@f5-sales-demo/xcsh 20.4.1 → 20.4.2

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "20.4.1",
+	"version": "20.4.2",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -60,13 +60,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "20.4.1",
-		"@f5-sales-demo/pi-agent-core": "20.4.1",
-		"@f5-sales-demo/pi-ai": "20.4.1",
-		"@f5-sales-demo/pi-natives": "20.4.1",
-		"@f5-sales-demo/pi-resource-management": "20.4.1",
-		"@f5-sales-demo/pi-tui": "20.4.1",
-		"@f5-sales-demo/pi-utils": "20.4.1",
+		"@f5-sales-demo/xcsh-stats": "20.4.2",
+		"@f5-sales-demo/pi-agent-core": "20.4.2",
+		"@f5-sales-demo/pi-ai": "20.4.2",
+		"@f5-sales-demo/pi-natives": "20.4.2",
+		"@f5-sales-demo/pi-resource-management": "20.4.2",
+		"@f5-sales-demo/pi-tui": "20.4.2",
+		"@f5-sales-demo/pi-utils": "20.4.2",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/cli/sandbox-check.ts

@@ -168,7 +168,7 @@ function renderReport(report: SandboxCheckReport, json: boolean, verbose: boolea
 
 /** Run the conformance matrix and report only after every synthetic fixture has been removed. */
 export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promise<SandboxCheckReport> {
-	const backend = containmentStatus(true);
+	let backend = containmentStatus(true);
 	const checks: SandboxCheckResult[] = [];
 	const fixturePaths: string[] = [];
 	const knownCleanupLeaves: string[] = [];
@@ -218,18 +218,20 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 		// session parent — which is the operator home for a `~/<workspace>` layout (#2807).
 		const liveWorkspace = inheritedWorkspace ?? (await fs.realpath(workspaceInput));
 		const liveHome = inheritedHome ?? (await fs.realpath(homeInput));
-		redactions.push([liveWorkspace, "<workspace>"], [liveHome, "<operator-home>"]);
+		const liveSystemTmp = await fs.realpath(os.tmpdir());
+		const liveSessionParent = path.dirname(liveWorkspace);
+		const liveAccountRoot = path.dirname(liveHome);
+		redactions.push(
+			[liveWorkspace, "<workspace>"],
+			[liveHome, "<operator-home>"],
+			[liveSystemTmp, "<system-temp>"],
+			[liveSessionParent, "<session-parent>"],
+			[liveAccountRoot, "<account-container>"],
+		);
 		if (inheritedSibling !== undefined) redactions.push([inheritedSibling, "<session-parent>/<synthetic-sibling>"]);
 
-		// A home-rooted Landlock profile must split the home grant around protected session stores. The
-		// kernel can grant an existing named child but cannot grant future children of that split root
-		// without also reopening the protected stores. BashTool therefore prepares one host-owned child
-		// before confinement; keep all exact-home live fixtures beneath that already-granted directory.
-		const liveWritableRoot =
-			inheritedProfile && liveWorkspace === liveHome && inheritedSibling !== undefined
-				? inheritedSibling
-				: liveWorkspace;
-		const fixtureBase = inheritedProfile ? liveWritableRoot : await fs.realpath(os.tmpdir());
+		const liveWritableRoot = liveWorkspace;
+		const fixtureBase = inheritedProfile ? liveWritableRoot : liveSystemTmp;
 		fixtureRoot = await fs.mkdtemp(path.join(fixtureBase, ".xcsh-sandbox-check-policy-"));
 		fixturePaths.push(fixtureRoot);
 		redactions.push([fixtureRoot, "<synthetic-root>"]);
@@ -262,23 +264,15 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 			fsRoot: fixtureRoot,
 			leakRoots: [sessionStore, memoryStore],
 		});
+		const liveFence = buildContainmentFence({ workspace: liveWorkspace, home: liveHome });
+		backend = containmentStatus(true, process.platform, undefined, liveFence);
 
