@luckydraw/cumulus 1.0.2 → 1.0.4

package/dist/lib/tool-inventory.js

@@ -0,0 +1,309 @@
+/**
+ * Tool inventory + allowlist compilation (task 137).
+ *
+ * WHY THIS EXISTS
+ * A thread that should only be able to do a few things (a public web-app visitor
+ * panel) previously had to be configured with a DENYLIST — @cdda hand-enumerated 47
+ * tool names to get a safe surface. That inverts maintenance onto every app author:
+ * any tool cumulus or the Claude CLI adds in a future release is silently granted to
+ * every visitor on every deployed app until each author notices and edits their list.
+ *
+ * The fix is an allowlist. But `--allowedTools` on the Claude CLI is an AUTO-APPROVE
+ * list, not a restriction — measured under three permission modes, `--allowedTools Glob`
+ * failed to block Bash every time, and cumulus spawns with `--permission-mode
+ * bypassPermissions` where an auto-approve list is a guaranteed no-op. `--disallowedTools`
+ * DOES restrict there (also measured). So an allowlist has to be COMPILED into a denylist:
+ *
+ *     denylist = (everything that exists) − (what this thread may use)
+ *
+ * which is why this module has to know the full inventory.
+ *
+ * WHERE THE INVENTORY COMES FROM (three sources, because no single one is complete)
+ *  1. Built-in CLI tools — read from the `system:init` stream event, which carries the
+ *     CLI's own `tools[]`. Probed once per process (see probeBuiltinTools).
+ *  2. cumulus's own MCP tools — derived from the definitions cumulus itself ships.
+ *  3. Namespace `extraMcpServers` — NOT knowable here, and deliberately not closed over.
+ *     Those are the app author's own shim tools, granted to that namespace on purpose.
+ *
+ * The seed list is a FLOOR, not merely a fallback: the inventory is always the union of
+ * the probe and the seed, so a probe that returns a short list (different cwd, different
+ * plugin set, a future CLI that changes the event shape) can never quietly widen what a
+ * constrained thread is allowed to reach.
+ */
+import { spawn } from 'child_process';
+import * as os from 'os';
+import { getToolDefinitions } from '../mcp/tool-handler.js';
+/**
+ * Built-in Claude CLI tools, as reported by `system:init` on CLI 2.1.217.
+ *
+ * This is a FLOOR for the inventory, not a fallback — see the module comment. Adding a
+ * name here can only ever deny more on an allowlisted thread; it has no effect on a
+ * thread without `allowedTools`. Safe to update from a probe of a newer CLI.
+ */
+export const SEED_BUILTIN_TOOLS = [
+    'Bash',
+    'CronCreate',
+    'CronDelete',
+    'CronList',
+    'DesignSync',
+    'Edit',
+    'EnterWorktree',
+    'ExitWorktree',
+    'Monitor',
+    'NotebookEdit',
+    'PushNotification',
+    'Read',
+    'RemoteTrigger',
+    'ReportFindings',
+    'ScheduleWakeup',
+    'SendMessage',
+    'Skill',
+    'Task',
+    'TaskCreate',
+    'TaskGet',
+    'TaskList',
+    'TaskOutput',
+    'TaskStop',
+    'TaskUpdate',
+    'ToolSearch',
+    'WebFetch',
+    'WebSearch',
+    'Workflow',
+    'Write',
+];
+/**
+ * Tools served by the `gateway-agents` MCP server.
+ *
+ * Duplicated here rather than imported because `gateway-agents-mcp.ts` calls `main()`
+ * at top level — it is a stdio binary, and importing it would start a server. A source
+ * tripwire test asserts this list matches the tool definitions in that file, so the two
+ * cannot drift (same shape as task 132's artifact tripwire).
+ *
+ * `broadcast` is absent on purpose: it is deliberately not served (task 135).
+ */
+export const GATEWAY_AGENTS_TOOL_NAMES = [
+    'cancel_schedule',
+    'create_plastic_app',
+    'list_agents',
+    'list_emails',
+    'list_schedules',
+    'notify_user',
+    'schedule_trigger',
+    'send_email',
+    'send_to_agent',
+    'update_pipeline',
+    'upload_media',
+];
+/** MCP server keys cumulus attaches itself (see generateMcpConfig). */
+const CUMULUS_HISTORY_SERVER = 'cumulus-history';
+const GATEWAY_AGENTS_SERVER = 'gateway-agents';
+/** How long to wait for the CLI to emit its init event before giving up on the probe. */
+const PROBE_TIMEOUT_MS = 15_000;
+/** Fully-qualified names of the MCP tools cumulus ships itself. */
+export function cumulusMcpToolNames() {
+    const history = getToolDefinitions().map(t => `mcp__${CUMULUS_HISTORY_SERVER}__${t.name}`);
