@xopcai/xopc 0.0.277 → 0.0.278

package/dist/src/agent/sandbox/fileAccess.js

@@ -0,0 +1,100 @@
+import { evaluateFilePolicy } from "./exec-policy.js";
+import { dirname, join, resolve } from "node:path";
+import { closeSync, constants, fstatSync, ftruncateSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+//#region src/agent/sandbox/fileAccess.ts
+/** Revalidate at I/O time; never truncate a file before checking the opened inode. */
+function checkedFilePath(workspaceRoot, path, operation) {
+	const policy = evaluateFilePolicy({
+		workspaceRoot,
+		path,
+		operation
+	});
+	if (!policy.allowed || !policy.canonicalPath) throw new Error(`Sandbox: ${policy.reason ?? "Cannot resolve file"}`);
+	return policy.canonicalPath;
+}
+function mkdirChecked(workspace, directory) {
+	const path = checkedFilePath(workspace, directory, "write");
+	try {
+		if (!lstatSync(path).isDirectory()) throw new Error("Expected a directory");
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		mkdirChecked(workspace, dirname(path));
+		if (checkedFilePath(workspace, path, "write") !== path) throw new Error("Directory changed during operation");
+		mkdirSync(path);
+	}
+}
+function openChecked(workspace, inputPath, write) {
+	const operation = write ? "write" : "read";
+	const path = checkedFilePath(workspace, inputPath, operation);
+	if (write) mkdirChecked(workspace, dirname(path));
+	if (checkedFilePath(workspace, path, operation) !== path) throw new Error("Path changed during operation");
+	const flags = (write ? constants.O_WRONLY : constants.O_RDONLY) | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+	let fd;
+	try {
+		fd = openSync(path, flags);
+	} catch (error) {
+		if (!write || error.code !== "ENOENT") throw error;
+		fd = openSync(path, flags | constants.O_CREAT | constants.O_EXCL, 384);
+	}
+	try {
+		const opened = fstatSync(fd);
+		const currentPath = checkedFilePath(workspace, inputPath, operation);
+		const current = statSync(currentPath);
+		if (currentPath !== path || current.dev !== opened.dev || current.ino !== opened.ino) throw new Error("File changed during operation");
+		if (!opened.isFile() || opened.nlink !== 1) throw new Error("Sandbox requires a regular file without hard links");
+		return fd;
+	} catch (error) {
+		closeSync(fd);
+		throw error;
+	}
+}
+function readWorkspaceFile(workspace, path, maxBytes = 10 * 1024 * 1024) {
+	const fd = openChecked(workspace, path, false);
+	try {
+		if (fstatSync(fd).size > maxBytes) throw new Error(`File too large: maximum ${maxBytes} bytes`);
+		const chunks = [];
+		let total = 0;
+		for (;;) {
+			const chunk = Buffer.alloc(Math.min(64 * 1024, maxBytes - total + 1));
+			const count = readSync(fd, chunk);
+			if (count === 0) break;
+			total += count;
+			if (total > maxBytes) throw new Error(`File too large: maximum ${maxBytes} bytes`);
+			chunks.push(chunk.subarray(0, count));
+		}
+		return Buffer.concat(chunks);
+	} finally {
+		closeSync(fd);
+	}
+}
+function writeWorkspaceFile(workspace, path, content) {
+	const fd = openChecked(workspace, path, true);
+	try {
+		ftruncateSync(fd, 0);
+		writeFileSync(fd, content, "utf8");
+	} finally {
+		closeSync(fd);
+	}
+}
+function deleteWorkspaceFile(workspace, path) {
+	const target = checkedFilePath(workspace, path, "delete");
+	if (!lstatSync(target).isFile()) throw new Error("Expected a regular file");
+	if (checkedFilePath(workspace, resolve(target), "delete") !== target) throw new Error("File changed during operation");
+	unlinkSync(target);
+}
+/** Refuse publication of directory trees containing protected or escaping entries. */
+function assertWorkspaceTreeReadable(workspace, path) {
+	const seen = /* @__PURE__ */ new Set();
+	let count = 0;
+	const visit = (input) => {
+		if (++count > 2e5) throw new Error("Share exceeds safe traversal limit");
+		const target = checkedFilePath(workspace, input, "read");
+		if (seen.has(target)) return;
+		seen.add(target);
+		if (lstatSync(target).isDirectory()) for (const name of readdirSync(target)) visit(join(target, name));
+		else closeSync(openChecked(workspace, target, false));
+	};
+	visit(path);
+}
+//#endregion
+export { assertWorkspaceTreeReadable, checkedFilePath, deleteWorkspaceFile, readWorkspaceFile, writeWorkspaceFile };

