@xopcai/xopc 0.0.276 → 0.0.278

package/dist/src/agent/tools/apply-patch.js

@@ -1,9 +1,7 @@
-import { checkFileSafety } from "../prompt/safety.js";
-import { resolvePathUnderWorkspace } from "./tool-paths.js";
-import { evaluateFilePolicy } from "../sandbox/exec-policy.js";
+import { checkedFilePath, deleteWorkspaceFile, readWorkspaceFile, writeWorkspaceFile } from "../sandbox/fileAccess.js";
 import { detectLineEnding, generateDiffString, normalizeToLF, restoreLineEndings } from "./edit-diff.js";
-import { dirname, relative } from "node:path";
-import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { relative } from "node:path";
+import { stat } from "node:fs/promises";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/apply-patch.ts
 const ApplyPatchSchema = Type.Object({ patch: Type.String({ description: [
@@ -128,19 +126,11 @@ function applyHunks(original, hunks, path) {
 	}
 	return content;
 }
-async function readExisting(path) {
-	return readFile(path, "utf-8");
+async function readExisting(workspace, path) {
+	return readWorkspaceFile(workspace, path).toString("utf8");
 }
 async function assertWritable(workspace, path) {
-	const quick = checkFileSafety("write", path);
-	if (!quick.allowed) throw new Error(quick.message ?? `Cannot write ${path}`);
-	const policy = evaluateFilePolicy({
-		operation: "write",
-		path,
-		workspaceRoot: workspace
-	});
-	if (!policy.allowed) throw new Error(`Sandbox: ${policy.reason}`);
-	return resolvePathUnderWorkspace(path, workspace);
+	return checkedFilePath(workspace, path, "write");
 }
 async function pathExists(path) {
 	try {
@@ -178,7 +168,7 @@ async function buildPatchPlan(workspace, parsed) {
 		if (op.kind === "delete") {
 			const target = await assertWritable(workspace, op.path);
 			rememberTarget(target);
-			const oldContent = await readExisting(target);
+			const oldContent = await readExisting(workspace, target);
 			const diff = generateDiffString(oldContent, "", op.path);
 			const counts = countDiff(diff);
 			changes.push({
@@ -193,7 +183,7 @@ async function buildPatchPlan(workspace, parsed) {
 		}
 		const target = await assertWritable(workspace, op.path);
 		rememberTarget(target);
-		const oldContent = await readExisting(target);
+		const oldContent = await readExisting(workspace, target);
 		const lineEnding = detectLineEnding(oldContent);
 		const newContent = restoreLineEndings(applyHunks(normalizeToLF(oldContent), op.hunks, op.path), lineEnding);
 		const destination = op.moveTo ? await assertWritable(workspace, op.moveTo) : target;
@@ -217,33 +207,28 @@ async function buildPatchPlan(workspace, parsed) {
 	}
 	return changes;
 }
-async function commitPatchPlan(changes) {
+async function commitPatchPlan(workspace, changes) {
 	const committed = [];
 	try {
 		for (const change of changes) {
 			committed.push(change);
-			if (change.kind === "add") {
-				await mkdir(dirname(change.absolutePath), { recursive: true });
-				await writeFile(change.absolutePath, change.newContent ?? "", "utf-8");
-			} else if (change.kind === "delete") await rm(change.absolutePath);
+			if (change.kind === "add") writeWorkspaceFile(workspace, change.absolutePath, change.newContent ?? "");
+			else if (change.kind === "delete") deleteWorkspaceFile(workspace, change.absolutePath);
 			else {
 				const destination = change.absoluteMoveTo ?? change.absolutePath;
-				await mkdir(dirname(destination), { recursive: true });
-				await writeFile(destination, change.newContent ?? "", "utf-8");
-				if (destination !== change.absolutePath) await rm(change.absolutePath);
+				writeWorkspaceFile(workspace, destination, change.newContent ?? "");
+				if (destination !== change.absolutePath) deleteWorkspaceFile(workspace, change.absolutePath);
 			}
 		}
 	} catch (error) {
 		for (const change of committed.reverse()) try {
-			if (change.kind === "add") await rm(change.absolutePath, { force: true });
-			else if (change.kind === "delete") {
-				await mkdir(dirname(change.absolutePath), { recursive: true });
-				await writeFile(change.absolutePath, change.oldContent ?? "", "utf-8");
-			} else if (change.absoluteMoveTo) {
-				await rm(change.absoluteMoveTo, { force: true });
-				await mkdir(dirname(change.absolutePath), { recursive: true });
-				await writeFile(change.absolutePath, change.oldContent ?? "", "utf-8");
-			} else await writeFile(change.absolutePath, change.oldContent ?? "", "utf-8");
+			if (change.kind === "add") {
+				if (await pathExists(change.absolutePath)) deleteWorkspaceFile(workspace, change.absolutePath);
+			} else if (change.kind === "delete") writeWorkspaceFile(workspace, change.absolutePath, change.oldContent ?? "");
+			else if (change.absoluteMoveTo) {
+				if (await pathExists(change.absoluteMoveTo)) deleteWorkspaceFile(workspace, change.absoluteMoveTo);
+				writeWorkspaceFile(workspace, change.absolutePath, change.oldContent ?? "");
+			} else writeWorkspaceFile(workspace, change.absolutePath, change.oldContent ?? "");
 		} catch {}
 		throw error;
 	}
@@ -262,12 +247,14 @@ function createApplyPatchTool(workspace) {
 		finalGuardRelevant: true,
 		async execute(_toolCallId, params) {
 			try {
-				const changes = await buildPatchPlan(workspace, parsePatch(params.patch ?? ""));
-				await commitPatchPlan(changes);
+				const parsed = parsePatch(params.patch ?? "");
+				const canonicalWorkspace = checkedFilePath(workspace, workspace, "write");
+				const changes = await buildPatchPlan(canonicalWorkspace, parsed);
+				await commitPatchPlan(canonicalWorkspace, changes);
 				const diff = changes.map((change) => change.diff).join("\n");
 				const added = changes.reduce((sum, change) => sum + change.added, 0);
 				const removed = changes.reduce((sum, change) => sum + change.removed, 0);
-				const files = changes.map((change) => relative(workspace, change.absoluteMoveTo ?? change.absolutePath));
+				const files = changes.map((change) => relative(canonicalWorkspace, change.absoluteMoveTo ?? change.absolutePath));
 				const summary = changes.map((change) => {
 					const display = change.moveTo ? `${change.path} -> ${change.moveTo}` : change.path;
 					return `${change.kind}: ${display} (+${change.added}/-${change.removed})`;