+    const agents = GATEWAY_AGENTS_TOOL_NAMES.map(n => `mcp__${GATEWAY_AGENTS_SERVER}__${n}`);
+    return [...history, ...agents];
+}
+/**
+ * Ask the Claude CLI what built-in tools it has, by reading the `tools[]` array off its
+ * `system:init` stream event and killing the subprocess immediately.
+ *
+ * Measured cost: init arrives ~871ms in and is the ONLY event before the kill — no
+ * assistant output, no result event, so nothing comes back from the model. A prompt is
+ * required: with stdin closed the CLI exits before emitting init (0 lines), and merely
+ * holding stdin open emits nothing at all (20s). Hence the one-character `x`.
+ *
+ * Runs in a neutral cwd so a project's own settings cannot shape the answer, and the
+ * result is unioned with the seed floor by the caller either way.
+ *
+ * Rejects on timeout, spawn failure, or a missing/empty `tools[]`. Never throws
+ * synchronously; the caller treats any rejection as "use the floor".
+ *
+ * `claudePath` is supplied by the caller, which already has it resolved. Taking it as a
+ * parameter rather than importing `resolveClaudeCli` avoids a module cycle: that function
+ * lives in gateway.ts, which imports this module.
+ */
+export function probeBuiltinTools(claudePath) {
+    return new Promise((resolve, reject) => {
+        const bin = claudePath || 'claude';
+        // Same env hygiene as the real spawn: CLAUDE* vars would leak the parent session.
+        const cleanEnv = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('CLAUDE') && key !== 'CLAUDECODE'));
+        let child;
+        try {
+            child = spawn(bin, [
+                '--print',
+                '--output-format',
+                'stream-json',
+                '--verbose',
+                '--permission-mode',
+                'bypassPermissions',
+                'x',
+            ], { stdio: ['ignore', 'pipe', 'ignore'], cwd: os.tmpdir(), env: cleanEnv });
+        }
+        catch (err) {
+            reject(err instanceof Error ? err : new Error(String(err)));
+            return;
+        }
+        let settled = false;
+        let buf = '';
+        const finish = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            try {
+                child.kill('SIGKILL');
+            }
+            catch {
+                // already gone
+            }
+            fn();
+        };
+        const timer = setTimeout(() => finish(() => reject(new Error('tool inventory probe timed out'))), PROBE_TIMEOUT_MS);
+        // Don't hold the event loop open on a probe nobody is waiting for.
+        timer.unref?.();
+        child.stdout?.on('data', (chunk) => {
+            buf += chunk.toString();
+            let nl;
+            while ((nl = buf.indexOf('\n')) >= 0) {
+                const line = buf.slice(0, nl);
+                buf = buf.slice(nl + 1);
+                if (!line.trim())
+                    continue;
+                let parsed;
+                try {
+                    parsed = JSON.parse(line);
+                }
+                catch {
+                    continue;
+                }
+                if (parsed.type !== 'system' || parsed.subtype !== 'init')
+                    continue;
+                const tools = Array.isArray(parsed.tools)
+                    ? parsed.tools.filter((t) => typeof t === 'string')
+                    : [];
+                if (tools.length === 0) {
+                    finish(() => reject(new Error('init event carried no tools')));
+                    return;
+                }
+                finish(() => resolve(tools));
+                return;
+            }
+        });
+        child.on('error', err => finish(() => reject(err)));
+        // 'close', not 'exit': close fires after stdio has drained, so a CLI that prints init
+        // and exits immediately still resolves. On 'exit' the reject could win the race.
+        child.on('close', () => finish(() => reject(new Error('CLI exited before emitting init'))));
+    });
+}
+/** Memoized so the probe runs at most once per gateway process. */
+let inventoryPromise = null;
+/**
+ * The full set of tool names a spawned turn could otherwise reach.
+ *
+ * Deliberately NOT threaded through `MessagePipelineOptions`: task 113 is the recorded
+ * case of a field added to one of four spawn paths and silently doing nothing in the
