@f5-sales-demo/xcsh 20.0.4 → 20.1.0

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [20.1.0] - 2026-08-01
+
+### Added
+
+- Added `xcsh sandbox check` to verify the installed sandbox with synthetic fixtures and automatic cleanup ([#2790](https://github.com/f5-sales-demo/xcsh/issues/2790))
+
+### Fixed
+
+- Denied local account containers and other operators' homes while preserving full access to the current operator's home ([#2788](https://github.com/f5-sales-demo/xcsh/issues/2788))
+
 ## [20.0.4] - 2026-08-01
 
 ### Fixed

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "20.0.4",
+	"version": "20.1.0",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -57,13 +57,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "20.0.4",
-		"@f5-sales-demo/pi-agent-core": "20.0.4",
-		"@f5-sales-demo/pi-ai": "20.0.4",
-		"@f5-sales-demo/pi-natives": "20.0.4",
-		"@f5-sales-demo/pi-resource-management": "20.0.4",
-		"@f5-sales-demo/pi-tui": "20.0.4",
-		"@f5-sales-demo/pi-utils": "20.0.4",
+		"@f5-sales-demo/xcsh-stats": "20.1.0",
+		"@f5-sales-demo/pi-agent-core": "20.1.0",
+		"@f5-sales-demo/pi-ai": "20.1.0",
+		"@f5-sales-demo/pi-natives": "20.1.0",
+		"@f5-sales-demo/pi-resource-management": "20.1.0",
+		"@f5-sales-demo/pi-tui": "20.1.0",
+		"@f5-sales-demo/pi-utils": "20.1.0",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/cli/sandbox-check.ts