 		await check("structured tools share the boundary", () => {
 			const blocked = [
 				evaluateToolCall({ toolName: "read", input: { file_path: workspaces }, cwd: workspace, fence }),
 				evaluateToolCall({ toolName: "find", input: { pattern: `${accountRoot}/**/*` }, cwd: workspace, fence }),
-				evaluateToolCall({
-					toolName: "read",
-					input: { file_path: path.join(otherSession, "state.jsonl") },
-					cwd: workspace,
-					fence,
-				}),
-				evaluateToolCall({
-					toolName: "read",
-					input: { file_path: path.join(otherMemory, "MEMORY.md") },
-					cwd: workspace,
-					fence,
-				}),
+				evaluateToolCall({ toolName: "read", input: { file_path: sessionStore }, cwd: workspace, fence }),
+				evaluateToolCall({ toolName: "find", input: { pattern: `${memoryStore}/**/*` }, cwd: workspace, fence }),
 			];
 			const allowed = [
 				evaluateToolCall({
@@ -300,6 +294,18 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 					cwd: workspace,
 					fence,
 				}),
+				evaluateToolCall({
+					toolName: "read",
+					input: { file_path: path.join(otherSession, "state.jsonl") },
+					cwd: workspace,
+					fence,
+				}),
+				evaluateToolCall({
+					toolName: "read",
+					input: { file_path: path.join(otherMemory, "MEMORY.md") },
+					cwd: workspace,
+					fence,
+				}),
 			];
 			const passed = blocked.every(result => result.block) && allowed.every(result => !result.block);
 			return passed
@@ -385,6 +391,77 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 			);
 		});
 
+		await check("system temp supports direct file creation", async () => {
+			const displayPath = "<system-temp>/<synthetic-fixture>";
+			const template = path.join(liveSystemTmp, ".xcsh-sandbox-check-tmp-XXXXXX");
+			const command =
+				`probe=$(mktemp ${quote(template)}) || exit $?; ` +
+				`trap 'rm -f "$probe"' EXIT; printf temporary > "$probe" && ` +
+				`test "$(cat "$probe")" = temporary && rm "$probe"`;
+			const result = await shellProbe(
+				command,
+				liveWorkspace,
+				inheritedProfile ? undefined : liveFence,
+				abortController.signal,
+			);
+			return shellOutcome(
+				result,
+				true,
+				"live profile must allow direct system-temp creation and removal",
+				displayPath,
+				redactions,
+			);
+		});
+
+		await check("system temp remains enumerable", async () => {
+			const result = await shellProbe(
+				`ls ${quote(liveSystemTmp)} > /dev/null`,
+				liveWorkspace,
+				inheritedProfile ? undefined : liveFence,
+				abortController.signal,
+			);
+			return shellOutcome(
+				result,
+				true,
+				"live profile must preserve normal system-temp enumeration",
+				"<system-temp>",
+				redactions,
+			);
+		});
+
+		await check("operator home remains enumerable", async () => {
+			const result = await shellProbe(
+				`ls ${quote(liveHome)} > /dev/null`,
+				liveWorkspace,
+				inheritedProfile ? undefined : liveFence,
+				abortController.signal,
+			);
+			return shellOutcome(
+				result,
+				true,
+				"live profile must preserve normal operator-home enumeration",
+				"<operator-home>",
+				redactions,
+			);
+		});
+
+		await check("filesystem root remains enumerable", async () => {
+			const filesystemRoot = path.parse(liveWorkspace).root;
+			const result = await shellProbe(
+				`ls ${quote(filesystemRoot)} > /dev/null`,
+				liveWorkspace,
+				inheritedProfile ? undefined : liveFence,
+				abortController.signal,
+			);
+			return shellOutcome(
+				result,
+				true,
+				"live profile must preserve normal filesystem-root enumeration",
+				"<filesystem-root>",
+				redactions,
+			);
+		});
+
 		await check("named sibling remains reachable", async () => {
 			const displayPath = "<session-parent>/<synthetic-sibling>";
 			let liveSibling = inheritedSibling;
@@ -413,17 +490,21 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 		});
 
