@vellumai/assistant 0.4.55 → 0.4.57

package/src/tools/shared/shell-output.ts

@@ -9,7 +9,7 @@ export interface ShellOutputResult {
 /**
  * Format the raw stdout/stderr/exit-code from a spawned shell command into the
  * final tool result.  Both `shell.ts` (sandbox bash) and `host-shell.ts`
- * (host_bash) must produce identical output formatting — this shared function
+ * (host_bash) must produce identical output formatting - this shared function
  * is the single source of truth for that logic.
  */
 export function formatShellOutput(

package/src/tools/side-effects.ts

@@ -1,7 +1,7 @@
-// Side-effect tool classification — single source of truth.
+// Side-effect tool classification - single source of truth.
 // Tools that modify state outside the assistant (filesystem writes,
 // shell commands, network requests that trigger actions, etc.).
-// Used by private-thread gating and permission simulation to decide
+// Used by private-conversation gating and permission simulation to decide
 // whether a tool invocation requires explicit approval.
 
 const SIDE_EFFECT_TOOLS: ReadonlySet<string> = new Set([
@@ -26,6 +26,7 @@ const SIDE_EFFECT_TOOLS: ReadonlySet<string> = new Set([
   "schedule_create",
   "schedule_update",
   "schedule_delete",
+  "manage_secure_command_tool",
 ]);
 
 /**

package/src/tools/skills/execute.ts

@@ -27,7 +27,7 @@ export class SkillExecuteTool implements Tool {
             description:
               "Tool-specific parameters as documented in the skill's instructions",
           },
-          reason: {
+          activity: {
             type: "string",
             description:
               "Brief non-technical explanation of what you are doing and why, shown to the user as a status update.",

package/src/tools/skills/load.ts

@@ -5,7 +5,11 @@ import { isAssistantFeatureFlagEnabled } from "../../config/assistant-feature-fl
 import { getConfig } from "../../config/loader.js";
 import { skillFlagKey } from "../../config/skill-state.js";
 import type { SkillSummary, SkillToolManifest } from "../../config/skills.js";
-import { loadSkillBySelector, loadSkillCatalog } from "../../config/skills.js";
+import {
+  listReferenceFiles,
+  loadSkillBySelector,
+  loadSkillCatalog,
+} from "../../config/skills.js";
 import { RiskLevel } from "../../permissions/types.js";
 import type { ToolDefinition } from "../../providers/types.js";
 import {
@@ -109,7 +113,7 @@ function formatToolSchemas(
 export class SkillLoadTool implements Tool {
   name = "skill_load";
   description =
-    "Load full instructions for a configured skill from ~/.vellum/workspace/skills.";
+    "Load full instructions for a skill. Works for both bundled skills (listed in the catalog) and workspace skills in ~/.vellum/workspace/skills.";
   category = "skills";
   defaultRiskLevel = RiskLevel.Low;
 
@@ -245,7 +249,7 @@ export class SkillLoadTool implements Tool {
         catalogIndex = indexCatalogById(catalog);
       }
 
-      // Validate (fail-closed — catches genuinely missing deps + cycles)
+      // Validate (fail-closed - catches genuinely missing deps + cycles)
       const validation = validateIncludes(skill.id, catalogIndex);
       if (!validation.ok) {
         if (validation.error === "missing") {
@@ -277,6 +281,9 @@ export class SkillLoadTool implements Tool {
 
     const body = skill.body.length > 0 ? skill.body : "(No body content)";
 
+    // Build reference file listing (if any)
+    const referenceListing = listReferenceFiles(skill.directoryPath);
+
     // Load tool schemas for the main skill
     const mainManifest = loadToolManifest(skill.directoryPath);
     const toolSchemasSection = mainManifest
@@ -300,7 +307,7 @@ export class SkillLoadTool implements Tool {
           continue;
 
         childLines.push(
-          `  - ${child.id}: ${child.displayName} — ${child.description} (${child.skillFilePath})`,
+          `  - ${child.id}: ${child.displayName} - ${child.description} (${child.skillFilePath})`,
         );
 
         // Load the included skill's body content
@@ -310,6 +317,12 @@ export class SkillLoadTool implements Tool {
             `--- Included Skill: ${childLoaded.skill.displayName} (${childId}) ---\n${childLoaded.skill.body}`,
           );
 
