSON.generate(record)] })
+            text = Array(out).map { |b| b[:text] || b['text'] }.compact.join
+            unless text.match?(/Block #\d+ recorded successfully/)
+              log_agent(:warn, 'act_refusal_unrecorded', session, detail: text[0, 160])
+            end
+          rescue StandardError => e
+            log_agent(:warn, 'act_refusal_unrecorded', session, error: e.message)
+          end
+
           def project_root_for_merge
             if defined?(KairosMcp) && KairosMcp.respond_to?(:data_dir)
               root = File.dirname(KairosMcp.data_dir)
@@ -1634,13 +1750,49 @@ module KairosMcp
             admission_denied = guard_admission_blacklist(session)
             return admission_denied if admission_denied.is_a?(Hash) # guard halt
 
+            # What constrains the agent or its operator is off limits to the act,
+            # with or without the guard: a plan whose path arguments reach the
+            # stores, the harness configuration or the instruction files is
+            # refused before it runs (Admission::PROTECTED_*). This binds path
+            # arguments only; store writers that carry content rather than a
+            # path (context_save, operator_report, ...) remain the act's tools
+            # by design.
+            admission = ::KairosMcp::SkillSets::Agent::Admission
+            violations = admission.protected_path_violations(decision_payload['task_json'],
+                                                             protected_dirs_for_admission,
+                                                             workspace_roots_for_admission,
+                                                             allowed_roots_for_admission) +
+                         admission.unsafe_llm_steps(decision_payload['task_json'], configured_llm_provider)
+            unless violations.empty?
+              listed = violations.map { |v| "#{v['step_id']} #{v['tool_name']} [#{v['rule']}]" }.join('; ')
+              log_agent(:warn, 'act_protected_path_refused', session, steps: listed[0, 200])
+              record_act_refusal(session, violations)
+              return { 'error' => 'ACT refused before execution: the plan names a protected location ' \
+                                  '(KairosChain stores, harness configuration, instruction files), a ' \
+                                  'path outside the project, or an llm_call provider that carries tools, ' \
+                                  "in #{listed[0, 240]}#{stores_root_hint}",
+                       'summary' => 'failed', 'protected_path_refused' => violations }
+            end
+
+            # Denied on the act route whether or not the guard is on: record-store
+            # writers (the record judges the act, so the act may not write it)
+            # and configuration writers (they rewrite what governs every later
+            # call without naming a path, or launch an external agent body).
             act_ctx = session.invocation_context.derive(
               blacklist_remove: %w[autoexec_plan autoexec_run],
-              blacklist_add: admission_denied
+              blacklist_add: (admission::RECORD_STORE_TOOLS + admission::ACT_CONFIG_WRITERS + admission_denied).uniq
             )
 
+            # LLM bodies the act launches run without tools in the project root:
+            # llm_call steps are sandboxed (providers that carry tools were
+            # refused above; multi_llm_review is denied on the act context). The
+            # executed plan is a copy; the rewritten step ids are logged so the
+            # recorded decision and the executed plan hash can be reconciled.
+            task_json, rewritten = confine_launcher_steps(decision_payload['task_json'])
+            log_agent(:info, 'act_launcher_steps_confined', session, steps: rewritten.join(',')) unless rewritten.empty?
+
             plan_result = invoke_tool('autoexec_plan', {
-              'task_json' => JSON.generate(decision_payload['task_json'])
+              'task_json' => JSON.generate(task_json)
             }, context: act_ctx)
 
             plan_parsed = JSON.parse(plan_result.map { |b| b[:text] || b['text'] }.compact.join)
@@ -2795,7 +2947,12 @@ module KairosMcp
             "arguments, so a body written as an instruction — assemble this, summarize " \
             "that — is delivered to the operator verbatim as the report. When the " \
             "deliverable depends on outputs of steps in this plan, deliver it in the " \
-            "next cycle, written from what those steps actually returned."
+            "next cycle, written from what those steps actually returned.\n" \
+            "  (h) Some places are never the act's to touch, in any argument of any step: " \
+            "the KairosChain stores (.kairos), .claude, .codex, .mcp.json, CLAUDE.md, AGENTS.md, " \
+            "and anything outside the project. A plan naming one is refused before it runs. " \
+            "Configuration tools (llm_configure, mode_hooks_*, plugin_project), multi_llm_review and " \
+            "llm_call providers that carry tools (codex, cursor) are not the act's either."
           end
 