 		if (backend.osEnforced) {
-			await check("session parent cannot be enumerated", async () => {
+			await check("session parent discovery respects operator home", async () => {
+				const probeParent = inheritedProfile ? liveSessionParent : workspaces;
+				const parentIsOperatorHome = probeParent === liveHome;
 				const result = await shellProbe(
-					`ls ${quote(workspaces)} > /dev/null`,
+					`ls ${quote(probeParent)} > /dev/null`,
 					workspace,
-					fence,
+					inheritedProfile ? undefined : fence,
 					abortController.signal,
 				);
 				return shellOutcome(
 					result,
-					false,
-					"synthetic session parent enumeration must be refused",
+					parentIsOperatorHome,
+					parentIsOperatorHome
+						? "operator home must remain enumerable when it is the session parent"
+						: "synthetic session parent enumeration must be refused",
 					"<synthetic-session-parent>",
 					redactions,
 				);
@@ -469,10 +550,11 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 				);
 			});
 			await check("account container cannot be enumerated", async () => {
+				const probeAccountRoot = inheritedProfile ? liveAccountRoot : accountRoot;
 				const result = await shellProbe(
-					`ls ${quote(accountRoot)} > /dev/null`,
+					`ls ${quote(probeAccountRoot)} > /dev/null`,
 					workspace,
-					fence,
+					inheritedProfile ? undefined : fence,
 					abortController.signal,
 				);
 				return shellOutcome(
@@ -493,74 +575,94 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 					redactions,
 				);
 			});
-			await check("cross-session stores cannot be read", async () => {
-				const sessionRead = await shellProbe(
-					`cat ${quote(path.join(otherSession, "state.jsonl"))} > /dev/null`,
+			await check("cross-session stores hide listings and keep named access", async () => {
+				let probeStore = sessionStore;
+				let knownPaths = [path.join(otherSession, "state.jsonl"), path.join(otherMemory, "MEMORY.md")];
+				let probeFence: ContainmentFence | undefined = fence;
+				if (inheritedProfile) {
+					const livePrivateContainer = path.join(liveSystemTmp, "xcsh-local");
+					try {
+						await fs.mkdir(livePrivateContainer, { recursive: true });
+						const livePrivateFixture = await fs.mkdtemp(
+							path.join(livePrivateContainer, ".xcsh-sandbox-check-private-"),
+						);
+						fixturePaths.push(livePrivateFixture);
+						redactions.push(
+							[livePrivateContainer, "<live-private-container>"],
+							[livePrivateFixture, "<live-private-container>/<synthetic-session>"],
+						);
+						const knownState = path.join(livePrivateFixture, "state.jsonl");
+						await Bun.write(knownState, "synthetic\n");
+						probeStore = livePrivateContainer;
+						knownPaths = [knownState];
+						probeFence = undefined;
+					} catch (error) {
+						return exceptionOutcome(
+							"create a known path in the live private temp container",
+							"<live-private-container>/<synthetic-session>",
+							error,
+							redactions,
+						);
+					}
+				}
+				const sessionListing = await shellProbe(
+					`ls ${quote(probeStore)} > /dev/null`,
 					workspace,
-					fence,
+					probeFence,
 					abortController.signal,
 				);
 				const sessionOutcome = shellOutcome(
-					sessionRead,
+					sessionListing,
 					false,
-					"synthetic other session read must be refused",
-					"<synthetic-session-store>/<synthetic-session>",
+					"synthetic session-store listing must be refused",
+					"<synthetic-session-store>",
 					redactions,
 				);
 				if (!sessionOutcome.passed) return sessionOutcome;
 
-				const memoryRead = await shellProbe(
-					`cat ${quote(path.join(otherMemory, "MEMORY.md"))} > /dev/null`,
+				const namedReads = await shellProbe(
+					`cat ${knownPaths.map(quote).join(" ")} > /dev/null`,
 					workspace,
-					fence,
+					probeFence,
 					abortController.signal,
 				);
 				return shellOutcome(
-					memoryRead,
-					false,
-					"synthetic other memory read must be refused",
-					"<synthetic-memory-store>/<synthetic-memory>",
+					namedReads,
+					true,
+					"known synthetic cross-session paths must keep operator access",
+					"<synthetic-session-store>/<known-path>",
 					redactions,
 				);
 			});
 		} else {
 			for (const name of [
-				"session parent cannot be enumerated",
+				"session parent discovery respects operator home",
 				"explicit grant restores parent enumeration",
 				"account container cannot be enumerated",
 				"named other account remains reachable",
-				"cross-session stores cannot be read",
+				"cross-session stores hide listings and keep named access",
 			]) {
 				add(name, "SKIP", "OS enforcement backend unavailable; path=<probe>; errno=unsupported");
 			}
 		}
 
