@xopcai/xopc 0.0.277 → 0.0.278

package/dist/src/agent/tools/create-share-tool.js

@@ -1,16 +1,18 @@
 import { turnOutcomeKindFromFileName } from "../../../packages/gateway-contract/src/turn-outcome.js";
-import { resolvePathUnderWorkspace } from "./tool-paths.js";
 import { resolveGatewayEffectiveHost } from "../../config/gateway-bind.js";
+import { resolveReverseProxyPublicUrl } from "../../gateway/public-url.js";
+import { resolvePathUnderWorkspace } from "./tool-paths.js";
+import { assertWorkspaceTreeReadable, checkedFilePath } from "../sandbox/fileAccess.js";
 import { resolveShareConfig } from "../../share/share-config.js";
 import { mergeWithDefaults } from "../../share/site-share-config.js";
 import { getShareStore } from "../../share/share-store.js";
 import { getSiteShareStore } from "../../share/site-share-store.js";
 import { resolveShareUrl, resolveSiteShareUrl } from "../../share/share-url.js";
 import { publishHostedStaticSite } from "../../share/hosted-static-site-publish.js";
-import { resolveReverseProxyPublicUrl } from "../../gateway/public-url.js";
 import { audienceDefaults, decideShareKind, makeDescription, makeTitle, probeShareTarget, rememberStagedSite, stageSingleHtmlAsSite } from "../../share/share-auto.js";
 import { scheduleThumbnail } from "../../share/share-thumbnail.js";
 import { resolveToolLocale, shareToolErrorLine, shareToolSuccessLines } from "../../i18n/share-tool-bundle.js";
+import { relative } from "node:path";
 import { createHash } from "node:crypto";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/create-share-tool.ts
@@ -87,9 +89,15 @@ function createCreateShareTool(deps) {
 				reverseProxyPublicUrl: resolveReverseProxyPublicUrl(cfg)
 			};
 			const tokenHash = hashCreator(deps.getAgentId?.() ?? "agent-tool");
-			const absolutePath = resolvePathUnderWorkspace(p.filePath, workspace);
-			if (!absolutePath.startsWith(workspace)) return errorResult(locale, "File must be inside the agent workspace.");
-			const relPath = absolutePath === workspace ? "" : absolutePath.slice(workspace.length).replace(/^[\\/]+/, "").replace(/\\/g, "/");
+			let relPath;
+			try {
+				const root = checkedFilePath(workspace, workspace, "read");
+				const absolutePath = checkedFilePath(workspace, resolvePathUnderWorkspace(p.filePath, workspace), "read");
+				relPath = relative(root, absolutePath).replace(/\\/g, "/");
+				if (relPath) assertWorkspaceTreeReadable(workspace, absolutePath);
+			} catch (err) {
+				return errorResult(locale, `Cannot read target: ${err instanceof Error ? err.message : String(err)}`);
+			}
 			if (!relPath) return errorResult(locale, "Cannot share the workspace root itself.");
 			let probe;
 			try {

package/dist/src/agent/tools/delegate-tool.js

@@ -1,10 +1,10 @@
+import { runGit } from "../../execution-environments/git.js";
+import { LocalWorktreeManager } from "../../execution-environments/local-worktree-manager.js";
+import { SessionEnvironmentService } from "../../execution-environments/session-environment-service.js";
 import { readWorkspaceRevision } from "../coding/workspace-revision.js";
 import { EXTERNAL_TOOL_NAMES } from "../external-tools/gateway-tools.js";
 import "../external-tools/index.js";
 import { createDelegateChildHandle } from "../child-agent-factory.js";
-import { runGit } from "../../execution-environments/git.js";
-import { LocalWorktreeManager } from "../../execution-environments/local-worktree-manager.js";
-import { SessionEnvironmentService } from "../../execution-environments/session-environment-service.js";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/delegate-tool.ts
 const DEFAULT_DELEGATE_TOOLS = [