package/dist/src/agent/tools/create-share-tool.js

@@ -1,16 +1,18 @@
 import { turnOutcomeKindFromFileName } from "../../../packages/gateway-contract/src/turn-outcome.js";
-import { resolvePathUnderWorkspace } from "./tool-paths.js";
 import { resolveGatewayEffectiveHost } from "../../config/gateway-bind.js";
+import { resolveReverseProxyPublicUrl } from "../../gateway/public-url.js";
+import { resolvePathUnderWorkspace } from "./tool-paths.js";
+import { assertWorkspaceTreeReadable, checkedFilePath } from "../sandbox/fileAccess.js";
 import { resolveShareConfig } from "../../share/share-config.js";
 import { mergeWithDefaults } from "../../share/site-share-config.js";
 import { getShareStore } from "../../share/share-store.js";
 import { getSiteShareStore } from "../../share/site-share-store.js";
 import { resolveShareUrl, resolveSiteShareUrl } from "../../share/share-url.js";
 import { publishHostedStaticSite } from "../../share/hosted-static-site-publish.js";
-import { resolveReverseProxyPublicUrl } from "../../gateway/public-url.js";
 import { audienceDefaults, decideShareKind, makeDescription, makeTitle, probeShareTarget, rememberStagedSite, stageSingleHtmlAsSite } from "../../share/share-auto.js";
 import { scheduleThumbnail } from "../../share/share-thumbnail.js";
 import { resolveToolLocale, shareToolErrorLine, shareToolSuccessLines } from "../../i18n/share-tool-bundle.js";
+import { relative } from "node:path";
 import { createHash } from "node:crypto";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/create-share-tool.ts
@@ -87,9 +89,15 @@ function createCreateShareTool(deps) {
 				reverseProxyPublicUrl: resolveReverseProxyPublicUrl(cfg)
 			};
 			const tokenHash = hashCreator(deps.getAgentId?.() ?? "agent-tool");
-			const absolutePath = resolvePathUnderWorkspace(p.filePath, workspace);
-			if (!absolutePath.startsWith(workspace)) return errorResult(locale, "File must be inside the agent workspace.");
-			const relPath = absolutePath === workspace ? "" : absolutePath.slice(workspace.length).replace(/^[\\/]+/, "").replace(/\\/g, "/");
+			let relPath;
+			try {
+				const root = checkedFilePath(workspace, workspace, "read");
+				const absolutePath = checkedFilePath(workspace, resolvePathUnderWorkspace(p.filePath, workspace), "read");
+				relPath = relative(root, absolutePath).replace(/\\/g, "/");
+				if (relPath) assertWorkspaceTreeReadable(workspace, absolutePath);
+			} catch (err) {
+				return errorResult(locale, `Cannot read target: ${err instanceof Error ? err.message : String(err)}`);
+			}
 			if (!relPath) return errorResult(locale, "Cannot share the workspace root itself.");
 			let probe;
 			try {

