@dcl-regenesislabs/opendcl 0.1.4-22337368589.commit-8d0fe5a → 0.1.4-22626562583.commit-09a1d03

package/README.md

@@ -32,7 +32,7 @@ The result: **more creators building more scenes, faster.**
 - **Integrated commands** — `/init` to scaffold, `/preview` to launch the dev server, `/tasks` to manage running processes, `/review` to audit code
 - **TypeScript validation** — catches type errors immediately after writing code
 - **Free asset catalogs** — 2,700+ Creator Hub 3D models, 900+ CC0-licensed models, and 50 audio files the agent proactively suggests when building scenes
-- **Permission gate** — prompts for confirmation before destructive bash commands or writes to sensitive files
+- **Permission gate** — prompts for confirmation before destructive bash commands, writes to sensitive files, or any file access outside the working directory
 - **Compact tool output** — write shows path + size instead of file content, read shows a 5-line preview instead of 10
 - **Session persistence** — pick up where you left off across sessions
 

package/context/asset-packs-catalog.md

@@ -6,10 +6,12 @@ Premium 3D models from the official Decentraland Creator Hub. All models are fre
 
 **How to use**:
 1. Find a model below that matches your scene
-2. Download it: `curl -o models/filename.glb "URL"`
-3. Reference it: `GltfContainer.create(entity, { src: 'models/filename.glb' })`
+2. Download it — the output path **must** start with `models/`:
+   `curl -o models/<filename>.glb "<URL>"`
+3. Reference it: `GltfContainer.create(entity, { src: 'models/<filename>.glb' })`
 
-> **Important**: `GltfContainer` only works with local files. Always download models into the scene's `models/` directory first.
+> **Important**: Always download into `models/`. Never write to the scene root.
+> Correct: `curl -o models/Sofa_Black.glb "..."` | Wrong: `curl -o Sofa_Black.glb "..."`
 
 ---
 

package/context/audio-catalog.md

@@ -6,10 +6,12 @@ Free audio files from the official Decentraland Creator Hub asset packs. All sou
 
 **How to use**:
 1. Find a sound below that matches your scene
-2. Download it: `curl -o sounds/filename.mp3 "URL"`
-3. Reference it: `AudioSource.create(entity, { audioClipUrl: 'sounds/filename.mp3', playing: true, loop: false })`
+2. Download it — the output path **must** start with `sounds/`:
+   `curl -o sounds/<filename>.mp3 "<URL>"`
+3. Reference it: `AudioSource.create(entity, { audioClipUrl: 'sounds/<filename>.mp3', playing: true, loop: false })`
 
-> **Important**: `AudioSource` only works with local files. Always download audio into the scene's `sounds/` directory first.
+> **Important**: Always download into `sounds/`. Never write to the scene root.
+> Correct: `curl -o sounds/click.mp3 "..."` | Wrong: `curl -o click.mp3 "..."`
 
 ---
 

package/context/open-source-3d-assets.md

@@ -9,6 +9,15 @@ Free CC0-licensed GLB 3D models curated from the [Open Source 3D Assets](https:/
 - **Creator**: Polygonal Mind
 - **License**: CC0 (Public Domain)
 
