agent-gear 1.1.10 → 1.2.0

package/src/acp/bridge.ts

@@ -298,6 +298,8 @@ export class AcpSessionBridge extends EventEmitter implements acp.Client {
       this.acpSessionId = externalSessionId;
       this.initializing = false;
 
+      // 初始 mode/model 在 acp:initialized 之前应用（时序同 start：initialized → resume:result → prompt 补发）
+      await this.applyInitialModeModel();
       this.emit('acp:initialized', this.buildInitializedPayload(result));
     } catch (error) {
       // resumeSession may fail if agent doesn't support session.resume
@@ -311,6 +313,7 @@ export class AcpSessionBridge extends EventEmitter implements acp.Client {
         this.acpSessionId = result.sessionId;
         this.initializing = false;
 
+        await this.applyInitialModeModel();
         this.emit('acp:initialized', this.buildInitializedPayload(result));
       } catch (fallbackError) {
         this.initializing = false;
@@ -322,8 +325,14 @@ export class AcpSessionBridge extends EventEmitter implements acp.Client {
   async stop(): Promise<void> {
     try {
       if (this.acpSessionId && this.connection) {
-        await this.connection.cancel({ sessionId: this.acpSessionId });
-        await this.connection.closeSession({ sessionId: this.acpSessionId });
+        // 5s timeout for cancel/closeSession to prevent hanging
+        await Promise.race([
+          (async () => {
+            await this.connection!.cancel({ sessionId: this.acpSessionId! });
+            await this.connection!.closeSession({ sessionId: this.acpSessionId! });
+          })(),
+          new Promise<void>((resolve) => setTimeout(resolve, 5000)),
+        ]);
       }
     } catch { /* ignore */ }
     this.activePrompt = null;

package/src/acp/process-registry.integration.test.ts

@@ -0,0 +1,65 @@
+import { describe, it, expect, vi, beforeEach, afterAll } from 'vitest';
+import { rmSync, existsSync, readFileSync } from 'fs';
+import { join } from 'path';
+
+// Real-filesystem integration test: no fs mock. REGISTRY_DIR is redirected to a
+// unique temp dir via the os mock so the module-level constant picks it up at
+// import time. The dir itself is created lazily by the registry's ensureDir.
+const TEST_HOME = vi.hoisted(() =>
+  `${process.env.TMPDIR ?? '/tmp'}/zag-registry-it-${process.pid}-${Math.random().toString(36).slice(2)}`);
+
+vi.mock('os', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('os')>();
+  return { ...actual, homedir: () => TEST_HOME };
+});
+
+import { ProcessRegistry } from './process-registry.js';
+
+const REGISTRY_DIR = join(TEST_HOME, '.zag');
+const REGISTRY_FILE = join(REGISTRY_DIR, 'processes.json');
+
+describe('ProcessRegistry (real fs integration)', () => {
+  beforeEach(() => {
+    rmSync(REGISTRY_DIR, { recursive: true, force: true });
+  });
+
+  afterAll(() => {
+    rmSync(TEST_HOME, { recursive: true, force: true });
+  });
+
+  it('persists registered entries to disk and reloads them', () => {
+    const registry = new ProcessRegistry();
+    registry.register('s1', { pid: process.pid, cwd: '/tmp/project', acpServerType: 'opencode' });
+
+    expect(existsSync(REGISTRY_FILE)).toBe(true);
+    const onDisk = JSON.parse(readFileSync(REGISTRY_FILE, 'utf-8'));
+    expect(onDisk.version).toBe(1);
+    expect(onDisk.processes).toHaveLength(1);
+    expect(onDisk.processes[0].sessionId).toBe('s1');
+
+    const reloaded = new ProcessRegistry();
+    expect(reloaded.get('s1')).toBeDefined();
+    expect(reloaded.get('s1')!.pid).toBe(process.pid);
+  });
+
+  it('deregister removes the entry from disk', () => {
+    const registry = new ProcessRegistry();
+    registry.register('s1', { pid: process.pid, cwd: '/tmp', acpServerType: 'opencode' });
+    registry.deregister('s1');
+
+    const onDisk = JSON.parse(readFileSync(REGISTRY_FILE, 'utf-8'));
+    expect(onDisk.processes).toHaveLength(0);
+    expect(new ProcessRegistry().get('s1')).toBeUndefined();
+  });
+
+  it('prunes dead PIDs on load', () => {
+    const registry = new ProcessRegistry();
+    registry.register('alive', { pid: process.pid, cwd: '/tmp', acpServerType: 'opencode' });
+    // PID beyond common pid_max values, must not exist
+    registry.register('dead', { pid: 4194304 + 12345, cwd: '/tmp', acpServerType: 'opencode' });
+
+    const reloaded = new ProcessRegistry();
+    expect(reloaded.get('alive')).toBeDefined();
+    expect(reloaded.get('dead')).toBeUndefined();
+  });
+});