package/dist/src/agent/tools/delegate-tool.js

@@ -1,10 +1,10 @@
+import { runGit } from "../../execution-environments/git.js";
+import { LocalWorktreeManager } from "../../execution-environments/local-worktree-manager.js";
+import { SessionEnvironmentService } from "../../execution-environments/session-environment-service.js";
 import { readWorkspaceRevision } from "../coding/workspace-revision.js";
 import { EXTERNAL_TOOL_NAMES } from "../external-tools/gateway-tools.js";
 import "../external-tools/index.js";
 import { createDelegateChildHandle } from "../child-agent-factory.js";
-import { runGit } from "../../execution-environments/git.js";
-import { LocalWorktreeManager } from "../../execution-environments/local-worktree-manager.js";
-import { SessionEnvironmentService } from "../../execution-environments/session-environment-service.js";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/delegate-tool.ts
 const DEFAULT_DELEGATE_TOOLS = [

package/dist/src/agent/tools/exec-command.js

@@ -1,6 +1,6 @@
 import { commandRegistry, commandTimeout } from "../commands/command-registry.js";
-import { formatSize, truncateTail } from "./truncate.js";
 import { evaluateExecPolicy } from "../sandbox/exec-policy.js";
+import { formatSize, truncateTail } from "./truncate.js";
 import { publishArtifactPaths } from "./publish-artifacts.js";
 import { resolve } from "node:path";
 import { Type } from "@sinclair/typebox";
@@ -93,6 +93,7 @@ function createExecCommandTool(workspaceCwd, options) {
 			const policy = evaluateExecPolicy({
 				command,
 				cwd: requestedCwd,
+				workspaceRoot: workspaceCwd,
 				allowedEnvVars: options?.getSkillPassthroughEnvVarNames?.() ?? []
 			});
 			if (!policy.allowed) {

package/dist/src/agent/tools/executor.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { withRetry } from "../../infra/retry.js";
 import { commandTimeout } from "../commands/command-registry.js";
 import { DEFAULT_TOOL_EXECUTION_TIMEOUT_MS, TimeoutError, executeWithTimeout } from "../lifecycle/timeout-wrapper.js";
-import { withRetry } from "../../infra/retry.js";
 import { ToolConcurrencyController, resolveToolLockMode } from "./concurrency.js";
 //#region src/agent/tools/executor.ts
 init_logger();