package/dist/src/agent/tools/exec-command.js

@@ -1,6 +1,6 @@
 import { commandRegistry, commandTimeout } from "../commands/command-registry.js";
-import { formatSize, truncateTail } from "./truncate.js";
 import { evaluateExecPolicy } from "../sandbox/exec-policy.js";
+import { formatSize, truncateTail } from "./truncate.js";
 import { publishArtifactPaths } from "./publish-artifacts.js";
 import { resolve } from "node:path";
 import { Type } from "@sinclair/typebox";
@@ -93,6 +93,7 @@ function createExecCommandTool(workspaceCwd, options) {
 			const policy = evaluateExecPolicy({
 				command,
 				cwd: requestedCwd,
+				workspaceRoot: workspaceCwd,
 				allowedEnvVars: options?.getSkillPassthroughEnvVarNames?.() ?? []
 			});
 			if (!policy.allowed) {

package/dist/src/agent/tools/executor.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { withRetry } from "../../infra/retry.js";
 import { commandTimeout } from "../commands/command-registry.js";
 import { DEFAULT_TOOL_EXECUTION_TIMEOUT_MS, TimeoutError, executeWithTimeout } from "../lifecycle/timeout-wrapper.js";
-import { withRetry } from "../../infra/retry.js";
 import { ToolConcurrencyController, resolveToolLockMode } from "./concurrency.js";
 //#region src/agent/tools/executor.ts
 init_logger();

package/dist/src/agent/tools/factory.js

@@ -7,15 +7,24 @@ import { getSessionMetadata } from "../../storage/sqlite/session-repository.js";
 import { getSessionTaskPlan, setSessionTaskPlan } from "../../storage/sqlite/session-task-plan-repository.js";
 import "../../storage/sqlite/index.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../agent-scope.js";
-import { resolveEffectiveAgentConfigForSession } from "../../config/agent-profile.js";
+import { BrowserRuntime } from "../../browser/runtime/browser-runtime.js";
 import "../../../packages/browser-control-contract/src/index.js";
-import { getEmbeddedExecutionRunId, getEmbeddedExecutionSession } from "../embedded/execution-context.js";
+import { createBrowserDriver } from "../../browser/drivers/create-driver.js";
+import { checkBrowserReadiness } from "../../browser/readiness.js";
+import "../../browser/index.js";
+import { mergeTtsConfigFromAppConfig } from "../../voice/tts/merge-config.js";
+import { resolveEffectiveAgentConfigForSession } from "../../config/agent-profile.js";
+import { createWorkflowCatalog } from "../workflow/catalog.js";
+import { buildRuntimeEnvironment } from "../../runtime-tools/environment.js";
+import { skillEnvironmentId } from "../skills/installer.js";
 import { wrapToolsWithProtection } from "./executor.js";
 import { EXTERNAL_TOOL_NAMES } from "../external-tools/gateway-tools.js";
-import { buildRuntimeEnvironment } from "../../runtime-tools/environment.js";
 import { createDefaultExternalToolGatewayTools } from "../external-tools/index.js";
+import { resolveUserContextSessionAccess } from "../../user-context/access-policy.js";
+import { getPendingTranscriptUserText } from "../inbound/attachment-pipeline.js";
+import { getEmbeddedExecutionRunId, getEmbeddedExecutionSession } from "../embedded/execution-context.js";
+import { createDelegateTool } from "./delegate-tool.js";
 import { createReadFileTool } from "./read.js";
-import { skillEnvironmentId } from "../skills/installer.js";
 import { createWriteFileTool } from "./write.js";
 import { createListDirTool } from "./list-dir.js";
 import { createPublishArtifactsTool } from "./publish-artifacts.js";
@@ -38,12 +47,6 @@ import { createUpdatePlanTool } from "./update-plan-tool.js";
 import { createSessionStatusTool } from "./session-status-tool.js";
 import { createMemoryMaintenanceTool } from "./memory-maintenance-tool.js";
 import { createClarifyTool } from "./clarify-tool.js";
-import { BrowserRuntime } from "../../browser/runtime/browser-runtime.js";
-import { createBrowserDriver } from "../../browser/drivers/create-driver.js";
-import { checkBrowserReadiness } from "../../browser/readiness.js";
-import "../../browser/index.js";
-import { getPendingTranscriptUserText } from "../inbound/attachment-pipeline.js";
-import { createDelegateTool } from "./delegate-tool.js";
 import { createWorkflowTool } from "./workflow-tool.js";
 import { createAutomationTool } from "./automation-tool.js";
 import { createBrowserAutomationTool } from "./browser-automation-tool.js";
@@ -58,12 +61,9 @@ import { createManagedJobTool } from "./managed-job-tool.js";
 import { createImageTool } from "./image-tool.js";
 import { createImageGenerateTool } from "./image-generate-tool.js";
 import "./index.js";
-import { resolveUserContextSessionAccess } from "../../user-context/access-policy.js";
 import { createBrowserUseTool } from "./browser/tool/browser-use-tool.js";
 import { createReviewWorkspaceTool } from "./review-workspace.js";
 import { createLanguageDiagnosticsTool } from "./language-diagnostics.js";
-import { createWorkflowCatalog } from "../workflow/catalog.js";
-import { mergeTtsConfigFromAppConfig } from "../../voice/tts/merge-config.js";
 import { createTextToSpeechTool } from "./tts-tool.js";
 import { getAgentCapabilityToolNames } from "../capabilities/registry.js";
 import "../capabilities/index.js";