@@ -0,0 +1,283 @@
+/** Installed-binary conformance check for the live filesystem sandbox. */
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { executeShell } from "@f5-sales-demo/pi-natives";
+import { isEnoent } from "@f5-sales-demo/pi-utils";
+import { Settings } from "../config/settings";
+import { fenceForNative } from "../exec/bash-executor";
+import { buildContainmentFence, type ContainmentFence, containmentStatus } from "../sandbox/containment";
+import { evaluateToolCall } from "../sandbox/enforce";
+import { BashTool, type ToolSession } from "../tools";
+
+export type SandboxCheckResultStatus = "PASS" | "FAIL" | "SKIP";
+
+export interface SandboxCheckResult {
+	name: string;
+	status: SandboxCheckResultStatus;
+}
+
+export interface SandboxCheckReport {
+	backend: string;
+	osEnforced: boolean;
+	checks: SandboxCheckResult[];
+	summary: {
+		passed: number;
+		failed: number;
+		skipped: number;
+	};
+}
+
+export interface SandboxCheckOptions {
+	json?: boolean;
+}
+
+function quote(value: string): string {
+	return JSON.stringify(value);
+}
+
+async function shellExitCode(
+	command: string,
+	cwd: string,
+	fence: ContainmentFence,
+	signal: AbortSignal,
+): Promise<number> {
+	const result = await executeShell(
+		{
+			command,
+			cwd,
+			fence: fenceForNative(fence),
+			signal,
+			timeoutMs: 15_000,
+		},
+		() => {},
+	);
+	return result.exitCode ?? -1;
+}
+
+function renderReport(report: SandboxCheckReport, json: boolean): void {
+	if (json) {
+		process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+		return;
+	}
+
+	const enforcement = report.osEnforced ? "OS enforced" : "scanner only";
+	process.stdout.write(`Sandbox backend: ${report.backend} (${enforcement})\n\n`);
+	const width = Math.max(...report.checks.map(check => check.name.length));
+	for (const check of report.checks) {
+		process.stdout.write(`${check.status.padEnd(4)}  ${check.name.padEnd(width)}\n`);
+	}
+	process.stdout.write(
+		`\n${report.summary.passed} passed, ${report.summary.failed} failed, ${report.summary.skipped} skipped\n`,
+	);
+}
+
+/** Run the conformance matrix and report only after every synthetic fixture has been removed. */
+export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promise<SandboxCheckReport> {
+	const backend = containmentStatus(true);
+	const checks: SandboxCheckResult[] = [];
+	const abortController = new AbortController();
+	const interrupt = () => abortController.abort();
+	process.once("SIGINT", interrupt);
+	process.once("SIGTERM", interrupt);
+
+	let fixtureRoot: string | undefined;
+	const add = (name: string, status: SandboxCheckResultStatus): void => {
+		checks.push({ name, status });
+	};
+	const check = async (name: string, probe: () => boolean | Promise<boolean>): Promise<void> => {
+		if (abortController.signal.aborted) {
+			add(name, "FAIL");
+			return;
+		}
+		try {
+			add(name, (await probe()) ? "PASS" : "FAIL");
+		} catch {
+			add(name, "FAIL");
+		}
+	};
+
+	try {
+		const tmpRoot = await fs.realpath(os.tmpdir());
+		fixtureRoot = await fs.mkdtemp(path.join(tmpRoot, "xcsh-sandbox-check-"));
+		const accountRoot = path.join(fixtureRoot, "Users");
+		const operatorHome = path.join(accountRoot, "operator");
+		const otherHome = path.join(accountRoot, "other-account");
+		const workspaces = path.join(operatorHome, "workspaces");
+		const workspace = path.join(workspaces, "example-a");
+		const sibling = path.join(workspaces, "example-b");
+		const nested = path.join(workspace, "nested");
+		const sessionStore = path.join(operatorHome, ".xcsh", "agent", "sessions");
+		const otherSession = path.join(sessionStore, "synthetic-session");
+		const memoryStore = path.join(operatorHome, ".xcsh", "agent", "memories");
+		const otherMemory = path.join(memoryStore, "synthetic-memory");
+		const configDir = path.join(operatorHome, ".config", "xcsh-check");
+
+		for (const dir of [workspace, sibling, nested, otherHome, otherSession, otherMemory, configDir]) {
+			await fs.mkdir(dir, { recursive: true });
+		}
+		await Bun.write(path.join(workspace, "own.txt"), "own\n");
+		await Bun.write(path.join(sibling, "named.txt"), "sibling\n");
+		await Bun.write(path.join(otherHome, "synthetic.txt"), "synthetic\n");
+		await Bun.write(path.join(otherSession, "state.jsonl"), "synthetic\n");
+		await Bun.write(path.join(otherMemory, "MEMORY.md"), "synthetic\n");
+
+		const fence = buildContainmentFence({
+			workspace,
+			home: operatorHome,
+			fsRoot: fixtureRoot,
+			leakRoots: [sessionStore, memoryStore],
+		});
+
+		await check("structured tools share the boundary", () => {
+			const blocked = [
+				evaluateToolCall({ toolName: "read", input: { file_path: workspaces }, cwd: workspace, fence }),
+				evaluateToolCall({
+					toolName: "write",
+					input: { file_path: path.join(otherHome, "new.txt") },
+					cwd: workspace,
+					fence,
+				}),
+				evaluateToolCall({ toolName: "find", input: { pattern: `${accountRoot}/**/*` }, cwd: workspace, fence }),
+				evaluateToolCall({ toolName: "grep", input: { path: otherHome }, cwd: workspace, fence }),
+				evaluateToolCall({
+					toolName: "read",
+					input: { file_path: path.join(otherSession, "state.jsonl") },
