@f5-sales-demo/xcsh 19.100.1 → 19.101.1

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "19.100.1",
+	"version": "19.101.1",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -57,13 +57,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "19.100.1",
-		"@f5-sales-demo/pi-agent-core": "19.100.1",
-		"@f5-sales-demo/pi-ai": "19.100.1",
-		"@f5-sales-demo/pi-natives": "19.100.1",
-		"@f5-sales-demo/pi-resource-management": "19.100.1",
-		"@f5-sales-demo/pi-tui": "19.100.1",
-		"@f5-sales-demo/pi-utils": "19.100.1",
+		"@f5-sales-demo/xcsh-stats": "19.101.1",
+		"@f5-sales-demo/pi-agent-core": "19.101.1",
+		"@f5-sales-demo/pi-ai": "19.101.1",
+		"@f5-sales-demo/pi-natives": "19.101.1",
+		"@f5-sales-demo/pi-resource-management": "19.101.1",
+		"@f5-sales-demo/pi-tui": "19.101.1",
+		"@f5-sales-demo/pi-utils": "19.101.1",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/scripts/generate-extension-capabilities.ts

@@ -20,55 +20,182 @@ const here = import.meta.dir; // packages/coding-agent/scripts
 const vendoredPath = path.resolve(here, "../src/browser/capabilities.json");
 const generatedPath = path.resolve(here, "../src/browser/capabilities.generated.ts");
 
-// Co-build refresh: prefer the sibling extension's freshly-built contract.
-const siblingPath =
-	process.env.XCSH_EXTENSION_CAPABILITIES ?? path.resolve(here, "../../../../xcsh-chrome-extension/capabilities.json");
-if (fs.existsSync(siblingPath) && path.resolve(siblingPath) !== vendoredPath) {
-	fs.copyFileSync(siblingPath, vendoredPath);
+// Guarded so the regression checks below can be imported by tests without regenerating files.
+// Importing this module used to run the whole generator as a side effect (#2578).
+if (import.meta.main) {
+	// Co-build refresh: adopt the sibling extension's freshly-built contract — but only when it really is
+	// fresher. "The directory exists" is not evidence of that, and treating it as evidence silently rewrote a
+	// committed contract from whatever happened to be on the developer's disk (#2578).
+	//
+	// Measured on a real machine: a sibling checkout left at contractVersion 1.8.0 overwrote the committed
+	// 1.12.0 and deleted the whole `handshake` feature block, on every `bun run check`, `bun test` and
+	// `bun run build`. `release.ts` runs `git commit -a`, so the downgrade was one release away from shipping.
+	// The guard applies to the path found by *proximity*, which is the accidental one. An explicitly set
+	// XCSH_EXTENSION_CAPABILITIES is a deliberate statement about which manifest to compile in — including a
+	// major-version co-build that removes tools on purpose — so it is honoured and merely announced.
+	const explicitPath = process.env.XCSH_EXTENSION_CAPABILITIES;
+	const siblingPath = explicitPath ?? path.resolve(here, "../../../../xcsh-chrome-extension/capabilities.json");
+	if (explicitPath !== undefined && fs.existsSync(explicitPath) && path.resolve(explicitPath) !== vendoredPath) {
+		console.log(`Adopting ${explicitPath} (XCSH_EXTENSION_CAPABILITIES set explicitly).`);
+		fs.copyFileSync(explicitPath, vendoredPath);
+	} else if (explicitPath === undefined && fs.existsSync(siblingPath) && path.resolve(siblingPath) !== vendoredPath) {
+		adoptSiblingIfNotARegression(siblingPath, vendoredPath);
+	}
+
+	const manifest = JSON.parse(fs.readFileSync(vendoredPath, "utf8")) as {
+		contractVersion: string;
+		tools: Array<{ name: string }>;
+	};
+	const toolNames = manifest.tools.map(t => t.name);
+
+	const output = [
+		"// Auto-generated by scripts/generate-extension-capabilities.ts - DO NOT EDIT",
+		"// Source: src/browser/capabilities.json (the Chrome extension's published contract).",
+		"",
+		"export interface ExtensionToolFlags {",
+		"\treadonly readOnly?: boolean;",
+		"\treadonly mutates?: boolean;",
+		"\treadonly requiresExplainMode?: boolean;",
+		"}",
+		"",
+		"export interface ExtensionToolDef {",
+		"\treadonly name: string;",
+		"\treadonly summary: string;",
+		"\treadonly category: string;",
+		"\treadonly params: Record<string, unknown>;",
+		"\treadonly flags?: ExtensionToolFlags;",
+		"}",
+		"",
+		"export interface ExtensionCapabilities {",
+		"\treadonly version: string;",
+		"\treadonly contractVersion: string;",
+		"\treadonly multiPortDiscovery?: boolean;",
+		"\treadonly protocol: string;",
+		"\treadonly tools: readonly ExtensionToolDef[];",
+		"\treadonly features: Record<string, unknown>;",
+		"}",
+		"",
+		`export const EXTENSION_CAPABILITIES: ExtensionCapabilities = ${JSON.stringify(manifest, null, "\t")};`,
+		"",
+		`export const EXTENSION_CONTRACT_VERSION = ${JSON.stringify(manifest.contractVersion)};`,
+		"",
+		`export const EXTENSION_TOOL_NAMES: readonly string[] = ${JSON.stringify(toolNames)};`,
+		"",
+	].join("\n");
+
+	await Bun.write(generatedPath, output);
+	console.log(
+		`Generated ${path.relative(process.cwd(), generatedPath)} (${toolNames.length} tools, contract ${manifest.contractVersion})`,
+	);
+}
+
+/** A capability manifest, as far as the regression check needs to understand one. */
+interface CapabilityManifest {
+	contractVersion?: string;
+	tools?: Array<{ name?: string }>;
+	features?: Record<string, unknown>;
+}
+
+/**
+ * Decide whether a sibling manifest may replace the committed one.
+ *
+ * Exported for tests. Returns the reason to refuse, or undefined when adoption is safe.
+ *
+ * Two independent guards, because they catch different mistakes:
+ *  - a lower `contractVersion` is a stale checkout, the case that actually happened;
+ *  - a missing tool or feature key at the same-or-higher version is a broken build, which a version
+ *    comparison alone would wave through.
+ */
+export function regressionReason(sibling: CapabilityManifest, vendored: CapabilityManifest): string | undefined {
+	const siblingVersion = sibling.contractVersion ?? "";
+	const vendoredVersion = vendored.contractVersion ?? "";
+	const versionOrder = compareContractVersions(siblingVersion, vendoredVersion);
+	if (versionOrder < 0) {
+		return `contractVersion would go backwards, ${vendoredVersion} -> ${siblingVersion}`;
+	}
+
+	const lostTools = missingKeys(
+		(vendored.tools ?? []).map(tool => tool.name ?? ""),
+		(sibling.tools ?? []).map(tool => tool.name ?? ""),
+	);
+	if (lostTools.length > 0) return `tools would be lost: ${lostTools.join(", ")}`;
+
+	const lostFeatures = missingKeys(Object.keys(vendored.features ?? {}), Object.keys(sibling.features ?? {}));
+	if (lostFeatures.length > 0) return `features would be lost: ${lostFeatures.join(", ")}`;
+
+	// Equal versions with different content mean one side changed without bumping, so the version says
+	// nothing about which is fresher. That is not hypothetical: a tool was once added while contractVersion
+	// stayed put, which is exactly how a stale same-version sibling could regress nested tool params or
+	// feature internals past a check that only compares names. Refuse and let the operator decide, via
+	// XCSH_EXTENSION_CAPABILITIES if they mean it.
+	if (versionOrder === 0 && !sameContent(sibling, vendored)) {
+		return `contractVersion is unchanged at ${vendoredVersion} but the content differs, so neither copy is provably fresher`;
+	}
+
+	return undefined;
 }
 