-		await check("operator home configuration is writable", async () => {
+		await check("operator home supports direct file creation", async () => {
 			const displayPath = "<operator-home>/<synthetic-fixture>";
-			let liveConfig: string;
-			try {
-				// Landlock cannot grant creation on a split directory without also granting every
-				// denied descendant. The live fence therefore grants operator-owned CLI config roots
-				// explicitly; use one of those when another Landlock profile is already inherited.
-				// Standalone and Seatbelt checks retain the direct-home probe.
-				const configBase =
-					inheritedProfile && backend.backend === "landlock" ? path.join(liveHome, ".config", "gh") : liveHome;
-				liveConfig = await fs.mkdtemp(path.join(configBase, ".xcsh-sandbox-check-home-"));
-				fixturePaths.push(liveConfig);
-				redactions.push([liveConfig, displayPath]);
-			} catch (error) {
-				return exceptionOutcome("create operator-home fixture", displayPath, error, redactions);
-			}
+			const template = path.join(liveHome, ".xcsh-sandbox-check-home-XXXXXX");
+			const command =
+				`probe=$(mktemp ${quote(template)}) || exit $?; ` +
+				`trap 'rm -f "$probe"' EXIT; printf operator > "$probe" && ` +
+				`test "$(cat "$probe")" = operator && rm "$probe"`;
 			const result = await shellProbe(
-				'printf operator > config && test "$(cat config)" = operator',
-				liveConfig,
-				undefined,
+				command,
+				liveWorkspace,
+				inheritedProfile ? undefined : liveFence,
 				abortController.signal,
 			);
 			return shellOutcome(
 				result,
 				true,
-				"live profile must allow operator-home configuration writes",
+				"live profile must allow direct operator-home creation and removal",
 				displayPath,
 				redactions,
 			);

package/src/config/settings-schema.ts

@@ -1810,22 +1810,19 @@ export const SETTINGS_SCHEMA = {
 		ui: { tab: "providers", label: "Hide Secrets", description: "Obfuscate secrets before sending to AI providers" },
 	},
 
-	// Session filesystem isolation. Confines the file tools (read/write/edit/find/grep)
-	// and the Bash working directory to the session's CWD subtree plus a curated global
-	// allowlist, so concurrent sessions in different customer folders cannot read or
-	// write each other's files, secrets, or memory. See src/sandbox/.
+	// Session filesystem isolation is a discovery courtesy, not a user-rights policy. It hides selected
+	// cross-session container listings while named paths retain the operator's normal access.
 	"sandbox.enabled": {
 		type: "boolean",
 		default: true,
 		ui: {
 			tab: "sandbox",
 			label: "Filesystem isolation",
-			description: "Confine file tools to the working directory subtree (blocks cross-session access)",
+			description: "Hide cross-session container listings without restricting named operator access",
 		},
 	},
-	// Extra roots (beyond the CWD subtree) the session may read/write. Config/CLI only —
-	// e.g. `--allow-path <dir>` maps into both. The hardcoded cross-session leak-denies
-	// (other sessions' memories/sessions and the shared tenant contexts) always win.
+	// Historical names retained for compatibility. Either list now restores discovery and leaves the
+	// operator's ordinary read/write rights unchanged; `--allow-path <dir>` maps into both.
 	"sandbox.allowRead": { type: "array", default: [] as string[] },
 	"sandbox.allowWrite": { type: "array", default: [] as string[] },
 