+					cwd: workspace,
+					fence,
+				}),
+				evaluateToolCall({
+					toolName: "read",
+					input: { file_path: path.join(otherMemory, "MEMORY.md") },
+					cwd: workspace,
+					fence,
+				}),
+				evaluateToolCall({
+					toolName: "python",
+					input: { code: `import os; os.listdir(${JSON.stringify(accountRoot)})` },
+					cwd: workspace,
+					fence,
+				}),
+			];
+			const ownConfig = evaluateToolCall({
+				toolName: "write",
+				input: { file_path: path.join(configDir, "config") },
+				cwd: workspace,
+				fence,
+			});
+			return blocked.every(result => result.block) && !ownConfig.block;
+		});
+
+		await check("workspace read, write, glob, and recursion", async () => {
+			const command =
+				"cat own.txt > /dev/null && printf created > created.txt && " +
+				"printf '%s\\n' ./* > /dev/null && find . -type f > /dev/null";
+			return (await shellExitCode(command, workspace, fence, abortController.signal)) === 0;
+		});
+		await check("named sibling remains reachable", async () => {
+			const command = `cd ${quote(sibling)} && test "$(cat named.txt)" = sibling`;
+			return (await shellExitCode(command, workspace, fence, abortController.signal)) === 0;
+		});
+
+		if (backend.osEnforced) {
+			await check("session parent cannot be enumerated", async () => {
+				const command = `ls ${quote(workspaces)} > /dev/null`;
+				return (await shellExitCode(command, workspace, fence, abortController.signal)) !== 0;
+			});
+			await check("account container cannot be enumerated", async () => {
+				const command = `ls ${quote(accountRoot)} > /dev/null`;
+				return (await shellExitCode(command, workspace, fence, abortController.signal)) !== 0;
+			});
+			await check("synthetic other account cannot be entered", async () => {
+				const command = `cd ${quote(otherHome)}`;
+				return (await shellExitCode(command, workspace, fence, abortController.signal)) !== 0;
+			});
+			await check("cross-session stores cannot be read", async () => {
+				const sessionRead = `cat ${quote(path.join(otherSession, "state.jsonl"))} > /dev/null`;
+				const memoryRead = `cat ${quote(path.join(otherMemory, "MEMORY.md"))} > /dev/null`;
+				return (
+					(await shellExitCode(sessionRead, workspace, fence, abortController.signal)) !== 0 &&
+					(await shellExitCode(memoryRead, workspace, fence, abortController.signal)) !== 0
+				);
+			});
+		} else {
+			for (const name of [
+				"session parent cannot be enumerated",
+				"account container cannot be enumerated",
+				"synthetic other account cannot be entered",
+				"cross-session stores cannot be read",
+			]) {
+				add(name, "SKIP");
+			}
+		}
+
+		await check("operator home configuration is writable", async () => {
+			const target = path.join(configDir, "config");
+			const command = `printf operator > ${quote(target)} && test "$(cat ${quote(target)})" = operator`;
+			return (await shellExitCode(command, workspace, fence, abortController.signal)) === 0;
+		});
+
+		await check("cwd resets across tool calls", async () => {
+			const settings = await Settings.init({
+				cwd: workspace,
+				agentDir: path.join(fixtureRoot!, "agent-state"),
+				inMemory: true,
+				overrides: {
+					"async.enabled": false,
+					"bash.autoBackground.enabled": false,
+					"bashInterceptor.enabled": false,
+					"sandbox.enabled": true,
+				},
+			});
+			const session: ToolSession = {
+				cwd: workspace,
+				hasUI: false,
+				hasEditTool: true,
+				settings,
+				getSessionFile: () => null,
+				getSessionSpawns: () => null,
+				getSessionId: () => "sandbox-check-session",
+			};
+			const tool = new BashTool(session);
+			const moved = await tool.execute("sandbox-check-move", { command: `cd ${quote(nested)}; pwd` });
+			const reset = await tool.execute("sandbox-check-reset", { command: "pwd" });
+			const explicit = await tool.execute("sandbox-check-explicit", { command: "pwd", cwd: nested });
+			const text = (result: typeof moved): string =>
+				result.content
+					.filter((part): part is { type: "text"; text: string } => part.type === "text")
+					.map(part => part.text)
+					.join("")
+					.trim();
+			return text(moved) === nested && text(reset) === workspace && text(explicit) === nested;
+		});
+	} catch {
+		add("conformance matrix completed", "FAIL");
+	} finally {
+		process.off("SIGINT", interrupt);
+		process.off("SIGTERM", interrupt);
+		if (fixtureRoot === undefined) {
+			add("synthetic fixtures removed", "FAIL");
+		} else {
+			try {
+				await fs.rm(fixtureRoot, { recursive: true, force: true });
+				await fs.stat(fixtureRoot);
+				add("synthetic fixtures removed", "FAIL");
+			} catch (error) {
+				add("synthetic fixtures removed", isEnoent(error) ? "PASS" : "FAIL");
+			}
+		}
+	}
+
+	const report: SandboxCheckReport = {
+		backend: backend.backend,
+		osEnforced: backend.osEnforced,
+		checks,
+		summary: {
+			passed: checks.filter(result => result.status === "PASS").length,
+			failed: checks.filter(result => result.status === "FAIL").length,
+			skipped: checks.filter(result => result.status === "SKIP").length,
+		},
+	};
+	renderReport(report, options.json ?? false);
+	return report;
+}