package/dist/src/agent/tools/find.js

@@ -1,6 +1,6 @@
 import { evaluateFilePolicy } from "../sandbox/exec-policy.js";
 import { resolveToCwd } from "../../utils/helpers.js";
-import { repositorySearch } from "./repository-search.js";
+import { isSearchFileAllowed, repositorySearch } from "./repository-search.js";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/find.ts
 const findSchema = Type.Object({
@@ -20,20 +20,22 @@ function createFindTool(cwd) {
 		supportsParallel: true,
 		idempotent: true,
 		async execute(_id, params, signal) {
-			const path = resolveToCwd(params.path || ".", cwd);
+			let path = resolveToCwd(params.path || ".", cwd);
 			const policy = evaluateFilePolicy({
 				operation: "read",
 				path,
 				workspaceRoot: cwd
 			});
 			if (!policy.allowed) throw new Error(policy.reason);
+			path = policy.canonicalPath;
 			const result = await repositorySearch(path, [
 				"--files",
+				"--null",
 				"--glob",
 				params.pattern
 			], signal);
 			const limit = Math.min(1e4, Math.max(1, params.limit ?? 1e3));
-			const lines = result.output.trimEnd().split("\n").filter(Boolean).sort();
+			const lines = result.output.split("\0").slice(0, -1).filter((file) => file && isSearchFileAllowed(cwd, resolveToCwd(file, path))).sort();
 			const truncated = result.truncated || lines.length > limit;
 			return {
 				content: [{

package/dist/src/agent/tools/grep.js

@@ -1,6 +1,6 @@
 import { evaluateFilePolicy } from "../sandbox/exec-policy.js";
 import { resolveToCwd } from "../../utils/helpers.js";
-import { repositorySearch } from "./repository-search.js";
+import { isSearchFileAllowed, repositorySearch } from "./repository-search.js";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/grep.ts
 const grepSchema = Type.Object({
@@ -27,15 +27,17 @@ function createGrepTool(cwd) {
 		supportsParallel: true,
 		idempotent: true,
 		async execute(_id, params, signal) {
-			const path = resolveToCwd(params.path || ".", cwd);
+			let path = resolveToCwd(params.path || ".", cwd);
 			const policy = evaluateFilePolicy({
 				operation: "read",
 				path,
 				workspaceRoot: cwd
 			});
 			if (!policy.allowed) throw new Error(policy.reason);
+			path = policy.canonicalPath;
 			const limit = Math.min(1e3, Math.max(1, params.limit ?? 100));
 			const result = await repositorySearch(cwd, [
+				"--json",
 				"--line-number",
 				"--with-filename",
 				"--color",
@@ -55,13 +57,28 @@ function createGrepTool(cwd) {
 				"--",
 				path
 			], signal);
-			const lines = result.output.trimEnd().split("\n");
+			const lines = [];
+			for (const row of result.output.split("\n")) {
+				if (!row) continue;
+				let event;
+				try {
+					event = JSON.parse(row);
+				} catch {
+					if (result.truncated) continue;
+					throw new Error("Invalid search output");
+				}
+				if (event.type !== "match" && event.type !== "context") continue;
+				const data = event.data;
+				if (!data?.path?.text || !data.lines?.text || !isSearchFileAllowed(cwd, data.path.text)) continue;
+				const separator = event.type === "match" ? ":" : "-";
+				lines.push(`${data.path.text}${separator}${data.line_number}${separator}${data.lines.text.replace(/\r?\n$/, "")}`);
+			}
 			const outputLimit = limit * (1 + 2 * (params.context ?? 0));
 			const truncated = result.truncated || lines.length > outputLimit;
 			return {
 				content: [{
 					type: "text",
-					text: (result.output ? lines.slice(0, outputLimit).join("\n") : "No matches found") + (truncated ? "\n[Results truncated; narrow the path or pattern.]" : "")
+					text: (lines.length ? lines.slice(0, outputLimit).join("\n") : "No matches found") + (truncated ? "\n[Results truncated; narrow the path or pattern.]" : "")
 				}],
 				details: { truncated }
 			};

