@snowyroad/braid 0.94.0 → 0.96.0

package/dist/{chunk-267GOUH7.js → chunk-2TZT7YDG.js}

@@ -400,7 +400,7 @@ var InviteExpiredError = class extends Error {
   }
 };
 async function redeemInvite(relayHttpUrl, code) {
-  const { boundedJsonFetch: boundedJsonFetch2 } = await import("./http-JA7L7WBG.js");
+  const { boundedJsonFetch: boundedJsonFetch2 } = await import("./http-5RVYBQJV.js");
   const r = await boundedJsonFetch2(`${relayHttpUrl.replace(/\/$/, "")}/invites/redeem`, {
     method: "POST",
     headers: { "content-type": "application/json" },
@@ -432,8 +432,8 @@ async function redeemInvite(relayHttpUrl, code) {
 
 // src/config.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname4, join as join6 } from "path";
-import { homedir as homedir5 } from "os";
+import { dirname as dirname4, join as join7 } from "path";
+import { homedir as homedir6 } from "os";
 
 // src/keystore.ts
 import { spawnSync as nodeSpawnSync } from "child_process";
@@ -492,7 +492,7 @@ function validateReplacementToken(newToken, currentToken, nowMs = Date.now()) {
   return { ok: true };
 }
 async function mintAccessToken(relayHttpUrl, agentKey, fetchFn = fetch, dpopProof) {
-  const { boundedJsonFetch: boundedJsonFetch2 } = await import("./http-JA7L7WBG.js");
+  const { boundedJsonFetch: boundedJsonFetch2 } = await import("./http-5RVYBQJV.js");
   const r = await boundedJsonFetch2(`${relayHttpUrl.replace(/\/$/, "")}/agents/token`, {
     method: "POST",
     headers: {
@@ -1101,8 +1101,195 @@ async function chooseRelayWhenAmbiguous(agentName, matches, io = { input: proces
 }
 
 // src/toolPolicy.ts
+import { homedir as homedir4 } from "os";
+import { join as join3, resolve, sep } from "path";
+
+// src/scope/protectedPaths.ts
+import path2 from "path";
+function join2(platform, ...segments) {
+  return platform === "win32" ? path2.win32.join(...segments) : path2.posix.join(...segments);
+}
+function isAbsolute(platform, p) {
+  return platform === "win32" ? path2.win32.isAbsolute(p) : path2.posix.isAbsolute(p);
+}
+function dedupe(paths) {
+  return [...new Set(paths)];
+}
+function osDeniableReadPaths(home, env, platform) {
+  const xdgConfigHome = env.XDG_CONFIG_HOME;
+  const paths = [
+    join2(platform, home, ".ssh"),
+    join2(platform, home, ".aws"),
+    join2(platform, home, ".gnupg"),
+    join2(platform, home, ".kube/config"),
+    join2(platform, home, ".npmrc"),
+    join2(platform, home, ".netrc"),
+    join2(platform, home, ".config/gh"),
+    join2(platform, home, ".docker/config.json"),
+    join2(platform, home, ".git-credentials"),
+    join2(platform, home, ".config/git/credentials"),
+    join2(platform, home, ".config/gcloud"),
+    join2(platform, home, ".azure"),
+    join2(platform, home, ".zsh_history"),
+    join2(platform, home, ".bash_history"),
+    join2(platform, home, ".local/share/fish/fish_history"),
+    join2(platform, home, ".pypirc"),
+    join2(platform, home, ".cargo/credentials"),
+    join2(platform, home, ".cargo/credentials.toml"),
+    join2(platform, home, ".gem/credentials"),
+    join2(platform, home, ".m2/settings.xml"),
+    join2(platform, home, ".gradle/gradle.properties"),
+    join2(platform, home, ".composer/auth.json"),
+    join2(platform, home, ".bundle/config"),
+    join2(platform, home, ".terraform.d/credentials.tfrc.json"),
+    join2(platform, home, ".terraformrc"),
+    join2(platform, home, ".vault-token")
+  ];
+  if (xdgConfigHome && isAbsolute(platform, xdgConfigHome)) {
+    paths.push(join2(platform, xdgConfigHome, "gh"));
+    paths.push(join2(platform, xdgConfigHome, "git/credentials"));
+  }
+  if (platform === "win32") {
+    const appData = env.APPDATA ?? join2(platform, home, "AppData/Roaming");
+    const userProfile = env.USERPROFILE ?? home;
+    paths.push(join2(platform, appData, "GitHub CLI"));
+    paths.push(join2(platform, appData, "gcloud"));
+    paths.push(join2(platform, appData, "Microsoft/Windows/PowerShell/PSReadLine"));
+    paths.push(join2(platform, userProfile, "_netrc"));
+  }
+  return dedupe(paths);
+}
+function toolOnlyReadPaths(home, _env, platform) {
+  return dedupe([
+    join2(platform, home, ".claude/.credentials.json"),
+    join2(platform, home, ".codex/auth.json"),
+    join2(platform, home, ".gemini/oauth_creds.json"),
+    join2(platform, home, ".gemini/google_accounts.json"),
+    join2(platform, home, ".local/share/opencode/auth.json")
+  ]);
+}
+function protectedReadPaths(home, env, platform, braidConfigDirs) {
+  return dedupe([
+    ...osDeniableReadPaths(home, env, platform),
+    ...toolOnlyReadPaths(home, env, platform),
+    ...braidConfigDirs
+  ]);
+}
+
+// src/readScope.ts
+import { realpathSync } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join2, resolve, sep } from "path";
+import * as posixPath from "path/posix";
+import * as win32Path from "path/win32";
+function pathModuleFor(platform) {
+  return platform === "win32" ? win32Path : posixPath;
+}
+function foldCase(p, platform) {
+  return platform === "darwin" || platform === "win32" ? p.toLowerCase() : p;
+}
+function canonicalize(lexical, pathMod, realpath) {
+  let current = lexical;
+  let remainder = "";
+  while (true) {
+    try {
+      const resolved = realpath(current);
+      return pathMod.normalize(remainder ? pathMod.join(resolved, remainder) : resolved);
+    } catch {
+      const parent = pathMod.dirname(current);
+      if (parent === current) {
+        return lexical;
+      }
+      const base = pathMod.basename(current);
+      remainder = remainder ? pathMod.join(base, remainder) : base;
+      current = parent;
+    }
+  }
+}
+function expandHome(raw, home, pathMod) {
+  if (raw === "~") {
+    return home;
+  }
+  if (raw.startsWith("~/") || pathMod === win32Path && raw.startsWith("~\\")) {
+    return home + pathMod.sep + raw.slice(2);
+  }
+  if (raw.startsWith("~")) {
+    return null;
+  }
+  return raw;
+}
+function normalizeCandidate(raw, scope) {
+  if (!raw) {
+    return null;
+  }
+  const platform = scope.platform ?? process.platform;
+  const pathMod = pathModuleFor(platform);
+  const home = scope.home ?? homedir3();
+  const expanded = expandHome(raw, home, pathMod);
+  if (expanded === null) {
+    return null;
+  }
+  const absolute = pathMod.isAbsolute(expanded) ? expanded : platform === "win32" ? pathMod.resolve(scope.cwd, expanded) : scope.cwd + pathMod.sep + expanded;
+  const lexical = pathMod.normalize(absolute);
+  const realpath = scope.realpath ?? realpathSync.native;
+  const canonical = canonicalize(absolute, pathMod, realpath);
+  return { lexical, canonical };
+}
+function isInsideRoot(p, root, pathMod, platform) {
+  const foldedP = foldCase(p, platform);
+  const foldedRoot = foldCase(root, platform);
+  return foldedP === foldedRoot || foldedP.startsWith(foldedRoot + pathMod.sep);
+}
+function isSameDrive(p, root, platform) {
+  if (platform !== "win32") {
+    return true;
+  }
+  if (p.startsWith("\\\\") || root.startsWith("\\\\")) {
+    return p.toLowerCase() === root.toLowerCase() || p.toLowerCase().startsWith(root.toLowerCase());