-const manifest = JSON.parse(fs.readFileSync(vendoredPath, "utf8")) as {
-	contractVersion: string;
-	tools: Array<{ name: string }>;
-};
-const toolNames = manifest.tools.map(t => t.name);
-
-const output = [
-	"// Auto-generated by scripts/generate-extension-capabilities.ts - DO NOT EDIT",
-	"// Source: src/browser/capabilities.json (the Chrome extension's published contract).",
-	"",
-	"export interface ExtensionToolFlags {",
-	"\treadonly readOnly?: boolean;",
-	"\treadonly mutates?: boolean;",
-	"\treadonly requiresExplainMode?: boolean;",
-	"}",
-	"",
-	"export interface ExtensionToolDef {",
-	"\treadonly name: string;",
-	"\treadonly summary: string;",
-	"\treadonly category: string;",
-	"\treadonly params: Record<string, unknown>;",
-	"\treadonly flags?: ExtensionToolFlags;",
-	"}",
-	"",
-	"export interface ExtensionCapabilities {",
-	"\treadonly version: string;",
-	"\treadonly contractVersion: string;",
-	"\treadonly multiPortDiscovery?: boolean;",
-	"\treadonly protocol: string;",
-	"\treadonly tools: readonly ExtensionToolDef[];",
-	"\treadonly features: Record<string, unknown>;",
-	"}",
-	"",
-	`export const EXTENSION_CAPABILITIES: ExtensionCapabilities = ${JSON.stringify(manifest, null, "\t")};`,
-	"",
-	`export const EXTENSION_CONTRACT_VERSION = ${JSON.stringify(manifest.contractVersion)};`,
-	"",
-	`export const EXTENSION_TOOL_NAMES: readonly string[] = ${JSON.stringify(toolNames)};`,
-	"",
-].join("\n");
-
-await Bun.write(generatedPath, output);
-console.log(
-	`Generated ${path.relative(process.cwd(), generatedPath)} (${toolNames.length} tools, contract ${manifest.contractVersion})`,
-);
+/**
+ * Whole-manifest equality, by canonical JSON.
+ *
+ * Deliberately not a deep field-by-field comparison: the question is only "are these the same document",
+ * and any difference at an equal version is enough to refuse.
+ */
+function sameContent(left: CapabilityManifest, right: CapabilityManifest): boolean {
+	return canonicalJson(left) === canonicalJson(right);
+}
+
+/** JSON with object keys sorted, so key order alone does not read as a difference. */
+function canonicalJson(value: unknown): string {
+	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+	if (value !== null && typeof value === "object") {
+		const entries = Object.entries(value as Record<string, unknown>).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+		return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`).join(",")}}`;
+	}
+	return JSON.stringify(value) ?? "null";
+}
+
+function missingKeys(expected: readonly string[], actual: readonly string[]): string[] {
+	const present = new Set(actual.filter(Boolean));
+	return expected.filter(key => key !== "" && !present.has(key));
+}
+
+/** Numeric-segment comparison. Enough for a dotted contract version, and no dependency. */
+export function compareContractVersions(left: string, right: string): number {
+	const parse = (value: string): number[] => value.split(".").map(part => Number.parseInt(part, 10) || 0);
+	const a = parse(left);
+	const b = parse(right);
+	for (let index = 0; index < Math.max(a.length, b.length); index += 1) {
+		const diff = (a[index] ?? 0) - (b[index] ?? 0);
+		if (diff !== 0) return diff < 0 ? -1 : 1;
+	}
+	return 0;
+}
+
+function adoptSiblingIfNotARegression(from: string, to: string): void {
+	let sibling: CapabilityManifest;
+	let vendored: CapabilityManifest;
+	try {
+		sibling = JSON.parse(fs.readFileSync(from, "utf8")) as CapabilityManifest;
+		vendored = JSON.parse(fs.readFileSync(to, "utf8")) as CapabilityManifest;
+	} catch (error) {
+		// Unreadable input must not silently leave the committed copy in place either — say so.
+		console.warn(`Keeping the committed capabilities: could not compare with ${from} (${String(error)}).`);
+		return;
+	}
+
+	const reason = regressionReason(sibling, vendored);
+	if (reason === undefined) {
+		fs.copyFileSync(from, to);
+		return;
+	}
+
+	// Refused rather than fatal: this generator runs from `check:types`, `test` and `build`, so failing
+	// here would block every command on any machine with a stale sibling checkout. Skipping keeps the
+	// committed contract — the correct one — and names what was ignored so it is fixable.
+	console.warn(
+		`Ignoring ${from}: ${reason}.\n` +
+			"  The committed capabilities.json is being kept. Update or remove that checkout, or set\n" +
+			"  XCSH_EXTENSION_CAPABILITIES to the manifest you actually want compiled in.",
+	);
+}

package/src/extensibility/extensions/bundled/sandbox-guard.ts

@@ -1,5 +1,6 @@
 import type { ExtensionAPI } from "@f5-sales-demo/xcsh";
 import { settings } from "../../../config/settings";
+import { containmentStatus } from "../../../sandbox/containment";
 import { evaluateToolCall } from "../../../sandbox/enforce";
 import { resolveSessionPolicy } from "../../../sandbox/session-policy";
 