+ * other three, and here a miss would fail OPEN. Module-scope memoization means the single
+ * args-assembly site is the only consumer and it cannot be half-wired.
+ */
+export function getToolInventory(claudePath) {
+    if (!inventoryPromise) {
+        inventoryPromise = probeBuiltinTools(claudePath)
+            .catch(err => {
+            console.warn(`[Gateway] Tool inventory probe failed (${err instanceof Error ? err.message : err}); ` +
+                'using the seed floor. Allowlisted threads stay closed.');
+            return [];
+        })
+            .then(probed => {
+            const all = new Set([...SEED_BUILTIN_TOOLS, ...probed, ...cumulusMcpToolNames()]);
+            return [...all].sort();
+        });
+    }
+    return inventoryPromise;
+}
+/** Test seam: drop the memo so a suite can probe with a stub. */
+export function resetToolInventoryCache() {
+    inventoryPromise = null;
+}
+/** The bare tool name of an `mcp__server__tool` entry, or the name itself. */
+export function bareToolName(name) {
+    if (!name.startsWith('mcp__'))
+        return name;
+    const parts = name.split('__');
+    return parts.length > 2 ? parts.slice(2).join('__') : name;
+}
+/**
+ * Compile an allowlist into the denylist the CLI actually honours.
+ *
+ * Returns `existingDisallowed` UNCHANGED when no allowlist is configured — additive, so
+ * every thread that does not opt in behaves exactly as before.
+ *
+ * An allowlist entry matches an inventory entry exactly, or as its bare name, so
+ * `read_file` allows `mcp__cumulus-history__read_file` (the system prompt calls it
+ * `read_file`; a user should not have to know the prefix). An entry that matches nothing
+ * is inert — and inertness DENIES, so a typo fails closed.
+ *
+ * `disallowedTools` still applies on top: it can subtract from an allowlist but never add.
+ */
+export function compileDisallowedTools(allowedTools, inventory, existingDisallowed) {
+    if (!allowedTools)
+        return existingDisallowed;
+    const allowed = new Set(allowedTools);
+    const denied = new Set(existingDisallowed ?? []);
+    for (const name of inventory) {
+        if (allowed.has(name) || allowed.has(bareToolName(name)))
+            continue;
+        denied.add(name);
+    }
+    return denied.size ? [...denied].sort() : undefined;
+}
+/**
+ * Is `name` (a bare tool name) reachable on this thread?
+ *
+ * Deliberately inventory-INDEPENDENT: it reads the thread's stated intent, so it gives the
+ * same answer on the Claude CLI path and the direct-provider path, whose real inventories
+ * differ. Available iff the allowlist admits it (or there is no allowlist) and the denylist
+ * does not name it.
+ */
+export function toolAvailable(name, policy) {
+    const denied = (policy.disallowedTools ?? []).some(d => d === name || bareToolName(d) === name);
+    if (denied)
+        return false;
+    if (!policy.allowedTools)
+        return true;
+    return policy.allowedTools.some(a => a === name || bareToolName(a) === name);
+}
+export function promptCapabilities(policy) {
+    return {
+        backgroundWork: toolAvailable('Bash', policy),
+        scheduling: toolAvailable('schedule_trigger', policy),
+        interAgent: toolAvailable('send_to_agent', policy),
+    };
+}
+/** Section header prefixes, keyed by the capability that keeps them. */
+const GATED_SECTIONS = [
+    ['backgroundWork', 'BACKGROUND WORK:'],
+    ['scheduling', 'SCHEDULING'],
+    ['interAgent', 'INTER-AGENT MESSAGING:'],
+];
+/**
+ * Remove prompt sections whose tools this thread cannot reach.
+ *
+ * Sections in SYSTEM_PROMPT_TEMPLATE are blank-line-delimited blocks whose first line is a
+ * header, so this is a split/filter/join — lossless when nothing is gated (regression-locked),
+ * and a no-op on a custom template that has no such headers.
+ *
+ * Only ever REMOVES text, so an unconstrained thread's prompt is byte-identical and the task
+ * 117 static-prompt budget cannot be breached by this function.
+ */
+export function applyCapabilityGates(template, caps) {
+    const dropPrefixes = GATED_SECTIONS.filter(([cap]) => !caps[cap]).map(([, prefix]) => prefix);
+    if (dropPrefixes.length === 0)
+        return template;
+    return template
+        .split('\n\n')
+        .filter(block => !dropPrefixes.some(prefix => block.startsWith(prefix)))
+        .join('\n\n');
+}
+//# sourceMappingURL=tool-inventory.js.map