+  }
+  const driveOf = (s) => {
+    const parsed = win32Path.parse(s);
+    return parsed.root.slice(0, 2).toLowerCase();
+  };
+  return driveOf(p) === driveOf(root);
+}
+function formIsInsideRootSet(form, roots, pathMod, platform) {
+  if (platform === "win32" && form.startsWith("\\\\")) {
+    return false;
+  }
+  for (const root of roots) {
+    if (platform === "win32" && !isSameDrive(form, root, platform)) {
+      continue;
+    }
+    if (isInsideRoot(form, root, pathMod, platform)) {
+      return true;
+    }
+  }
+  return false;
+}
+function isInsideRootSet(raw, scope) {
+  const platform = scope.platform ?? process.platform;
+  const pathMod = pathModuleFor(platform);
+  const normalized = normalizeCandidate(raw, scope);
+  if (!normalized) {
+    return false;
+  }
+  const roots = [scope.cwd, ...scope.allowRead].map((r) => {
+    const n = pathMod.normalize(r);
+    return n.length > 1 && n.endsWith(pathMod.sep) && !isFilesystemRoot(n, platform) ? n.slice(0, -1) : n;
+  });
+  const lexicalOk = formIsInsideRootSet(normalized.lexical, roots, pathMod, platform);
+  const canonicalOk = formIsInsideRootSet(normalized.canonical, roots, pathMod, platform);
+  return lexicalOk && canonicalOk;
+}
+function isFilesystemRoot(p, platform) {
+  if (!p) {
+    return false;
+  }
+  const pathMod = pathModuleFor(platform);
+  return pathMod.parse(p).root === p;
+}
+
+// src/toolPolicy.ts
 function narrowestMode(...modes) {
   for (const m of modes) {
     if (m === "readonly") return "readonly";
@@ -1122,10 +1309,10 @@ function toolStatusLine(mode, cause = "operator") {
   if (cause === "channel") {
     return "Tool status: your operator granted this agent full tool access, but THIS CHANNEL restricts you to read-only here. You can still read channel context, sources, tasks, artifacts, and memory, but requests to run commands, edit files, or write to the channel are denied for this channel. This is governed by the channel's own configuration (its capability bundle), NOT your agent's bridge tool mode \u2014 changing the agent's bridge settings will not lift it. A channel admin must adjust the channel's capability bundle to allow writes.";
   }
-  return "Tool status: this agent runs in read-and-reply mode; requests to run commands or edit files are denied by the operator's bridge settings (changeable with: braid tools full <agent>).";
+  return "Tool status: this agent runs in read-and-reply mode; requests to run commands or edit files are denied by the operator's bridge settings (changeable with: braid tools full <agent>). File reads are limited to the launch directory and any --allow-read paths.";
 }
 var denialHintShown = false;
-function takeDenialHint(policy, cause = "operator") {
+function takeDenialHint(policy, cause = "operator", kind = "mode", cwd) {
   if (denialHintShown) return null;
   denialHintShown = true;
   if (cause === "channel") {
@@ -1133,6 +1320,10 @@ function takeDenialHint(policy, cause = "operator") {
   }
   const raw = policy.agentName;
   const name = raw && isShellSafeName(raw) ? raw : "<agent-name>";
+  if (kind === "scope") {
+    const where = cwd ? ` (${cwd})` : "";
+    return `[braid] In read-and-reply mode this agent may only read files under its launch directory${where}. To widen: start it with --allow-read <dir>, or add the path to scope.allowRead in its agent config. For full tool access: braid tools full ${name}.`;
+  }
   return `[braid] To allow tools for this agent: stop the bridge, run \`braid tools full ${name}\`, then start it again (advanced override: BRAID_TOOL_MODE=full).`;
 }
 function parseToolMode(env) {
@@ -1166,14 +1357,17 @@ function braidMcpFloorToolName(title) {
   return FLOOR_BRAID_MCP_TOOLS.has(short) ? short : null;
 }
 function expandTilde(p) {
-  if (p === "~") return homedir3();
-  if (p.startsWith("~/") || p.startsWith(`~${sep}`)) return join2(homedir3(), p.slice(2));
+  if (p === "~") return homedir4();
+  if (p.startsWith("~/") || p.startsWith(`~${sep}`)) return join3(homedir4(), p.slice(2));
   return p;
 }
-function isInsideConfigDir(configDirAbs, rawPath) {
-  const cfg = resolve(expandTilde(configDirAbs));
-  const p = resolve(expandTilde(rawPath));
-  return p === cfg || p.startsWith(cfg + sep);
+function foldCase2(p, platform = process.platform) {
+  return platform === "darwin" || platform === "win32" ? p.toLowerCase() : p;
+}
+function isInsidePath(protectedAbs, rawPath, cwd = process.cwd()) {
+  const prot = foldCase2(resolve(expandTilde(protectedAbs)));
+  const p = foldCase2(resolve(cwd, expandTilde(rawPath)));
+  return p === prot || p.startsWith(prot + sep);
 }
 function pathsFromInput(input) {
   if (input == null || typeof input !== "object") return [];
@@ -1185,19 +1379,189 @@ function pathsFromInput(input) {
   }
   return out;
 }
-function findConfigDirHit(configDirAbs, paths) {
+function findProtectedHit(protectedAbs, paths, cwd = process.cwd()) {
   for (const p of paths) {
-    if (isInsideConfigDir(configDirAbs, p)) return p;
+    for (const prot of protectedAbs) {
+      if (isInsidePath(prot, p, cwd)) return p;
+    }
   }
   return null;
 }
-function evaluateAcpPermission(mode, configDirAbs, req) {
+function legacyArpDir() {
+  return join3(homedir4(), ".arp");
+}
+function protectedInventory(configDirAbs) {
+  const home = homedir4();
+  return protectedReadPaths(home, process.env, process.platform, [configDirAbs, legacyArpDir()]);
+}
+function protectedHitReason(configDirAbs, hit, cwd, toolName) {
+  const subject = toolName ? `tool ${toolName}` : "tool call";
+  if (isInsidePath(configDirAbs, hit, cwd) || isInsidePath(legacyArpDir(), hit, cwd)) {
+    return `${subject} touches the Braid config dir (${hit})`;
+  }
+  return `${subject} touches a protected credential path (${hit})`;
+}
+var ENV_BASENAME_RE = /^\.env(\..+)?$/;
+function basenameOf(p) {
+  const idx = Math.max(p.lastIndexOf("/"), p.lastIndexOf("\\"));
+  return idx === -1 ? p : p.slice(idx + 1);
+}
+function unmaskGlobSegment(seg2) {
+  return seg2.replace(/\[([^\]])\]/g, "$1").replace(/\\(.)/g, "$1").trim();
+}
+function formEscapesRootSet(form, platform) {
+  if (form.startsWith("/") || form.startsWith("~")) return true;
+  if (/^[A-Za-z]:[\\/]/.test(form)) return true;
+  if (form.startsWith("\\\\")) return true;
+  const posixSegs = form.split("/");
+  if (posixSegs.some((s) => unmaskGlobSegment(s) === "..")) return true;
+  if (platform === "win32" && form.split(/[\\/]/).some((s) => unmaskGlobSegment(s) === "..")) return true;
+  return false;
+}
+function splitTopLevelCommas(inner) {
+  const parts = [];
+  let depth = 0;
+  let start = 0;
+  for (let i = 0; i < inner.length; i++) {
+    const c = inner[i];
+    if (c === "\\") {
+      i++;
+      continue;
+    }
+    if (c === "{") depth++;
+    else if (c === "}" && depth > 0) depth--;
+    else if (c === "," && depth === 0) {
+      parts.push(inner.slice(start, i));
+      start = i + 1;
+    }
+  }
+  parts.push(inner.slice(start));
+  return parts;
+}
+var BRACE_FORM_BUDGET = 1e4;
+var MAX_PATTERN_LEN = 512;