@@ -30,6 +31,11 @@ export default function sandboxGuard(pi: ExtensionAPI): void {
 			input: event.input as Record<string, unknown>,
 			cwd: ctx.cwd,
 			policy,
+			// Asked per call rather than cached at load: the answer comes from a probe of the running
+			// kernel, and a session can be created before the native module has been reached. The probe
+			// itself memoises, so this costs nothing after the first call. When an OS backend confines the
+			// shell, the command-text scan stops deciding for `bash` — see the #2582 note in enforce.ts.
+			shellOsConfined: containmentStatus(true).osEnforced,
 		});
 		return decision.block ? { block: true, reason: decision.reason } : undefined;
 	});

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "19.100.1",
-	"commit": "ab1af6daf7fdebc0fd0a193bdae578f0e9395eab",
-	"shortCommit": "ab1af6d",
+	"version": "19.101.1",
+	"commit": "fbb716396d667153d37600b5c654893f7cdb3385",
+	"shortCommit": "fbb7163",
 	"branch": "main",
-	"tag": "v19.100.1",
-	"commitDate": "2026-07-29T00:48:34Z",
-	"buildDate": "2026-07-29T01:14:16.102Z",
+	"tag": "v19.101.1",
+	"commitDate": "2026-07-30T02:09:00Z",
+	"buildDate": "2026-07-30T02:36:13.835Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/ab1af6daf7fdebc0fd0a193bdae578f0e9395eab",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.100.1"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/fbb716396d667153d37600b5c654893f7cdb3385",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.101.1"
 };

package/src/internal-urls/fleet-resolve.ts

@@ -210,6 +210,127 @@ export function classifyRepo(classes: RepoClasses | null, repo: RepoIdentity | n
 	return { className: className || CLASS_UNCLASSIFIED, declared, trustedOrg, definition };
 }
 
+/** The fleet split by what may be done in each repository, rather than by class name. */
+export interface AuthorityPartition {
+	/** Repositories xcsh authors in directly. */
+	readonly authored: readonly string[];
+	/** Repositories whose implementation belongs to a coding harness. */
+	readonly delegated: readonly string[];
+	/** Repositories that change only through the governed path. */
+	readonly governed: readonly string[];
+	/** Declared repositories whose class carries an authority this build does not know. */
+	readonly unknown: readonly string[];
+	/** Distinct `delegate_to` targets across the delegating classes. */
+	readonly delegateTargets: readonly string[];
+}
+
+/**
+ * Group every *declared* repository by the authority its class carries.
+ *
+ * Classes are the manifest's vocabulary; authority is what actually decides how xcsh
+ * contributes, and it is the only thing that answers "is this one mine?". Grouping by it
+ * keeps that answer correct if docs-control ever adds a fourth class — a new authoring
+ * class lands in `authored` without a change here.
+ *
+ * Only declared repositories appear. An unlisted one is UNCLASSIFIED and must never be
+ * presented as authorable, which is the same fail-closed stance `classifyRepo` takes.
+ */
+export function partitionByAuthority(classes: RepoClasses): AuthorityPartition {
+	const authored: string[] = [];
+	const delegated: string[] = [];
+	const governed: string[] = [];
+	const unknown: string[] = [];
+	const delegateTargets = new Set<string>();
+
+	for (const [repo, className] of Object.entries(classes.repos)) {
+		// An assignment naming an undefined class has no authority to read, so it falls
+		// through to `unknown` — never to `authored`.
+		const definition = classes.classes[className];
+		switch (definition?.authority) {
+			case AUTHORITY_AUTHOR:
+				authored.push(repo);
+				break;
+			case AUTHORITY_DELEGATE:
+				delegated.push(repo);
+				if (definition.delegateTo) delegateTargets.add(definition.delegateTo);
+				break;
+			case AUTHORITY_GOVERNED:
+				governed.push(repo);
+				break;
+			default:
+				unknown.push(repo);
+				break;
+		}
+	}
+
+	return {
+		authored: authored.sort(),
+		delegated: delegated.sort(),
+		governed: governed.sort(),
+		unknown: unknown.sort(),
+		delegateTargets: [...delegateTargets].sort(),
+	};
+}
+
+/** Repository names as inline code, or an explicit marker when the group is empty. */
+function renderRepoList(repos: readonly string[]): string {
+	return repos.length > 0 ? repos.map(r => `\`${r}\``).join(" ") : "_none_";
+}
+
+/**
+ * The roster, stated plainly: which repositories xcsh authors in, which belong to a
+ * coding harness, and which move only through the governed path.
+ *
+ * `renderFleet` below already lists every class in manifest detail, but reading it means
+ * mapping class → authority → "is this mine?" for each entry. That question comes up on
+ * its own ("which repositories do I manage?"), so answer it once, by name, and let it be
+ * read rather than inferred.
+ */
+function renderTerritory(classes: RepoClasses): string[] {
+	const { authored, delegated, governed, unknown, delegateTargets } = partitionByAuthority(classes);
+	const handOff =
+		delegateTargets.length > 0 ? delegateTargets.map(t => `\`${t}\``).join(", ") : "a dedicated coding harness";
+
+	const lines = [
+		"## Your territory",
+		"",
+		`**You author in these ${authored.length} repositories** — every one whose class carries`,
+		`\`authority: ${AUTHORITY_AUTHOR}\`. Documentation, Terraform plans, network diagrams, howtos and`,
+		"demo scripts are yours to write here, through the governed path:",
+		"",
+		renderRepoList(authored),
+		"",
+		`**${delegated.length} repositories are delegated** to ${handOff}. Your deliverable there is a`,
+		"verified issue plus the specification, review and documentation around it — never an",
+		"implementation:",
+		"",
+		renderRepoList(delegated),
+		"",
+		`**${governed.length} repositories change through the governed path only** — fleet plumbing whose`,
+		"changes propagate everywhere:",
+		"",
+		renderRepoList(governed),
+		"",
+	];
+
+	if (unknown.length > 0) {
+		lines.push(
+			`**${unknown.length} repositories carry an authority this build does not recognize.** Treat them`,
+			"as `delegate`, the restrictive case, and ask docs-control to fix the manifest:",
+			"",
+			renderRepoList(unknown),
+			"",
+		);
+	}
+
+	lines.push(
+		"This roster is read from the manifest, never inferred from what a repository contains. A",
+		"repository missing from it is UNCLASSIFIED and is never authored, whatever it holds.",
+		"",
+	);
+	return lines;
+}
+
 /** The behaviour each authority implies, stated so the agent does not have to infer it. */
 function authorityGuidance(authority: string): string[] {
 	switch (authority) {
@@ -309,16 +430,7 @@ function renderFleet(classes: RepoClasses): string[] {
 		const def = classes.classes[className];
 		lines.push(`### ${className} (${repos.length}) — authority: ${def?.authority ?? "unknown"}`);
 		if (def?.description) lines.push("", def.description);
-		lines.push(
-			"",
-			repos.length > 0
-				? repos
-						.sort()
-						.map(r => `\`${r}\``)
-						.join(" ")
-				: "_none_",
-			"",
-		);
+		lines.push("", renderRepoList(repos.sort()), "");
 	}
 