package/dist/src/agent/tools/factory.js

@@ -7,15 +7,24 @@ import { getSessionMetadata } from "../../storage/sqlite/session-repository.js";
 import { getSessionTaskPlan, setSessionTaskPlan } from "../../storage/sqlite/session-task-plan-repository.js";
 import "../../storage/sqlite/index.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../agent-scope.js";
-import { resolveEffectiveAgentConfigForSession } from "../../config/agent-profile.js";
+import { BrowserRuntime } from "../../browser/runtime/browser-runtime.js";
 import "../../../packages/browser-control-contract/src/index.js";
-import { getEmbeddedExecutionRunId, getEmbeddedExecutionSession } from "../embedded/execution-context.js";
+import { createBrowserDriver } from "../../browser/drivers/create-driver.js";
+import { checkBrowserReadiness } from "../../browser/readiness.js";
+import "../../browser/index.js";
+import { mergeTtsConfigFromAppConfig } from "../../voice/tts/merge-config.js";
+import { resolveEffectiveAgentConfigForSession } from "../../config/agent-profile.js";
+import { createWorkflowCatalog } from "../workflow/catalog.js";
+import { buildRuntimeEnvironment } from "../../runtime-tools/environment.js";
+import { skillEnvironmentId } from "../skills/installer.js";
 import { wrapToolsWithProtection } from "./executor.js";
 import { EXTERNAL_TOOL_NAMES } from "../external-tools/gateway-tools.js";
-import { buildRuntimeEnvironment } from "../../runtime-tools/environment.js";
 import { createDefaultExternalToolGatewayTools } from "../external-tools/index.js";
+import { resolveUserContextSessionAccess } from "../../user-context/access-policy.js";
+import { getPendingTranscriptUserText } from "../inbound/attachment-pipeline.js";
+import { getEmbeddedExecutionRunId, getEmbeddedExecutionSession } from "../embedded/execution-context.js";
+import { createDelegateTool } from "./delegate-tool.js";
 import { createReadFileTool } from "./read.js";
-import { skillEnvironmentId } from "../skills/installer.js";
 import { createWriteFileTool } from "./write.js";
 import { createListDirTool } from "./list-dir.js";
 import { createPublishArtifactsTool } from "./publish-artifacts.js";
@@ -38,12 +47,6 @@ import { createUpdatePlanTool } from "./update-plan-tool.js";
 import { createSessionStatusTool } from "./session-status-tool.js";
 import { createMemoryMaintenanceTool } from "./memory-maintenance-tool.js";
 import { createClarifyTool } from "./clarify-tool.js";
-import { BrowserRuntime } from "../../browser/runtime/browser-runtime.js";
-import { createBrowserDriver } from "../../browser/drivers/create-driver.js";
-import { checkBrowserReadiness } from "../../browser/readiness.js";
-import "../../browser/index.js";
-import { getPendingTranscriptUserText } from "../inbound/attachment-pipeline.js";
-import { createDelegateTool } from "./delegate-tool.js";
 import { createWorkflowTool } from "./workflow-tool.js";
 import { createAutomationTool } from "./automation-tool.js";
 import { createBrowserAutomationTool } from "./browser-automation-tool.js";
@@ -58,12 +61,9 @@ import { createManagedJobTool } from "./managed-job-tool.js";
 import { createImageTool } from "./image-tool.js";
 import { createImageGenerateTool } from "./image-generate-tool.js";
 import "./index.js";
-import { resolveUserContextSessionAccess } from "../../user-context/access-policy.js";
 import { createBrowserUseTool } from "./browser/tool/browser-use-tool.js";
 import { createReviewWorkspaceTool } from "./review-workspace.js";
 import { createLanguageDiagnosticsTool } from "./language-diagnostics.js";
-import { createWorkflowCatalog } from "../workflow/catalog.js";
-import { mergeTtsConfigFromAppConfig } from "../../voice/tts/merge-config.js";
 import { createTextToSpeechTool } from "./tts-tool.js";
 import { getAgentCapabilityToolNames } from "../capabilities/registry.js";
 import "../capabilities/index.js";