package/dist/src/agent/sandbox/path-policy.d.ts

@@ -5,6 +5,8 @@
  * Aligned with OpenClaw's validate-sandbox-security.ts blocked-path approach.
  */
 import type { PathValidationResult } from './types.js';
+export declare function getBlockedPaths(): string[];
+export declare function containsBlockedCredentialSegment(target: string): string | null;
 /**
  * Validate that a path does not escape into blocked system/credential directories.
  *

package/dist/src/agent/sandbox/path-policy.js

@@ -1,6 +1,6 @@
 import { homedir } from "node:os";
 import { isAbsolute, normalize, posix, resolve, sep } from "node:path";
-import { realpathSync } from "node:fs";
+import { lstatSync, realpathSync } from "node:fs";
 //#region src/agent/sandbox/path-policy.ts
 /**
 * Path safety validation for sandbox isolation.
@@ -52,6 +52,23 @@ function getBlockedPaths() {
 		process.env.USERPROFILE
 	].filter((home) => Boolean(home && home !== "/")));
 	for (const home of homes) for (const sub of BLOCKED_HOME_SUBPATHS) blocked.add(normalizePosixPath(resolvePolicyPath(`${home}/${sub}`)));
+	for (const path of [
+		process.env.XOPC_CONFIG_PATH,
+		process.env.XOPC_CONFIG,
+		...[
+			"",
+			"-wal",
+			"-shm",
+			"-journal"
+		].map((suffix) => process.env.XOPC_STATE_DIR ? resolve(process.env.XOPC_STATE_DIR, `xopc.db${suffix}`) : void 0)
+	]) {
+		if (!path) continue;
+		const resolved = resolvePolicyPath(path);
+		blocked.add(normalizePosixPath(resolved));
+		try {
+			blocked.add(normalizePosixPath(realpathSync(resolved)));
+		} catch {}
+	}
 	return [...blocked];
 }
 /**
@@ -70,6 +87,8 @@ function containsBlockedCredentialSegment(target) {
 		const prefix = `/${sub.replace(/\\/g, "/")}`;
 		if (normalized.endsWith(prefix) || normalized.includes(`${prefix}/`)) return sub;
 	}
+	if (/(?:^|\/)\.xopc\/(?:xopc\.json|xopc\.db(?:-[^/]*)?)(?:\/|$)/.test(normalized)) return ".xopc config/state";
+	if (/(?:^|\/)\.env(?:\.[^/]*)?(?:\/|$)/.test(normalized)) return ".env";
 	return null;
 }
 /**
@@ -80,20 +99,16 @@ function containsBlockedCredentialSegment(target) {
 function resolveCanonicalPath(targetPath) {
 	try {
 		return realpathSync(targetPath);
-	} catch {
-		const segments = targetPath.split(sep);
-		let resolved = segments[0] === "" ? "/" : segments[0];
-		let unresolved = "";
-		for (let i = 1; i < segments.length; i++) {
-			const candidate = resolve(resolved, segments[i]);
-			try {
-				resolved = realpathSync(candidate);
-			} catch {
-				unresolved = segments.slice(i).join("/");
-				break;
-			}
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		try {
+			if (lstatSync(targetPath).isSymbolicLink()) throw new Error("Unresolvable symbolic link");
+		} catch (statError) {
+			if (statError.code !== "ENOENT") throw statError;
 		}
-		return unresolved ? `${resolved}/${unresolved}` : resolved;
+		const parent = resolve(targetPath, "..");
+		if (parent === targetPath) throw error;
+		return resolve(resolveCanonicalPath(parent), targetPath.split(sep).at(-1));
 	}
 }
 /**
@@ -134,7 +149,21 @@ function validatePath(rawPath, options) {
 			};
 		}
 	}
-	const canonicalNormalized = normalizePosixPath(resolveCanonicalPath(target));
+	let canonical;
+	try {
+		canonical = resolveCanonicalPath(target);
+	} catch {
+		return {
+			allowed: false,
+			reason: "Cannot safely resolve path"
+		};
+	}
+	const canonicalNormalized = normalizePosixPath(canonical);
+	const canonicalCredential = containsBlockedCredentialSegment(canonicalNormalized);
+	if (canonicalCredential) return {
+		allowed: false,
+		reason: `Path resolves to protected credential path: ${canonicalCredential}`
+	};
 	if (canonicalNormalized !== target) {
 		for (const blocked of blockedPaths) if (isPathInsideOrEqual(blocked, canonicalNormalized)) return {
 			allowed: false,
@@ -142,7 +171,15 @@ function validatePath(rawPath, options) {
 		};
 	}
 	if (options?.allowedRoots && options.allowedRoots.length > 0) {
-		const normalizedRoots = options.allowedRoots.map((r) => normalizePosixPath(resolveCanonicalPath(resolvePolicyPath(r))));
+		let normalizedRoots;
+		try {
+			normalizedRoots = options.allowedRoots.map((r) => normalizePosixPath(resolveCanonicalPath(resolvePolicyPath(r))));
+		} catch {
+			return {
+				allowed: false,
+				reason: "Cannot safely resolve allowed roots"
+			};
+		}
 		if (!normalizedRoots.some((root) => isPathInsideOrEqual(root, canonicalNormalized))) return {
 			allowed: false,
 			reason: `Path is outside allowed roots: ${normalizedRoots.join(", ")}`
@@ -173,4 +210,4 @@ function validateWritePath(rawPath, workspaceRoot, options) {
 	return validatePath(resolvedPath, options);
 }
 //#endregion
-export { validatePath, validateWritePath };
+export { containsBlockedCredentialSegment, getBlockedPaths, validatePath, validateWritePath };