+          // List reference files for the included skill
+          const childRefs = listReferenceFiles(childLoaded.skill.directoryPath);
+          if (childRefs) {
+            includedBodies.push(childRefs);
+          }
+
           // Load tool schemas for the included skill (lighter sub-heading)
           const childManifest = loadToolManifest(
             childLoaded.skill.directoryPath,
@@ -378,6 +391,7 @@ export class SkillLoadTool implements Tool {
         "",
         body,
         "",
+        ...(referenceListing ? [referenceListing, ""] : []),
         ...(toolSchemasSection ? [toolSchemasSection, ""] : []),
         ...(!toolSchemasSection && anyChildHasTools
           ? [

package/src/tools/skills/sandbox-runner.ts

@@ -152,7 +152,6 @@ function spawnRunner(
     // Pass a serializable subset of context to the subprocess
     env.__SKILL_CONTEXT_JSON = JSON.stringify({
       workingDir: context.workingDir,
-      sessionId: context.sessionId,
       conversationId: context.conversationId,
     });
 
@@ -205,7 +204,7 @@ function spawnRunner(
         return;
       }
 
-      // No structured result — fall back to raw output
+      // No structured result - fall back to raw output
       if (code !== 0) {
         const truncatedStderr =
           stderr.length > MAX_OUTPUT_CHARS
@@ -262,7 +261,7 @@ function parseSkillResult(
         }
       }
     } catch {
-      // malformed line — keep scanning
+      // malformed line - keep scanning
     }
     searchFrom = lineStart;
   }
@@ -286,7 +285,7 @@ function parseSkillResult(
         };
       }
     } catch {
-      // malformed line — keep scanning
+      // malformed line - keep scanning
     }
     searchFrom = lineStart;
   }

package/src/tools/skills/scaffold-managed.ts

@@ -92,14 +92,6 @@ export async function executeScaffoldManagedSkill(
       typeof input.emoji === "string"
         ? sanitizeFrontmatterValue(input.emoji)
         : undefined,
-    userInvocable:
-      typeof input.user_invocable === "boolean"
-        ? input.user_invocable
-        : undefined,
-    disableModelInvocation:
-      typeof input.disable_model_invocation === "boolean"
-        ? input.disable_model_invocation
-        : undefined,
     overwrite: input.overwrite === true,
     addToIndex: input.add_to_index !== false,
     includes,

package/src/tools/subagent/abort.ts

@@ -17,7 +17,7 @@ export async function executeSubagentAbort(
   const aborted = manager.abort(
     subagentId,
     sendToClient as ((msg: unknown) => void) | undefined,
-    context.sessionId,
+    context.conversationId,
     { suppressNotification: true },
   );
 

package/src/tools/subagent/message.ts

@@ -17,9 +17,9 @@ export async function executeSubagentMessage(
 
   const manager = getSubagentManager();
 
-  // Ownership check: only the parent session can message a subagent.
+  // Ownership check: only the parent conversation can message a subagent.
   const state = manager.getState(subagentId);
-  if (!state || state.config.parentSessionId !== context.sessionId) {
+  if (!state || state.config.parentConversationId !== context.conversationId) {
     return {
       content: `Could not send message to subagent "${subagentId}". It may not exist or be in a terminal state.`,
       isError: true,

package/src/tools/subagent/read.ts

@@ -20,8 +20,8 @@ export async function executeSubagentRead(
     };
   }
 
-  // Ownership check: only the parent session can read a subagent's output.
-  if (state.config.parentSessionId !== context.sessionId) {
+  // Ownership check: only the parent conversation can read a subagent's output.
+  if (state.config.parentConversationId !== context.conversationId) {
     return {
       content: `No subagent found with ID "${subagentId}".`,
       isError: true,
@@ -44,7 +44,7 @@ export async function executeSubagentRead(
     };
   }
 