package/src/cli.ts

@@ -56,6 +56,7 @@ const commands: CommandEntry[] = [
 	{ name: "grep", load: () => import("./commands/grep").then(m => m.default) },
 	{ name: "grievances", load: () => import("./commands/grievances").then(m => m.default) },
 	{ name: "read", load: () => import("./commands/read").then(m => m.default) },
+	{ name: "sandbox", load: () => import("./commands/sandbox").then(m => m.default) },
 	{ name: "jupyter", load: () => import("./commands/jupyter").then(m => m.default) },
 	{ name: "manager", load: () => import("./commands/manager").then(m => m.default) },
 	{ name: "office", load: () => import("./commands/office").then(m => m.default) },

package/src/commands/sandbox.ts

@@ -0,0 +1,25 @@
+/** Run installed-binary sandbox diagnostics. */
+import { Args, Command, Flags } from "@f5-sales-demo/pi-utils/cli";
+import { runSandboxCheck } from "../cli/sandbox-check";
+
+export default class Sandbox extends Command {
+	static description = "Verify the installed filesystem sandbox";
+
+	static args = {
+		action: Args.string({
+			description: "Sandbox action",
+			required: true,
+			options: ["check"],
+		}),
+	};
+
+	static flags = {
+		json: Flags.boolean({ description: "Output JSON" }),
+	};
+
+	async run(): Promise<void> {
+		const { flags } = await this.parse(Sandbox);
+		const report = await runSandboxCheck({ json: flags.json });
+		if (report.summary.failed > 0) process.exitCode = 1;
+	}
+}

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "20.0.4",
-	"commit": "c1606427884c61f77f5f1fbf1c4ab7511920061b",
-	"shortCommit": "c160642",
+	"version": "20.1.0",
+	"commit": "a4002d84fa2f409413a313cb8a04670a1b107084",
+	"shortCommit": "a4002d8",
 	"branch": "main",
-	"tag": "v20.0.4",
-	"commitDate": "2026-08-01T06:54:53Z",
-	"buildDate": "2026-08-01T07:20:58.905Z",
+	"tag": "v20.1.0",
+	"commitDate": "2026-08-01T13:46:31Z",
+	"buildDate": "2026-08-01T14:24:45.281Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/c1606427884c61f77f5f1fbf1c4ab7511920061b",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v20.0.4"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/a4002d84fa2f409413a313cb8a04670a1b107084",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v20.1.0"
 };

package/src/internal-urls/console-catalog.generated.ts

@@ -2,10 +2,10 @@
 
 import type { ConsoleCatalogData } from "./console-catalog-types";
 
-export const CONSOLE_CATALOG_VERSION = "7410235724c7a9fa215feddaded61f37179248fb";
+export const CONSOLE_CATALOG_VERSION = "8e7e1863840cc8ed4db0a9781c695f251aafb214";
 