package/dist/src/agent/sandbox/sanitize-env-vars.js

@@ -1,3 +1,4 @@
+import { isDangerousHostEnvVarName } from "../../infra/host-env-security.js";
 //#region src/agent/sandbox/sanitize-env-vars.ts
 /**
 * Filters process environment before passing it to child processes (e.g. exec_command)
@@ -21,10 +22,10 @@ function isDangerousEnvVar(key) {
 	const upperKey = key.toUpperCase();
 	return BLOCKED_ENV_VAR_PATTERNS.some((pattern) => pattern.test(upperKey));
 }
-function validateEnvVarValue(key, value) {
+function validateEnvVarValue(key, value, allowCredentialData = false) {
 	if (value.includes("\0")) return `Environment variable ${key} contains null bytes`;
 	if (value.length > MAX_ENV_VAR_LENGTH) return `Environment variable ${key} exceeds maximum length (${MAX_ENV_VAR_LENGTH})`;
-	if (/^[A-Za-z0-9+/=]{80,}$/.test(value)) return `Environment variable ${key} looks like base64-encoded credential data`;
+	if (!allowCredentialData && /^[A-Za-z0-9+/=]{80,}$/.test(value)) return `Environment variable ${key} looks like base64-encoded credential data`;
 	return null;
 }
 function sanitizeEnvVars(env, options) {
@@ -35,17 +36,17 @@ function sanitizeEnvVars(env, options) {
 	const customBlocked = options?.customBlocked ?? [];
 	for (const [key, value] of Object.entries(env)) {
 		if (value === void 0) continue;
-		if (allowedVars.has(key)) {
-			safe[key] = value;
+		const warning = validateEnvVarValue(key, value, allowedVars.has(key));
+		if (warning) {
+			warnings.push(warning);
 			continue;
 		}
-		if (isDangerousEnvVar(key) || customBlocked.some((pattern) => pattern.test(key))) {
+		if (isDangerousHostEnvVarName(key)) {
 			blocked.push(key);
 			continue;
 		}
-		const warning = validateEnvVarValue(key, value);
-		if (warning) {
-			warnings.push(warning);
+		if (!allowedVars.has(key) && (isDangerousEnvVar(key) || customBlocked.some((pattern) => pattern.test(key)))) {
+			blocked.push(key);
 			continue;
 		}
 		safe[key] = value;
@@ -63,7 +64,7 @@ function prepareSafeToolEnv(baseEnv, options) {
 	const { safe } = sanitizeEnvVars(baseEnv, options);
 	return {
 		...safe,
-		HOME: typeof baseEnv.HOME === "string" && baseEnv.HOME ? baseEnv.HOME : safe.HOME || "/tmp"
+		HOME: safe.HOME || "/tmp"
 	};
 }
 //#endregion