-  // Extract assistant messages only — that's the subagent's output.
+  // Extract assistant messages only - that's the subagent's output.
   const output: string[] = [];
   for (const msg of dbMessages) {
     if (msg.role !== "assistant") continue;

package/src/tools/subagent/spawn.ts

@@ -23,7 +23,7 @@ export async function executeSubagentSpawn(
     | undefined;
   if (!sendToClient) {
     return {
-      content: "No client connected — cannot spawn subagent.",
+      content: "No client connected - cannot spawn subagent.",
       isError: true,
     };
   }
@@ -31,7 +31,7 @@ export async function executeSubagentSpawn(
   try {
     const subagentId = await manager.spawn(
       {
-        parentSessionId: context.sessionId,
+        parentConversationId: context.conversationId,
         label,
         objective,
         context: extraContext,
@@ -45,7 +45,7 @@ export async function executeSubagentSpawn(
         subagentId,
         label,
         status: "pending",
-        message: `Subagent "${label}" spawned. You will be notified automatically when it completes or fails — do NOT poll subagent_status. Continue the conversation normally.`,
+        message: `Subagent "${label}" spawned. You will be notified automatically when it completes or fails - do NOT poll subagent_status. Continue the conversation normally.`,
       }),
       isError: false,
     };

package/src/tools/subagent/status.ts

@@ -10,7 +10,10 @@ export async function executeSubagentStatus(
 
   if (subagentId) {
     const state = manager.getState(subagentId);
-    if (!state || state.config.parentSessionId !== context.sessionId) {
+    if (
+      !state ||
+      state.config.parentConversationId !== context.conversationId
+    ) {
       return {
         content: `No subagent found with ID "${subagentId}".`,
         isError: true,
@@ -31,10 +34,13 @@ export async function executeSubagentStatus(
     };
   }
 
-  // List all subagents for this parent session.
-  const children = manager.getChildrenOf(context.sessionId);
+  // List all subagents for this parent conversation.
+  const children = manager.getChildrenOf(context.conversationId);
   if (children.length === 0) {
-    return { content: "No subagents found for this session.", isError: false };
+    return {
+      content: "No subagents found for this conversation.",
+      isError: false,
+    };
   }
 
   const summary = children.map((s) => ({

package/src/tools/swarm/delegate.ts

@@ -12,8 +12,8 @@ import type { Tool, ToolContext, ToolExecutionResult } from "../types.js";
 
 const log = getLogger("swarm-delegate");
 
-/** Tracks active swarm sessions to prevent nested invocation per-session. */
-const activeSessions = new Set<string>();
+/** Tracks active swarm conversations to prevent nested invocation per-conversation. */
+const activeConversations = new Set<string>();
 
 export const swarmDelegateTool: Tool = {
   name: "swarm_delegate",
@@ -73,17 +73,17 @@ export const swarmDelegateTool: Tool = {
       return { content: "Cancelled", isError: true };
     }
 
-    // Recursion guard — scoped to session so independent sessions are not blocked
-    const sessionKey = context.sessionId;
-    if (activeSessions.has(sessionKey)) {
+    // Recursion guard - scoped to conversation so independent conversations are not blocked
+    const conversationKey = context.conversationId;
+    if (activeConversations.has(conversationKey)) {
       return {
         content:
-          "Error: A swarm is already executing in this session. Nested swarm invocation is not allowed.",
+          "Error: A swarm is already executing in this conversation. Nested swarm invocation is not allowed.",
         isError: true,
       };
     }
 
-    activeSessions.add(sessionKey);
+    activeConversations.add(conversationKey);
     try {
       const limits = resolveSwarmLimits({
         maxWorkers: maxWorkersOverride ?? config.swarm.maxWorkers,
@@ -96,7 +96,7 @@ export const swarmDelegateTool: Tool = {
       // Generate plan
       context.onOutput?.("Planning task decomposition...\n");
       const planProvider = getFailoverProvider(
-        config.provider,
+        config.services.inference.provider,
         config.providerOrder,
       );
       const plan = await generatePlan({
@@ -125,11 +125,11 @@ export const swarmDelegateTool: Tool = {
       let synthesisProvider: typeof planProvider | undefined;
       try {
         synthesisProvider = getFailoverProvider(
-          config.provider,
+          config.services.inference.provider,
           config.providerOrder,
         );
       } catch {
-        // No provider available for synthesis — will use fallback
+        // No provider available for synthesis - will use fallback
       }
 
       const summary = await executeSwarm({
@@ -194,12 +194,12 @@ export const swarmDelegateTool: Tool = {
         isError: true,
       };
     } finally {
-      activeSessions.delete(sessionKey);
+      activeConversations.delete(conversationKey);
     }
   },
 };
 
