@tritard/waterbrother 0.8.6 → 0.8.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tritard/waterbrother",
-  "version": "0.8.6",
+  "version": "0.8.8",
   "description": "Waterbrother: Grok-powered coding CLI with local tools, sessions, operator modes, and approval controls",
   "type": "module",
   "bin": {

package/src/path-utils.js

@@ -8,6 +8,11 @@ const COMMON_HOME_ALIASES = new Map([
   ["/documents", path.join(os.homedir(), "Documents")]
 ]);
 
+const COMMON_HOME_PATHS = ["Desktop", "Downloads", "Documents"].map((name) => ({
+  lower: path.join(os.homedir(), name).toLowerCase(),
+  actual: path.join(os.homedir(), name)
+}));
+
 const COMMON_READ_ONLY_HOME_ROOTS = ["Desktop", "Downloads", "Documents"].map((name) => path.join(os.homedir(), name));
 
 function isWithinPath(rootPath, targetPath) {
@@ -35,6 +40,10 @@ function canonicalizePath(targetPath) {
   return path.join(canonicalParent, path.basename(resolved));
 }
 
+export function canonicalizeLoosePath(targetPath) {
+  return canonicalizePath(expandHomePath(targetPath || "."));
+}
+
 function isAllowedReadOnlyHomePath(targetPath) {
   return COMMON_READ_ONLY_HOME_ROOTS.some((rootPath) => isWithinPath(rootPath, targetPath));
 }
@@ -58,15 +67,20 @@ export function expandHomePath(inputPath) {
       return path.join(replacement, raw.slice(prefix.length + 1));
     }
   }
+  for (const { lower, actual } of COMMON_HOME_PATHS) {
+    if (lowered === lower) return actual;
+    if (lowered.startsWith(`${lower}/`)) {
+      return path.join(actual, raw.slice(lower.length + 1));
+    }
+  }
   if (raw === "~") return os.homedir();
   if (raw.startsWith("~/")) return path.join(os.homedir(), raw.slice(2));
   return raw;
 }
 
 export function resolveSandboxPath(baseDir, targetPath, allowOutsideCwd = false, options = {}) {
-  const expanded = expandHomePath(targetPath || ".");
   const baseReal = canonicalizePath(baseDir);
-  const resolved = canonicalizePath(path.resolve(baseReal, expanded));
+  const resolved = canonicalizePath(path.resolve(baseReal, expandHomePath(targetPath || ".")));
   if (!allowOutsideCwd) {
     const rel = path.relative(baseReal, resolved);
     const outside = rel.startsWith("..") || path.isAbsolute(rel);

package/src/tools.js

@@ -5,7 +5,7 @@ import crypto from "node:crypto";
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
 import { normalizeAutonomyMode, normalizeExperienceMode } from "./modes.js";
-import { expandHomePath, resolveSandboxPath } from "./path-utils.js";
+import { canonicalizeLoosePath, expandHomePath, resolveSandboxPath } from "./path-utils.js";
 import { promptKeyChoice, promptLine } from "./prompt.js";
 import { McpManager } from "./mcp.js";
 
@@ -416,7 +416,11 @@ function normalizePathPattern(value) {
   const raw = String(value || "").trim();
   if (!raw) return "";
   const expanded = expandHomePath(raw);
-  return String(expanded).replace(/^\.\//, "").replace(/\\/g, "/");
+  const text = String(expanded);
+  const normalized = (text.startsWith("/") || raw.startsWith("~"))
+    ? canonicalizeLoosePath(text)
+    : text;
+  return String(normalized).replace(/^\.\//, "").replace(/\\/g, "/");
 }
 
 function looksLikeMutatingShellCommand(command) {
@@ -1036,7 +1040,11 @@ export function createToolRuntime({
   function contractAllows(toolName, args = {}) {
     if (!currentTurn.contract) return { ok: !toolRequiresContract(toolName, args), reason: "No active contract" };
     const touchedPaths = getTouchedPathsForTool(toolName, args);
-    if (touchedPaths.length > 0 && !touchedPaths.every((item) => matchesAnyPattern(item, currentTurn.contract.paths))) {
+    const allowedPaths = normalizePathList([
+      ...(Array.isArray(currentTurn.contract.paths) ? currentTurn.contract.paths : []),
+      ...getCurrentWriteRoots()
+    ]);
+    if (touchedPaths.length > 0 && !touchedPaths.every((item) => matchesAnyPattern(item, allowedPaths))) {
       return { ok: false, reason: `Action outside declared contract scope: ${touchedPaths.join(", ")}` };
     }
     if (toolName === "run_shell") {
@@ -2201,6 +2209,7 @@ ${clipped}`;
   function beginTurn() {
     checkpointCreatedThisTurn = false;
     currentReadOnlyRoots = [];
+    currentWriteRoots = [];
     currentTurn = buildDefaultTurnRecord();
   }