package/dist/src/agent/service/direct-turn-helpers.js

@@ -1,16 +1,16 @@
 import { getClarificationResumeInput } from "../../storage/sqlite/clarification-wait-repository.js";
 import { getConnectionResumeInput } from "../../storage/sqlite/connection-wait-repository.js";
-import { resolveImageHandlingStrategy } from "../image/vision-detection.js";
-import { hydrateUserTurnForLlm } from "../inbound/attachment-pipeline.js";
-import { buildTaskExecutionDirective } from "../../tasks/task-context-assembler.js";
-import { prependAgentContext } from "../context/prepend.js";
-import { extractAgentUserPlainText } from "../memory/user-message-text.js";
-import { shouldSkipResetOverlapCommand } from "../../session/reset-triggers.js";
 import { parseSlashCommand } from "../../chat-commands/command-parse.js";
 import { commandRegistry } from "../../chat-commands/registry.js";
 import "../../chat-commands/index.js";
+import { shouldSkipResetOverlapCommand } from "../../session/reset-triggers.js";
+import { resolveImageHandlingStrategy } from "../image/vision-detection.js";
+import { hydrateUserTurnForLlm } from "../inbound/attachment-pipeline.js";
 import { runEmbeddedTurnForSession } from "../embedded/run-for-session.js";
 import { injectSourceContextsIntoUserMessage } from "../source-context/injector.js";
+import { extractAgentUserPlainText } from "../memory/user-message-text.js";
+import { buildTaskExecutionDirective } from "../../tasks/task-context-assembler.js";
+import { prependAgentContext } from "../context/prepend.js";
 import crypto from "node:crypto";
 //#region src/agent/service/direct-turn-helpers.ts
 /**

package/dist/src/agent/service/process-direct-one-shot.js

@@ -1,6 +1,6 @@
-import { clearPendingTranscriptUserMessage, setPendingTranscriptUserMessage } from "../inbound/attachment-pipeline.js";
 import { initSessionTurn } from "../../session/init-session-turn.js";
 import "../../session/index.js";
+import { clearPendingTranscriptUserMessage, setPendingTranscriptUserMessage } from "../inbound/attachment-pipeline.js";
 import { buildDirectUserMessageContent } from "./build-direct-message-content.js";
 import { hydratePerTurnState, runDirectAgentTurn, tryRunSlashCommand } from "./direct-turn-helpers.js";
 //#region src/agent/service/process-direct-one-shot.ts

package/dist/src/agent/service/process-direct-streaming.js

@@ -1,16 +1,16 @@
 import { getClarificationResumeInput } from "../../storage/sqlite/clarification-wait-repository.js";
 import { getConnectionResumeInput } from "../../storage/sqlite/connection-wait-repository.js";
+import { mergeSttConfigFromAppConfig } from "../../voice/stt/config.js";
+import "../../voice/stt/index.js";
 import { readAgentMessageContent } from "../memory/agent-message-access.js";
-import { abortEmbeddedRun } from "../embedded/runs.js";
-import { clearPendingTranscriptUserMessage, setPendingTranscriptUserMessage } from "../inbound/attachment-pipeline.js";
-import { formatAgentRunErrorForClient } from "../client-error-format.js";
 import { resolveConfiguredActivityDetailDefault, resolveEffectiveReasoningLevel } from "../../session/thinking-resolve.js";
 import { initSessionTurn } from "../../session/init-session-turn.js";
 import "../../session/index.js";
-import { mergeSttConfigFromAppConfig } from "../../voice/stt/config.js";
-import "../../voice/stt/index.js";
+import { abortEmbeddedRun } from "../embedded/runs.js";
+import { clearPendingTranscriptUserMessage, setPendingTranscriptUserMessage } from "../inbound/attachment-pipeline.js";
 import { isVoiceLikeAttachment, mergeVoiceTranscriptsIntoUserText } from "../../channels/attachments/voice-stt-webchat.js";
 import { applyReasoningVisibility } from "../streaming/reasoning-visibility.js";
+import { formatAgentRunErrorForClient } from "../client-error-format.js";
 import { isSessionSourceBinding, summarizeSourceContext } from "../source-context/types.js";
 import { injectSourceContextsIntoUserMessage } from "../source-context/injector.js";
 import { AsyncQueue, AsyncQueueOverflowError } from "./async-queue.js";