package/dist/src/agent/tools/find.js

@@ -1,6 +1,6 @@
 import { evaluateFilePolicy } from "../sandbox/exec-policy.js";
 import { resolveToCwd } from "../../utils/helpers.js";
-import { repositorySearch } from "./repository-search.js";
+import { isSearchFileAllowed, repositorySearch } from "./repository-search.js";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/find.ts
 const findSchema = Type.Object({
@@ -20,20 +20,22 @@ function createFindTool(cwd) {
 		supportsParallel: true,
 		idempotent: true,
 		async execute(_id, params, signal) {
-			const path = resolveToCwd(params.path || ".", cwd);
+			let path = resolveToCwd(params.path || ".", cwd);
 			const policy = evaluateFilePolicy({
 				operation: "read",
 				path,
 				workspaceRoot: cwd
 			});
 			if (!policy.allowed) throw new Error(policy.reason);
+			path = policy.canonicalPath;
 			const result = await repositorySearch(path, [
 				"--files",
+				"--null",
 				"--glob",
 				params.pattern
 			], signal);
 			const limit = Math.min(1e4, Math.max(1, params.limit ?? 1e3));
-			const lines = result.output.trimEnd().split("\n").filter(Boolean).sort();
+			const lines = result.output.split("\0").slice(0, -1).filter((file) => file && isSearchFileAllowed(cwd, resolveToCwd(file, path))).sort();
 			const truncated = result.truncated || lines.length > limit;
 			return {
 				content: [{

package/dist/src/agent/tools/grep.js

@@ -1,6 +1,6 @@
 import { evaluateFilePolicy } from "../sandbox/exec-policy.js";
 import { resolveToCwd } from "../../utils/helpers.js";
-import { repositorySearch } from "./repository-search.js";
+import { isSearchFileAllowed, repositorySearch } from "./repository-search.js";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/grep.ts
 const grepSchema = Type.Object({
@@ -27,15 +27,17 @@ function createGrepTool(cwd) {
 		supportsParallel: true,
 		idempotent: true,
 		async execute(_id, params, signal) {
-			const path = resolveToCwd(params.path || ".", cwd);
+			let path = resolveToCwd(params.path || ".", cwd);
 			const policy = evaluateFilePolicy({
 				operation: "read",
 				path,
 				workspaceRoot: cwd
 			});
 			if (!policy.allowed) throw new Error(policy.reason);
+			path = policy.canonicalPath;
 			const limit = Math.min(1e3, Math.max(1, params.limit ?? 100));
 			const result = await repositorySearch(cwd, [
+				"--json",
 				"--line-number",
 				"--with-filename",
 				"--color",
@@ -55,13 +57,28 @@ function createGrepTool(cwd) {
 				"--",
 				path
 			], signal);
-			const lines = result.output.trimEnd().split("\n");
+			const lines = [];
+			for (const row of result.output.split("\n")) {
+				if (!row) continue;
+				let event;
+				try {
+					event = JSON.parse(row);
+				} catch {
+					if (result.truncated) continue;
+					throw new Error("Invalid search output");
+				}
+				if (event.type !== "match" && event.type !== "context") continue;
+				const data = event.data;
+				if (!data?.path?.text || !data.lines?.text || !isSearchFileAllowed(cwd, data.path.text)) continue;
+				const separator = event.type === "match" ? ":" : "-";
+				lines.push(`${data.path.text}${separator}${data.line_number}${separator}${data.lines.text.replace(/\r?\n$/, "")}`);
+			}
 			const outputLimit = limit * (1 + 2 * (params.context ?? 0));
 			const truncated = result.truncated || lines.length > outputLimit;
 			return {
 				content: [{
 					type: "text",
-					text: (result.output ? lines.slice(0, outputLimit).join("\n") : "No matches found") + (truncated ? "\n[Results truncated; narrow the path or pattern.]" : "")
+					text: (lines.length ? lines.slice(0, outputLimit).join("\n") : "No matches found") + (truncated ? "\n[Results truncated; narrow the path or pattern.]" : "")
 				}],
 				details: { truncated }
 			};