+**How to use**:
+1. Find a model below that matches your scene
+2. Download it — the output path **must** start with `models/`:
+   `curl -o models/<filename>.glb "<URL>"`
+3. Reference it: `GltfContainer.create(entity, { src: 'models/<filename>.glb' })`
+
+> **Important**: Always download into `models/`. Never write to the scene root.
+> Correct: `curl -o models/Tree_01.glb "..."` | Wrong: `curl -o Tree_01.glb "..."`
+
 Base URL for all downloads:
 ```
 https://raw.githubusercontent.com/ToxSam/cc0-models-Polygonal-Mind/main/projects/

package/dist/index.js

@@ -51,6 +51,7 @@ const extensions = [
     "dcl-update-check.ts",
     "dcl-status.ts",
     "dcl-tasks.ts",
+    "dcl-asset-path.ts",
 ];
 for (const ext of extensions) {
     args.push("-e", join(extDir, ext));

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;GAIG;AAEH,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AACtC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAEzC,uFAAuF;AACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AACtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,QAAQ,CAAC;AAC7C,CAAC;AAED,wEAAwE;AACxE,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;AACrD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;IAC9B,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED,yCAAyC;AACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEnC,wFAAwF;AACxF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,EAAE,OAAO,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,GAAG;SACrB,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC;SACpC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;SAC9E,IAAI,EAAE,CAAC;IACV,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED,sBAAsB;AACtB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AAC9C,MAAM,UAAU,GAAG;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,eAAe;IACf,cAAc;IACd,qBAAqB;IACrB,iBAAiB;IACjB,eAAe;IACf,qBAAqB;IACrB,eAAe;IACf,cAAc;CACf,CAAC;AACF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;IAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;AACrC,CAAC;AACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;AACpD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAEtD,6BAA6B;AAC7B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEjD,yFAAyF;AACzF,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC,CAAC;AACtE,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAEvE,gFAAgF;AAChF,mEAAmE;AACnE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;IACb,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,GAAG,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,sEAAsE;AACtE,MAAM,YAAY,GAAG,eAAe,CAAC,SAAS,CAAC,WAAW,CAAC;AAC3D,eAAe,CAAC,SAAS,CAAC,WAAW,GAAG,UAAU,GAAW;IAC3D,IAAI,GAAG,CAAC,UAAU,CAAC,qBAAqB,CAAC;QAAE,OAAO;IAClD,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,+EAA+E;AAC/E,qDAAqD;AACpD,eAAe,CAAC,SAAiB,CAAC,sBAAsB,GAAG;IAC1D,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,0EAA0E;AAC1E,iFAAiF;AACjF,gEAAgE;AAChE,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AAClG,eAAe,CAAC,SAAiB,CAAC,sBAAsB,GAAG;IACzD,IAAY,CAAC,UAAU,CACtB,YAAY,cAAc,gEAAgE,cAAc,EAAE,CAC3G,CAAC;AACJ,CAAC,CAAC;AAEF,yFAAyF;AACzF,uFAAuF;AACvF,8FAA8F;AAC9F,2EAA2E;AAC3E,MAAM,WAAW,GAAI,eAAe,CAAC,SAAiB,CAAC,2BAA2B,CAAC;AAClF,eAAe,CAAC,SAAiB,CAAC,2BAA2B,GAAG,UAAU,QAAgB;IACzF,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACvB,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;IAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;GAIG;AAEH,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AACtC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAEzC,uFAAuF;AACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AACtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,QAAQ,CAAC;AAC7C,CAAC;AAED,wEAAwE;AACxE,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;AACrD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;IAC9B,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED,yCAAyC;AACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEnC,wFAAwF;AACxF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,EAAE,OAAO,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,GAAG;SACrB,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC;SACpC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;SAC9E,IAAI,EAAE,CAAC;IACV,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED,sBAAsB;AACtB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AAC9C,MAAM,UAAU,GAAG;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,eAAe;IACf,cAAc;IACd,qBAAqB;IACrB,iBAAiB;IACjB,eAAe;IACf,qBAAqB;IACrB,eAAe;IACf,cAAc;IACd,mBAAmB;CACpB,CAAC;AACF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;IAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;AACrC,CAAC;AACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;AACpD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAEtD,6BAA6B;AAC7B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEjD,yFAAyF;AACzF,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC,CAAC;AACtE,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAEvE,gFAAgF;AAChF,mEAAmE;AACnE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;IACb,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,GAAG,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,sEAAsE;AACtE,MAAM,YAAY,GAAG,eAAe,CAAC,SAAS,CAAC,WAAW,CAAC;AAC3D,eAAe,CAAC,SAAS,CAAC,WAAW,GAAG,UAAU,GAAW;IAC3D,IAAI,GAAG,CAAC,UAAU,CAAC,qBAAqB,CAAC;QAAE,OAAO;IAClD,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,+EAA+E;AAC/E,qDAAqD;AACpD,eAAe,CAAC,SAAiB,CAAC,sBAAsB,GAAG;IAC1D,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,0EAA0E;AAC1E,iFAAiF;AACjF,gEAAgE;AAChE,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AAClG,eAAe,CAAC,SAAiB,CAAC,sBAAsB,GAAG;IACzD,IAAY,CAAC,UAAU,CACtB,YAAY,cAAc,gEAAgE,cAAc,EAAE,CAC3G,CAAC;AACJ,CAAC,CAAC;AAEF,yFAAyF;AACzF,uFAAuF;AACvF,8FAA8F;AAC9F,2EAA2E;AAC3E,MAAM,WAAW,GAAI,eAAe,CAAC,SAAiB,CAAC,2BAA2B,CAAC;AAClF,eAAe,CAAC,SAAiB,CAAC,2BAA2B,GAAG,UAAU,QAAgB;IACzF,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACvB,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;IAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/extensions/dcl-asset-path.ts

@@ -0,0 +1,60 @@
+/**
+ * Asset Path Guard Extension
+ *
+ * Blocks curl downloads that place asset files in the wrong directory.
+ * Models (.glb/.gltf) must go into models/, audio (.mp3/.ogg/.wav) into sounds/.
+ */
+
+import type { ExtensionFactory } from "@mariozechner/pi-coding-agent";
+
+interface AssetViolation {
+  file: string;
+  expected: string;
+}
+
+const ASSET_RULES: { pattern: RegExp; dir: string }[] = [
+  { pattern: /\.gl(?:b|tf)$/i, dir: "models/" },
+  { pattern: /\.(?:mp3|ogg|wav)$/i, dir: "sounds/" },
+];
+
+/**
+ * Check a curl command for asset files downloaded to the wrong directory.
+ * Returns null if the command is fine, or a violation object if it should be blocked.
+ */
+export function checkCurlOutput(command: string): AssetViolation | null {
+  const outputMatches = command.matchAll(/-o\s+["']?([^\s"']+)/g);
+  for (const match of outputMatches) {
+    const outputPath = match[1];
+    for (const rule of ASSET_RULES) {
+      if (rule.pattern.test(outputPath) && !outputPath.includes(rule.dir)) {
+        const relativePath = outputPath.replace(/^\.\//, "");
+        return {
+          file: relativePath,
+          expected: rule.dir + relativePath,
+        };
+      }
+    }
+  }
+  return null;
+}
+
+const extension: ExtensionFactory = (pi) => {
+  pi.on("tool_call", async (event) => {
+    if (event.toolName !== "bash") return;
+
+    const command = (event.input as { command?: string }).command ?? "";
+    const violation = checkCurlOutput(command);
+    if (!violation) return;
+
+    return {
+      block: true,
+      reason: [
+        "Asset files must be downloaded into the correct directory.",
+        `Use: curl -o ${violation.expected} instead of curl -o ${violation.file}`,
+        "Models (.glb/.gltf) → models/    Audio (.mp3/.ogg/.wav) → sounds/",
+      ].join("\n"),
+    };
+  });
+};
+
+export default extension;

package/extensions/permissions/index.ts

@@ -7,25 +7,53 @@
  */
 
 import type { ExtensionFactory } from "@mariozechner/pi-coding-agent";
-import { classifyBashCommand, classifyFilePath } from "./utils.js";
+import { classifyBashCommand, classifyFilePath, isOutsideCwd, OUTSIDE_CWD_REASON } from "./utils.js";
+import { resolve } from "node:path";
 
-function blockResult(reason: string, detail: string): { block: true; reason: string } {
+type BlockResult = { block: true; reason: string };
+
+function blockResult(reason: string, detail: string): BlockResult {
   return {
     block: true,
     reason: `Blocked: ${reason}\n${detail}\nUse --no-permissions to allow in non-interactive mode.`,
   };
 }
 
-function denyResult(reason: string): { block: true; reason: string } {
+function denyResult(reason: string): BlockResult {
   return { block: true, reason: `User denied: ${reason}` };
 }
 
-const ALLOW = "Allow";
-const ALWAYS = "Always allow";
-const DENY = "Deny";
+const CHOICES = ["Allow", "Always allow", "Deny"] as const;
 
 const extension: ExtensionFactory = (pi) => {
   const sessionAllow = new Set<string>();
+  const allowedPaths = new Set<string>();
+