package/src/extensibility/extensions/bundled/sandbox-guard.ts

@@ -6,15 +6,13 @@ import { resolveSessionFence } from "../../../sandbox/session-fence";
 /**
  * Session filesystem sandbox (bundled, default-on).
  *
- * Confines the model-invoked file tools (read/write/edit/find/grep) and the Bash
- * working directory to the session's CWD subtree plus a curated global allowlist, so
- * concurrent sessions in different customer folders cannot read or write each other's
- * files, secrets, or memory. Enforcement is a `tool_call` gate: the extension wrapper
+ * Removes casual cross-session discovery from model-invoked filesystem tools while preserving the
+ * operator's normal rights on every named path. Enforcement is a `tool_call` gate: the extension wrapper
  * blocks the tool when this returns `{ block: true }`, and fails safe (a thrown handler
  * also blocks).
  *
  * The boundary is derived from `ctx.cwd` (always the live session's directory) plus the
- * `sandbox.*` settings. Controlled by `sandbox.enabled` (default true); widened per run
+ * `sandbox.*` settings. Controlled by `sandbox.enabled` (default true); discovery is widened per run
  * with `--allow-path` / `--no-sandbox` or the `sandbox.allow*` settings.
  */
 export default function sandboxGuard(pi: ExtensionAPI): void {

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "20.4.1",
-	"commit": "eb7f355ecbeb2a6a44003ad13128ee973824a2e4",
-	"shortCommit": "eb7f355",
+	"version": "20.4.2",
+	"commit": "b85f1346a0ed047c05151f127ba9628612b386a3",
+	"shortCommit": "b85f134",
 	"branch": "main",
-	"tag": "v20.4.1",
-	"commitDate": "2026-08-05T01:08:56Z",
-	"buildDate": "2026-08-05T01:37:18.582Z",
+	"tag": "v20.4.2",
+	"commitDate": "2026-08-05T05:46:35Z",
+	"buildDate": "2026-08-05T06:17:35.937Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/eb7f355ecbeb2a6a44003ad13128ee973824a2e4",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v20.4.1"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/b85f1346a0ed047c05151f127ba9628612b386a3",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v20.4.2"
 };

package/src/prompts/internal-urls/containment.md

@@ -16,9 +16,9 @@ followed symlinks — so how a path is spelled does not change what is reachable
 - Cross-tenant isolation removes the discovery step. The session container, local-account containers,
   data roots, and mounted-data containers cannot be enumerated, but a descendant path the operator
   names directly can still be read, written, or entered. An explicit read grant restores enumeration.
-- Xcsh-private cross-session stores remain denied recursively. Another session's transcripts, memories,
-  internal contexts, credentials, and temporary working state are not reachable unless the operator
-  explicitly grants the relevant root.
+- Xcsh-private cross-session stores follow the same discovery boundary: their container cannot be
+  enumerated, while a descendant path the operator names directly keeps the operator's normal rights.
+  This preserves `/tmp`, home, credentials, package managers, and ordinary tooling without workarounds.
 
 Structured filesystem tools and the `bash` runtime consult the same fence. Bash command text is not
 scanned for path-looking strings; the operating system decides when a process actually opens a path.
@@ -33,10 +33,10 @@ operator. The rule of thumb is that if a file belongs to someone other than the
 working with, it is not yours to read.
 
 {{#if containment.landlock}}
-Three things behave differently under this backend, and none of them is a bug to work around:
+Three things behave differently under this backend, and none is a bug to work around:
 
-- `ls /` can fail because a kernel rule cannot expose a directory that mixes reachable and denied data
-  roots. Listing a specific reachable directory works normally.
+- `ls /` can fail because a kernel rule cannot expose a directory whose descendants have different
+  enumeration rights. Listing a specific reachable directory works normally.
 - `sudo` and other setuid programs do not work, because confining a process requires giving up the
   ability to gain privileges.
 - Interactive terminal programs (`top`, `less`, an interactive `ssh`) run without a real terminal here,
@@ -47,7 +47,15 @@ Three things behave differently under this backend, and none of them is a bug to
 {{/if}}
 {{/if}}
 {{else}}
-On this platform there is **no OS-level backend**, so for `bash` the boundary is enforced only by
+{{#if containment.discoveryOnly}}
+This Linux session deliberately does **not** arm Landlock for its discovery-only profile. Landlock
+cannot hide one nested directory listing without also breaking ordinary ancestor listings such as
+`ls ~`, `ls /tmp`, and `ls /`; arming it also disables PTYs and setuid tools such as `sudo`. Those
+costs would turn a cross-context courtesy into a user-rights control.
+
+{{else}}
+This session is **not using an OS-level backend**, so for `bash` the boundary is enforced only by
+{{/if}}
 precise pre-checks for an explicit `cwd`, literal redirections, known write operands, and literal
 directory changes. Command and source text are never scanned for path-looking strings.
 