package/dist/src/agent/tools/image-generate-tool.js

@@ -1,15 +1,15 @@
 import { getAgentDefaultImageGenerationModelConfig, init_schema } from "../../config/schema.js";
 import { imageAssetFromDataUrl, imageFileExtensionForMimeType, mimeTypeFromFileName, parseImageDataUrl, sniffImageMimeType } from "../image/generation/image-assets.js";
-import { persistToolMedia } from "./tool-media.js";
+import { getImageGenerationProvider } from "../image/generation/provider-registry.js";
 import { buildCapabilityPlansForConfig } from "../../capabilities/readiness/from-config.js";
 import "../../capabilities/readiness/index.js";
 import { applyImageGenerationModelConfigDefaults } from "../image/image-helpers.js";
+import { readWorkspaceFile, writeWorkspaceFile } from "../sandbox/fileAccess.js";
+import { persistToolMedia } from "./tool-media.js";
 import { isFailoverError } from "../failover-error.js";
-import { getImageGenerationProvider } from "../image/generation/provider-registry.js";
 import { generateImage, listImageGenerationProvidersSummary } from "../image/generation/runtime.js";
 import path from "node:path";
 import { randomBytes } from "node:crypto";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/image-generate-tool.ts
 init_schema();
@@ -114,7 +114,7 @@ async function loadInputImages(params) {
 		if (resolved !== workspaceAbs && !resolved.startsWith(workspaceAbs + path.sep)) throw new ToolInputError("inputImages[].source escapes workspace.");
 		let buffer;
 		try {
-			buffer = await readFile(resolved);
+			buffer = readWorkspaceFile(params.workspace, resolved);
 		} catch (e) {
 			throw new ToolInputError(`inputImages[].source not readable: ${e instanceof Error ? e.message : String(e)}`);
 		}
@@ -173,7 +173,6 @@ function resolveImageGenerationModelConfigForTool(params) {
 }
 async function saveGeneratedImages(params) {
 	const dir = path.join(params.workspace, "media", "generated");
-	await mkdir(dir, { recursive: true });
 	const out = [];
 	const random = randomBytes(4).toString("hex");
 	let i = 0;
@@ -182,7 +181,7 @@ async function saveGeneratedImages(params) {
 		const ext = imageFileExtensionForMimeType(img.mimeType);
 		const name = `${(params.filenameHint?.replace(/[^\w.-]/g, "") || "image") + `-${random}`}-${i}.${ext}`;
 		const full = path.join(dir, name);
-		await writeFile(full, img.buffer);
+		writeWorkspaceFile(params.workspace, full, img.buffer);
 		out.push(full);
 	}
 	return out;