+var MAX_BRACE_GROUPS = 8;
+function expandBraces(pattern) {
+  let depth = 0;
+  let open = -1;
+  for (let i = 0; i < pattern.length; i++) {
+    const c = pattern[i];
+    if (c === "\\") {
+      i++;
+      continue;
+    }
+    if (c === "{") {
+      if (depth === 0) open = i;
+      depth++;
+    } else if (c === "}" && depth > 0) {
+      depth--;
+      if (depth === 0) {
+        const opts = splitTopLevelCommas(pattern.slice(open + 1, i));
+        if (opts.length <= 1) continue;
+        const pre = pattern.slice(0, open);
+        const post = pattern.slice(i + 1);
+        const out = [];
+        for (const opt of opts) {
+          const sub = expandBraces(pre + opt + post);
+          if (sub === null) return null;
+          for (const s of sub) {
+            if (out.length >= BRACE_FORM_BUDGET) return null;
+            out.push(s);
+          }
+        }
+        return out;
+      }
+    }
+  }
+  return [pattern];
+}
+function patternEscapesRootSet(pattern, platform) {
+  if (pattern.length > MAX_PATTERN_LEN) return true;
+  if ((pattern.match(/\{/g)?.length ?? 0) > MAX_BRACE_GROUPS) return true;
+  const forms = expandBraces(pattern);
+  if (forms === null) return true;
+  return forms.some((f) => formEscapesRootSet(f, platform));
+}
+function patternBasenameTargetsEnv(pattern, platform) {
+  if (pattern.length > MAX_PATTERN_LEN) return false;
+  const forms = expandBraces(pattern);
+  if (forms === null) return false;
+  return forms.some((f) => {
+    const segs = platform === "win32" ? f.split(/[\\/]/) : f.split("/");
+    const base = unmaskGlobSegment(segs[segs.length - 1] ?? "");
+    return ENV_BASENAME_RE.test(base.toLowerCase());
+  });
+}
+function checkReadonlyRootSet(kind, candidates, patternFields, hasReadIntent, unknownShape, scope) {
+  const platform = scope.platform ?? process.platform;
+  const foldBasename = (s) => platform === "darwin" || platform === "win32" ? s.toLowerCase() : s;
+  if (isFilesystemRoot(scope.cwd, platform) && hasReadIntent) {
+    return {
+      allow: false,
+      reason: "readonly file reads have no working-directory boundary (bridge started at the filesystem root, e.g. a service install); pass --allow-read <dir> or set a working directory (BL-290)",
+      deniedByMode: true,
+      deniedByScope: true
+      // remedy is --allow-read (a working directory), not `braid tools full`
+    };
+  }
+  for (const p of candidates) {
+    if (ENV_BASENAME_RE.test(foldBasename(basenameOf(p)))) {
+      return {
+        allow: false,
+        reason: `read of ${p} touches a .env file, denied in readonly mode (D6)`,
+        deniedByMode: true
+        // .env IS readable in full mode, so `braid tools full` is the right hint
+      };
+    }
+  }
+  for (const pattern of patternFields) {
+    if (patternEscapesRootSet(pattern, platform)) {
+      return {
+        allow: false,
+        reason: `${kind} pattern "${pattern}" may not be absolute, ~-relative, drive/UNC-rooted, or contain ".." segments (readonly root-set escape)`,
+        deniedByMode: true,
+        deniedByScope: true
+        // remedy is --allow-read / a narrower pattern
+      };
+    }
+    if (patternBasenameTargetsEnv(pattern, platform)) {
+      return {
+        allow: false,
+        reason: `${kind} glob "${pattern}" targets a .env file, denied in readonly mode (D6)`,
+        deniedByMode: true
+      };
+    }
+  }
+  if (unknownShape) {
+    return {
+      allow: false,
+      reason: `tool kind "${kind}" rawInput has no recognizable path field (unknown read shape)`,
+      deniedByMode: true
+    };
+  }
+  if (candidates.length === 0) {
+    return null;
+  }
+  for (const p of candidates) {
+    if (!isInsideRootSet(p, scope)) {
+      const grants = scope.allowRead.length > 0 ? `, ${scope.allowRead.join(", ")}` : "";
+      return {
+        allow: false,
+        reason: `read of ${p} is outside the readonly root set [${scope.cwd}${grants}]; widen with --allow-read <dir> (or scope.allowRead), or braid tools full <name>`,
+        deniedByScope: true,
+        deniedByMode: true
+      };
+    }
+  }
+  return null;
+}
+function evaluateAcpPermission(mode, configDirAbs, req, scope) {
   const tc = req.toolCall;
   const locationPaths = (tc?.locations ?? []).map((l) => l?.path).filter((p) => typeof p === "string" && p.trim() !== "");
   const candidates = [...locationPaths, ...pathsFromInput(tc?.rawInput)];
-  const hit = findConfigDirHit(configDirAbs, candidates);
+  const hit = findProtectedHit(protectedInventory(configDirAbs), candidates, scope.cwd);
   if (hit) {
-    return { allow: false, reason: `tool call touches the Braid config dir (${hit})` };
+    return { allow: false, reason: protectedHitReason(configDirAbs, hit, scope.cwd) };
   }
   const arpFloor = braidMcpFloorToolName(tc?.title);
   if (arpFloor) {
@@ -1205,6 +1569,21 @@ function evaluateAcpPermission(mode, configDirAbs, req) {
   }
   if (mode === "full") return { allow: true, reason: "BRAID_TOOL_MODE=full" };
   const kind = tc?.kind ?? null;
+  if (kind === "read" || kind === "search") {
+    const rawInput = tc?.rawInput;
+    const rawInputIsObject = rawInput != null && typeof rawInput === "object";
+    const rawInputPresent = rawInputIsObject && Object.keys(rawInput).length > 0 || rawInput != null && !rawInputIsObject;
+    const patternFields = [];
+    if (rawInputIsObject) {
+      const o = rawInput;
+      if (typeof o.glob === "string") patternFields.push(o.glob);
+    }
+    const searchPatternPresent = kind === "search" && rawInputIsObject && typeof rawInput.pattern === "string";
+    const hasReadIntent = candidates.length > 0 || patternFields.length > 0 || rawInputPresent || locationPaths.length > 0;
+    const unknownShape = rawInputPresent && candidates.length === 0 && patternFields.length === 0 && !searchPatternPresent && locationPaths.length === 0;
+    const denial = checkReadonlyRootSet(kind, candidates, patternFields, hasReadIntent, unknownShape, scope);
+    if (denial) return denial;
+  }
   if (kind != null && READONLY_ACP_KINDS.has(kind)) {
     return { allow: true, reason: `read-only tool kind "${kind}"` };
   }
@@ -1225,10 +1604,11 @@ var READONLY_SDK_TOOLS = /* @__PURE__ */ new Set([
   "TodoWrite",
   "ExitPlanMode"
 ]);
-function evaluateSdkTool(mode, configDirAbs, toolName, input) {
-  const hit = findConfigDirHit(configDirAbs, pathsFromInput(input));
+function evaluateSdkTool(mode, configDirAbs, toolName, input, scope) {
+  const inputPaths = pathsFromInput(input);
+  const hit = findProtectedHit(protectedInventory(configDirAbs), inputPaths, scope.cwd);
   if (hit) {
-    return { allow: false, reason: `tool ${toolName} touches the Braid config dir (${hit})` };
+    return { allow: false, reason: protectedHitReason(configDirAbs, hit, scope.cwd, toolName) };
   }
   const arpFloor = braidMcpFloorToolName(toolName);
   if (arpFloor) {
@@ -1236,6 +1616,24 @@ function evaluateSdkTool(mode, configDirAbs, toolName, input) {
   }
   if (mode === "full") return { allow: true, reason: "BRAID_TOOL_MODE=full" };