 	lines.push(
@@ -392,6 +504,7 @@ export function renderFleetDoc(
 		"# Fleet — repository classes and your authority here",
 		"",
 		...renderCurrentRepo(slug, verdict, classes),
+		...renderTerritory(classes),
 		...renderFleet(classes),
 		...renderProvenance(origin, classes),
 		...FOOTER,

package/src/prompts/internal-urls/containment.md

@@ -7,15 +7,34 @@ Filesystem isolation is **on**. Enforcement for the `bash` tool: **{{containment
 Your shell is confined by the operating system, not by inspecting the command you wrote. A path is
 checked where it is actually opened, after the shell has expanded variables, resolved aliases and
 followed symlinks — so how a path is spelled does not change what is reachable.
-- Ordinary work is unrestricted: system paths, `/tmp`, package caches (`~/.bun`, `~/.cargo`, …), the
-  network, and running programs are all untouched.
+- Ordinary work is unrestricted: system paths, `/tmp`, package caches (`~/.bun`, `~/.cargo`,
+  `~/go/pkg/mod`, …), the network, and running programs are all untouched.
+- The CLIs you drive keep their own configuration, so `gh`, `glab`, `az`, `aws`, `gcloud`, `sf`,
+  `docker`, `kubectl` and `terraform` all work normally, including the token refreshes and logs they
+  write as they go.
+{{#unless containment.commandConfigWritable}}
+  What you cannot do is *rewrite* the settings that name a command to run — `~/.aws/config`,
+  `~/.kube/config`, `~/.docker/config.json`, a plugin directory. Those stay readable and are refused for
+  writing, because a later unfenced run of that CLI would execute what you wrote.
+{{else}}
+  This backend cannot hold a file read-only inside a writable directory, so those settings are
+  writable here. Do not edit the ones that name a command to run — `~/.aws/config`, `~/.kube/config`,
+  `~/.docker/config.json`, `~/.azure/config`, a plugin directory — unless the operator asked you to: a
+  later unfenced run of that CLI would execute what you wrote.
+{{/unless}}
 - What is refused: reading or writing outside the session directory — another checkout, `~/.ssh`,
-  `~/.aws`, `~/Documents`, and other sessions' transcripts. `~/.gitconfig` is readable, not writable.
-- `cd` out of the session tree is refused, because every later relative path would resolve there.
+  `~/.gnupg`, `~/Documents`, and other sessions' transcripts. `~/.gitconfig` is readable, not writable.
+- `cd` follows the same boundary as everything else: moving somewhere reachable is fine, and `cd` into
+  a place you could not read is refused. Where you stand does not widen anything — the boundary is
+  fixed for the session, so it never follows the shell.
+
+If a command is refused, do not try to reach the same path a different way. Say what you needed and why.
+The operator can widen it with `--allow-path <dir>`, which grants read and write.
 
-If a command is refused, do not try to reach the same path a different way: the boundary is enforced
-below the command text, so no rewriting will succeed. Say what you needed and why. The operator can
-widen it with `--allow-path <dir>`, which grants read and write.
+That is an instruction, not a claim that rewriting is impossible. Two layers decide: the OS confinement
+above, and a scan of the command text before it runs. The scan reads what you wrote, so a path assembled
+at runtime can get past it — and reaching for that spelling after a refusal is precisely the behaviour
+being asked for here, whether or not it would work.
 
 {{#if containment.landlock}}
 Three things behave differently under this backend, and none of them is a bug to work around:

package/src/prompts/system/system-prompt.md

@@ -44,7 +44,9 @@ Terraform, howtos, demo and traffic-generation scripts — through the governed
 classified **developer** your deliverable is a rigorously-verified issue plus the specification,
 review and documentation around it, and the implementation is delegated to a development
 environment (Claude Code / Codex). In one classified **scaffolding**, changes go through the
-governed path only. An unclassified repository is treated as **developer**.
+governed path only. An unclassified repository is treated as **developer**. That document also
+names, one by one, every repository in each group — so "which repositories do I manage?" is a
+question you read the answer to, never one you estimate.
 
 You are also a **work in progress** under active development — you improve by verified
 contribution, never by claiming. See `<self-awareness>`.
@@ -313,7 +315,7 @@ Most tools resolve custom protocol URLs to internal resources (not web URLs):
 - `local://<TITLE>.md` — Finalized plan artifact created after `exit_plan_mode` approval
 - `jobs://<job-id>` — Specific job status and result
 - `mcp://<resource-uri>` — MCP resource from a connected server; matched against exact resource URIs first, then RFC 6570 URI templates advertised by connected servers
-- `xcsh://fleet` — The class of the repository you are working in and what you may author there. **MUST** read before creating, updating, or deleting content in any repository of this organization — this is about the *current repository*, not about xcsh, so the gate on the other `xcsh://` documents does not apply.
+- `xcsh://fleet` — The class of the repository you are working in and what you may author there, plus the full roster: every repository in the fleet listed by name under the authority that governs it. **MUST** read before creating, updating, or deleting content in any repository of this organization, and whenever you are asked which repositories you author in or manage — this is about the *current repository* and its fleet, not about xcsh, so the gate on the other `xcsh://` documents does not apply.
 - `xcsh://..` — Internal xcsh documentation. **MUST NOT** read unless the user asks about xcsh itself.
   - `xcsh://about` — Identity, version, build fingerprint, architecture, self-improvement. **MUST** read for any question about xcsh before exploring `~/.xcsh/`.
     This document contains the authoritative repository URL, issues URL, and source location.
@@ -349,7 +351,8 @@ from the contents**. Before you create, update, or delete content in any reposit
 organization, read `xcsh://fleet` and act on its verdict:
 - **content** → author directly. You do not need permission to write documentation, Terraform,
   howtos, diagrams or demo scripts here; you do need the governed path — linked issue → branch →
-  pull request → CI → auto-merge, never a commit to `main`.
+  pull request → CI → auto-merge, never a commit to `main`. `xcsh://fleet` lists every content
+  repository by name under "Your territory"; that list is the answer to what you author in.
 - **developer** → do not implement feature code. File a CONTRIBUTING-compliant issue (reproduce
   first, no unverified claims) and delegate the implementation to a dedicated coding harness.
   Specifying, reviewing and documenting remain yours.