package/src/sandbox/containment.ts

@@ -7,9 +7,8 @@
  * profile could not even `execvp /bin/cat`.
  *
  * So the fence is gentle. It leaves `/usr`, `/tmp`, package caches, the network and process execution
- * alone. Its cross-tenant courtesy removes discovery by enumerating session, account, and data
- * containers while keeping named operator access. Xcsh-private cross-session state remains denied
- * recursively unless the operator grants it explicitly (#2931).
+ * alone. Its cross-tenant courtesy removes discovery by enumerating session, account, data, and
+ * xcsh-private containers while keeping named operator access (#2931, #2952).
  *
  * Produced declaratively rather than as an ordered rule list, because the two backends disagree about
  * order: seatbelt evaluates rules in sequence with the last match winning, while Landlock only grants
@@ -375,12 +374,14 @@ function otherFilesystemRoots(fsRoot: string): string[] {
  *
  * `local://` content lands at `<tmp>/xcsh-local/<sessionId>` (`internal-urls/local-protocol.ts`) and a
  * task's artifacts at `<tmp>/xcsh-tasks/<id>` (`task/index.ts`) whenever no session artifacts dir is
- * configured. Those are the same class as `~/.xcsh/agent/sessions` — one session reading another's
- * working notes — so they belong in the leak roots rather than being covered incidentally.
+ * configured. Those are the same class as `~/.xcsh/agent/sessions` — another session's working notes —
+ * so their parent listings belong in the leak roots rather than being covered incidentally.
  *
  * Nothing else in the temp dir is touched: `xcsh://about` promises `/tmp` is reachable, and refusing it
- * wholesale is the false refusal #2582 removed. The session's OWN local root is granted back through
- * `extraRoots` at greater depth, so `local://` keeps working.
+ * wholesale is the false refusal #2582 removed. These roots lose enumeration only. A recursive deny
+ * beneath `/tmp` makes Landlock split that writable parent, which prevents ordinary programs from
+ * creating a direct child there (#2952). Named access therefore keeps the operator's normal rights,
+ * while the session's own local root remains discoverable through its known path.
  *
  * **Two fixed parents, deliberately never enumerated.** The first version listed the temp dir looking for
  * `xcsh-task-*` siblings, which cost 15ms of a 25-42ms fence build on a 17k-entry temp directory — per
@@ -475,7 +476,10 @@ export function buildContainmentFence(options: ContainmentOptions): ContainmentF
 	const parentExplicitlyReadable = [...extraResolved, ...readOnlyResolved].some(root =>
 		pathIsWithin(root, parentToProtect),
 	);
-	if (!tooBroadToDeny(parentToProtect, fsRoot) && !parentExplicitlyReadable) {
+	// Home itself is an operator workspace, not a customer-container boundary. Hiding its listing when a
+	// project is a direct child made ordinary shell navigation fail even on Seatbelt. Deeper project
+	// containers are still protected, but the operator always retains a normal `ls ~` experience.
+	if (parentToProtect !== home && !tooBroadToDeny(parentToProtect, fsRoot) && !parentExplicitlyReadable) {
 		denyEnumerate.add(parentToProtect);
 	}
 
@@ -532,25 +536,27 @@ export function buildContainmentFence(options: ContainmentOptions): ContainmentF
 		denyEnumerate.add(resolved);
 	}
 