   if (READONLY_SDK_TOOLS.has(toolName)) {
+    if (toolName === "Read" || toolName === "Grep" || toolName === "Glob") {
+      const candidates = inputPaths;
+      const patternFields = [];
+      if (toolName === "Glob" && typeof input.pattern === "string") patternFields.push(input.pattern);
+      if (toolName === "Grep" && typeof input.glob === "string") patternFields.push(input.glob);
+      const kind = toolName === "Read" ? "read" : "search";
+      const unknownShape = toolName === "Read" && candidates.length === 0;
+      const denial = checkReadonlyRootSet(
+        kind,
+        candidates,
+        patternFields,
+        /* hasReadIntent */
+        true,
+        unknownShape,
+        scope
+      );
+      if (denial) return denial;
+    }
     return { allow: true, reason: `read-only tool ${toolName}` };
   }
   const arpRead = braidMcpReadToolName(toolName);
@@ -1317,12 +1715,13 @@ import { createInterface as createInterface3 } from "readline";
 // src/adapter.ts
 import { query } from "@anthropic-ai/claude-agent-sdk";
 import { accessSync, constants, existsSync as existsSync2, statSync as statSync2 } from "fs";
-import { delimiter, dirname as dirname3, join as join5, resolve as resolve2 } from "path";
-import { homedir as homedir4 } from "os";
+import { delimiter, dirname as dirname3, join as join6, resolve as resolve2 } from "path";
+import { homedir as homedir5 } from "os";
 
 // src/acp/client.ts
 import { spawn } from "child_process";
 import { Readable, Writable } from "stream";
+import { realpathSync as realpathSync2 } from "fs";
 import { ClientSideConnection, ndJsonStream } from "@agentclientprotocol/sdk";
 
 // src/acp/filterStream.ts
@@ -1395,7 +1794,7 @@ function capLines(s, maxLines) {
   if (lines.length <= maxLines) return { value: s, truncated: false };
   return { value: lines.slice(0, maxLines).join("\n") + BRIDGE_CAPS.truncationSuffix, truncated: true };
 }
-function buildActivityContent(raw) {
+function buildActivityContent(raw, kind) {
   if (!Array.isArray(raw) || raw.length === 0) return null;
   const out = [];
   let total = 0;
@@ -1403,13 +1802,13 @@ function buildActivityContent(raw) {
     if (typeof item !== "object" || item === null) continue;
     const it = item;
     let built = null;
-    if (it.type === "diff" && typeof it.path === "string" && typeof it.newText === "string") {
+    if (it.type === "diff" && kind === "edit" && typeof it.path === "string" && typeof it.newText === "string") {
       const oldText = typeof it.oldText === "string" ? it.oldText : "";
       let patch = createTwoFilesPatch(it.path, it.path, oldText, it.newText, void 0, void 0, { context: 3 });
       const byLines = capLines(patch, BRIDGE_CAPS.diffPatchLines);
       const byBytes = capBytes(byLines.value, BRIDGE_CAPS.diffPatchBytes);
       built = { type: "diff", path: it.path, patch: byBytes.value, truncated: byLines.truncated || byBytes.truncated };
-    } else if (it.type === "content") {
+    } else if (it.type === "content" && kind === "execute") {
       const block = it.content;
       if (block?.type === "text" && typeof block.text === "string" && block.text.length > 0) {
         const capped = capBytes(block.text, BRIDGE_CAPS.textBytes);
@@ -1558,6 +1957,13 @@ function pickAllowOption(req) {
     "ACP request_permission had no allow option (allow_once/allow_always); refusing to auto-select a non-allow option"
   );
 }
+function acpSessionCwd(cwd) {
+  try {
+    return realpathSync2.native(cwd);
+  } catch {
+    return cwd;
+  }
+}
 function safeAcpToolName(tc) {
   const title = tc?.title;
   if (typeof title === "string") {
@@ -1573,7 +1979,7 @@ var AcpClient = class {
     this.afterChildExitHook = afterChildExitHook;
     this.telemetry = telemetry;
     this.warmupCeilingMs = warmupCeilingMs;
-    this.policy = launch.policy ?? { mode: "readonly", configDirAbs: configDir(process.env) };
+    this.policy = launch.policy ?? { mode: "readonly", configDirAbs: configDir(process.env), allowReadAbs: [] };
   }
   launch;
   scopeWrap;
@@ -1771,7 +2177,10 @@ var AcpClient = class {
       },
       requestPermission: async (req) => {
         const mode = this.currentTurnOverrideMode ?? this.policy.mode;
-        const verdict = evaluateAcpPermission(mode, this.policy.configDirAbs, req);
+        const verdict = evaluateAcpPermission(mode, this.policy.configDirAbs, req, {
+          cwd: acpSessionCwd(this.launch.cwd),
+          allowRead: this.policy.allowReadAbs ?? []
+        });
         if (verdict.allow) {
           return {
             outcome: { outcome: "selected", optionId: pickAllowOption(req) }
@@ -1782,11 +2191,11 @@ var AcpClient = class {
           tool: safeAcpToolName(req.toolCall),
           mode,
           path: "acp",
-          reason: verdict.deniedByMode ? "mode" : "tripwire"
+          reason: verdict.deniedByScope ? "scope" : verdict.deniedByMode ? "mode" : "tripwire"
         });
         if (verdict.deniedByMode) {
           const cause = this.currentTurnOverrideMode === "readonly" && this.policy.mode !== "readonly" ? "channel" : "operator";
-          const hint = takeDenialHint(this.policy, cause);
+          const hint = takeDenialHint(this.policy, cause, verdict.deniedByScope ? "scope" : "mode", acpSessionCwd(this.launch.cwd));
           if (hint) console.warn(sanitizeForTty(hint));
         }
         const rejectId = pickRejectOptionId(req);
@@ -1863,6 +2272,8 @@ var AcpClient = class {
     const sink = this.launch.onActivity;
     if (!sink) return;
     const locations = u.locations && u.locations.length > 0 ? u.locations.map((l) => l.line == null ? { path: l.path } : { path: l.path, line: l.line }) : null;
+    if (u.kind) this.activeTurnBuffer?.kinds.set(u.toolCallId, u.kind);
+    const kind = u.kind ?? this.activeTurnBuffer?.kinds.get(u.toolCallId) ?? null;
     const event = {
       turnId,
       toolCallId: u.toolCallId,
@@ -1872,7 +2283,7 @@ var AcpClient = class {
       status: u.status ?? null,
       locations,
       ts: Date.now(),
-      content: buildActivityContent(u.content)
+      content: buildActivityContent(u.content, kind)
     };
     try {
       sink(event);
@@ -1932,7 +2343,8 @@ var AcpClient = class {
     const buffer = {
       text: "",
       turnId,
-      thoughts: new ThoughtBuffer(turnId)
+      thoughts: new ThoughtBuffer(turnId),
+      kinds: /* @__PURE__ */ new Map()
     };
     this.activeTurnBuffer = buffer;
     this.currentTurnOverrideMode = overrideMode;
@@ -2048,7 +2460,7 @@ var AcpClient = class {
 
 // src/sessionStore.ts
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, renameSync as renameSync2, chmodSync as chmodSync2 } from "fs";
-import { join as join3, dirname as dirname2 } from "path";
+import { join as join4, dirname as dirname2 } from "path";
 function mergeSessionPointer(existing, sessionId, cwd) {
   return existing ? { ...existing, sessionId, cwd } : { sessionId, cwd };
 }
@@ -2056,7 +2468,7 @@ function safe(s) {
   return s.replace(/[^a-zA-Z0-9._-]/g, "_");
 }
 function sessionFilePath(dir, relayUrl, agentName, channelId) {