package/dist/src/agent/tools/index.js

@@ -1,5 +1,10 @@
+import { assertBrowserUrlAllowed } from "../../browser/url-policy.js";
+import { BrowserRuntime } from "../../browser/runtime/browser-runtime.js";
+import "../../browser/index.js";
 import { DEFAULT_TOOL_METADATA, getToolMetadata } from "./metadata.js";
 import { ToolConcurrencyController, resolveToolLockMode } from "./concurrency.js";
+import { resolveImageModelConfigForTool } from "../image/tool-model-config.js";
+import { DEFAULT_DELEGATE_TOOLS, DELEGATE_BLOCKED_TOOLS, createDelegateTool } from "./delegate-tool.js";
 import { DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, GREP_MAX_LINE_LENGTH, formatSize, truncateHead, truncateLine, truncateTail } from "./truncate.js";
 import { createReadFileTool } from "./read.js";
 import { createWriteFileTool, writeFileTool } from "./write.js";
@@ -25,11 +30,6 @@ import { createUpdatePlanTool } from "./update-plan-tool.js";
 import { createSessionStatusTool } from "./session-status-tool.js";
 import { createMemoryMaintenanceTool } from "./memory-maintenance-tool.js";
 import { createClarifyTool } from "./clarify-tool.js";
-import { assertBrowserUrlAllowed } from "../../browser/url-policy.js";
-import { BrowserRuntime } from "../../browser/runtime/browser-runtime.js";
-import "../../browser/index.js";
-import { resolveImageModelConfigForTool } from "../image/tool-model-config.js";
-import { DEFAULT_DELEGATE_TOOLS, DELEGATE_BLOCKED_TOOLS, createDelegateTool } from "./delegate-tool.js";
 import { createWorkflowTool } from "./workflow-tool.js";
 import { createAutomationTool } from "./automation-tool.js";
 import { createBrowserAutomationTool } from "./browser-automation-tool.js";

package/dist/src/agent/tools/list-dir.js

@@ -1,4 +1,5 @@
 import { resolvePathUnderWorkspace } from "./tool-paths.js";
+import { checkedFilePath } from "../sandbox/fileAccess.js";
 import { readdir } from "fs/promises";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/list-dir.ts
@@ -16,7 +17,7 @@ function createListDirTool(workspace) {
 				return {
 					content: [{
 						type: "text",
-						text: (await readdir(resolvePathUnderWorkspace(params.path, workspace), { withFileTypes: true })).map((e) => {
+						text: (await readdir(checkedFilePath(workspace, resolvePathUnderWorkspace(params.path, workspace), "read"), { withFileTypes: true })).map((e) => {
 							return `${e.isDirectory() ? "d" : e.isFile() ? "f" : "?"} ${e.name}`;
 						}).join("\n") || "(empty)"
 					}],

package/dist/src/agent/tools/managed-job-tool.js

@@ -71,6 +71,7 @@ function createManagedJobTool(workspace, getSessionKey, getSkillPassthroughEnvVa
 				error: "command is required"
 			});
 			const policy = evaluateExecPolicy({
+				workspaceRoot: workspace,
 				command,
 				cwd: resolve(workspace, input.cwd?.trim() || "."),
 				allowedEnvVars: getSkillPassthroughEnvVarNames?.() ?? []

package/dist/src/agent/tools/publish-artifacts.js

@@ -1,10 +1,11 @@
 import { turnOutcomeKindFromFileName, turnOutcomeMimeTypeFromFileName } from "../../../packages/gateway-contract/src/turn-outcome.js";
-import { resolvePathUnderWorkspace } from "./tool-paths.js";
 import { fileResourceId, fileSpaceId } from "../../files/file-service.js";
+import { resolvePathUnderWorkspace } from "./tool-paths.js";
 import { evaluateFilePolicy } from "../sandbox/exec-policy.js";
+import { readWorkspaceFile } from "../sandbox/fileAccess.js";
 import { persistToolMedia } from "./tool-media.js";
 import { basename, isAbsolute, relative, sep } from "node:path";
-import { readFile, realpath } from "node:fs/promises";
+import { realpath } from "node:fs/promises";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/publish-artifacts.ts
 const PublishArtifactsSchema = Type.Object({ paths: Type.Array(Type.String({ minLength: 1 }), {
@@ -35,7 +36,7 @@ async function publishArtifactPaths(params) {
 				if (sourcePath !== ".." && !sourcePath.startsWith(`..${sep}`) && !isAbsolute(sourcePath)) sourceFileId = fileResourceId(fileSpaceId(root), sourcePath.split(sep).join("/"));
 			}
 			const media = await persistToolMedia({
-				buffer: await readFile(source),
+				buffer: readWorkspaceFile(params.workspaceRoot, source),
 				filePath: resolved
 			});
 			const kind = turnOutcomeKindFromFileName(media.name);

