@sabaiway/agent-workflow-kit 1.45.0 → 1.46.0

package/tools/manifest/validate.mjs

@@ -339,6 +339,44 @@ export const validateManifest = (skillDir) => {
     }
   }
 
+  // `writableDirs` (REC-UX-REWORK, D6): the backend CLI's writable state-dir declarations —
+  // {env, default} entries the Recommendations advisor RESOLVES at run time (a NON-EMPTY env
+  // value wins, else the default) and renders into the sandbox-lane recipe. Like `networkHosts`
+  // this is a DOCUMENTATION source (the kit never seeds filesystem allowances), and a malformed
+  // list FAILS --strict for the same reason: the resolved dir is rendered into a hand-applied line.
+  const writableDirs = manifest.writableDirs;
+  if (writableDirs != null) {
+    if (!Array.isArray(writableDirs) || writableDirs.length === 0) {
+      errors.push('`writableDirs` must be a non-empty array of {env, default} entries');
+    } else {
+      const seenDefaults = new Set();
+      writableDirs.forEach((entry, i) => {
+        const at = `\`writableDirs[${i}]\``;
+        if (entry == null || typeof entry !== 'object' || Array.isArray(entry)) {
+          errors.push(`${at} must be an {env, default} object`);
+          return;
+        }
+        if (entry.env !== null && (typeof entry.env !== 'string' || !/^[A-Z][A-Z0-9_]*$/.test(entry.env))) {
+          errors.push(`${at}.env must be null or an UPPER_SNAKE_CASE env-var name (${JSON.stringify(entry.env)})`);
+        }
+        const dir = entry.default;
+        if (typeof dir !== 'string' || !(dir.startsWith('~/') || dir.startsWith('/'))) {
+          errors.push(`${at}.default must be a \`~/\`-anchored or absolute POSIX path (${JSON.stringify(dir)})`);
+          return;
+        }
+        if (/[*?[\]]/.test(dir)) errors.push(`${at}.default must not carry glob characters ("${dir}")`);
+        // The resolved dir is rendered into a ONE-LINE hand-applied recipe — a control character
+        // (newline, CR, NUL, …) would break the line or the shell paste.
+        // eslint-disable-next-line no-control-regex
+        if (/[\x00-\x1f\x7f]/.test(dir)) errors.push(`${at}.default must not carry control characters (${JSON.stringify(dir)})`);
+        if (dir.endsWith('/')) errors.push(`${at}.default must not end with a trailing slash ("${dir}")`);
+        if (hasTraversal(dir)) errors.push(`${at}.default must not contain ".." traversal ("${dir}")`);
+        if (seenDefaults.has(dir)) errors.push(`duplicate writableDirs default "${dir}" (${at})`);
+        else seenDefaults.add(dir);
+      });
+    }
+  }
+
   if (!isStub) {
     const auth = readAuthoritativeVersion(skillDir);
     if (auth.version == null) errors.push(`could not resolve an authoritative version (${auth.from})`);

package/tools/procedures.mjs

@@ -297,6 +297,8 @@ const costLanesAdvice = () => [
   '  • L3 frontier — judgment: plan/fold/synthesis, ADR/handover/changelog-entry wording, persuasive copy, go/no-go, real code.',
   '  • A step with no named guardrail does not move down a lane; red lines never move down (council review models · real code · memory/copy wording · the maintainer approval asks).',
   '  • Sandbox lanes (under an OS sandbox): the L0 surfaces are sandbox-safe — gates/ledger/state/fold checks, git reads, plain no-network tests; the bridge wrappers are genuinely unsandboxed (network); npm-cache-touching commands are COMMAND-SHAPE dependent — first try the sandbox-safe shape (cache under $TMPDIR, offline/notifier off). Move ONLY the failing command out of the sandbox, never its class; BATCH consecutive unsandboxed calls.',
+  '  • Prompt economy (autonomy-preserving dispatch): read-only fan-out (research/sweeps/extraction) runs ONLY on restricted-tool vehicles — a full-tool subagent for read-only work is a forbidden lane downgrade (invisible prompt-flood + blast radius), and a subagent is never told to shell out for facts obtainable read-only; the orchestrator\'s own shell form is ONE plain pipeline per call (a ;/&& chain or env-prefixed invocation never matches a prefix allow rule); a fan-out LAUNCHER that gates per call yields to the agent-spawn lane. Capability-gated: on a host with restricted-tool subagent vehicles use them; without restricted-tool vehicles (a host offering only full-tool agents included), read-only research stays in the orchestrator\'s own context — never a vehicle mandate a host cannot satisfy.',
+  '  • The prompt-economy clause narrows TOOLS for read-only work only — judgment, code, synthesis stay at the frontier lane; a task that genuinely needs to run or write keeps a full-tool subagent. Honest limit: no deterministic gate classifies a dispatch — enforcement is the canon at the point of use + the placed vehicles + the retro loop.',
 ];
 
 // The verbatim per-backend DRIVING CONTRACT block (M-contract): the exact invocation descriptor(s),