package/dist/src/agent/service/webchat-tts.js

@@ -1,10 +1,10 @@
 import { isTTSAvailable } from "../../voice/tts/factory.js";
-import { speak } from "../../voice/tts/speak-core.js";
 import { mergeTtsConfigFromAppConfig } from "../../voice/tts/merge-config.js";
 import { getChannelOutputFormat, shouldUseTTS } from "../../voice/tts/service.js";
+import { speak } from "../../voice/tts/speak-core.js";
 import { compressAudio } from "../../voice/tts/audio.js";
-import { persistOutboundTtsAudio } from "../../channels/attachments/outbound-tts-persist.js";
 import "../../voice/tts/index.js";
+import { persistOutboundTtsAudio } from "../../channels/attachments/outbound-tts-persist.js";
 //#region src/agent/service/webchat-tts.ts
 /** True when the explicit TTS tool already produced durable Webchat audio. */
 function isSuccessfulWebchatTtsToolEvent(event) {

package/dist/src/agent/service.js

@@ -2,40 +2,32 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { parseNoteAttachmentTarget } from "../notes/attachment-ref.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
-import { applyConfigOverrides } from "../config/runtime-overrides.js";
 import { init_agent_scope, resolveAgentHomeDir, resolveDefaultAgentId } from "./agent-scope.js";
-import { extractProfileAgentId } from "../config/agent-profile.js";
 import { init_providers, resolveModel } from "../providers/index.js";
-import { extractTextContent } from "./context/workspace.js";
-import { effectiveWorkspacePathForSession } from "../session/session-workspace.js";
-import { getProjectForSession } from "../projects/workspace.js";
-import { runWithEmbeddedExecutionSession } from "./embedded/execution-context.js";
-import { resolveWorkspaceSkillsDir, resolveWorkspaceSkillsLockPath } from "./skills/workspace-skills-dir.js";
 import { removeSkillsLockEntry } from "./skills/hub-lock.js";
 import { installSkillFromZip } from "./skills/managed-store.js";
-import { pullSkillFromSource } from "./skills/hub-pull.js";
+import { extractProfileAgentId } from "../config/agent-profile.js";
+import { effectiveWorkspacePathForSession } from "../session/session-workspace.js";
+import { getProjectForSession } from "../projects/workspace.js";
 import { getUserTimezone } from "../user-model/repository.js";
 import "../user-model/index.js";
-import { resolveAgentTurnTimeoutMs } from "./orchestration/run-agent-turn-with-timeout.js";
-import { onSessionTranscriptUpdate } from "../session/transcript-events.js";
-import { persistInboundAttachments } from "../channels/attachments/inbound-persist.js";
-import { buildTranscriptUserMessage, hydrateUserTurnForLlm } from "./inbound/attachment-pipeline.js";
-import { runXopcEmbeddedTurn } from "./embedded/run-turn.js";
-import { resolveResponseLanguageForSession } from "./prompt/response-language.js";
-import { normalizeSkillInstallTarget } from "./skills/install-target.js";
-import { AgentManager } from "./agent-manager.js";
+import { initializeCommands } from "../chat-commands/index.js";
+import { applyConfigOverrides } from "../config/runtime-overrides.js";
+import { ExtensionHookRunner } from "../extensions/hooks.js";
+import "../extensions/index.js";
+import { resolveWorkspaceSkillsDir, resolveWorkspaceSkillsLockPath } from "./skills/workspace-skills-dir.js";
+import { pullSkillFromSource } from "./skills/hub-pull.js";
+import { extractTextContent } from "./context/workspace.js";
 import { MAX_WEBCHAT_ATTACHMENT_FILE_BYTES } from "../gateway/chat-limits.js";
 import { maybeRefineSessionTitleWithLlm, maybeSetProvisionalSessionTitle } from "../session/session-title.js";
 import { resolveCompactionPolicy } from "./memory/compaction-policy.js";
 import { SessionStore } from "../session/store.js";
+import { onSessionTranscriptUpdate } from "../session/transcript-events.js";
 import { SessionConfigStore } from "../session/config-store.js";
 import "../session/index.js";
-import { ExtensionHookRunner } from "../extensions/hooks.js";
-import "../extensions/index.js";
 import { SessionTracker } from "./session/tracker.js";
 import { ModelManager } from "./models/manager.js";
 import "./models/index.js";
-import { initializeCommands } from "../chat-commands/index.js";
 import { HookHandler } from "./lifecycle/hook-handler.js";
 import { ToolErrorTracker } from "./tools/error-tracker.js";
 import { RequestLimiter } from "./models/request-limiter.js";
@@ -47,6 +39,11 @@ import { ContextMiddleware } from "./middleware/context.js";
 import "./middleware/index.js";
 import { LifecycleManager } from "./lifecycle/manager.js";
 import "./lifecycle/index.js";
+import { resolveAgentTurnTimeoutMs } from "./orchestration/run-agent-turn-with-timeout.js";
+import { persistInboundAttachments } from "../channels/attachments/inbound-persist.js";
+import { buildTranscriptUserMessage, hydrateUserTurnForLlm } from "./inbound/attachment-pipeline.js";
+import { runXopcEmbeddedTurn } from "./embedded/run-turn.js";
+import { runWithEmbeddedExecutionSession } from "./embedded/execution-context.js";
 import { MessageRouter } from "./messaging/message-router.js";
 import { CommandHandler } from "./messaging/command-handler.js";
 import { StreamManager } from "./messaging/stream-manager.js";
@@ -65,7 +62,10 @@ import { AgentOrchestrator } from "./orchestration/agent-orchestrator.js";
 import { AgentEventHandler } from "./orchestration/agent-event-handler.js";
 import "./orchestration/index.js";
 import { getWorkflowProgressBroker } from "./workflow/progress-broker.js";
+import { resolveResponseLanguageForSession } from "./prompt/response-language.js";
 import "./workflow/index.js";
+import { normalizeSkillInstallTarget } from "./skills/install-target.js";
+import { AgentManager } from "./agent-manager.js";
 import { TaskJudgeService } from "./tasks/task-judge-service.js";
 import { analyzeResponseLanguage } from "../i18n/language-consistency.js";
 import { readFile } from "node:fs/promises";