package/dist/src/agent/tools/read.js

@@ -1,7 +1,8 @@
+import { isBareProfileMarkdownFileName, resolvePathUnderWorkspace, resolveProfileMarkdownPathIfBareName } from "./tool-paths.js";
+import { checkedFilePath, readWorkspaceFile } from "../sandbox/fileAccess.js";
 import { checkFileSafety } from "../prompt/safety.js";
 import { DEFAULT_MAX_BYTES, formatSize, truncateHead } from "./truncate.js";
-import { isBareProfileMarkdownFileName, resolvePathUnderWorkspace, resolveProfileMarkdownPathIfBareName } from "./tool-paths.js";
-import { readFile, stat } from "fs/promises";
+import { stat } from "fs/promises";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/read.ts
 const MAX_FILE_SIZE = 10 * 1024 * 1024;
@@ -41,7 +42,8 @@ async function executeReadFile(workspace, profileMarkdownRoot, params) {
 			}],
 			details: { status: "failed" }
 		};
-		let normalized = resolvePathUnderWorkspace(params.path, workspace);
+		let activeRoot = workspace;
+		let normalized = checkedFilePath(activeRoot, resolvePathUnderWorkspace(params.path, workspace), "read");
 		let stats;
 		try {
 			stats = await stat(normalized);
@@ -49,8 +51,9 @@ async function executeReadFile(workspace, profileMarkdownRoot, params) {
 			if (e?.code === "ENOENT" && profileMarkdownRoot && isBareProfileMarkdownFileName(params.path)) {
 				const alt = resolveProfileMarkdownPathIfBareName(params.path, profileMarkdownRoot);
 				try {
-					stats = await stat(alt);
-					normalized = alt;
+					normalized = checkedFilePath(profileMarkdownRoot, alt, "read");
+					stats = await stat(normalized);
+					activeRoot = profileMarkdownRoot;
 				} catch {
 					throw e;
 				}
@@ -63,7 +66,7 @@ async function executeReadFile(workspace, profileMarkdownRoot, params) {
 			}],
 			details: { status: "failed" }
 		};
-		const content = await readFile(normalized, "utf-8");
+		const content = readWorkspaceFile(activeRoot, normalized, MAX_FILE_SIZE).toString("utf8");
 		const offset = Math.max(1, params.offset ?? 1);
 		const lines = content.split("\n");
 		if (offset > lines.length) throw new Error(`Offset ${offset} exceeds ${lines.length} lines`);

package/dist/src/agent/tools/repository-search.d.ts

@@ -3,3 +3,5 @@ export declare function repositorySearch(cwd: string, args: string[], signal?: A
     output: string;
     truncated: boolean;
 }>;
+/** Search results must satisfy the same policy as direct file reads. */
+export declare function isSearchFileAllowed(workspace: string, path: string): boolean;