package/src/acp/process-registry.test.ts

@@ -0,0 +1,239 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { join } from 'path';
+import { homedir } from 'os';
+
+const REGISTRY_DIR = join(homedir(), '.zag');
+const REGISTRY_FILE = join(REGISTRY_DIR, 'processes.json');
+
+vi.mock('fs', () => ({
+  existsSync: vi.fn(() => false),
+  readFileSync: vi.fn(() => { throw new Error('ENOENT'); }),
+  writeFileSync: vi.fn(),
+  mkdirSync: vi.fn(),
+  renameSync: vi.fn(),
+  unlinkSync: vi.fn(),
+}));
+
+vi.mock('os', () => ({
+  homedir: vi.fn(() => '/home/test'),
+  tmpdir: vi.fn(() => '/tmp'),
+}));
+
+import { ProcessRegistry } from './process-registry.js';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync } from 'fs';
+
+function getMockFs() {
+  return {
+    existsSync: vi.mocked(existsSync),
+    readFileSync: vi.mocked(readFileSync),
+    writeFileSync: vi.mocked(writeFileSync),
+    mkdirSync: vi.mocked(mkdirSync),
+    renameSync: vi.mocked(renameSync),
+  };
+}
+
+describe('ProcessRegistry', () => {
+  let registry: ProcessRegistry;
+  let fs: ReturnType<typeof getMockFs>;
+  let processKillSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    fs = getMockFs();
+    processKillSpy = vi.spyOn(process, 'kill').mockReturnValue(true as any);
+    // Default: file doesn't exist
+    fs.existsSync.mockReturnValue(false);
+    registry = new ProcessRegistry();
+  });
+
+  afterEach(() => {
+    processKillSpy.mockRestore();
+  });
+
+  describe('constructor / load', () => {
+    it('should create empty registry when file does not exist', () => {
+      expect(registry.list()).toEqual([]);
+    });
+
+    it('should create empty registry on malformed JSON', () => {
+      fs.existsSync.mockReturnValue(true);
+      fs.readFileSync.mockReturnValue('not valid json{{{');
+      const reg = new ProcessRegistry();
+      expect(reg.list()).toEqual([]);
+    });
+
+    it('should create empty registry on invalid schema (missing version)', () => {
+      fs.existsSync.mockReturnValue(true);
+      fs.readFileSync.mockReturnValue(JSON.stringify({ processes: [] }));
+      const reg = new ProcessRegistry();
+      expect(reg.list()).toEqual([]);
+    });
+
+    it('should create empty registry on invalid schema (missing processes)', () => {
+      fs.existsSync.mockReturnValue(true);
+      fs.readFileSync.mockReturnValue(JSON.stringify({ version: 1 }));
+      const reg = new ProcessRegistry();
+      expect(reg.list()).toEqual([]);
+    });
+
+    it('should load alive processes from registry file', () => {
+      fs.existsSync.mockReturnValue(true);
+      fs.readFileSync.mockReturnValue(JSON.stringify({
+        version: 1,
+        processes: [
+          { sessionId: 's1', pid: process.pid, cwd: '/tmp', acpServerType: 'opencode', startedAt: '2026-01-01T00:00:00Z' },
+        ],
+      }));
+      // process.kill(pid, 0) returns true for current process
+      processKillSpy.mockImplementation((pid: number, _sig?: any) => {
+        if (_sig === 0 && pid === process.pid) return true;
+        throw new Error('ESRCH');
+      });
+
+      const reg = new ProcessRegistry();
+      expect(reg.list()).toHaveLength(1);
+      expect(reg.get('s1')).toBeDefined();
+    });
+
+    it('should treat EPERM (process owned by another user) as alive', () => {