-  return join3(dir, "sessions", relayHostSegment(relayUrl), `${safe(agentName)}__${safe(channelId)}.json`);
+  return join4(dir, "sessions", relayHostSegment(relayUrl), `${safe(agentName)}__${safe(channelId)}.json`);
 }
 function parseSlot(p) {
   if (typeof p.sessionId === "string" && p.sessionId.trim() !== "" && typeof p.cwd === "string" && p.cwd.trim() !== "") {
@@ -2281,14 +2693,14 @@ function modelLaunchFor(agent, model) {
 
 // src/scope/sandbox.ts
 import { SandboxManager, SandboxRuntimeConfigSchema, installWindowsSandbox, getSrtWinPath } from "@anthropic-ai/sandbox-runtime";
-import path3 from "path";
-import { realpathSync as realpathSync2 } from "fs";
+import path4 from "path";
+import { realpathSync as realpathSync4 } from "fs";
 import { spawnSync as nodeSpawnSync2 } from "child_process";
 
 // src/scope/scopeConfig.ts
-import { realpathSync, readdirSync as readdirSync2, lstatSync } from "fs";
+import { realpathSync as realpathSync3, readdirSync as readdirSync2, lstatSync } from "fs";
 import { execSync } from "child_process";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 function resolveIpcProfile(scope, flagValue) {
   if (flagValue !== void 0) return flagValue;
   if (scope?.ipcProfile !== void 0) return scope.ipcProfile;
@@ -2379,14 +2791,14 @@ var PROVIDER_PATHS = {
   copilot: ["~/.copilot"],
   qwen: ["~/.qwen"]
 };
-function expandHome(p, home) {
+function expandHome2(p, home) {
   if (p.startsWith("~/")) return `${home}${p.slice(1)}`;
   if (p === "~") return home;
   return p;
 }
-function canonicalize(p) {
+function canonicalize2(p) {
   try {
-    return realpathSync(p);
+    return realpathSync3(p);
   } catch {
     return p;
   }
@@ -2410,18 +2822,18 @@ function darwinMdsCacheDir() {
   }
 }
 function resolvePaths(paths, home) {
-  return dedup(paths.map((p) => canonicalize(expandHome(p, home))));
+  return dedup(paths.map((p) => canonicalize2(expandHome2(p, home))));
 }
-function foldCase(p, platform) {
+function foldCase3(p, platform) {
   return platform === "darwin" || platform === "win32" ? p.toLowerCase() : p;
 }
 function checkGrantsAgainstReservations(grants, reservations, platform) {
   const sep2 = platform === "win32" ? "\\" : "/";
   const out = [];
   for (const g of grants) {
-    const gf = foldCase(g.path, platform);
+    const gf = foldCase3(g.path, platform);
     for (const r of reservations) {
-      const rf = foldCase(r, platform);
+      const rf = foldCase3(r, platform);
       if (gf === rf) {
         out.push({ grant: g.path, source: g.source, reservation: r, relation: "equal" });
       } else if (gf.startsWith(rf + sep2)) {
@@ -2436,41 +2848,36 @@ function resolveScope(cfg, provider, env, platform = process.platform) {
   const home = env["HOME"] ?? "";
   const cwd = env["PWD"] ?? process.cwd();
   const tmpDir = env["TMPDIR"] ?? "/tmp";
-  const braidConfigDir = env["BRAID_CONFIG_DIR"]?.trim() || expandHome("~/.braid", home);
-  const legacyArpConfigDir = expandHome("~/.arp", home);
+  const braidConfigDir = env["BRAID_CONFIG_DIR"]?.trim() || expandHome2("~/.braid", home);
+  const legacyArpConfigDir = expandHome2("~/.arp", home);
   const protectedConfigDirs = braidConfigDir === legacyArpConfigDir ? [braidConfigDir] : [braidConfigDir, legacyArpConfigDir];
   const flagOverride = cfg.scopeFlags?.scopeOverride;
   const disabled = flagOverride !== void 0 ? flagOverride === "off" : scope.disabled === true || env["BRAID_SCOPE"] === "off";
-  const secretDirs = [
-    "~/.ssh",
-    "~/.aws",
-    "~/.gnupg",
-    "~/.kube/config"
-  ].map((p) => expandHome(p, home));
+  const secretDirs = osDeniableReadPaths(home, env, platform);
   const protectedConfigDirEntries = protectedConfigDirs.flatMap((configDirPath) => {
     if (platform !== "win32") return [configDirPath];
     try {
       const children = readdirSync2(configDirPath, { withFileTypes: true });
-      const denied = children.filter((entry) => entry.name !== "runtime").map((entry) => canonicalize(join4(configDirPath, entry.name)));
+      const denied = children.filter((entry) => entry.name !== "runtime").map((entry) => canonicalize2(join5(configDirPath, entry.name)));
       if (denied.length === 0) return [configDirPath];
       return denied;
     } catch {
       return [configDirPath];
     }
   });
-  const providerPaths = PROVIDER_PATHS[provider].map((p) => expandHome(p, home));
+  const providerPaths = PROVIDER_PATHS[provider].map((p) => expandHome2(p, home));
   const uid = process.getuid?.();
-  const claudeTmpRoot = provider === "claude-code" && uid !== void 0 ? [`${canonicalize("/tmp")}/claude-${uid}`, `${canonicalize("/tmp")}/claude-*-cwd`] : [];
+  const claudeTmpRoot = provider === "claude-code" && uid !== void 0 ? [`${canonicalize2("/tmp")}/claude-${uid}`, `${canonicalize2("/tmp")}/claude-*-cwd`] : [];
   const mdsCacheDir = platform === "darwin" ? darwinMdsCacheDir() : [];
-  const opAllowWrite = (scope.allowWrite ?? []).map((p) => expandHome(p, home));
-  const envAllowWrite = parseEnvList(env["BRAID_SCOPE_ALLOW_WRITE"]).map((p) => expandHome(p, home));
-  const flagAllowWrite = (cfg.scopeFlags?.allowWrite ?? []).map((p) => expandHome(p, home));
+  const opAllowWrite = (scope.allowWrite ?? []).map((p) => expandHome2(p, home));
+  const envAllowWrite = parseEnvList(env["BRAID_SCOPE_ALLOW_WRITE"]).map((p) => expandHome2(p, home));
+  const flagAllowWrite = (cfg.scopeFlags?.allowWrite ?? []).map((p) => expandHome2(p, home));
   const rawAllowWrite = [
     cwd,
     ...providerPaths,
     ...claudeTmpRoot,
     ...mdsCacheDir,
-    expandHome("~/.npm", home),
+    expandHome2("~/.npm", home),
     tmpDir,
     ...opAllowWrite,
     ...envAllowWrite,
@@ -2480,24 +2887,24 @@ function resolveScope(cfg, provider, env, platform = process.platform) {
   const rawDenyWrite = [
     ...secretDirs,
     ...protectedConfigDirEntries,
-    ...(scope.denyWrite ?? []).map((p) => expandHome(p, home)),
-    ...parseEnvList(env["BRAID_SCOPE_DENY_WRITE"]).map((p) => expandHome(p, home))
+    ...(scope.denyWrite ?? []).map((p) => expandHome2(p, home)),
+    ...parseEnvList(env["BRAID_SCOPE_DENY_WRITE"]).map((p) => expandHome2(p, home))
   ];
   const denyWrite = resolvePaths(rawDenyWrite, home);
   const ipcProfile = resolveIpcProfile(scope, cfg.scopeFlags?.ipcProfile);
   const rawDenyRead = [
     ...secretDirs,
     ...protectedConfigDirEntries,
-    ...(scope.denyRead ?? []).map((p) => expandHome(p, home)),
-    ...parseEnvList(env["BRAID_SCOPE_DENY_READ"]).map((p) => expandHome(p, home))
+    ...(scope.denyRead ?? []).map((p) => expandHome2(p, home)),
+    ...parseEnvList(env["BRAID_SCOPE_DENY_READ"]).map((p) => expandHome2(p, home))
   ];
   const denyRead = dedup([
     ...resolvePaths(rawDenyRead, home),
     ...ipcProfile === "strict" && platform === "linux" ? strictIpcDenyRead(env) : []
   ]);
-  const opAllowRead = (scope.allowRead ?? []).map((p) => expandHome(p, home));
-  const envAllowRead = parseEnvList(env["BRAID_SCOPE_ALLOW_READ"]).map((p) => expandHome(p, home));