+  function isPathAllowed(resolvedPath: string): boolean {
+    for (const allowed of allowedPaths) {
+      if (resolvedPath === allowed || resolvedPath.startsWith(allowed + "/")) return true;
+    }
+    return false;
+  }
+
+  /**
+   * Prompts the user for confirmation and handles their choice.
+   * Returns a BlockResult to deny, or undefined to allow.
+   */
+  async function promptOrBlock(
+    ctx: { hasUI: boolean; ui: { select: (title: string, options: string[]) => Promise<string | null> } },
+    reason: string,
+    detail: string,
+    onAlways: () => void,
+  ): Promise<BlockResult | undefined> {
+    if (!ctx.hasUI) return blockResult(reason, detail);
+
+    const choice = await ctx.ui.select(`${reason}\n${detail}`, [...CHOICES]);
+
+    if (choice === "Always allow") { onAlways(); return; }
+    if (choice === "Allow") return;
+    return denyResult(reason);
+  }
 
   pi.registerFlag("no-permissions", {
     description: "Disable permission gate (skip confirmation prompts for dangerous operations)",
@@ -43,33 +71,36 @@ const extension: ExtensionFactory = (pi) => {
       const reason = classifyBashCommand(command);
       if (!reason || sessionAllow.has(reason)) return;
 
-      if (!ctx.hasUI) return blockResult(reason, `Command: ${command}`);
-
-      const choice = await ctx.ui.select(
-        `${reason}\nCommand: ${command}`,
-        [ALLOW, ALWAYS, DENY],
-      );
-
-      if (choice === ALWAYS) { sessionAllow.add(reason); return; }
-      if (choice === ALLOW) return;
-      return denyResult(reason);
+      return promptOrBlock(ctx, reason, `Command: ${command}`, () => sessionAllow.add(reason));
     }
 
     if (toolName === "write" || toolName === "edit") {
       const filePath = (event.input as { path?: string }).path ?? "";
       const reason = filePath ? classifyFilePath(filePath, ctx.cwd) : null;
-      if (!reason || sessionAllow.has(reason)) return;
+      if (!reason) return;
 
-      if (!ctx.hasUI) return blockResult(reason, `Path: ${filePath}`);
+      if (reason === OUTSIDE_CWD_REASON) {
+        const resolved = resolve(ctx.cwd, filePath);
+        if (isPathAllowed(resolved)) return;
+
+        return promptOrBlock(ctx, reason, `File: ${filePath}`, () => allowedPaths.add(resolved));
+      }
+
+      if (sessionAllow.has(reason)) return;
+
+      return promptOrBlock(ctx, reason, `Path: ${filePath}`, () => sessionAllow.add(reason));
+    }
+
+    if (toolName === "read" || toolName === "grep" || toolName === "find" || toolName === "ls") {
+      const filePath = (event.input as { path?: string }).path ?? "";
+      if (!filePath) return;
 
-      const choice = await ctx.ui.select(
-        `${reason}\nFile: ${filePath}`,
-        [ALLOW, ALWAYS, DENY],
-      );
+      const resolved = resolve(ctx.cwd, filePath);
+      const reason = isOutsideCwd(filePath, ctx.cwd);
+      if (!reason) return;
+      if (isPathAllowed(resolved)) return;
 
-      if (choice === ALWAYS) { sessionAllow.add(reason); return; }
-      if (choice === ALLOW) return;
-      return denyResult(reason);
+      return promptOrBlock(ctx, reason, `Path: ${filePath}`, () => allowedPaths.add(resolved));
     }
   });
 };

package/extensions/permissions/utils.ts

@@ -5,6 +5,8 @@
 
 import { resolve, relative } from "node:path";
 
+export const OUTSIDE_CWD_REASON = "Accesses path outside working directory";
+
 interface DenylistEntry {
   pattern: RegExp;
   reason: string;
@@ -75,8 +77,20 @@ export function classifyFilePath(filePath: string, projectRoot: string): string
   const rel = relative(projectRoot, resolved);
 
   if (rel.startsWith("..")) {
-    return "File is outside the project root";
+    return OUTSIDE_CWD_REASON;
   }
 
   return findMatchingReason(SENSITIVE_FILE_PATTERNS, filePath);
 }
+
+/**
+ * Returns a reason string if the file path resolves outside the given cwd,
+ * or null if inside (or empty).
+ */
+export function isOutsideCwd(filePath: string, cwd: string): string | null {
+  if (!filePath) return null;
+  const resolved = resolve(cwd, filePath);
+  const rel = relative(cwd, resolved);
+  if (rel.startsWith("..")) return OUTSIDE_CWD_REASON;
+  return null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dcl-regenesislabs/opendcl",
-  "version": "0.1.4-22337368589.commit-8d0fe5a",
+  "version": "0.1.4-22626562583.commit-09a1d03",
   "description": "AI coding assistant for Decentraland SDK7 scene development",
   "type": "module",
   "bin": {
@@ -66,5 +66,5 @@
     "prompts/",
     "context/"
   ],
-  "commit": "8d0fe5a0f4b0f42d764cb734512ce31a1dabb8a4"
+  "commit": "09a1d037c3a42a9041ce7baccd6d22411cb365ed"
 }