package/dist/src/agent/tools/image-generate-tool.js

@@ -1,15 +1,15 @@
 import { getAgentDefaultImageGenerationModelConfig, init_schema } from "../../config/schema.js";
 import { imageAssetFromDataUrl, imageFileExtensionForMimeType, mimeTypeFromFileName, parseImageDataUrl, sniffImageMimeType } from "../image/generation/image-assets.js";
-import { persistToolMedia } from "./tool-media.js";
+import { getImageGenerationProvider } from "../image/generation/provider-registry.js";
 import { buildCapabilityPlansForConfig } from "../../capabilities/readiness/from-config.js";
 import "../../capabilities/readiness/index.js";
 import { applyImageGenerationModelConfigDefaults } from "../image/image-helpers.js";
+import { readWorkspaceFile, writeWorkspaceFile } from "../sandbox/fileAccess.js";
+import { persistToolMedia } from "./tool-media.js";
 import { isFailoverError } from "../failover-error.js";
-import { getImageGenerationProvider } from "../image/generation/provider-registry.js";
 import { generateImage, listImageGenerationProvidersSummary } from "../image/generation/runtime.js";
 import path from "node:path";
 import { randomBytes } from "node:crypto";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/image-generate-tool.ts
 init_schema();
@@ -114,7 +114,7 @@ async function loadInputImages(params) {
 		if (resolved !== workspaceAbs && !resolved.startsWith(workspaceAbs + path.sep)) throw new ToolInputError("inputImages[].source escapes workspace.");
 		let buffer;
 		try {
-			buffer = await readFile(resolved);
+			buffer = readWorkspaceFile(params.workspace, resolved);
 		} catch (e) {
 			throw new ToolInputError(`inputImages[].source not readable: ${e instanceof Error ? e.message : String(e)}`);
 		}
@@ -173,7 +173,6 @@ function resolveImageGenerationModelConfigForTool(params) {
 }
 async function saveGeneratedImages(params) {
 	const dir = path.join(params.workspace, "media", "generated");
-	await mkdir(dir, { recursive: true });
 	const out = [];
 	const random = randomBytes(4).toString("hex");
 	let i = 0;
@@ -182,7 +181,7 @@ async function saveGeneratedImages(params) {
 		const ext = imageFileExtensionForMimeType(img.mimeType);
 		const name = `${(params.filenameHint?.replace(/[^\w.-]/g, "") || "image") + `-${random}`}-${i}.${ext}`;
 		const full = path.join(dir, name);
-		await writeFile(full, img.buffer);
+		writeWorkspaceFile(params.workspace, full, img.buffer);
 		out.push(full);
 	}
 	return out;

package/dist/src/agent/tools/index.js

@@ -1,5 +1,10 @@
+import { assertBrowserUrlAllowed } from "../../browser/url-policy.js";
+import { BrowserRuntime } from "../../browser/runtime/browser-runtime.js";
+import "../../browser/index.js";
 import { DEFAULT_TOOL_METADATA, getToolMetadata } from "./metadata.js";
 import { ToolConcurrencyController, resolveToolLockMode } from "./concurrency.js";
+import { resolveImageModelConfigForTool } from "../image/tool-model-config.js";
+import { DEFAULT_DELEGATE_TOOLS, DELEGATE_BLOCKED_TOOLS, createDelegateTool } from "./delegate-tool.js";
 import { DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, GREP_MAX_LINE_LENGTH, formatSize, truncateHead, truncateLine, truncateTail } from "./truncate.js";
 import { createReadFileTool } from "./read.js";
 import { createWriteFileTool, writeFileTool } from "./write.js";
@@ -25,11 +30,6 @@ import { createUpdatePlanTool } from "./update-plan-tool.js";
 import { createSessionStatusTool } from "./session-status-tool.js";
 import { createMemoryMaintenanceTool } from "./memory-maintenance-tool.js";
 import { createClarifyTool } from "./clarify-tool.js";
-import { assertBrowserUrlAllowed } from "../../browser/url-policy.js";
-import { BrowserRuntime } from "../../browser/runtime/browser-runtime.js";
-import "../../browser/index.js";
-import { resolveImageModelConfigForTool } from "../image/tool-model-config.js";
-import { DEFAULT_DELEGATE_TOOLS, DELEGATE_BLOCKED_TOOLS, createDelegateTool } from "./delegate-tool.js";
 import { createWorkflowTool } from "./workflow-tool.js";
 import { createAutomationTool } from "./automation-tool.js";
 import { createBrowserAutomationTool } from "./browser-automation-tool.js";