-  const flagAllowRead = (cfg.scopeFlags?.allowRead ?? []).map((p) => expandHome(p, home));
+  const opAllowRead = (scope.allowRead ?? []).map((p) => expandHome2(p, home));
+  const envAllowRead = parseEnvList(env["BRAID_SCOPE_ALLOW_READ"]).map((p) => expandHome2(p, home));
+  const flagAllowRead = (cfg.scopeFlags?.allowRead ?? []).map((p) => expandHome2(p, home));
   const rawAllowRead = [
     ...opAllowRead,
     ...envAllowRead,
@@ -2528,10 +2935,10 @@ Narrow the grant to a path outside the protected set. (Ancestor grants like "~"
       );
     }
     const writableDefaults = resolvePaths(
-      [...providerPaths, expandHome("~/.npm", home), tmpDir],
+      [...providerPaths, expandHome2("~/.npm", home), tmpDir],
       home
     );
-    const resolvedConfigDir = canonicalize(braidConfigDir);
+    const resolvedConfigDir = canonicalize2(braidConfigDir);
     const placement = checkGrantsAgainstReservations(
       [{ path: resolvedConfigDir, source: "BRAID_CONFIG_DIR" }],
       writableDefaults,
@@ -2562,10 +2969,15 @@ Narrow the grant to a path outside the protected set. (Ancestor grants like "~"
       return lines;
     }
     lines.push("[scope] Agent sandbox is ACTIVE");
-    lines.push(
-      `[scope] protected (never readable/writable by the agent): ${resolvePaths([...secretDirs, ...protectedConfigDirs], home).join(", ")}`
-    );
+    {
+      const configDirsShown = resolvePaths(protectedConfigDirs, home);
+      const credentialPaths = resolvePaths(secretDirs, home);
+      lines.push(
+        `[scope] protected (never readable/writable by the agent): ${configDirsShown.join(", ")}, + ${credentialPaths.length} credential paths incl. ${credentialPaths.slice(0, 2).join(", ")}, ...`
+      );
+    }
     lines.push(`[scope] cwd (writable): ${cwd}`);
+    lines.push(`[scope] file tools may read (readonly): ${cwd}${allowRead.length ? ", " + allowRead.join(", ") : ""}`);
     if (providerPaths.length > 0) {
       lines.push(`[scope] provider paths (writable): ${providerPaths.join(", ")}`);
     }
@@ -2602,7 +3014,7 @@ Narrow the grant to a path outside the protected set. (Ancestor grants like "~"
 // src/mcp/broker.ts
 import http from "http";
 import os from "os";
-import path2 from "path";
+import path3 from "path";
 import fs from "fs";
 import { randomUUID as randomUUID4, randomBytes } from "crypto";
 
@@ -3026,7 +3438,7 @@ function classifyCatchUp(messages, agentName, nowMs, opts) {
 import { createRemoteJWKSet, jwtVerify } from "jose";
 
 // src/cardSigning.ts
-import canonicalize2 from "canonicalize";
+import canonicalize3 from "canonicalize";
 import {
   FlattenedSign,
   flattenedVerify,
@@ -3083,7 +3495,7 @@ function pruneForSigning(card) {
   return pruneNode(clone, REQUIRED_TOP);
 }
 function canonicalCardString(card) {
-  return canonicalize2(pruneForSigning(card));
+  return canonicalize3(pruneForSigning(card));
 }
 function publicOkpJwk(jwk) {
   return { kty: jwk.kty, crv: jwk.crv, x: jwk.x };
@@ -3403,8 +3815,8 @@ var RelayClient = class {
    *  boundedJsonFetch. All relay HTTP call sites route through this. Never throws (returns
    *  a BoundedJsonResult union). Plain-object fetch doubles ({ok,status,json}) are supported
    *  by the underlying helper for test compatibility. */
-  httpJson(path4, opts) {
-    return boundedJsonFetch(`${this.cfg.relayHttpUrl}${path4}`, {
+  httpJson(path5, opts) {
+    return boundedJsonFetch(`${this.cfg.relayHttpUrl}${path5}`, {
       ...opts,
       headers: {
         Authorization: `Bearer ${this.cfg.token}`,
@@ -4151,7 +4563,18 @@ var RelayClient = class {
       candidates: Array.isArray(msg.candidates) ? msg.candidates.map((c) => untrusted(String(c ?? ""))) : void 0,
       history,
       // BL-126: server-minted attribution key — pure pass-through, never invented by bridge.
-      dispatchId: typeof msg.dispatchId === "string" && msg.dispatchId.length > 0 ? msg.dispatchId : void 0
+      dispatchId: typeof msg.dispatchId === "string" && msg.dispatchId.length > 0 ? msg.dispatchId : void 0,
+      // D14: additive Lisa Loop signal — pass-through, mostly untransformed. Absent
+      // on every non-lisa msg (msg.lisa undefined), so non-lisa signals are unaffected.
+      // Defensive shape-narrowing for parity with the sibling fields above: a
+      // malformed lisa (string/null/array) is dropped rather than passed through raw.
+      // Review Minor 1 (T11 final wave): freshSession is ROUTING-relevant (D13 — it
+      // decides whether the turn runs on the ephemeral one-shot session at all), so
+      // unlike the other (display-only) lisa fields it is coerced to a STRICT boolean
+      // here rather than passed through raw. A relay drift like `freshSession:"false"`
+      // (string) is truthy in JS and would otherwise wrongly route to the ephemeral
+      // path; `=== true` makes anything but the literal boolean true resolve false.
+      lisa: typeof msg.lisa === "object" && msg.lisa !== null && !Array.isArray(msg.lisa) ? { ...msg.lisa, freshSession: msg.lisa.freshSession === true } : void 0
     };
     this.flowCbs.forEach((cb) => cb(signal));
   }
@@ -4611,9 +5034,9 @@ var RelayClient = class {
   // ── End private memory lane ───────────────────────────────────────────────────
   // ── Task board ──────────────────────────────────────────────────────────────
   /** Shared helper: fetch to a task endpoint and return {ok, status, json}. Callers surface errors. */
-  async taskFetch(method, path4, body) {
+  async taskFetch(method, path5, body) {
     const bodyStr = body === void 0 ? void 0 : JSON.stringify(body);
-    const r = await this.httpJson(path4, { method, body: bodyStr, requestClass: "relay.task" });
+    const r = await this.httpJson(path5, { method, body: bodyStr, requestClass: "relay.task" });
     return { ok: r.ok, status: r.ok ? r.status : r.status ?? 0, json: r.ok ? r.json : r.json };
   }
   async createTask(channelId, title, description) {
@@ -4670,7 +5093,7 @@ var RelayClient = class {
    *  guard so malformed JSON is rejected with a clear error before any fetch call.
    *  Byte-parity contract: the EXACT docJson string is embedded as the "doc" value
    *  so what the bridge signs and what the relay stores are identical bytes. */
-  async artifactWriteFetch(method, path4, docJson, extraFields) {
+  async artifactWriteFetch(method, path5, docJson, extraFields) {
     try {
       JSON.parse(docJson);
     } catch (e) {
@@ -4678,7 +5101,7 @@ var RelayClient = class {
     }
     const extras = JSON.stringify(extraFields);
     const body = `{"doc":${docJson},${extras.slice(1)}`;
-    const r = await this.httpJson(path4, { method, body, requestClass: "relay.artifact.write" });
+    const r = await this.httpJson(path5, { method, body, requestClass: "relay.artifact.write" });
     return { ok: r.ok, status: r.ok ? r.status : r.status ?? 0, json: r.ok ? r.json : r.json };
   }
   /** Try to produce an artifact signature. Fail-open: returns undefined on any error. */
@@ -4744,9 +5167,9 @@ var RelayClient = class {
   // attributed by the relay's own authenticated caller identity.