package/dist/src/agent/tools/repository-search.js

@@ -1,4 +1,7 @@
+import { prepareSafeToolEnv } from "../sandbox/sanitize-env-vars.js";
+import { evaluateFilePolicy } from "../sandbox/exec-policy.js";
 import { resolveRipgrepBinary } from "../../infra/ripgrep.js";
+import { lstatSync } from "node:fs";
 import { spawn } from "node:child_process";
 //#region src/agent/tools/repository-search.ts
 /** Bounded native search; unavailable tools and invalid regexes are explicit failures. */
@@ -6,15 +9,41 @@ async function repositorySearch(cwd, args, signal) {
 	signal?.throwIfAborted();
 	const binary = await resolveRipgrepBinary();
 	return new Promise((resolve, reject) => {
+		const separator = args.indexOf("--");
+		const options = separator < 0 ? args : args.slice(0, separator);
+		const targets = separator < 0 ? [] : args.slice(separator);
+		const excluded = [
+			".git",
+			"node_modules",
+			".env",
+			".env.*",
+			".ssh",
+			".aws",
+			".gnupg",
+			".docker",
+			".config",
+			".netrc",
+			".npmrc",
+			".cargo/credentials",
+			".kube",
+			".xopc"
+		];
 		const child = spawn(binary, [
 			"--no-config",
 			"--hidden",
-			"--glob",
-			"!.git",
-			"--glob",
-			"!node_modules",
-			...args
-		], { cwd });
+			...options,
+			...excluded.flatMap((path) => [
+				"--glob",
+				`!**/${path}`,
+				"--glob",
+				`!**/${path}/**`
+			]),
+			"--no-follow",
+			...targets
+		], {
+			cwd,
+			env: prepareSafeToolEnv(process.env)
+		});
 		const chunks = [];
 		let bytes = 0, truncated = false, stderr = "";
 		const timer = setTimeout(() => child.kill("SIGKILL"), 1e4);
@@ -52,5 +81,20 @@ async function repositorySearch(cwd, args, signal) {
 		if (signal?.aborted) abort();
 	});
 }
+/** Search results must satisfy the same policy as direct file reads. */
+function isSearchFileAllowed(workspace, path) {
+	const policy = evaluateFilePolicy({
+		operation: "read",
+		workspaceRoot: workspace,
+		path
+	});
+	if (!policy.allowed || !policy.canonicalPath) return false;
+	try {
+		const stat = lstatSync(policy.canonicalPath);
+		return stat.isFile() && stat.nlink === 1;
+	} catch {
+		return false;
+	}
+}
 //#endregion
-export { repositorySearch };
+export { isSearchFileAllowed, repositorySearch };