           def reflect_system_prompt
@@ -2982,6 +3139,11 @@ module KairosMcp
             ctx = session&.invocation_context
             tools = @registry.list_tools
             tools = tools.reject { |t| ctx && !ctx.allowed?(t[:name]) } if ctx
+            # The act route always refuses record-store writers; offering them
+            # to the planner would only produce plans that fail at dispatch.
+            adm = ::KairosMcp::SkillSets::Agent::Admission
+            act_denied = adm::RECORD_STORE_TOOLS + adm::ACT_CONFIG_WRITERS
+            tools = tools.reject { |t| act_denied.any? { |pat| File.fnmatch(pat, t[:name].to_s) } }
 
             tools.map { |t|
               format_tool_entry(t)

data/templates/skillsets/document_authoring/lib/document_authoring/section_writer.rb

@@ -128,10 +128,15 @@ module KairosMcp
             'role' => 'user',
             'content' => build_user_prompt(section_name, instructions, context_text, max_words, language)
           }]
+          # A section writer only produces text from what it is given. Sandboxed
+          # so a claude_code provider does not launch `claude -p` in the project
+          # root with the project's instruction files and permission rules —
+          # where instructions inside the section request could run commands.
           llm_args = {
             'messages' => messages,
             'system' => system_prompt,
-            'max_tokens' => resolve_max_tokens(max_words, context_text)
+            'max_tokens' => resolve_max_tokens(max_words, context_text),
+            'sandbox_mode' => true
           }
           # Forward InvocationContext via dispatch-level context: keyword only.
           result = @caller.invoke_tool('llm_call', llm_args, context: invocation_context)

data/templates/skillsets/llm_client/lib/llm_client/cursor_adapter.rb

@@ -2,6 +2,8 @@
 
 require 'json'
 require 'securerandom'
+require 'tmpdir'
+require 'fileutils'
 require_relative 'adapter'
 require_relative 'safe_subprocess'
 
@@ -14,12 +16,19 @@ module KairosMcp
       class CursorAdapter < Adapter
         DEFAULT_TIMEOUT = 180
 
+        # `agent -p` has every tool, write and shell included, and runs in its
+        # working directory. Launched from the MCP server it ran in the project
+        # root, so a prompt could have it edit or execute there. A seat here
+        # only answers: read-only plan mode, in an empty directory made for
+        # the call (--trust only skips the trust prompt for that empty dir).
+        BASE_ARGS = ['agent', '-p', '--trust', '--mode', 'plan'].freeze
+
         def call(messages:, system: nil, tools: nil, model: nil,
                  max_tokens: nil, temperature: nil, output_schema: nil)
           prompt = build_prompt(messages, system, tools, output_schema)
           timeout_seconds = @config&.dig('timeout_seconds') || DEFAULT_TIMEOUT
 
-          args = ['agent', '-p']
+          args = BASE_ARGS.dup
 
           # Multi-model support: pass --model to `agent -p` when caller specified
           # a model. Backward compat: nil/empty → no flag → cursor's default
@@ -30,13 +39,19 @@ module KairosMcp
             args << '--model' << model.to_s
           end
 
-          stdout, stderr, status = SafeSubprocess.safe_capture(
-            args,
-            stdin_data: prompt,
-            timeout_seconds: timeout_seconds,
-            env: {},
-            dispatch_id: @config&.dig('dispatch_id')
-          )
+          workdir = Dir.mktmpdir('kairos_cursor_')
+          stdout, stderr, status = begin
+            SafeSubprocess.safe_capture(
+              args,
+              stdin_data: prompt,
+              timeout_seconds: timeout_seconds,
+              env: {},
+              dispatch_id: @config&.dig('dispatch_id'),
+              chdir: workdir
+            )
+          ensure
+            FileUtils.remove_entry(workdir, true)
+          end
 
           unless status && status.success?
             msg = strip_ansi(stderr)[0..200]