-	// Cross-session leak roots. These may sit *under* an allowed root — the agent dir is inside home,
-	// and a session whose workspace is the agent dir would otherwise re-expose every other session's
-	// transcript. `fenceVerdict` resolves that by depth, so nesting is safe rather than accidental.
+	// Cross-session leak roots lose their exact directory listing, just like sibling workspace and
+	// account containers. Named descendants keep the operator's normal filesystem rights. This is
+	// deliberate rather than a weaker approximation: Landlock is allow-only, so recursively denying a
+	// child of `/tmp` or home prevents creating any new direct child in that parent (#2952). A professional
+	// tool must not require TMPDIR workarounds or a pre-created home subdirectory merely to run.
 	//
-	// Emitted even when absent: a rule that appears only once the directory does is one nobody can rely
-	// on, and creating it would otherwise be the way around it. This also covers relocated agent state.
+	// Emitted even when absent: a root created after the session starts must already have its listing
+	// protected. This also covers relocated agent state without enumerating home or the OS temp dir.
 	const leaks = options.leakRoots ?? [
 		getMemoriesDir(),
 		getSessionsDir(),
 		getXCSHContextsDir(),
 		...sharedTempLeakRoots(),
 	];
-	const explicitGrants = [...extraResolved, ...readOnlyResolved, ...writeOnlyResolved];
+	const explicitlyReadable = [...extraResolved, ...readOnlyResolved];
 	for (const leak of leaks) {
 		const resolved = canonicalThroughExisting(leak);
-		// A grant at or above a private root is an explicit operator override. Directional grants stay
-		// directional because their allowReadOnly/allowWriteOnly rule remains the deepest matching rule.
-		if (explicitGrants.some(root => pathIsWithin(root, resolved))) continue;
-		deny.add(resolved);
+		// A full or read grant at or above a private root explicitly restores its listing. A write-only
+		// grant does not imply permission to discover entries, so it leaves this exact protection intact.
+		if (explicitlyReadable.some(root => pathIsWithin(root, resolved))) continue;
+		denyEnumerate.add(resolved);
 	}
 
 	return {
@@ -602,6 +608,8 @@ export interface ContainmentStatus {
 	readonly backend: ContainmentBackend;
 	/** True when the kernel enforces it, false when only precise tool-call pre-checks run. */
 	readonly osEnforced: boolean;
+	/** Linux discovery-only profiles stay scanner-only so Landlock cannot remove ordinary ancestor listings. */
+	readonly discoveryOnly?: true;
 	/**
 	 * Set when the backend enforces reads and writes but cannot govern truncation.
 	 *
@@ -625,14 +633,34 @@ export interface ContainmentStatus {
  *
  * Deliberately not surfaced at startup or anywhere in the TUI — the operator asked for no UI change.
  */
+/**
+ * Whether Linux needs to arm Landlock for this fence.
+ *
+ * Exact enumeration denies are the production session courtesy, but Landlock cannot express one without
+ * also removing READ_DIR from every ancestor. Arming it made `ls ~`, `ls /tmp`, and `ls /` fail and also
+ * set `no_new_privs`, disabling sudo. Keep those checks in brush and the structured-tool gate. Recursive
+ * or directional low-level policies still require the kernel backend and retain their stricter contract.
+ */
+export function requiresLandlock(fence: ContainmentFence): boolean {
+	return fence.deny.length > 0 || fence.allowReadOnly.length > 0 || fence.allowWriteOnly.length > 0;
+}
+
 export function containmentStatus(
 	enabled: boolean,
 	platform: string = process.platform,
 	probe: () => { backend: string; truncateHandled?: boolean } | undefined = probeNativeBackend,
+	fence?: ContainmentFence,
 ): ContainmentStatus {
 	if (!enabled) return { enabled: false, backend: "disabled", osEnforced: false };
 	// macOS always has seatbelt, so there is nothing to ask.
 	if (platform === "darwin") return { enabled: true, backend: "seatbelt", osEnforced: true };
+	// Landlock is subtree-based. Applying it to an exact-listing-only courtesy removes normal access to
+	// ancestor listings and sets no_new_privs even though it cannot faithfully enforce the intended rule.
+	// Do not even probe in this common path: avoiding the syscall is part of keeping the sandbox off the
+	// command's latency path.
+	if (platform === "linux" && fence !== undefined && !requiresLandlock(fence)) {
+		return { enabled: true, backend: "scanner-only", osEnforced: false, discoveryOnly: true };
+	}
 	// Everywhere else the answer cannot be inferred from the platform name. Landlock can be compiled
 	// out of the kernel, left out of its boot-time LSM list, or too old to allow cross-directory
 	// rename — and none of that is visible from `process.platform`. Asking the native layer is the

package/src/sandbox/session-fence.ts

@@ -67,7 +67,7 @@ export interface SessionFenceExtras {
  * The session's fence for `workspace`, or undefined when sandboxing is off.
  *
  * Cached on the full effective configuration — the workspace plus the resolved enable flag, both
- * allow-lists and any extra roots — not on the workspace alone. Keying on the allow-lists is what lets
+ * discovery-grant lists and any extra roots — not on the workspace alone. Keying on the lists is what lets
  * a mid-session `settings.override("sandbox.allowRead", …)` take effect, as when the Office pane grants
  * a user-picked folder; a workspace-only key would keep serving the stale fence and block the path that
  * was just granted. The key only ever triggers more rebuilds, never fewer restrictions.
@@ -94,15 +94,15 @@ export function resolveSessionFence(
 	const cached = cache.get(signature);
 	if (cached) return cached;
 