package/src/sandbox/containment.ts

@@ -51,6 +51,14 @@ export interface ContainmentOptions {
 	writeOnlyRoots?: readonly string[];
 	/** Cross-session leak roots to deny. Defaults to the real memories/sessions/contexts dirs. */
 	leakRoots?: readonly string[];
+	/**
+	 * Whether the active backend can express "writable directory, except this file" — see
+	 * COMMAND_BEARING_CONFIG. True for seatbelt, false for Landlock, which cannot.
+	 *
+	 * Defaults to false, so a caller that does not know its backend gets the portable policy rather
+	 * than one that silently breaks the CLIs on Linux.
+	 */
+	narrowsWithinGrant?: boolean;
 }
 
 /**
@@ -75,6 +83,12 @@ const CACHE_DIRS = [
 	path.join(".yarn", "berry", "cache"),
 	path.join(".rustup", "toolchains"),
 	path.join(".rustup", "downloads"),
+	// Go keeps its module cache under ~/go, but ~/go also holds checked-out source and `go install`
+	// output, so only the cache is granted. Missed in the original list; `go build` failed for it.
+	path.join("go", "pkg", "mod"),
+	// The build cache is separate from the module cache and `go build` needs both. On macOS it lands in
+	// ~/Library/Caches (already granted); on Linux it is ~/.cache/go-build, which nothing else covers.
+	path.join(".cache", "go-build"),
 	// No credential convention of their own, so granted whole.
 	".pnpm-store",
 	".deno",
@@ -82,6 +96,88 @@ const CACHE_DIRS = [
 	path.join("Library", "pnpm"),
 ];
 
+/**
+ * Config and state directories of the CLIs xcsh ships plugins and skills for — the same list it probes
+ * for in `internal-urls/computer-profile.ts`.
+ *
+ * Granted read and write. In v19.100.0 the home deny covered all of these, so every one of `gh`, `glab`,
+ * `sf`, `az`, `aws` and `gcloud` failed on its own configuration — and the agent is instructed to file
+ * issues with `gh` (#2581). Write is required, not convenience: `az` writes a log per invocation to
+ * `~/.azure/commands`, `sf` writes a dated log into `~/.sf`, and both `aws` and `gcloud` refresh cached
+ * tokens without being asked. Measured with these read-only instead: `az` exits 1 on
+ * `~/.azure/commands/<stamp>.log`, and `sf` reproduces the original `EPERM` crash on `~/.sf/sf-<date>.log`.
+ *
+ * The cost, stated plainly: a fence keyed on paths cannot let `aws` read `~/.aws/credentials` without
+ * letting `cat` read it, so the operator's cloud credentials are readable from a fenced shell. Accepted,
+ * because the fence exists to stop the assistant wandering between customer workspaces rather than to
+ * withhold the operator's credential store from the operator's own CLIs — and the native `az`/`aws` tools
+ * already act with those credentials, so denying only the shell path broke the CLIs without protecting
+ * anything. `~/.ssh` and `~/.gnupg` are still denied: no shipped tool needs them.
+ *
+ * Reading a credential is not the same as being able to *replace* one, so see COMMAND_BEARING_CONFIG.
+ */
+const TOOL_CONFIG_DIRS = [
+	path.join(".config", "gh"), // gh
+	path.join(".config", "glab-cli"), // glab, XDG layout
+	path.join("Library", "Application Support", "glab-cli"), // glab, macOS layout
+	".sf", // sf
+	".sfdx", // sf, legacy layout still read by current versions
+	".azure", // az
+	".aws", // aws
+	path.join(".config", "gcloud"), // gcloud
+	".docker", // docker
+	".kube", // kubectl
+	".terraform.d", // terraform
+];
+
+/**
+ * Paths inside TOOL_CONFIG_DIRS that name a command or hold a loadable executable. Read-only, so the
+ * grant above never becomes a way to run code later.
+ *
+ * This is the distinction that matters: reading `~/.aws/credentials` discloses a secret, but *writing*
+ * `~/.aws/config` installs a `credential_process` that the operator's next — unfenced — `aws` call
+ * executes, with access to every customer workspace and private file the fence exists to protect. That
+ * is an escape from the sandbox rather than a leak inside it. `~/.cargo/config.toml` and
+ * `~/.gradle/init.gradle` are excluded from the cache carve-out for exactly this reason; these are the
+ * same class, and none of them was writable before #2581, so keeping them read-only means that change
+ * adds no new write capability on any path that can cause execution.
+ *
+ * Each entry is a documented mechanism, not a guess: `credential_process` (aws), `user.exec`
+ * (kubeconfig), `credsStore`/`credHelpers` and CLI plugins (docker), Python extensions (az), provider
+ * binaries (terraform), the virtualenv `activate` that gcloud's launcher sources, and `!`-prefixed shell
+ * aliases (gh, glab). The CLIs still read all of them, so nothing stops working; only rewriting does.
+ * `gh auth login` and `glab auth login` are interactive and belong outside a fenced session anyway.
+ */
+const COMMAND_BEARING_CONFIG = [
+	path.join(".aws", "config"), // credential_process = <command>
+	path.join(".aws", "cli", "alias"), // aws aliases; a leading `!` runs through a shell
+	path.join(".azure", "config"), // extension.index_url + use_dynamic_install fetch and run wheels
+	path.join(".kube", "config"), // users[].user.exec.command
+	path.join(".docker", "config.json"), // credsStore / credHelpers -> docker-credential-*
+	path.join(".docker", "cli-plugins"), // docker-* plugin executables
+	path.join(".azure", "cliextensions"), // az extensions, executed as Python
+	path.join(".terraform.d", "plugins"), // provider binaries
+	path.join(".config", "gcloud", "virtenv"), // sourced by the gcloud launcher
+	path.join(".config", "gh", "config.yml"), // gh alias set x '!sh -c ...', plus editor/browser/pager
+	// glab keeps aliases in their own file, so those can be held read-only. Its config.yml cannot:
+	// glab rewrites it on ordinary commands (atomic rename) to refresh the OAuth token and the
+	// update-check stamp, and holding it read-only reproduced #2581 — `glab auth status` exits 1 with
+	// "rename …/.config.yml".
+	//
+	// Worse than a failed command, and the reason this is not merely a convenience: the OAuth refresh
+	// already happened at GitLab, so a denied write loses the rotated refresh token and the operator's
+	// login is permanently dead — `invalid_grant` afterwards, even outside the fence. Observed while
+	// testing this change, which cost a real `glab auth login`. Any CLI that refreshes a rotating token
+	// must be able to persist it.
+	//
+	// Left writable, and the residual exposure is stated rather than hidden:
+	// that file also carries `editor`, `browser` and `duo_cli_binary_path`/`duo_cli_auto_run`, so a write
+	// there IS a code-execution vector this fence does not close. `gh` needs no such exception because it
+	// was measured working with its config.yml read-only.
+	path.join(".config", "glab-cli", "aliases.yml"),
+	path.join("Library", "Application Support", "glab-cli", "aliases.yml"),
+];
+
 /** Read-only inside home: configuration a tool needs to behave correctly, but must not rewrite. */
 const READ_ONLY_HOME = [".gitconfig", path.join(".config", "git")];
 