 export const CONSOLE_CATALOG_DATA: ConsoleCatalogData = {
-	version: "7410235724c7a9fa215feddaded61f37179248fb",
+	version: "8e7e1863840cc8ed4db0a9781c695f251aafb214",
 	workflows: {
 		"address-allocator/create":
 			'---\nschema: urn:xcsh:console:workflow:v1\nid: address-allocator-create\nlabel: Create IP Address Allocators\nresource: address-allocator\noperation: create\npreconditions:\n  - user_logged_in\n  - "role_minimum: admin"\nparams:\n  name:\n    required: true\n    description: IP Address Allocators name (lowercase alphanumeric and hyphens)\n    example: example-address-allocator\n  address_allocator_mode:\n    required: true\n    description: Address Allocator Mode\n  allocation_unit:\n    required: false\n    description: Allocation Unit\n    default: 0\n  address_pool:\n    required: false\n    description: Address Pool\n    default: value\n  address_allocation_scheme:\n    required: false\n    description: "Server-required: Field should be not nil"\n    default: value\nsteps:\n  - id: navigate-to-list\n    action: navigate\n    url: /web/workspaces/multi-cloud-network-connect/manage/networking/legacy_network_configuration/address_allocators\n    wait_for: text(\'IP Address Allocators\')\n    description: Navigate to IP Address Allocators list page\n  - id: click-add-tab\n    action: click\n    selector: text(\'Add IP Address Allocator\')\n    wait_for: textbox[name=\'Name\']\n    description: Click Add IP Address Allocator to open the create form\n  - id: fill-name\n    action: fill\n    selector: textbox[name=\'Name\']\n    value: "{name}"\n    description: Enter Name\n  - id: select-address_allocator_mode\n    action: select\n    selector: listbox\n    context: Address Allocator Mode section\n    value: "{address_allocator_mode}"\n    description: Select Address Allocator Mode\n  - id: fill-allocation_unit\n    action: fill\n    selector: spinbutton[name=\'Allocation Unit\']\n    value: "{allocation_unit}"\n    description: Set Allocation Unit\n  - id: fill-address_pool\n    action: fill\n    selector: ngx-datatable input.form-control\n    context: Address Pool table\n    value: "{address_pool}"\n    description: Enter Address Pool in the existing table row (no Add Item needed — the table ships one empty row)\n  - id: select-address_allocation_scheme\n    action: select\n    selector: listbox\n    context: Address Allocation Scheme section\n    value: "{address_allocation_scheme}"\n    description: Select Address Allocation Scheme\n  - id: save\n    action: click\n    selector: "[class*=\'save-bt\'],[class*=\'submit-button\']"\n    context: footer\n    wait_for: text(\'{name}\')\n    wait_timeout_ms: 30000\n    description: Save/submit the form (union selector matches save-bt OR submit-button)\npostconditions:\n  - resource_list_page_visible\n  - "resource_name_in_list: {name}"\nmetadata:\n  confidence: inferred\n  discovered_at: 2026-06-24\n  console_version: "2025.06"\n  notes: Auto-generated by scripts/generate-workflows.ts from api-specs-enriched field metadata.\n',

package/src/prompts/internal-urls/containment.md

@@ -15,9 +15,9 @@ followed symlinks — so how a path is spelled does not change what is reachable
 - Cross-tenant isolation removes the discovery step. The directory containing the session root cannot
   be enumerated, but a sibling path the operator names directly can still be read, written, or entered.
   An explicit read grant, including `--allow-path <dir>`, restores enumeration for that directory.
-- Cross-session stores and data roots remain denied. Another session's transcripts, memories, internal
-  contexts, and temporary working state are not reachable through tools, nor are unrelated data roots
-  and mounted data volumes.
+- Cross-session stores, other operators' accounts, and data roots remain denied. Another session's
+  transcripts, memories, internal contexts, and temporary working state are not reachable through
+  tools, nor are sibling local accounts, unrelated data roots, and mounted data volumes.
 
 The same boundary answers for every tool. `read`, `write`, `grep`, `find`, `python`, and `bash` consult
 the same rules, so changing tools or spelling a path differently does not widen the session.
@@ -51,7 +51,8 @@ spelling may not be caught.
 
 The intended rules are the same ones a confined session has: parent enumeration is refused while named
 operator access remains available, operator-owned home and configuration stay readable and writable,
-and cross-session stores and unrelated data roots stay denied. Ordinary work remains unrestricted.
+and cross-session stores, other operators' accounts, and unrelated data roots stay denied. Ordinary
+work remains unrestricted.
 