   /** Shared helper for canvas calls: same {ok,status,json} shape as taskFetch,
    *  under its own requestClass so canvas HTTP metrics are distinguishable. */
-  async canvasFetch(method, path4, body) {
+  async canvasFetch(method, path5, body) {
     const bodyStr = body === void 0 ? void 0 : JSON.stringify(body);
-    const r = await this.httpJson(path4, { method, body: bodyStr, requestClass: "relay.canvas" });
+    const r = await this.httpJson(path5, { method, body: bodyStr, requestClass: "relay.canvas" });
     return { ok: r.ok, status: r.ok ? r.status : r.status ?? 0, json: r.ok ? r.json : r.json };
   }
   async getCanvas(channelId) {
@@ -4818,7 +5241,7 @@ var RelayClient = class {
   /** Post a bounded-flow reply (turn or synthesis) to the flow-scoped endpoint.
    *  agentId MUST be the agent NAME — the relay's flow gate resolves turn ownership and
    *  synthesis role via resolveAgentUUID (a name lookup); a UUID resolves to uuid.Nil -> 403. */
-  async postFlowMessage(channelId, flowId, content, usage, dispatchId) {
+  async postFlowMessage(channelId, flowId, content, usage, dispatchId, lisaFresh) {
     const ch = this.pathId(channelId, "channelId");
     const fl = this.pathId(flowId, "flowId");
     if (!ch || !fl) return;
@@ -4837,6 +5260,10 @@ var RelayClient = class {
       // BL-126: echo the server-minted attribution key unchanged. Never invented here.
       ...dispatchId ? { dispatchId } : {},
       ...signature ? { signature } : {},
+      // D13: additive marker for a lisa fresh-session (ephemeral one-shot) turn's
+      // reply. Sent ONLY on lisa turns (true); every other flow reply omits the field
+      // entirely, byte-identical to the pre-lisa body shape.
+      ...lisaFresh ? { lisaFresh: true } : {},
       ...this.usageBody(usage)
     });
     const r = await this.httpJson(`/channels/${ch}/flows/${fl}/messages`, {
@@ -5041,13 +5468,13 @@ var REFLECTION_REQUIRED_FIELDS = ["stage", "failure_family", "impacted_unit", "p
 var REFLECTION_CLUSTER_FIELDS = ["stage", "failure_family", "impacted_unit"];
 var VALID_NOTE_KINDS = /* @__PURE__ */ new Set(["note", ...STRUCTURED_NOTE_KINDS]);
 function brokerSocketDir() {
-  return path2.join(os.tmpdir(), "braid-broker");
+  return path3.join(os.tmpdir(), "braid-broker");
 }
 function brokerSocketPath(uuid, platform = process.platform) {
   if (platform === "win32") {
     return `\\\\.\\pipe\\braid-broker-${uuid}`;
   }
-  return path2.join(brokerSocketDir(), `${uuid}.sock`);
+  return path3.join(brokerSocketDir(), `${uuid}.sock`);
 }
 var SourceBroker = class {
   /** `platform` injected so the win32 named-pipe branch is unit-testable on a POSIX host
@@ -5092,6 +5519,16 @@ var SourceBroker = class {
     });
     return { socketPath: this.socketPath, token: this.token };
   }
+  // G2 (lisa loop, D13 review Minor 3): the ephemeral one-shot lisa session (a blind
+  // critic or builder round) inherits this SAME per-channel broker's MCP tools via the
+  // startOpts replay in ChannelSession.runLisaFreshTurn (session.ts). That is safe
+  // TODAY only because NO route below reads channel/flow MESSAGES (only sources,
+  // reactions, notes, memory, tasks, artifacts, canvas). If a future route is added
+  // here that reads channel or flow messages, it MUST be gated off lisa turns (or
+  // otherwise structurally blocked from the ephemeral session) — reachable from a
+  // blind critic, it would silently leak the transcript the relay's read-filter is
+  // deliberately withholding (D9/G2b) and defeat critic blindness. Do not add a
+  // channel/flow message-read route here without addressing this.
   async handle(req, res) {
     const send = (status, body2) => {
       const s = JSON.stringify(body2);
@@ -5376,7 +5813,7 @@ function grantSrtWinRunnerRX(deps) {
     return;
   }
   const systemRoot = deps?.systemRoot ?? process.env["SystemRoot"] ?? "C:\\Windows";
-  const icacls = path3.win32.join(systemRoot, "System32", "icacls.exe");
+  const icacls = path4.win32.join(systemRoot, "System32", "icacls.exe");
   const spawnFn = deps?.spawnSync ?? ((cmd, args) => nodeSpawnSync2(cmd, args, { shell: false }));
   const result = spawnFn(icacls, [runnerPath, "/grant", "sandbox-runtime-users:(RX)"]);
   if (result.status !== 0) {
@@ -5392,7 +5829,7 @@ function brokerSocketNetworkExtras() {
     const dir = brokerSocketDir();
     const subpaths = [dir];
     try {
-      const resolved = path3.join(realpathSync2(path3.dirname(dir)), path3.basename(dir));
+      const resolved = path4.join(realpathSync4(path4.dirname(dir)), path4.basename(dir));
       if (resolved !== dir) subpaths.push(resolved);
     } catch {
     }
@@ -5568,7 +6005,7 @@ function formatRateLimitNotice(agentName, provider, message) {
 
 // src/adapter.ts
 function defaultToolPolicy() {
-  return { mode: "readonly", configDirAbs: resolve2(configDir(process.env)) };
+  return { mode: "readonly", configDirAbs: resolve2(configDir(process.env)), allowReadAbs: [] };
 }
 var ADAPTER_VERSIONS = {
   // Chosen 2026-06-11 (latest verified releases at pin time).
@@ -5588,13 +6025,13 @@ function pinned(pkg) {
 function computeNpxLaunch(platform, execPath, exists) {
   const nodeDir = dirname3(execPath);
   if (platform === "win32") {
-    const npxCliJs = join5(nodeDir, "node_modules", "npm", "bin", "npx-cli.js");
+    const npxCliJs = join6(nodeDir, "node_modules", "npm", "bin", "npx-cli.js");
     if (exists(npxCliJs)) {
       return { command: execPath, argsPrefix: [npxCliJs] };
     }
   }
   for (const name of ["npx", "npx.cmd"]) {
-    const candidate = join5(nodeDir, name);
+    const candidate = join6(nodeDir, name);
     if (exists(candidate)) {
       return { command: candidate, argsPrefix: [] };
     }
@@ -5617,7 +6054,7 @@ function which(cmd, pathEnv = process.env.PATH ?? "", platform = process.platfor
   const name = platform === "win32" && !cmd.toLowerCase().endsWith(".exe") ? `${cmd}.exe` : cmd;
   for (const dir of pathEnv.split(delimiter)) {
     if (!dir) continue;
-    const candidate = join5(dir, name);
+    const candidate = join6(dir, name);
     try {
       accessSync(candidate, constants.X_OK);
       if (statSync2(candidate).isFile()) return resolve2(candidate);
@@ -5745,11 +6182,11 @@ function launchSpecFor(agent) {
   }
 }
 function handoffFallbackDirs(name, home) {
-  const dirs = [join5(home, ".local", "bin")];
-  if (name === "claude") dirs.push(join5(home, ".claude", "local"));
+  const dirs = [join6(home, ".local", "bin")];
+  if (name === "claude") dirs.push(join6(home, ".claude", "local"));
   return dirs;
 }
-function findHandoffBinary(name, pathEnv = process.env.PATH ?? "", home = homedir4(), platform = process.platform) {
+function findHandoffBinary(name, pathEnv = process.env.PATH ?? "", home = homedir5(), platform = process.platform) {
   const onPath = which(name, pathEnv, platform);
   if (onPath) return onPath;
   return which(name, handoffFallbackDirs(name, home).join(delimiter), platform);
@@ -5913,6 +6350,16 @@ var AcpAdapter = class {
         this.noticeCbs.push(cb);
       },
       converseLocal: (text, overrideMode) => this.converseLocal(text, overrideMode),
+      // Review Minor 3: converseLocalWithUsage is exposed ONLY on a NO-PERSISTENCE
+      // (ephemeral, one-shot) construction — this.session undefined is the exact
+      // invariant D13 already encodes (no persistence wired => AcpClient.start()'s
+      // newSession path). A WARM adapter (session wired, e.g. createAdapter(cfg,
+      // channelId)) never gets this method on its AgentSession at all, so a future
+      // warm caller cannot silently advance the channel's disk-backed cumulative
+      // cost baseline — the method simply does not exist to call.