package/dist/src/agent/session/session-inspector.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { init_workspace_defaults, resolveDefaultAgentWorkspaceDir } from "../../config/workspace-defaults.js";
-import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { init_providers, resolveModel } from "../../providers/index.js";
+import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { getExecutionEnvironmentForSession } from "../../execution-environments/subject.js";
 import { effectiveWorkspacePathForSession, projectWorkspacePath } from "../../session/session-workspace.js";
 import { getProjectForSession } from "../../projects/workspace.js";

package/dist/src/agent/skills/filesystem-watcher.js

@@ -2,10 +2,10 @@ import { resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { init_paths, resolveSkillsDir } from "../../config/paths.js";
+import { isManagedSkillTransientDirName } from "./managed-store.js";
 import { createSkillConfigManager } from "./config.js";
 import { resolveWorkspaceSkillsDir } from "./workspace-skills-dir.js";
 import { resolveAgentsSkillsDir, resolveWorkspaceAgentsSkillsDir } from "./skill-sources.js";
-import { isManagedSkillTransientDirName } from "./managed-store.js";
 import path from "node:path";
 import chokidar from "chokidar";
 //#region src/agent/skills/filesystem-watcher.ts

package/dist/src/agent/skills/hub-lock.js

@@ -1,5 +1,5 @@
-import { init_paths, resolveSkillsLockPath } from "../../config/paths.js";
 import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
+import { init_paths, resolveSkillsLockPath } from "../../config/paths.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/agent/skills/hub-lock.ts
 /**

package/dist/src/agent/skills/hub-pull.js

@@ -1,15 +1,15 @@
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
-import { formatScanSummary, scanSkillDirectory } from "./scanner.js";
-import { computeSkillTreeHashSync } from "./hub-hash.js";
 import { getSkillsLockEntry, recordSkillsHubInstall } from "./hub-lock.js";
 import { installSkillFromZip, isIgnorableZipEntry, isValidSkillId, prepareManagedSkillTempDir, promoteManagedSkillTempDir } from "./managed-store.js";
+import { formatScanSummary, scanSkillDirectory } from "./scanner.js";
+import { computeSkillTreeHashSync } from "./hub-hash.js";
 import { tmpdir } from "node:os";
 import { basename, dirname, join, normalize, resolve, sep } from "node:path";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { execFileSync } from "node:child_process";
-import { fetch } from "undici";
 import AdmZip from "adm-zip";
+import { fetch } from "undici";
 //#region src/agent/skills/hub-pull.ts
 /**
 * CLI / hub: install or update skills from git or archive (zip / tar.gz) into ~/.xopc/skills.