package/dist/lib/tool-inventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-inventory.js","sourceRoot":"","sources":["../../src/lib/tool-inventory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,KAAK,EAAqB,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,MAAM;IACN,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,MAAM;IACN,eAAe;IACf,cAAc;IACd,SAAS;IACT,cAAc;IACd,kBAAkB;IAClB,MAAM;IACN,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,OAAO;IACP,MAAM;IACN,YAAY;IACZ,SAAS;IACT,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,WAAW;IACX,UAAU;IACV,OAAO;CACR,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IAC1D,iBAAiB;IACjB,oBAAoB;IACpB,aAAa;IACb,aAAa;IACb,gBAAgB;IAChB,aAAa;IACb,kBAAkB;IAClB,YAAY;IACZ,eAAe;IACf,iBAAiB;IACjB,cAAc;CACf,CAAC;AAEF,uEAAuE;AACvE,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AACjD,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAE/C,yFAAyF;AACzF,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,mEAAmE;AACnE,MAAM,UAAU,mBAAmB;IACjC,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,sBAAsB,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,qBAAqB,KAAK,CAAC,EAAE,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAmB;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,UAAU,IAAI,QAAQ,CAAC;QACnC,kFAAkF;QAClF,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CACjC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAChC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,YAAY,CAC7D,CACF,CAAC;QAEF,IAAI,KAAmB,CAAC;QACxB,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CACX,GAAG,EACH;gBACE,SAAS;gBACT,iBAAiB;gBACjB,aAAa;gBACb,WAAW;gBACX,mBAAmB;gBACnB,mBAAmB;gBACnB,GAAG;aACJ,EACD,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CACzE,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,GAAG,GAAG,EAAE,CAAC;QAEb,MAAM,MAAM,GAAG,CAAC,EAAc,EAAE,EAAE;YAChC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;YACD,EAAE,EAAE,CAAC;QACP,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC,EACvE,gBAAgB,CACjB,CAAC;QACF,mEAAmE;QACnE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAEhB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACxB,IAAI,EAAU,CAAC;YACf,OAAO,CAAC,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9B,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;oBAAE,SAAS;gBAC3B,IAAI,MAA4D,CAAC;gBACjE,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM;oBAAE,SAAS;gBACpE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;oBACvC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;oBAChE,CAAC,CAAC,EAAE,CAAC;gBACP,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC;oBAC/D,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpD,sFAAsF;QACtF,iFAAiF;QACjF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mEAAmE;AACnE,IAAI,gBAAgB,GAA6B,IAAI,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAmB;IAClD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,gBAAgB,GAAG,iBAAiB,CAAC,UAAU,CAAC;aAC7C,KAAK,CAAC,GAAG,CAAC,EAAE;YACX,OAAO,CAAC,IAAI,CACV,0CAA0C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK;gBACrF,wDAAwD,CAC3D,CAAC;YACF,OAAO,EAAc,CAAC;QACxB,CAAC,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,EAAE;YACb,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,kBAAkB,EAAE,GAAG,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC,CAAC,CAAC;YAC1F,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC,CAAC,CAAC;IACP,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,uBAAuB;IACrC,gBAAgB,GAAG,IAAI,CAAC;AAC1B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAkC,EAClC,SAA4B,EAC5B,kBAAwC;IAExC,IAAI,CAAC,YAAY;QAAE,OAAO,kBAAkB,CAAC;IAE7C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAAE,SAAS;QACnE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,MAAkB;IAC5D,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAChG,IAAI,MAAM;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAC/E,CAAC;AAgBD,MAAM,UAAU,kBAAkB,CAAC,MAAkB;IACnD,OAAO;QACL,cAAc,EAAE,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC;QAC7C,UAAU,EAAE,aAAa,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACrD,UAAU,EAAE,aAAa,CAAC,eAAe,EAAE,MAAM,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,cAAc,GAAsD;IACxE,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;IACtC,CAAC,YAAY,EAAE,YAAY,CAAC;IAC5B,CAAC,YAAY,EAAE,wBAAwB,CAAC;CACzC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,IAAwB;IAC7E,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAC9F,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/C,OAAO,QAAQ;SACZ,KAAK,CAAC,MAAM,CAAC;SACb,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;SACvE,IAAI,CAAC,MAAM,CAAC,CAAC;AAClB,CAAC"}