@@ -100,6 +196,33 @@ function canonical(root: string): string | undefined {
 	}
 }
 
+/**
+ * Canonicalise as much of `target` as already exists, keeping the absent tail.
+ *
+ * `canonical` gives up on a path whose leaf is missing, and falling back to the literal string is not
+ * safe for a rule whose job is to *narrow* another one. With `~/.aws` symlinked to a vault — chezmoi,
+ * stow and yadm all do this — and no config file yet, the grant is emitted resolved (`<vault>`) while
+ * the read-only rule keeps the link spelling (`~/.aws/config`). Both backends match a rule against the
+ * path the kernel resolved, so the narrower rule covers nothing.
+ *
+ * That was verified as a real escape before this existed: through the real seatbelt profile,
+ * `printf 'credential_process = …' > <vault>/config` succeeded. Note `fenceVerdict` did NOT show it,
+ * because `pathIsWithin` normalises symlinks — the in-process check was safe while the emitted profile
+ * was not, so a test asserting only the verdict passes while the boundary leaks.
+ */
+function canonicalThroughExisting(target: string): string {
+	const tail: string[] = [];
+	let current = target;
+	for (;;) {
+		const resolved = canonical(current);
+		if (resolved !== undefined) return path.join(resolved, ...tail);
+		const parent = path.dirname(current);
+		if (parent === current) return target;
+		tail.unshift(path.basename(current));
+		current = parent;
+	}
+}
+
 /**
  * Parents that must never be denied, however the workspace is placed.
  *
@@ -112,6 +235,11 @@ function tooBroadToDeny(candidate: string): boolean {
 	if (candidate === path.parse(candidate).root) return true;
 	const never = [
 		safeReal(os.tmpdir()),
+		// Both spellings: `/tmp` resolves to `/private/tmp` on macOS, and the ancestor walk works on
+		// resolved paths. Without the resolved form, a workspace at `/tmp/<x>/repo` denied `/private/tmp`
+		// — every other temp path with it — which contradicts the `/tmp` guarantee in `xcsh://about`.
+		"/tmp",
+		safeReal("/tmp"),
 		"/usr",
 		"/bin",
 		"/sbin",
@@ -166,13 +294,28 @@ export function buildContainmentFence(options: ContainmentOptions): ContainmentF
 	const allowWriteOnly = new Set<string>();
 	const deny = new Set<string>();
 
-	// Home is one fence. The workspace's own parent is the other, and it is the one that matters when
+	// Home is one fence. The workspace's ancestors are the other, and they are what matters when
 	// checkouts live outside home: with /work/customer-a as the workspace, /work/customer-b matched no
-	// rule at all and was readable and writable. Denying the parent closes sibling access wherever the
-	// checkouts sit, which is the threat this exists for.
+	// rule at all and was readable and writable.
+	//
+	// Every ancestor, not just the immediate parent. One level only works when the parent happens to be
+	// the container the tenants sit in; with `<container>/<tenant>/repo` the immediate parent IS the
+	// tenant, so every OTHER tenant matched nothing and the fence allowed it, read and write. That went
+	// unnoticed because the command-text scan is deny-by-default and refused those paths on the way in —
+	// the composite looked right while the fence alone did not. Removing that scan for OS-confined shells
+	// (#2582) is what exposed it, so the two changes ship together.
+	//
+	// Denying an ancestor costs nothing above it: the walk stops before anything `tooBroadToDeny`
+	// rejects, so `/`, `/usr`, `/tmp` and `$TMPDIR` are never denied and operational paths stay
+	// reachable. And it costs nothing below: the workspace is allowed at greater depth, and
+	// `fenceVerdict` takes the deepest match.
 	if (home !== undefined && home !== workspace) deny.add(home);
-	const parent = path.dirname(workspace);
-	if (parent !== workspace && !tooBroadToDeny(parent)) deny.add(parent);
+	for (let ancestor = path.dirname(workspace); ; ancestor = path.dirname(ancestor)) {
+		if (tooBroadToDeny(ancestor)) break;
+		deny.add(ancestor);
+		const next = path.dirname(ancestor);
+		if (next === ancestor) break; // reached a filesystem root that `tooBroadToDeny` did not name
+	}
 