package/dist/src/agent/skills/marketplace/adapters/store/adapter.js

@@ -1,6 +1,6 @@
+import { downloadSkillZipBuffer, fetchMarketplacePackageDetail, listSkillCategories, listSkillPackages, resolveSkillZipDownloadUrl, resolveSkillsStoreBaseUrl, skillIdForMarketplaceInstall, verifyStoreArtifactSha256 } from "./store-api-client.js";
 import { registerMarketplaceAdapter } from "../../registry.js";
 import { buildSkillMarkdownPreviewFromRaw } from "../../../skill-markdown-preview-from-raw.js";
-import { downloadSkillZipBuffer, fetchMarketplacePackageDetail, listSkillCategories, listSkillPackages, resolveSkillZipDownloadUrl, resolveSkillsStoreBaseUrl, skillIdForMarketplaceInstall, verifyStoreArtifactSha256 } from "./store-api-client.js";
 //#region src/agent/skills/marketplace/adapters/store/adapter.ts
 const storeMarketplaceAdapter = {
 	id: "store",

package/dist/src/agent/skills/marketplace/adapters/store/store-api-client.js

@@ -1,6 +1,6 @@
 import { init_resolution, resolveConnectedPlatformEndpoint } from "../../../../../platform/resolution.js";
-import { MAX_SKILL_ZIP_BYTES, isValidSkillId } from "../../../managed-store.js";
 import { MAX_EXTENSION_STORE_ZIP_BYTES } from "../../../../../extensions/store-zip-limits.js";
+import { MAX_SKILL_ZIP_BYTES, isValidSkillId } from "../../../managed-store.js";
 import { createHash } from "node:crypto";
 //#region src/agent/skills/marketplace/adapters/store/store-api-client.ts
 /**

package/dist/src/agent/tasks/task-judge-service.js

@@ -1,15 +1,15 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { TaskRunRepository } from "../../tasks/task-run-repository.js";
+import { extractAssistantText, getAssistantMessageErrorReason, stripCodeFences } from "../../providers/model-response.js";
 import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
-import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { getApiKey, init_providers, resolveModel } from "../../providers/index.js";
-import { TaskRepository } from "../../tasks/task-repository.js";
-import { TaskConversationRepository } from "../../tasks/task-conversation-repository.js";
-import { readWorkspaceRevision } from "../coding/workspace-revision.js";
 import { completeWithResolvedCredentials } from "../../providers/model-call.js";
+import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
+import { readWorkspaceRevision } from "../coding/workspace-revision.js";
+import { TaskRepository } from "../../tasks/task-repository.js";
 import { TaskApplicationService } from "../../tasks/task-application-service.js";
-import { extractAssistantText, getAssistantMessageErrorReason, stripCodeFences } from "../../providers/model-response.js";
+import { TaskConversationRepository } from "../../tasks/task-conversation-repository.js";
 //#region src/agent/tasks/task-judge-service.ts
 init_schema();
 init_providers();