package/dist/mcp/index.js

@@ -1,15 +1,18 @@
 #!/usr/bin/env node
+import * as path from 'path';
 import { runServer } from './server.js';
 const threadPath = process.env['CUMULUS_THREAD_PATH'];
 const contentPath = process.env['CUMULUS_CONTENT_PATH'];
 const sessionsPath = process.env['CUMULUS_SESSIONS_PATH'];
 const sessionId = process.env['CUMULUS_SESSION_ID'];
+// Task 136 — read_file root confinement, path.delimiter-separated. Absent = unrestricted.
+const readFileRoots = process.env['CUMULUS_READ_FILE_ROOTS']?.split(path.delimiter).filter(Boolean);
 if (!threadPath) {
     console.error('Error: CUMULUS_THREAD_PATH environment variable is required');
     console.error('Usage: CUMULUS_THREAD_PATH=/path/to/thread.jsonl node dist/mcp/index.js');
     process.exit(1);
 }
-runServer(threadPath, contentPath, sessionsPath, sessionId).catch(error => {
+runServer(threadPath, contentPath, sessionsPath, sessionId, readFileRoots).catch(error => {
     console.error('MCP server error:', error);
     process.exit(1);
 });

package/dist/mcp/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;AACtD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;AACxD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;AAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAEpD,IAAI,CAAC,UAAU,EAAE,CAAC;IAChB,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC7E,OAAO,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;IACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;IACxE,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":";AAEA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;AACtD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;AACxD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;AAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AACpD,0FAA0F;AAC1F,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAEpG,IAAI,CAAC,UAAU,EAAE,CAAC;IAChB,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC7E,OAAO,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;IACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;IACvF,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/mcp/server.d.ts

@@ -1,6 +1,6 @@
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { ContentStore } from '../lib/content-store.js';
 import { HistoryStore } from '../lib/history.js';
-export declare function createMcpServer(historyStore: HistoryStore, contentStore?: ContentStore, sessionsPath?: string, currentSessionId?: string): Server;
-export declare function runServer(threadPath: string, contentPath?: string, sessionsPath?: string, sessionId?: string): Promise<void>;
+export declare function createMcpServer(historyStore: HistoryStore, contentStore?: ContentStore, sessionsPath?: string, currentSessionId?: string, readFileRoots?: string[]): Server;
+export declare function runServer(threadPath: string, contentPath?: string, sessionsPath?: string, sessionId?: string, readFileRoots?: string[]): Promise<void>;
 //# sourceMappingURL=server.d.ts.map