-	// The three grants stay distinct. Merging allowRead and allowWrite into one read+write list made a
-	// folder shared for reading writable, undoing the split built for #2516. A root in *both* lists is
-	// the deliberate exception the fence itself handles, because that is what `--allow-path` produces.
+	// Session settings restore discovery; they do not reduce the operator's normal rights. The fence is a
+	// cross-context courtesy, not a read-only/write-only privilege boundary. Treat either historical
+	// allow-list as a full named-path grant so an old `sandbox.allowRead` entry cannot make a professional
+	// tool fail when it writes credentials, state, or build output there. The low-level fence keeps
+	// directional roots for specialized callers and tests, but ordinary xcsh sessions never emit them.
 	const fence = buildContainmentFence({
 		workspace,
 		sessionTmp: extras.sessionTmp,
-		extraRoots: extras.extraRoots,
-		readOnlyRoots: allowRead,
-		writeOnlyRoots: allowWrite,
+		extraRoots: [...(extras.extraRoots ?? []), ...allowRead, ...allowWrite],
 	});
 	if (cache.size >= CACHE_LIMIT) {
 		const oldest = cache.keys().next();

package/src/sdk.ts

@@ -1167,7 +1167,10 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 				},
 				// Read live rather than captured, for the same reason as the model: `--no-sandbox` and
 				// `sandbox.enabled` are per-session, so the answer must reflect this session (#2554).
-				getContainment: () => containmentStatus(resolveSessionFence(process.cwd(), settings) !== undefined),
+				getContainment: () => {
+					const fence = resolveSessionFence(process.cwd(), settings);
+					return containmentStatus(fence !== undefined, process.platform, undefined, fence);
+				},
 				// Read live rather than captured: `session.model` is a read-through to agent state, so a
 				// mid-session Ctrl+P switch shows up on the next xcsh://about read (#2459).
 				getActiveModel: () =>

package/src/tools/bash-skill-urls.ts

@@ -172,10 +172,10 @@ function shellEscape(p: string): string {
 /**
  * Refuse a resolved path the session is not allowed to read.
  *
- * Without this the expander and the sandbox disagreed: bash was handed paths under `~/.xcsh` that
- * the same session's `read` tool refuses. The carve-out for session-owned roots is what keeps
- * `artifact://`, `agent://` and `local://` working, since the default policy deny-lists the whole
- * sessions directory and a session's own artifact root lives inside it.
+ * Without this the expander and the sandbox can disagree when an operator configures an explicit
+ * directional or recursive boundary. Session-owned roots are still carved out so `artifact://`,
+ * `agent://` and `local://` keep working under those opt-in policies. The default production fence
+ * preserves named operator access and therefore reaches this check only for enumeration attempts.
  */
 function enforceReadBoundary(scheme: SupportedInternalScheme, resolved: string, options: InternalUrlExpansionOptions) {
 	const boundary = options.readBoundary;

package/src/tools/bash.ts

@@ -793,7 +793,7 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 		// Only worth giving up when there is an OS backend for the non-PTY path to use and none for this
 		// one. Where no backend exists — Linux without Landlock, Windows — both paths are scanner-only,
 		// so disabling PTY would remove interactive terminals and improve containment by nothing.
-		const osBackend = containmentStatus(fence !== undefined);
+		const osBackend = containmentStatus(fence !== undefined, process.platform, undefined, fence);
 		const ptyConfinable = !osBackend.osEnforced || osBackend.backend === "seatbelt";
 		const usePty = pty && ptyConfinable && $env.PI_NO_PTY !== "1" && ctx?.hasUI === true && ctx.ui !== undefined;
 		let sandboxCheckSibling: string | undefined;