-/** Clear all active sessions — only for testing. */
+/** Clear all active conversations - only for testing. */
 export function _resetSwarmActive(): void {
-  activeSessions.clear();
+  activeConversations.clear();
 }

package/src/tools/system/avatar-generator.ts

@@ -4,103 +4,76 @@ import { dirname, join } from "node:path";
 
 import { generateAvatar } from "../../media/avatar-router.js";
 import { mapGeminiError } from "../../media/gemini-image-service.js";
-import { RiskLevel } from "../../permissions/types.js";
-import type { ToolDefinition } from "../../providers/types.js";
 import { getLogger } from "../../util/logger.js";
 import { getWorkspaceDir } from "../../util/platform.js";
-import type { Tool, ToolContext, ToolExecutionResult } from "../types.js";
 
 const log = getLogger("avatar-generator");
 
-const TOOL_NAME = "set_avatar";
-
 /** Canonical path where the custom avatar PNG is stored. */
 function getAvatarPath(): string {
-  return join(getWorkspaceDir(), "data", "avatar", "custom-avatar.png");
+  return join(getWorkspaceDir(), "data", "avatar", "avatar-image.png");
 }
 
-export const setAvatarTool: Tool = {
-  name: TOOL_NAME,
-  description:
-    "Generate a custom avatar image from a text description. " +
-    "Saves the result as the assistant's avatar.",
-  category: "system",
-  defaultRiskLevel: RiskLevel.Low,
+export interface AvatarGenerationResult {
+  content: string;
+  isError: boolean;
+}
 
-  getDefinition(): ToolDefinition {
+/**
+ * Generate a custom avatar image from a text description and save it
+ * as the assistant's avatar PNG.
+ *
+ * Used by the HTTP route handler at POST /v1/settings/avatar/generate.
+ */
+export async function generateAndSaveAvatar(
+  description: string,
+): Promise<AvatarGenerationResult> {
+  if (typeof description !== "string" || description.trim() === "") {
     return {
-      name: TOOL_NAME,
-      description: this.description,
-      input_schema: {
-        type: "object",
-        properties: {
-          description: {
-            type: "string",
-            description:
-              "A text description of the desired avatar appearance, " +
-              'e.g. "a friendly purple cat with green eyes wearing a tiny hat".',
-          },
-        },
-        required: ["description"],
-      },
+      content: "Error: description is required and must be a non-empty string.",
+      isError: true,
     };
-  },
+  }
+
+  try {
+    log.info({ description: description.trim() }, "Generating avatar");
 
-  async execute(
-    input: Record<string, unknown>,
-    _context: ToolContext,
-  ): Promise<ToolExecutionResult> {
-    const description = input.description;
-    if (typeof description !== "string" || description.trim() === "") {
+    const prompt =
+      `Create an avatar image based on this description: ${description.trim()}\n\n` +
+      "Style: cute, friendly, work-safe illustration. " +
+      "Vibrant but soft colors. Simple and recognizable at small sizes (28px). " +
+      "Circular or rounded composition filling the canvas. " +
+      "Subtle background color (not white or transparent).";
+
+    const result = await generateAvatar(prompt);
+    if (!result.imageBase64) {
       return {
-        content:
-          "Error: description is required and must be a non-empty string.",
+        content: "Error: No image data returned. Please try again.",
         isError: true,
       };
     }
+    const pngBuffer = Buffer.from(result.imageBase64, "base64");
 
-    try {
-      log.info({ description: description.trim() }, "Generating avatar");
-
-      const prompt =
-        `Create an avatar image based on this description: ${description.trim()}\n\n` +
-        "Style: cute, friendly, work-safe illustration. " +
-        "Vibrant but soft colors. Simple and recognizable at small sizes (28px). " +
-        "Circular or rounded composition filling the canvas. " +
-        "Subtle background color (not white or transparent).";
+    const avatarPath = getAvatarPath();
+    const avatarDir = dirname(avatarPath);
 
-      const result = await generateAvatar(prompt);
-      if (!result.imageBase64) {
-        return {
-          content: "Error: No image data returned. Please try again.",
-          isError: true,
-        };
-      }
-      const pngBuffer = Buffer.from(result.imageBase64, "base64");
+    const tmpPath = `${avatarPath}.${randomUUID()}.tmp`;
+    mkdirSync(avatarDir, { recursive: true });
+    writeFileSync(tmpPath, pngBuffer);
+    renameSync(tmpPath, avatarPath);
 
-      const avatarPath = getAvatarPath();
-      const avatarDir = dirname(avatarPath);
+    log.info({ avatarPath }, "Avatar saved successfully");
 