package/dist/src/agent/tools/apply-patch.js

@@ -1,9 +1,7 @@
-import { checkFileSafety } from "../prompt/safety.js";
-import { resolvePathUnderWorkspace } from "./tool-paths.js";
-import { evaluateFilePolicy } from "../sandbox/exec-policy.js";
+import { checkedFilePath, deleteWorkspaceFile, readWorkspaceFile, writeWorkspaceFile } from "../sandbox/fileAccess.js";
 import { detectLineEnding, generateDiffString, normalizeToLF, restoreLineEndings } from "./edit-diff.js";
-import { dirname, relative } from "node:path";
-import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { relative } from "node:path";
+import { stat } from "node:fs/promises";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/apply-patch.ts
 const ApplyPatchSchema = Type.Object({ patch: Type.String({ description: [
@@ -128,19 +126,11 @@ function applyHunks(original, hunks, path) {
 	}
 	return content;
 }
-async function readExisting(path) {
-	return readFile(path, "utf-8");
+async function readExisting(workspace, path) {
+	return readWorkspaceFile(workspace, path).toString("utf8");
 }
 async function assertWritable(workspace, path) {
-	const quick = checkFileSafety("write", path);
-	if (!quick.allowed) throw new Error(quick.message ?? `Cannot write ${path}`);
-	const policy = evaluateFilePolicy({
-		operation: "write",
-		path,
-		workspaceRoot: workspace
-	});
-	if (!policy.allowed) throw new Error(`Sandbox: ${policy.reason}`);
-	return resolvePathUnderWorkspace(path, workspace);
+	return checkedFilePath(workspace, path, "write");
 }
 async function pathExists(path) {
 	try {
@@ -178,7 +168,7 @@ async function buildPatchPlan(workspace, parsed) {
 		if (op.kind === "delete") {
 			const target = await assertWritable(workspace, op.path);
 			rememberTarget(target);
-			const oldContent = await readExisting(target);
+			const oldContent = await readExisting(workspace, target);
 			const diff = generateDiffString(oldContent, "", op.path);
 			const counts = countDiff(diff);
 			changes.push({
@@ -193,7 +183,7 @@ async function buildPatchPlan(workspace, parsed) {
 		}
 		const target = await assertWritable(workspace, op.path);
 		rememberTarget(target);
-		const oldContent = await readExisting(target);
+		const oldContent = await readExisting(workspace, target);
 		const lineEnding = detectLineEnding(oldContent);
 		const newContent = restoreLineEndings(applyHunks(normalizeToLF(oldContent), op.hunks, op.path), lineEnding);
 		const destination = op.moveTo ? await assertWritable(workspace, op.moveTo) : target;
@@ -217,33 +207,28 @@ async function buildPatchPlan(workspace, parsed) {
 	}
 	return changes;
 }
-async function commitPatchPlan(changes) {
+async function commitPatchPlan(workspace, changes) {
 	const committed = [];
 	try {
 		for (const change of changes) {
 			committed.push(change);
-			if (change.kind === "add") {
-				await mkdir(dirname(change.absolutePath), { recursive: true });
-				await writeFile(change.absolutePath, change.newContent ?? "", "utf-8");
-			} else if (change.kind === "delete") await rm(change.absolutePath);
+			if (change.kind === "add") writeWorkspaceFile(workspace, change.absolutePath, change.newContent ?? "");
+			else if (change.kind === "delete") deleteWorkspaceFile(workspace, change.absolutePath);
 			else {
 				const destination = change.absoluteMoveTo ?? change.absolutePath;
-				await mkdir(dirname(destination), { recursive: true });
-				await writeFile(destination, change.newContent ?? "", "utf-8");
-				if (destination !== change.absolutePath) await rm(change.absolutePath);
+				writeWorkspaceFile(workspace, destination, change.newContent ?? "");
+				if (destination !== change.absolutePath) deleteWorkspaceFile(workspace, change.absolutePath);
 			}
 		}
 	} catch (error) {
 		for (const change of committed.reverse()) try {
-			if (change.kind === "add") await rm(change.absolutePath, { force: true });
-			else if (change.kind === "delete") {
-				await mkdir(dirname(change.absolutePath), { recursive: true });
-				await writeFile(change.absolutePath, change.oldContent ?? "", "utf-8");
-			} else if (change.absoluteMoveTo) {
-				await rm(change.absoluteMoveTo, { force: true });
-				await mkdir(dirname(change.absolutePath), { recursive: true });
-				await writeFile(change.absolutePath, change.oldContent ?? "", "utf-8");
-			} else await writeFile(change.absolutePath, change.oldContent ?? "", "utf-8");
+			if (change.kind === "add") {
+				if (await pathExists(change.absolutePath)) deleteWorkspaceFile(workspace, change.absolutePath);
+			} else if (change.kind === "delete") writeWorkspaceFile(workspace, change.absolutePath, change.oldContent ?? "");
+			else if (change.absoluteMoveTo) {
+				if (await pathExists(change.absoluteMoveTo)) deleteWorkspaceFile(workspace, change.absoluteMoveTo);
+				writeWorkspaceFile(workspace, change.absolutePath, change.oldContent ?? "");
+			} else writeWorkspaceFile(workspace, change.absolutePath, change.oldContent ?? "");
 		} catch {}
 		throw error;
 	}
@@ -262,12 +247,14 @@ function createApplyPatchTool(workspace) {
 		finalGuardRelevant: true,
 		async execute(_toolCallId, params) {
 			try {
-				const changes = await buildPatchPlan(workspace, parsePatch(params.patch ?? ""));
-				await commitPatchPlan(changes);
+				const parsed = parsePatch(params.patch ?? "");
+				const canonicalWorkspace = checkedFilePath(workspace, workspace, "write");
+				const changes = await buildPatchPlan(canonicalWorkspace, parsed);
+				await commitPatchPlan(canonicalWorkspace, changes);
 				const diff = changes.map((change) => change.diff).join("\n");
 				const added = changes.reduce((sum, change) => sum + change.added, 0);
 				const removed = changes.reduce((sum, change) => sum + change.removed, 0);
-				const files = changes.map((change) => relative(workspace, change.absoluteMoveTo ?? change.absolutePath));
+				const files = changes.map((change) => relative(canonicalWorkspace, change.absoluteMoveTo ?? change.absolutePath));
 				const summary = changes.map((change) => {
 					const display = change.moveTo ? `${change.path} -> ${change.moveTo}` : change.path;
 					return `${change.kind}: ${display} (+${change.added}/-${change.removed})`;