data/templates/skillsets/llm_client/test/test_cursor_adapter_model.rb

@@ -39,7 +39,7 @@ module KairosMcp
           stub_capture_recording_args
           begin
             @adapter.call(messages: [{ 'role' => 'user', 'content' => 'hi' }], model: nil)
-            assert_equal ['agent', '-p'], @captured_args
+            assert_equal CursorAdapter::BASE_ARGS, @captured_args
             refute_includes @captured_args, '--model'
           ensure
             restore_capture
@@ -50,7 +50,7 @@ module KairosMcp
           stub_capture_recording_args
           begin
             @adapter.call(messages: [{ 'role' => 'user', 'content' => 'hi' }])
-            assert_equal ['agent', '-p'], @captured_args
+            assert_equal CursorAdapter::BASE_ARGS, @captured_args
           ensure
             restore_capture
           end
@@ -60,7 +60,7 @@ module KairosMcp
           stub_capture_recording_args
           begin
             @adapter.call(messages: [{ 'role' => 'user', 'content' => 'hi' }], model: '')
-            assert_equal ['agent', '-p'], @captured_args
+            assert_equal CursorAdapter::BASE_ARGS, @captured_args
           ensure
             restore_capture
           end
@@ -80,7 +80,7 @@ module KairosMcp
           stub_capture_recording_args
           begin
             @adapter.call(messages: [{ 'role' => 'user', 'content' => 'hi' }], model: 'gpt-5.4-high')
-            assert_equal ['agent', '-p', '--model', 'gpt-5.4-high'], @captured_args
+            assert_equal CursorAdapter::BASE_ARGS + ['--model', 'gpt-5.4-high'], @captured_args
           ensure
             restore_capture
           end

data/templates/skillsets/llm_client/test/test_cursor_adapter_readonly.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+# A cursor seat only answers: `agent -p` has every tool (write and shell
+# included), so it runs read-only (--mode plan) in an empty directory made for
+# the call and removed afterwards, never in the MCP server's working directory.
+
+require 'minitest/autorun'
+require_relative '../lib/llm_client/adapter'
+require_relative '../lib/llm_client/cursor_adapter'
+
+module KairosMcp
+  module SkillSets
+    module LlmClient
+      class TestCursorAdapterReadonly < Minitest::Test
+        Status = Struct.new(:success?, :exitstatus)
+
+        def test_runs_read_only_in_an_empty_private_directory
+          seen = {}
+          SafeSubprocess.singleton_class.send(:alias_method, :_orig_safe_capture, :safe_capture)
+          SafeSubprocess.singleton_class.send(:define_method, :safe_capture) do |args, **kw|
+            seen[:args] = args
+            seen[:chdir] = kw[:chdir]
+            seen[:entries_at_launch] = Dir.children(kw[:chdir])
+            seen[:chdir_real] = File.realpath(kw[:chdir])
+            seen[:pwd_real] = File.realpath(Dir.pwd)
+            ['{"content":"ok"}', '', Status.new(true, 0)]
+          end
+          begin
+            CursorAdapter.new({ 'timeout_seconds' => 30 }).call(messages: [{ 'role' => 'user', 'content' => 'hi' }])
+          ensure
+            SafeSubprocess.singleton_class.send(:remove_method, :safe_capture)
+            SafeSubprocess.singleton_class.send(:alias_method, :safe_capture, :_orig_safe_capture)
+            SafeSubprocess.singleton_class.send(:remove_method, :_orig_safe_capture)
+          end
+
+          assert_includes seen[:args].each_cons(2).to_a, ['--mode', 'plan']
+          assert_includes seen[:args], '--trust'
+          refute_includes seen[:args], '--force'
+          refute_includes seen[:args], '--yolo'
+          refute_nil seen[:chdir]
+          refute_equal seen[:pwd_real], seen[:chdir_real], 'the seat must not run in the caller\'s working directory'
+          assert_empty seen[:entries_at_launch]
+          refute File.exist?(seen[:chdir]), 'the per-call directory is removed after the call'
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kairos-chain
 version: !ruby/object:Gem::Version
-  version: 3.88.1
+  version: 3.88.2
 platform: ruby
 authors:
 - Masaomi Hatakeyama
@@ -418,6 +418,7 @@ files:
 - templates/skillsets/agent/plugin/SKILL.md
 - templates/skillsets/agent/plugin/agents/monitor.md
 - templates/skillsets/agent/skillset.json
+- templates/skillsets/agent/test/test_agent_act_hardening.rb
 - templates/skillsets/agent/test/test_agent_admission.rb
 - templates/skillsets/agent/test/test_agent_capability_discovery.rb
 - templates/skillsets/agent/test/test_agent_complexity_review.rb
@@ -651,6 +652,7 @@ files:
 - templates/skillsets/llm_client/test/test_call_router.rb
 - templates/skillsets/llm_client/test/test_claude_code_adapter_parse.rb
 - templates/skillsets/llm_client/test/test_cursor_adapter_model.rb
+- templates/skillsets/llm_client/test/test_cursor_adapter_readonly.rb
 - templates/skillsets/llm_client/test/test_cursor_adapter_retryable.rb
 - templates/skillsets/llm_client/test/test_error_taxonomy.rb
 - templates/skillsets/llm_client/tools/llm_call.rb