-      const tmpPath = `${avatarPath}.${randomUUID()}.tmp`;
-      mkdirSync(avatarDir, { recursive: true });
-      writeFileSync(tmpPath, pngBuffer);
-      renameSync(tmpPath, avatarPath);
-
-      log.info({ avatarPath }, "Avatar saved successfully");
-
-      // Side-effect hook in tool-side-effects.ts broadcasts avatar_updated to all clients.
-
-      return {
-        content: "Avatar updated! Your new avatar will appear shortly.",
-        isError: false,
-      };
-    } catch (error) {
-      const message = mapGeminiError(error);
-      log.error({ error: message }, "Avatar generation failed");
-      return {
-        content: `Avatar generation failed: ${message}`,
-        isError: true,
-      };
-    }
-  },
-};
+    return {
+      content: "Avatar updated! Your new avatar will appear shortly.",
+      isError: false,
+    };
+  } catch (error) {
+    const message = mapGeminiError(error);
+    log.error({ error: message }, "Avatar generation failed");
+    return {
+      content: `Avatar generation failed: ${message}`,
+      isError: true,
+    };
+  }
+}

package/src/tools/system/request-permission.ts

@@ -53,8 +53,9 @@ const FRIENDLY_NAMES: Record<PermissionType, string> = {
 class RequestSystemPermissionTool implements Tool {
   name = "request_system_permission";
   description =
-    "Ask the user to grant a macOS system permission (e.g. Full Disk Access) via System Settings. " +
-    "Use this when a tool execution fails because of a TCC/permission error.";
+    "Ask the user to grant a macOS system permission via System Settings. " +
+    "Use when a tool fails with a permission/access error (e.g. 'Operation not permitted', 'EACCES', sandbox denial). " +
+    "Do not explain how to open System Settings manually - this tool handles it with a clickable button.";
   category = "system";
   defaultRiskLevel = RiskLevel.High;
 
@@ -70,13 +71,13 @@ class RequestSystemPermissionTool implements Tool {
             enum: [...PERMISSION_TYPES],
             description: "The macOS system permission to request",
           },
-          reason: {
+          activity: {
             type: "string",
             description:
               "Short explanation of why this permission is needed (shown to the user)",
           },
         },
-        required: ["permission_type", "reason"],
+        required: ["permission_type", "activity"],
       },
     };
   }

package/src/tools/terminal/backends/native.ts

@@ -21,24 +21,45 @@ const HASH_DISPLAY_LENGTH = 12;
  * - Allows write access only to the working directory and temp dirs
  * - Blocks outbound network access (unless proxied)
  * - Blocks process debugging (ptrace)
+ * - Optionally blocks read access to specific protected paths (CES lockdown)
  *
  * When `allowNetwork` is true the `(deny network*)` rule is replaced with
  * `(allow network*)` so the process can reach the local credential proxy.
  */
-function buildSandboxProfile(allowNetwork: boolean): string {
+function buildSandboxProfile(
+  allowNetwork: boolean,
+  denyReadPaths?: string[],
+): string {
   const networkRule = allowNetwork
-    ? ";; Allow network access (proxied mode — needed to reach the credential proxy)\n(allow network*)"
+    ? ";; Allow network access (proxied mode - needed to reach the credential proxy)\n(allow network*)"
     : ";; Block network access\n(deny network*)";
 
+  // Build deny-read rules for protected paths (CES shell lockdown).
+  // These are placed AFTER the allow file-read* rule because SBPL uses
+  // last-match-wins semantics - the more specific deny overrides the
+  // general allow.
+  const denyReadRules =
+    denyReadPaths && denyReadPaths.length > 0
+      ? "\n;; CES shell lockdown: block reads of protected credential/transport paths\n" +
+        denyReadPaths
+          .map(
+            (p) =>
+              `(deny file-read* (subpath "${escapeSBPL(p)}") (with no-log))`,
+          )
+          .join("\n")
+      : "";
+
   return `
 (version 1)
 (deny default)
 
 ;; Allow read access to the filesystem (tools, libraries, etc.)
 (allow file-read*)
+${denyReadRules}
 