package/dist/src/agent/tools/review-workspace.js

@@ -1,7 +1,10 @@
+import { prepareSafeToolEnv } from "../sandbox/sanitize-env-vars.js";
 import { readWorkspaceRevision } from "../coding/workspace-revision.js";
+import { evaluateFilePolicy } from "../sandbox/exec-policy.js";
+import { checkedFilePath, readWorkspaceFile } from "../sandbox/fileAccess.js";
 import { resolve } from "node:path";
 import { execFile } from "node:child_process";
-import { lstat, readFile, readlink, realpath } from "node:fs/promises";
+import { lstat, readlink, realpath } from "node:fs/promises";
 import { promisify } from "node:util";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/review-workspace.ts
@@ -15,62 +18,125 @@ function createReviewWorkspaceTool(workspace) {
 		supportsParallel: true,
 		idempotent: true,
 		async execute(_id, _args, signal) {
-			let cwd = workspace;
+			let cwd = checkedFilePath(workspace, workspace, "read");
 			const git = async (args) => (await exec("git", [
 				"-c",
 				"core.fsmonitor=false",
 				...args
 			], {
 				cwd,
+				env: prepareSafeToolEnv(process.env),
 				signal,
 				timeout: 1e4,
 				maxBuffer: 8 * 1024 * 1024
 			})).stdout;
-			cwd = await realpath((await git(["rev-parse", "--show-toplevel"])).trim());
+			cwd = checkedFilePath(workspace, await realpath((await git(["rev-parse", "--show-toplevel"])).trim()), "read");
 			const startRevision = await readWorkspaceRevision(cwd);
 			const head = await git([
 				"rev-parse",
 				"--verify",
 				"HEAD"
 			]).catch(() => "");
-			const [diff, names] = await Promise.all([head ? git([
+			const changedNames = head ? await git([
 				"diff",
+				"--no-renames",
+				"--name-only",
+				"-z",
+				"HEAD",
+				"--"
+			]) : (await Promise.all([git([
+				"diff",
+				"--name-only",
+				"-z",
+				"--cached",
+				"--"
+			]), git([
+				"diff",
+				"--name-only",
+				"-z",
+				"--"
+			])])).join("");
+			const safePaths = [];
+			let complete = true;
+			for (const path of new Set(changedNames.split("\0").filter(Boolean))) {
+				const file = resolve(cwd, path);
+				if (!evaluateFilePolicy({
+					workspaceRoot: workspace,
+					path: file,
+					operation: "read"
+				}).allowed) {
+					complete = false;
+					continue;
+				}
+				const info = await lstat(file).catch((error) => {
+					if (error.code === "ENOENT") return null;
+					throw error;
+				});
+				if (info && (!info.isFile() || info.nlink !== 1)) {
+					complete = false;
+					continue;
+				}
+				safePaths.push(`:(literal)${path}`);
+			}
+			if (safePaths.length > 1e3) throw new Error("Too many changed files for a bounded workspace review");
+			const [diff, names] = await Promise.all([safePaths.length === 0 ? Promise.resolve("") : head ? git([
+				"diff",
+				"--no-renames",
 				"--no-ext-diff",
 				"--no-textconv",
 				"--binary",
 				"HEAD",
-				"--"
+				"--",
+				...safePaths
 			]) : Promise.all([git([
 				"diff",
+				"--no-renames",
 				"--no-ext-diff",
 				"--no-textconv",
 				"--binary",
 				"--cached",
-				"--"
+				"--",
+				...safePaths
 			]), git([
 				"diff",
+				"--no-renames",
 				"--no-ext-diff",
 				"--no-textconv",
 				"--binary",
-				"--"
+				"--",
+				...safePaths
 			])]).then((parts) => parts.join("\n")), git([
 				"ls-files",
 				"--others",
 				"--exclude-standard",
 				"-z"
 			])]);
-			let text = diff.slice(0, 2e5), complete = diff.length <= 2e5;
+			let text = diff.slice(0, 2e5);
+			complete &&= diff.length <= 2e5;
 			for (const path of names.split("\0").filter(Boolean)) {
 				signal?.throwIfAborted();
 				if (text.length >= 2e5) {
 					complete = false;
 					break;
 				}
-				const file = resolve(cwd, path), info = await lstat(file);
+				const file = resolve(cwd, path);
+				if (!evaluateFilePolicy({
+					workspaceRoot: workspace,
+					path: file,
+					operation: "read"
+				}).allowed) {
+					complete = false;
+					continue;
+				}
+				const info = await lstat(file);
+				if (info.isFile() && info.nlink !== 1) {
+					complete = false;
+					continue;
+				}
 				text += `\nUntracked file: ${path}\n`;
 				if (info.isSymbolicLink()) text += `Symlink to ${await readlink(file)}\n`;
 				else if (info.isFile() && info.size <= 5e4) {
-					const content = await readFile(file);
+					const content = readWorkspaceFile(workspace, file, 5e4);
 					if (content.includes(0)) {
 						text += "(binary file; inspect separately)\n";
 						complete = false;

package/dist/src/agent/tools/send-media.js

@@ -1,13 +1,14 @@
 import { turnOutcomeKindFromFileName } from "../../../packages/gateway-contract/src/turn-outcome.js";
-import { checkFileSafety } from "../prompt/safety.js";
 import { resolvePathUnderWorkspace } from "./tool-paths.js";
+import { MEDIA_MAX_BYTES } from "../../media/store.js";
+import { readWorkspaceFile } from "../sandbox/fileAccess.js";
+import { checkFileSafety } from "../prompt/safety.js";
 import { persistToolMedia } from "./tool-media.js";
 import { basename } from "node:path";
-import { readFile } from "fs/promises";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/send-media.ts
 const SendMediaSchema = Type.Object({
-	filePath: Type.String({ description: "File to send. Relative paths are under the current agent workspace; absolute paths are used as given." }),
+	filePath: Type.String({ description: "File to send. Relative paths are under the current agent workspace; absolute paths must remain inside the workspace." }),
 	mediaType: Type.Optional(Type.Enum({
 		photo: "photo",
 		video: "video",
@@ -42,7 +43,7 @@ function createSendMediaTool(workspace, bus, getContext) {
 				details: {}
 			};
 			try {
-				const fileBuffer = await readFile(resolved);
+				const fileBuffer = readWorkspaceFile(workspace, resolved, MEDIA_MAX_BYTES);
 				const media = await persistToolMedia({
 					buffer: fileBuffer,
 					filePath: resolved,