package/dist/mcp/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAInE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAIjD,wBAAgB,eAAe,CAC7B,YAAY,EAAE,YAAY,EAC1B,YAAY,CAAC,EAAE,YAAY,EAC3B,YAAY,CAAC,EAAE,MAAM,EACrB,gBAAgB,CAAC,EAAE,MAAM,GACxB,MAAM,CAkBR;AAED,wBAAsB,SAAS,CAC7B,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CASf"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAInE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAIjD,wBAAgB,eAAe,CAC7B,YAAY,EAAE,YAAY,EAC1B,YAAY,CAAC,EAAE,YAAY,EAC3B,YAAY,CAAC,EAAE,MAAM,EACrB,gBAAgB,CAAC,EAAE,MAAM,EACzB,aAAa,CAAC,EAAE,MAAM,EAAE,GACvB,MAAM,CAwBR;AAED,wBAAsB,SAAS,CAC7B,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,MAAM,EAClB,aAAa,CAAC,EAAE,MAAM,EAAE,GACvB,OAAO,CAAC,IAAI,CAAC,CAef"}

package/dist/mcp/server.js

@@ -4,8 +4,14 @@ import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprot
 import { ContentStore } from '../lib/content-store.js';
 import { HistoryStore } from '../lib/history.js';
 import { getToolDefinitions, handleToolCall } from './tool-handler.js';
-export function createMcpServer(historyStore, contentStore, sessionsPath, currentSessionId) {
-    const ctx = { historyStore, contentStore, sessionsPath, currentSessionId };
+export function createMcpServer(historyStore, contentStore, sessionsPath, currentSessionId, readFileRoots) {
+    const ctx = {
+        historyStore,
+        contentStore,
+        sessionsPath,
+        currentSessionId,
+        readFileRoots,
+    };
     const server = new Server({ name: 'cumulus-history', version: '1.0.0' }, { capabilities: { tools: {} } });
     server.setRequestHandler(ListToolsRequestSchema, async () => ({
         tools: getToolDefinitions(),
@@ -16,10 +22,10 @@ export function createMcpServer(historyStore, contentStore, sessionsPath, curren
     });
     return server;
 }
-export async function runServer(threadPath, contentPath, sessionsPath, sessionId) {
+export async function runServer(threadPath, contentPath, sessionsPath, sessionId, readFileRoots) {
     const historyStore = new HistoryStore(threadPath);
     const contentStore = contentPath ? new ContentStore(contentPath) : undefined;
-    const server = createMcpServer(historyStore, contentStore, sessionsPath, sessionId);
+    const server = createMcpServer(historyStore, contentStore, sessionsPath, sessionId, readFileRoots);
     const transport = new StdioServerTransport();
     await server.connect(transport);
     await new Promise(resolve => {

package/dist/mcp/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAEnG,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAe,MAAM,mBAAmB,CAAC;AAEpF,MAAM,UAAU,eAAe,CAC7B,YAA0B,EAC1B,YAA2B,EAC3B,YAAqB,EACrB,gBAAyB;IAEzB,MAAM,GAAG,GAAgB,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC;IAExF,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,EAC7C,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,kBAAkB,EAAE;KAC5B,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;QAC9D,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACjD,OAAO,cAAc,CAAC,IAAI,EAAE,IAA2C,EAAE,GAAG,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,UAAkB,EAClB,WAAoB,EACpB,YAAqB,EACrB,SAAkB;IAElB,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,MAAM,GAAG,eAAe,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;QAChC,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAEnG,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAe,MAAM,mBAAmB,CAAC;AAEpF,MAAM,UAAU,eAAe,CAC7B,YAA0B,EAC1B,YAA2B,EAC3B,YAAqB,EACrB,gBAAyB,EACzB,aAAwB;IAExB,MAAM,GAAG,GAAgB;QACvB,YAAY;QACZ,YAAY;QACZ,YAAY;QACZ,gBAAgB;QAChB,aAAa;KACd,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,EAC7C,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,kBAAkB,EAAE;KAC5B,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;QAC9D,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACjD,OAAO,cAAc,CAAC,IAAI,EAAE,IAA2C,EAAE,GAAG,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,UAAkB,EAClB,WAAoB,EACpB,YAAqB,EACrB,SAAkB,EAClB,aAAwB;IAExB,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,MAAM,GAAG,eAAe,CAC5B,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,aAAa,CACd,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;QAChC,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/mcp/tool-handler.d.ts