 ;; Allow write access to the working directory and its children
 (allow file-write*
+  (literal "/dev/null")
   (subpath "__WORKING_DIR__")
   (subpath "/private/tmp")
   (subpath "/tmp")
@@ -90,21 +111,28 @@ function escapeSBPL(path: string): string {
  * a hash of the path) to avoid race conditions when concurrent commands
  * use different working directories.
  */
-function getProfilePath(workingDir: string, allowNetwork: boolean): string {
+function getProfilePath(
+  workingDir: string,
+  allowNetwork: boolean,
+  denyReadPaths?: string[],
+): string {
   const dir = join(process.env.HOME ?? "/tmp", ".vellum");
   if (!existsSync(dir)) {
     mkdirSync(dir, { recursive: true });
   }
-  // Include the network flag in the hash so proxied and non-proxied profiles
-  // for the same directory don't collide.
-  const hashInput = allowNetwork ? `${workingDir}:proxied` : workingDir;
+  // Include the network flag and deny-read paths in the hash so profiles
+  // with different configurations don't collide.
+  let hashInput = allowNetwork ? `${workingDir}:proxied` : workingDir;
+  if (denyReadPaths && denyReadPaths.length > 0) {
+    hashInput += `:deny-read:${denyReadPaths.sort().join(",")}`;
+  }
   const hash = createHash("sha256")
     .update(hashInput)
     .digest("hex")
     .slice(0, HASH_DISPLAY_LENGTH);
   const path = join(dir, `sandbox-profile-${hash}.sb`);
 
-  const profile = buildSandboxProfile(allowNetwork).replace(
+  const profile = buildSandboxProfile(allowNetwork, denyReadPaths).replace(
     /__WORKING_DIR__/g,
     () => escapeSBPL(workingDir),
   );
@@ -121,13 +149,13 @@ let bwrapAvailable = false;
 /**
  * Check whether bwrap is installed AND functional (can create namespaces).
  *
- * Just testing `bwrap --version` is not enough — the binary may exist but
+ * Just testing `bwrap --version` is not enough - the binary may exist but
  * namespace creation can be blocked by the kernel (e.g. inside containers
  * or when user namespaces are disabled). We run a minimal sandbox that
  * exercises all namespace types used by buildBwrapArgs() (mount, network,
  * PID) to verify end-to-end functionality.
  *
- * Only positive results are cached — if bwrap is unavailable, we re-check
+ * Only positive results are cached - if bwrap is unavailable, we re-check
  * on every call so that a mid-session install is picked up immediately.
  */
 function isBwrapAvailable(): boolean {
@@ -155,11 +183,13 @@ function isBwrapAvailable(): boolean {
  * - /dev bind-mounted for device access (needed by many tools)
  * - Network access blocked (--unshare-net)
  * - PID namespace isolated (--unshare-pid)
+ * - Optional tmpfs overlays on protected paths (CES lockdown)
  */
 function buildBwrapArgs(
   workingDir: string,
   command: string,
   allowNetwork: boolean,
+  denyReadPaths?: string[],
 ): string[] {
   const args = [
     // Filesystem: read-only root, writable working dir and temp
@@ -178,6 +208,15 @@ function buildBwrapArgs(
     "/proc",
   ];
 
+  // CES shell lockdown: overlay protected paths with empty tmpfs mounts
+  // so the subprocess cannot read credential data, bootstrap sockets, or
+  // toolstore contents. The tmpfs mount hides the real directory contents.
+  if (denyReadPaths && denyReadPaths.length > 0) {
+    for (const p of denyReadPaths) {
+      args.push("--tmpfs", p);
+    }
+  }
+
   // Only isolate the network namespace when network access is not needed.
   // In proxied mode the process must be able to reach 127.0.0.1:<proxy-port>.
   if (!allowNetwork) {
@@ -207,9 +246,10 @@ export class NativeBackend implements SandboxBackend {
     options?: WrapOptions,
   ): SandboxResult {
     const allowNetwork = options?.networkMode === "proxied";
+    const denyReadPaths = options?.denyReadPaths;
 
     if (isMacOS()) {
-      const profile = getProfilePath(workingDir, allowNetwork);
+      const profile = getProfilePath(workingDir, allowNetwork, denyReadPaths);
       return {
         command: "sandbox-exec",
         args: ["-f", profile, "bash", "-c", "--", command],
@@ -226,7 +266,7 @@ export class NativeBackend implements SandboxBackend {
       }
       return {
         command: "bwrap",
-        args: buildBwrapArgs(workingDir, command, allowNetwork),
+        args: buildBwrapArgs(workingDir, command, allowNetwork, denyReadPaths),
         sandboxed: true,
       };
     }