package/dist/src/agent/tools/list-dir.js

@@ -1,4 +1,5 @@
 import { resolvePathUnderWorkspace } from "./tool-paths.js";
+import { checkedFilePath } from "../sandbox/fileAccess.js";
 import { readdir } from "fs/promises";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/list-dir.ts
@@ -16,7 +17,7 @@ function createListDirTool(workspace) {
 				return {
 					content: [{
 						type: "text",
-						text: (await readdir(resolvePathUnderWorkspace(params.path, workspace), { withFileTypes: true })).map((e) => {
+						text: (await readdir(checkedFilePath(workspace, resolvePathUnderWorkspace(params.path, workspace), "read"), { withFileTypes: true })).map((e) => {
 							return `${e.isDirectory() ? "d" : e.isFile() ? "f" : "?"} ${e.name}`;
 						}).join("\n") || "(empty)"
 					}],

package/dist/src/agent/tools/managed-job-tool.js

@@ -71,6 +71,7 @@ function createManagedJobTool(workspace, getSessionKey, getSkillPassthroughEnvVa
 				error: "command is required"
 			});
 			const policy = evaluateExecPolicy({
+				workspaceRoot: workspace,
 				command,
 				cwd: resolve(workspace, input.cwd?.trim() || "."),
 				allowedEnvVars: getSkillPassthroughEnvVarNames?.() ?? []

package/dist/src/agent/tools/publish-artifacts.js

@@ -1,10 +1,11 @@
 import { turnOutcomeKindFromFileName, turnOutcomeMimeTypeFromFileName } from "../../../packages/gateway-contract/src/turn-outcome.js";
-import { resolvePathUnderWorkspace } from "./tool-paths.js";
 import { fileResourceId, fileSpaceId } from "../../files/file-service.js";
+import { resolvePathUnderWorkspace } from "./tool-paths.js";
 import { evaluateFilePolicy } from "../sandbox/exec-policy.js";
+import { readWorkspaceFile } from "../sandbox/fileAccess.js";
 import { persistToolMedia } from "./tool-media.js";
 import { basename, isAbsolute, relative, sep } from "node:path";
-import { readFile, realpath } from "node:fs/promises";
+import { realpath } from "node:fs/promises";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/publish-artifacts.ts
 const PublishArtifactsSchema = Type.Object({ paths: Type.Array(Type.String({ minLength: 1 }), {
@@ -35,7 +36,7 @@ async function publishArtifactPaths(params) {
 				if (sourcePath !== ".." && !sourcePath.startsWith(`..${sep}`) && !isAbsolute(sourcePath)) sourceFileId = fileResourceId(fileSpaceId(root), sourcePath.split(sep).join("/"));
 			}
 			const media = await persistToolMedia({
-				buffer: await readFile(source),
+				buffer: readWorkspaceFile(params.workspaceRoot, source),
 				filePath: resolved
 			});
 			const kind = turnOutcomeKindFromFileName(media.name);

package/dist/src/agent/tools/read.js

@@ -1,7 +1,8 @@
+import { isBareProfileMarkdownFileName, resolvePathUnderWorkspace, resolveProfileMarkdownPathIfBareName } from "./tool-paths.js";
+import { checkedFilePath, readWorkspaceFile } from "../sandbox/fileAccess.js";
 import { checkFileSafety } from "../prompt/safety.js";
 import { DEFAULT_MAX_BYTES, formatSize, truncateHead } from "./truncate.js";
-import { isBareProfileMarkdownFileName, resolvePathUnderWorkspace, resolveProfileMarkdownPathIfBareName } from "./tool-paths.js";
-import { readFile, stat } from "fs/promises";
+import { stat } from "fs/promises";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/read.ts
 const MAX_FILE_SIZE = 10 * 1024 * 1024;
@@ -41,7 +42,8 @@ async function executeReadFile(workspace, profileMarkdownRoot, params) {
 			}],
 			details: { status: "failed" }
 		};
-		let normalized = resolvePathUnderWorkspace(params.path, workspace);
+		let activeRoot = workspace;
+		let normalized = checkedFilePath(activeRoot, resolvePathUnderWorkspace(params.path, workspace), "read");
 		let stats;
 		try {
 			stats = await stat(normalized);
@@ -49,8 +51,9 @@ async function executeReadFile(workspace, profileMarkdownRoot, params) {
 			if (e?.code === "ENOENT" && profileMarkdownRoot && isBareProfileMarkdownFileName(params.path)) {
 				const alt = resolveProfileMarkdownPathIfBareName(params.path, profileMarkdownRoot);
 				try {
-					stats = await stat(alt);
-					normalized = alt;
+					normalized = checkedFilePath(profileMarkdownRoot, alt, "read");
+					stats = await stat(normalized);
+					activeRoot = profileMarkdownRoot;
 				} catch {
 					throw e;
 				}
@@ -63,7 +66,7 @@ async function executeReadFile(workspace, profileMarkdownRoot, params) {
 			}],
 			details: { status: "failed" }
 		};
-		const content = await readFile(normalized, "utf-8");
+		const content = readWorkspaceFile(activeRoot, normalized, MAX_FILE_SIZE).toString("utf8");
 		const offset = Math.max(1, params.offset ?? 1);
 		const lines = content.split("\n");
 		if (offset > lines.length) throw new Error(`Offset ${offset} exceeds ${lines.length} lines`);