 	for (const root of [options.sessionTmp, ...(options.extraRoots ?? [])]) {
 		if (root === undefined) continue;
@@ -194,9 +337,25 @@ export function buildContainmentFence(options: ContainmentOptions): ContainmentF
 		// Granted whether or not they exist yet. `~/.bun` has to be writable *before* the first
 		// `bun install` creates it, so dropping absent caches would break exactly the first run.
 		// Canonicalised when present, so a symlinked cache resolves to its real location.
-		for (const cache of CACHE_DIRS) allow.add(canonical(path.join(home, cache)) ?? path.join(home, cache));
-		for (const config of READ_ONLY_HOME) {
-			allowReadOnly.add(canonical(path.join(home, config)) ?? path.join(home, config));
+		for (const cache of [...CACHE_DIRS, ...TOOL_CONFIG_DIRS]) {
+			allow.add(canonicalThroughExisting(path.join(home, cache)));
+		}
+		// Deeper than the grant above, so `fenceVerdict` picks these and write becomes a deny while read
+		// stays allowed. Emitted even when absent, or creating the file would be the way around it — and
+		// resolved through existing ancestors, or a symlinked config dir puts the two rules in different
+		// namespaces and the narrower one stops applying.
+		//
+		// COMMAND_BEARING_CONFIG only when the backend can express a narrowing *inside* a grant.
+		// Seatbelt can: it is last-match-wins, so a deeper deny simply overrides. Landlock cannot — its
+		// rules are allow-only and always recursive, so a read-only child turns its parent into a split
+		// dir that loses write on its own inode. Verified with `containment-check plan`: adding
+		// `~/.azure/cliextensions` as read-only made `~/.azure` itself `r-`, which would stop `az` from
+		// creating `azureProfile.json` at all. Applying it anyway would trade a code-execution path for
+		// breaking the very CLIs #2581 is about, so the gap is reported instead — the same choice already
+		// made for `truncationUngoverned`.
+		const narrowed = options.narrowsWithinGrant ? COMMAND_BEARING_CONFIG : [];
+		for (const config of [...READ_ONLY_HOME, ...narrowed]) {
+			allowReadOnly.add(canonicalThroughExisting(path.join(home, config)));
 		}
 	}
 
@@ -260,6 +419,14 @@ export interface ContainmentStatus {
 	 * different claims and an operator is entitled to know which one they have.
 	 */
 	readonly truncationUngoverned?: boolean;
+	/**
+	 * Set when the backend cannot hold a file read-only inside a writable directory, so the
+	 * command-bearing CLI settings (`~/.aws/config`, `~/.kube/config`, …) are writable. Landlock's rules
+	 * are allow-only and recursive; narrowing inside a grant would strip write from the parent directory
+	 * and break the CLIs the grant exists for. Reported rather than folded into `osEnforced`, because it
+	 * changes what a write to those paths means, not whether the boundary holds.
+	 */
+	readonly commandConfigWritable?: boolean;
 }
 
 /**
@@ -301,6 +468,8 @@ export function containmentStatus(
 			osEnforced: true,
 			// Absent on the ABI that governs truncation; present, and stated, on the one that does not.
 			...(probed.truncateHandled === false ? { truncationUngoverned: true } : {}),
+			// Always true here: no Landlock ABI can narrow a right inside a grant.
+			commandConfigWritable: true,
 		};
 	}
 	return { enabled: true, backend: "scanner-only", osEnforced: false };

package/src/sandbox/enforce.ts

@@ -30,8 +30,18 @@
  *
  * So: keep it, and do not extend it. Another spelling caught here buys little now, and the pattern of
  * adding one has a poor record — two adversarial rounds on the #2542 fix alone produced six bypasses.
+ *
+ * **It is still a real layer, though, not a legacy one (#2582.)** It was tempting to conclude that the
+ * fence sits below this and therefore this can only produce false positives. That is wrong: the fence is
+ * allow-by-default and denies only home plus the workspace's ancestors, so it does not cover a second
+ * customer tree under an unrelated root, and `policy.ts` withholds the shared OS temp dir from the file
+ * tools on purpose. Deleting this would hand both away. What #2582 actually fixed is narrower — the
+ * *false refusals*, where this layer refused what the fence grants; see `fenceAlsoPermits`.
  */
+import * as fs from "node:fs";
+import * as os from "node:os";
 import * as path from "node:path";
+import { pathIsWithin } from "@f5-sales-demo/pi-utils";
 import { expandPath, parseFindPattern, parseSearchPath, resolveToCwd, splitTopLevel } from "../tools/path-utils";
 import { lexShellCommand, type ShellSimpleCommand } from "../tools/shell-lex";
 import { provenExemptWords } from "./command-operands";
@@ -42,6 +52,16 @@ export interface ToolCallCheck {
 	input: Record<string, unknown>;
 	cwd: string;
 	policy: SandboxPolicy;
+	/**
+	 * Whether an OS backend is confining the `bash` tool's shell — seatbelt or Landlock.
+	 *
+	 * It does not stand this scan down. It only stops the scan refusing the operational paths the fence
+	 * grants, so the composite is no longer stricter than either engine — see `fenceAlsoPermits`.
+	 *
+	 * Absent means "not known", which keeps every refusal in place: understating the backend costs a
+	 * false refusal, while overstating it would relax the only boundary a scanner-only host has.
+	 */
+	shellOsConfined?: boolean;
 }
 
 export interface ToolCallDecision {
@@ -153,6 +173,65 @@ function isSystemWriteSink(resolved: string): boolean {
 	return SYSTEM_WRITE_SINKS.has(resolved) || resolved.startsWith("/dev/fd/");
 }
 