 Treat the boundary as a statement of intent rather than a guarantee, and do not go looking for paths
 outside the session directory on the assumption that something would stop you.

package/src/sandbox/containment.ts

@@ -8,8 +8,8 @@
  *
  * So the fence is gentle. It leaves `/usr`, `/tmp`, package caches, the network and process execution
  * alone. Its cross-tenant courtesy removes the discovery step — enumerating the session root's parent —
- * while keeping named operator access. Explicit data-root and cross-session state denies remain where
- * the model has no legitimate reason to wander (#2554).
+ * while keeping named operator access. Other operators' accounts, explicit data roots and cross-session
+ * state remain denied where the model has no legitimate reason to wander (#2554).
  *
  * Produced declaratively rather than as an ordered rule list, because the two backends disagree about
  * order: seatbelt evaluates rules in sequence with the last match winning, while Landlock only grants
@@ -197,9 +197,8 @@ const OPERATIONAL_ROOT_NAMES = new Set([
  * unforeseen — `/data`, `/scratch`, a bespoke mount.
  */
 const DATA_ROOTS = [
-	// `/Users` and `/home` are deliberately absent: denying the home container denies this operator's own
-	// home with it, which is the whole of #2637. Other accounts are 0700, so the filesystem already refuses
-	// them; the fence is not here to re-implement file permissions.
+	"/Users", // Account containers are denied, then this operator's canonical home is allowed back at
+	"/home", // greater depth. That preserves #2637 without exposing another local account (#2788).
 	"/root", // Linux superuser home: not this operator's account
 	"/Volumes", // macOS mounts. Per-container, not per-child: /Volumes/Macintosh HD resolves to /,
 	"/mnt", // which `tooBroadToDeny` then rejects, and the kernel resolves such a path before any
@@ -481,6 +480,11 @@ export function buildContainmentFence(options: ContainmentOptions): ContainmentF
 	}
 
 	if (home !== undefined) {
+		// The account container is a data root, but this operator's whole home belongs to them (#2637).
+		// A deeper full allow preserves their normal filesystem rights while leaving sibling accounts under
+		// the broader deny. Cross-session stores are denied again at still greater depth below.
+		allow.add(home);
+
 		// Granted whether or not they exist yet. `~/.bun` has to be writable *before* the first
 		// `bun install` creates it, so dropping absent caches would break exactly the first run.
 		// Canonicalised when present, so a symlinked cache resolves to its real location.
@@ -505,6 +509,7 @@ export function buildContainmentFence(options: ContainmentOptions): ContainmentF
 	// prefix whether or not the path exists; Landlock cannot attach a rule to an absent inode, but its
 	// plan never grants a path `readdir` did not see either, so nothing is lost there.
 	const known = DATA_ROOTS.map(name => canonicalThroughExisting(path.join(fsRoot, path.basename(name))));
+	const accountRoots = new Set(["Users", "home"].map(name => canonicalThroughExisting(path.join(fsRoot, name))));
 	const found = dataRootEntries(fsRoot).map(entry => canonical(entry) ?? entry);
 	// Whole filesystem roots other than the workspace's own — the other Windows drives.
 	//
@@ -520,11 +525,11 @@ export function buildContainmentFence(options: ContainmentOptions): ContainmentF
 		// e.g. /Volumes/Macintosh HD -> /. Skipped for the whole-root list, per the note above.
 		if (!rootScoped.has(resolved) && tooBroadToDeny(resolved, fsRoot)) continue;
 		if (resolved === fsRoot) continue; // never the root the workspace lives on
-		// Never a directory that CONTAINS home, because denying it denies home (#2637). Removing `/Users`
-		// and `/home` from the static list was not enough: the root enumeration re-adds them, since
-		// `Users` is not an operational name. That is what still refused `~/git/STYLE_GUIDE.md` at the
-		// kernel while `fenceVerdict` said allow — the unit tests use synthetic roots and could not see it.
-		if (home !== undefined && pathIsWithin(resolved, home)) continue;
+		// A directory containing home is normally too broad to deny because it would revoke the operator's
+		// own files (#2637). Account containers are the deliberate exception: they are denied here and the
+		// canonical home allow above wins at greater depth, isolating sibling accounts without hobbling the
+		// operator (#2788).
+		if (home !== undefined && pathIsWithin(resolved, home) && !accountRoots.has(resolved)) continue;
 		// A deny beats an allow at EQUAL depth, so denying a root that IS the workspace or IS something
 		// the operator granted would not be redundant — it would silently revoke the grant. Deeper is
 		// fine and intended: an ancestor deny with the workspace allowed inside it is the normal shape.