@@ -6,7 +6,18 @@ export interface ToolContext {
     contentStore?: ContentStore;
     sessionsPath?: string;
     currentSessionId?: string;
+    /**
+     * Directories `read_file` is confined to (task 136). Undefined = unrestricted.
+     * Computed by readFileRootsForThread() in lib/gateway.ts; enforced here so a
+     * future wiring site cannot forget the check.
+     */
+    readFileRoots?: string[];
 }
+/**
+ * Is `target` inside one of `roots`? Segment-aware: `/a/bc` is NOT inside `/a/b`.
+ * Both sides are resolved first, so `..` traversal cannot escape.
+ */
+export declare function isPathWithinRoots(target: string, roots: string[]): boolean;
 export interface ToolResult {
     [key: string]: unknown;
     content: Array<{

package/dist/mcp/tool-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-handler.d.ts","sourceRoot":"","sources":["../../src/mcp/tool-handler.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAE1D,OAAO,EAAqB,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAQ1E,OAAO,EAAE,YAAY,EAAW,MAAM,mBAAmB,CAAC;AAoM1D,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,YAAY,CAAC;IAC3B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,kBAAkB,IAAI,IAAI,EAAE,CAmS3C;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACzC,GAAG,EAAE,WAAW,GACf,OAAO,CAAC,UAAU,CAAC,CA0pCrB"}
+{"version":3,"file":"tool-handler.d.ts","sourceRoot":"","sources":["../../src/mcp/tool-handler.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAE1D,OAAO,EAAqB,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAQ1E,OAAO,EAAE,YAAY,EAAW,MAAM,mBAAmB,CAAC;AAoM1D,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,YAAY,CAAC;IAC3B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAM1E;AAED,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,kBAAkB,IAAI,IAAI,EAAE,CAmS3C;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACzC,GAAG,EAAE,WAAW,GACf,OAAO,CAAC,UAAU,CAAC,CA2qCrB"}

package/dist/mcp/tool-handler.js

@@ -130,6 +130,17 @@ function messageToResult(msg, index) {
     }
     return result;
 }
+/**
+ * Is `target` inside one of `roots`? Segment-aware: `/a/bc` is NOT inside `/a/b`.
+ * Both sides are resolved first, so `..` traversal cannot escape.
+ */
+export function isPathWithinRoots(target, roots) {
+    const resolved = path.resolve(target);
+    return roots.some(root => {
+        const r = path.resolve(root);
+        return resolved === r || resolved.startsWith(r.endsWith(path.sep) ? r : r + path.sep);
+    });
+}
 export function getToolDefinitions() {
     return [
         {
@@ -401,7 +412,7 @@ export function getToolDefinitions() {
     ];
 }
 export async function handleToolCall(name, args, ctx) {
-    const { historyStore, contentStore, sessionsPath, currentSessionId } = ctx;
+    const { historyStore, contentStore, sessionsPath, currentSessionId, readFileRoots } = ctx;
     try {
         switch (name) {
             case 'search_history': {
@@ -997,8 +1008,23 @@ export async function handleToolCall(name, args, ctx) {
                         isError: true,
                     };
                 }
-                // Resolve and validate path
                 const resolvedPath = path.resolve(filePath);
+                // Root confinement (task 136) — a thread that denies the built-in Read
+                // tool must not get an unrestricted read_file under a different name.
+                if (readFileRoots?.length && !isPathWithinRoots(resolvedPath, readFileRoots)) {
+                    return {
+                        content: [
+                            {
+                                type: 'text',
+                                text: JSON.stringify({
+                                    error: `Path is outside this thread's allowed directories: ${resolvedPath}. ` +
+                                        `Allowed: ${readFileRoots.join(', ')}`,
+                                }),
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
                 try {
                     const stat = await fs.stat(resolvedPath);
                     if (stat.isDirectory()) {