+/**
+ * Paths the containment fence permits, which this scan must therefore stop refusing (#2582).
+ *
+ * The two engines have opposite defaults: this one is `SandboxPolicy`, deny-by-default and confined to
+ * the cwd, while the fence is allow-by-default with targeted denies. Running both made the composite
+ * their intersection, so the scan refused work the fence permits and `xcsh://about` promises — a `/tmp`
+ * write, a `~/.gitconfig` read, `cd /tmp`. That falsified the model's own instructions and taught it to
+ * abandon operations that were allowed.
+ *
+ * Only the *false refusals* go away. The scan keeps deciding, because it is not merely a slower copy of
+ * the fence: the fence denies home and the workspace's ancestors and allows everything else, so it does
+ * NOT cover a second customer tree under an unrelated root (`/data/globex`), and `policy.ts` deliberately
+ * withholds the shared OS temp dir from the *file* tools to stop one session reading another's scratch.
+ * Deleting this layer would hand both of those away. Adversarial review caught that; #2582's premise that
+ * the scan "cannot add security" is wrong.
+ *
+ * So this is a narrow, enumerated set — the operational paths the fence grants — and it applies to the
+ * shell only, gated on a backend actually being there. `python` is covered by no fence on any platform,
+ * and on a host with no backend this scan is the whole boundary, so neither is widened.
+ */
+function fenceAlsoPermits(resolved: string, access: SandboxAccess): boolean {
+	// The fence never mentions the temp directories, so they are reachable below the text whatever this
+	// says. Refusing them here only produced a diagnostic that contradicted the documentation.
+	if (tempRoots().some(root => pathIsWithin(root, resolved))) return true;
+	// Granted read-only by the fence (`READ_ONLY_HOME`): a tool needs it to behave correctly, and it must
+	// not be rewritten. The write direction stays refused, which matches the fence exactly.
+	if (access === "read") {
+		const home = os.homedir();
+		return [path.join(home, ".gitconfig"), path.join(home, ".config", "git")].some(root =>
+			pathIsWithin(root, resolved),
+		);
+	}
+	return false;
+}
+
+/**
+ * The temp directories, resolved once.
+ *
+ * Both spellings are needed, and conflating them is the bug this comment exists to prevent: on macOS
+ * `os.tmpdir()` is the *per-user* `/var/folders/…/T`, which is not `/tmp` at all. `xcsh://about` promises
+ * `/tmp` specifically, so covering only `os.tmpdir()` left the exact case #2582 reported still refused.
+ * Real paths as well as nominal ones, because `/tmp` is a symlink to `/private/tmp` and a resolved
+ * candidate carries the latter.
+ */
+let cachedTempRoots: string[] | undefined;
+function tempRoots(): string[] {
+	if (cachedTempRoots === undefined) {
+		const resolve = (input: string): string => {
+			try {
+				return fs.realpathSync(input);
+			} catch {
+				return input;
+			}
+		};
+		cachedTempRoots = [...new Set(["/tmp", resolve("/tmp"), os.tmpdir(), resolve(os.tmpdir())])];
+	}
+	return cachedTempRoots;
+}
+
 function firstString(input: Record<string, unknown>, keys: string[]): string | undefined {
 	for (const key of keys) {
 		const value = input[key];
@@ -554,13 +633,18 @@ function searchBases(raw: string, base: (token: string) => string): string[] {
 
 function evaluateCodeTool(check: ToolCallCheck, fields: string[], shell: boolean): ToolCallDecision {
 	const { input, cwd, policy } = check;
+	// The fence's allowances apply to the shell only, and only where a backend is actually enforcing.
+	const fenced = shell && check.shellOsConfined === true;
 
 	const rawCwd = typeof input.cwd === "string" ? input.cwd : undefined;
 	const base = rawCwd ? resolveToCwd(rawCwd, cwd) : cwd;
 	// Both boundaries, for the same reason a `cd` target needs both: relative paths are never
 	// scanned, so wherever the command runs is somewhere it can write freely. Read alone let
 	// `{ cwd: "/shared/ctx", command: "touch notes.md" }` write into a read-only root.
-	if (rawCwd && !(policy.isAllowed(base, "read") && policy.isAllowed(base, "write"))) {
+	// `cwd: "/tmp"` has to answer the same as `cd /tmp`, or the false refusal simply moves to the other
+	// interface — and `cwd` is the one the bash prompt tells the model to prefer over `cd`.
+	const fencePermitsBase = fenced && fenceAlsoPermits(base, "read") && fenceAlsoPermits(base, "write");
+	if (rawCwd && !fencePermitsBase && !(policy.isAllowed(base, "read") && policy.isAllowed(base, "write"))) {
 		return { block: true, reason: describeDirectoryChange(policy, base) };
 	}
 
@@ -600,6 +684,9 @@ function evaluateCodeTool(check: ToolCallCheck, fields: string[], shell: boolean
 				// because relative paths go unchecked wherever the shell is standing.
 				const moved = path.resolve(base, expandPath(token));
 				if (policy.isAllowed(moved, "read") && policy.isAllowed(moved, "write")) continue;
+				// `cd /tmp` was refused while the fence permits standing there, and the boundary no
+				// longer follows the shell (#2589), so where it stands widens nothing.
+				if (fenced && fenceAlsoPermits(moved, "read") && fenceAlsoPermits(moved, "write")) continue;
 				return { block: true, reason: describeDirectoryChange(policy, moved) };
 			}
 			const resolved = resolveToCwd(token, base);
@@ -608,6 +695,9 @@ function evaluateCodeTool(check: ToolCallCheck, fields: string[], shell: boolean
 			// read or traverse". It never licenses writing into /etc, /usr or /opt; only the
 			// discard-and-echo devices are writable.
 			if (access === "read" ? isSystemPath(resolved) : isSystemWriteSink(resolved)) continue;
+			// Anything the fence grants outright: refusing it here contradicted the documentation and
+			// bought nothing, since the fence permits it below the text either way.
+			if (fenced && fenceAlsoPermits(resolved, access)) continue;
 			return deny(policy, resolved, access);
 		}
 	}

package/src/sandbox/policy.ts

@@ -113,11 +113,19 @@ export interface DefaultSandboxOptions {
  * contexts are explicitly denied, so even a broad user-configured allow cannot re-expose
  * another customer's memory, session, or credentials.
  *
- * Note: the OS temp dir is deliberately NOT allowlisted. It is shared across all
+ * Note: the OS temp dir is deliberately NOT allowlisted here. It is shared across all
  * sessions, so allowing it would let one customer's session read another's scratch
  * files. The agent should work in temp directories under its CWD; internal tool temp
  * usage bypasses this boundary (it is not a model-invoked path). A specific session
  * temp dir can still be granted via `tmpDir`.
+ *
+ * That still holds for every tool this policy governs directly. It does NOT hold for
+ * `bash` on a host with an OS backend: the containment fence never mentions the temp
+ * directories, so they are reachable below the command text regardless, and refusing
+ * them in the text scan produced only a diagnostic that contradicted `xcsh://about`
+ * (#2582). The protection was spelling-deep in any case — `T=/tmp/other; cat "$T"`
+ * never went through this check. Treat shared temp as readable by a fenced shell, and
+ * put anything that must not cross sessions under the session directory or `tmpDir`.
  */
 export function buildDefaultSandboxPolicy(opts: DefaultSandboxOptions): SandboxPolicy {
 	const cwd = path.resolve(opts.cwd);

package/src/tools/bash.ts

@@ -543,6 +543,9 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 			extraRoots: artifactsDir ? [artifactsDir] : [],
 			readOnlyRoots: (this.session.settings.get("sandbox.allowRead") as string[] | undefined) ?? [],
 			writeOnlyRoots: (this.session.settings.get("sandbox.allowWrite") as string[] | undefined) ?? [],
+			// Only seatbelt can hold a file read-only inside a writable directory; Landlock's rules are
+			// recursive, so asking for it there would strip write from the parent and break the CLIs.
+			narrowsWithinGrant: containmentStatus(true).backend === "seatbelt",
 		});
 	}