package/dist/src/agent/tools/repository-search.d.ts

@@ -3,3 +3,5 @@ export declare function repositorySearch(cwd: string, args: string[], signal?: A
     output: string;
     truncated: boolean;
 }>;
+/** Search results must satisfy the same policy as direct file reads. */
+export declare function isSearchFileAllowed(workspace: string, path: string): boolean;

package/dist/src/agent/tools/repository-search.js

@@ -1,4 +1,7 @@
+import { prepareSafeToolEnv } from "../sandbox/sanitize-env-vars.js";
+import { evaluateFilePolicy } from "../sandbox/exec-policy.js";
 import { resolveRipgrepBinary } from "../../infra/ripgrep.js";
+import { lstatSync } from "node:fs";
 import { spawn } from "node:child_process";
 //#region src/agent/tools/repository-search.ts
 /** Bounded native search; unavailable tools and invalid regexes are explicit failures. */
@@ -6,15 +9,41 @@ async function repositorySearch(cwd, args, signal) {
 	signal?.throwIfAborted();
 	const binary = await resolveRipgrepBinary();
 	return new Promise((resolve, reject) => {
+		const separator = args.indexOf("--");
+		const options = separator < 0 ? args : args.slice(0, separator);
+		const targets = separator < 0 ? [] : args.slice(separator);
+		const excluded = [
+			".git",
+			"node_modules",
+			".env",
+			".env.*",
+			".ssh",
+			".aws",
+			".gnupg",
+			".docker",
+			".config",
+			".netrc",
+			".npmrc",
+			".cargo/credentials",
+			".kube",
+			".xopc"
+		];
 		const child = spawn(binary, [
 			"--no-config",
 			"--hidden",
-			"--glob",
-			"!.git",
-			"--glob",
-			"!node_modules",
-			...args
-		], { cwd });
+			...options,
+			...excluded.flatMap((path) => [
+				"--glob",
+				`!**/${path}`,
+				"--glob",
+				`!**/${path}/**`
+			]),
+			"--no-follow",
+			...targets
+		], {
+			cwd,
+			env: prepareSafeToolEnv(process.env)
+		});
 		const chunks = [];
 		let bytes = 0, truncated = false, stderr = "";
 		const timer = setTimeout(() => child.kill("SIGKILL"), 1e4);
@@ -52,5 +81,20 @@ async function repositorySearch(cwd, args, signal) {
 		if (signal?.aborted) abort();
 	});
 }
+/** Search results must satisfy the same policy as direct file reads. */
+function isSearchFileAllowed(workspace, path) {
+	const policy = evaluateFilePolicy({
+		operation: "read",
+		workspaceRoot: workspace,
+		path
+	});
+	if (!policy.allowed || !policy.canonicalPath) return false;
+	try {
+		const stat = lstatSync(policy.canonicalPath);
+		return stat.isFile() && stat.nlink === 1;
+	} catch {
+		return false;
+	}
+}
 //#endregion
-export { repositorySearch };
+export { isSearchFileAllowed, repositorySearch };