+      ...this.session ? {} : {
+        converseLocalWithUsage: (text, overrideMode) => this.converseLocalWithUsage(text, overrideMode)
+      },
       stop: async () => {
         this.stopped = true;
         await this.client?.stop();
@@ -5960,6 +6407,22 @@ var AcpAdapter = class {
       return `[braid] local turn failed: ${err?.message ?? String(err)}`;
     }
   }
+  /**
+   * D13/D20: like converseLocal, but for a lisa fresh-session (ephemeral one-shot)
+   * turn — ALSO returns usage, converted via this.usageSource (for the ephemeral
+   * construction path, an isolated non-persisted source; see createEphemeralLisaAdapter).
+   * Deliberately does NOT swallow errors into an error-string reply: a lisa turn that
+   * fails must fail loudly (nothing posts to the flow), never post a garbled
+   * "local turn failed" string as though it were a real builder/critic report.
+   */
+  async converseLocalWithUsage(text, overrideMode) {
+    const client = this.client;
+    if (!client || this.stopped || this.gaveUp || this.handoffPaused) {
+      throw new Error("[braid] agent unavailable for local conversation");
+    }
+    const result = await client.submit(text, overrideMode);
+    return { text: result.text, usage: this.usageSource?.forTurn(result.usage) };
+  }
   /**
    * Run one real channel turn against the warm session. On a turn that fails because
    * the subprocess crashed, supervise a restart (single-flight, capped) and best-effort
@@ -6205,17 +6668,20 @@ var ClaudeAdapter = class {
         permissionMode: "default",
         canUseTool: async (toolName, toolInput) => {
           const mode = overrideQueue[0] ?? policy.mode;
-          const verdict = evaluateSdkTool(mode, policy.configDirAbs, toolName, toolInput);
+          const verdict = evaluateSdkTool(mode, policy.configDirAbs, toolName, toolInput, {
+            cwd: process.cwd(),
+            allowRead: policy.allowReadAbs ?? []
+          });
           if (verdict.allow) return { behavior: "allow", updatedInput: toolInput };
           console.warn(`[braid] denied agent tool use: ${sanitizeForTty(verdict.reason)}`);
           this.telemetry?.captureBridgeEvent("tool_call_blocked", {
             tool: toolName,
             mode,
             path: "sdk",
-            reason: verdict.deniedByMode ? "mode" : "tripwire"
+            reason: verdict.deniedByScope ? "scope" : verdict.deniedByMode ? "mode" : "tripwire"
           });
           if (verdict.deniedByMode) {
-            const hint = takeDenialHint(policy);
+            const hint = takeDenialHint(policy, "operator", verdict.deniedByScope ? "scope" : "mode", process.cwd());
             if (hint) console.warn(sanitizeForTty(hint));
           }
           return { behavior: "deny", message: verdict.reason };
@@ -6262,13 +6728,31 @@ var ClaudeAdapter = class {
     };
   }
 };
-function createAdapter(cfg, channelId, telemetry) {
+function safeAllowRead(cfg) {
+  try {
+    return resolveScope(cfg, cfg.agent, process.env).runtimeConfig.filesystem.allowRead;
+  } catch {
+    return [];
+  }
+}
+function acpPolicyAndClientFactory(cfg, telemetry) {
   const policy = {
     mode: cfg.toolMode,
     configDirAbs: resolve2(configDir(process.env)),
-    agentName: cfg.agentName
+    agentName: cfg.agentName,
     // for the once-per-process "braid tools full <name>" denial hint
+    allowReadAbs: safeAllowRead(cfg)
   };
+  const makeClient = (launch) => new AcpClient(
+    launch,
+    (l) => scopedLaunch(l, cfg, cfg.agent),
+    afterChildExit,
+    telemetry
+  );
+  return { policy, makeClient };
+}
+function createAdapter(cfg, channelId, telemetry) {
+  const { policy, makeClient } = acpPolicyAndClientFactory(cfg, telemetry);
   if (cfg.agentMode !== "acp") return new ClaudeAdapter(policy, telemetry);
   if (channelId) {
     const prev = detectProviderSwitch(configDir(process.env), cfg.relayWsUrl, cfg.agentName, channelId, cfg.agent);
@@ -6288,14 +6772,13 @@ function createAdapter(cfg, channelId, telemetry) {
   }
   const session = channelId ? makeSessionPersistence(cfg, channelId) : void 0;
   const usageSource = channelId ? makeUsageSource(cfg, channelId) : void 0;
-  const makeClient = (launch) => new AcpClient(
-    launch,
-    (l) => scopedLaunch(l, cfg, cfg.agent),
-    afterChildExit,
-    telemetry
-  );
   return new AcpAdapter(cfg.agent, makeClient, void 0, policy, session, usageSource, cfg.agentName, cfg.stripEnvKeys, cfg.fallbackModel);
 }
+function createEphemeralLisaAdapter(cfg, telemetry) {
+  const { policy, makeClient } = acpPolicyAndClientFactory(cfg, telemetry);
+  const usageSource = makeEphemeralUsageSource(cfg);
+  return new AcpAdapter(cfg.agent, makeClient, void 0, policy, void 0, usageSource, cfg.agentName, cfg.stripEnvKeys, cfg.fallbackModel);
+}
 function makeSessionPersistence(cfg, channelId) {
   const dir = configDir(process.env);
   return {
@@ -6326,6 +6809,22 @@ function makeUsageSource(cfg, channelId) {
     saveBaseline: (cumulative, currency) => updateStoredCost(dir, cfg.relayWsUrl, cfg.agentName, channelId, cumulative, currency, cfg.agent)
   });
 }
+function makeEphemeralUsageSource(cfg) {
+  return new AcpUsageSource({
+    model: cfg.model,
+    provider: cfg.agent,
+    authMode: effectiveUsageAuthMode({
+      agent: cfg.agent,
+      agentMode: cfg.agentMode,
+      authMode: cfg.authMode ?? "auto",
+      env: process.env,
+      hasSubscriptionLogin: detectSubscriptionLogin(process.env)
+    }),
+    loadBaseline: () => void 0,
+    saveBaseline: () => {
+    }
+  });
+}
 
 // src/providerPrompt.ts
 var PROVIDER_LABELS = {
@@ -6460,7 +6959,7 @@ function detectSubscriptionLogin(env) {
       return void 0;
     }
   };
-  const home = env.HOME?.trim() || homedir5();
+  const home = env.HOME?.trim() || homedir6();
   return hasSubscriptionLogin(env, readText, home, keychainProbeFor(home));
 }
 function isHttpsOrLocalhostUrl(s) {
@@ -6874,7 +7373,7 @@ function parseClaudeConfigModel(jsonText) {
 function readClaudeConfigModel(agent) {
   if (agent !== "claude-code") return null;
   try {
-    const text = readFileSync3(join6(homedir5(), ".claude.json"), "utf8");
+    const text = readFileSync3(join7(homedir6(), ".claude.json"), "utf8");
     return parseClaudeConfigModel(text);
   } catch {
     return null;
@@ -7164,6 +7663,7 @@ export {
   acquireAgentLock,
   pinEndpoint,
   updateAgentWorkspace,
+  isFilesystemRoot,
   narrowestMode,
   narrowestOverride,
   toolModeLabel,
@@ -7191,6 +7691,7 @@ export {
   interactiveHandoffSupported,
   interactiveResumeSpecFor,
   createAdapter,
+  createEphemeralLisaAdapter,
   handoffCwdFor,
   PROVIDER_LABELS,
   chooseFirstRunProvider,