+      fs.existsSync.mockReturnValue(true);
+      fs.readFileSync.mockReturnValue(JSON.stringify({
+        version: 1,
+        processes: [
+          { sessionId: 's1', pid: 4242, cwd: '/tmp', acpServerType: 'opencode', startedAt: '2026-01-01T00:00:00Z' },
+        ],
+      }));
+      processKillSpy.mockImplementation(() => {
+        const err = new Error('kill EPERM') as NodeJS.ErrnoException;
+        err.code = 'EPERM';
+        throw err;
+      });
+
+      const reg = new ProcessRegistry();
+      expect(reg.list()).toHaveLength(1);
+      expect(reg.get('s1')).toBeDefined();
+    });
+
+    it('should prune dead processes on load and rewrite file', () => {
+      fs.existsSync.mockReturnValue(true);
+      fs.readFileSync.mockReturnValue(JSON.stringify({
+        version: 1,
+        processes: [
+          { sessionId: 's1', pid: 99999, cwd: '/tmp', acpServerType: 'opencode', startedAt: '2026-01-01T00:00:00Z' },
+        ],
+      }));
+      // pid 99999 is dead
+      processKillSpy.mockImplementation(() => { throw new Error('ESRCH'); });
+
+      const reg = new ProcessRegistry();
+      expect(reg.list()).toHaveLength(0);
+      // Should have rewritten file with empty list
+      expect(fs.writeFileSync).toHaveBeenCalled();
+    });
+  });
+
+  describe('register', () => {
+    it('should register a process', () => {
+      registry.register('s1', { pid: 1234, cwd: '/tmp/project', acpServerType: 'opencode' });
+      const entry = registry.get('s1');
+      expect(entry).toBeDefined();
+      expect(entry!.pid).toBe(1234);
+      expect(entry!.cwd).toBe('/tmp/project');
+      expect(entry!.acpServerType).toBe('opencode');
+    });
+
+    it('should persist to file on register', () => {
+      registry.register('s1', { pid: 1234, cwd: '/tmp', acpServerType: 'opencode' });
+      expect(fs.writeFileSync).toHaveBeenCalled();
+      const written = JSON.parse(fs.writeFileSync.mock.calls[0][1] as string);
+      expect(written.version).toBe(1);
+      expect(written.processes).toHaveLength(1);
+      expect(written.processes[0].sessionId).toBe('s1');
+    });
+
+    it('should write the temp file inside REGISTRY_DIR (same-filesystem atomic rename)', () => {
+      registry.register('s1', { pid: 1234, cwd: '/tmp', acpServerType: 'opencode' });
+      const tmpPath = fs.writeFileSync.mock.calls[0][0] as string;
+      expect(tmpPath.startsWith(REGISTRY_DIR)).toBe(true);
+      expect(tmpPath).not.toBe(REGISTRY_FILE);
+      expect(fs.renameSync).toHaveBeenCalledWith(tmpPath, REGISTRY_FILE);
+    });
+
+    it('should not throw when flush fails (e.g. unwritable directory)', () => {
+      fs.writeFileSync.mockImplementation(() => { throw new Error('EROFS: read-only file system'); });
+      expect(() => registry.register('s1', { pid: 1234, cwd: '/tmp', acpServerType: 'opencode' })).not.toThrow();
+      expect(registry.get('s1')).toBeDefined();
+    });
+
+    it('should use provided startedAt', () => {
+      registry.register('s1', { pid: 1234, cwd: '/tmp', acpServerType: 'opencode', startedAt: '2026-01-01' });
+      expect(registry.get('s1')!.startedAt).toBe('2026-01-01');
+    });
+
+    it('should auto-generate startedAt if not provided', () => {
+      registry.register('s1', { pid: 1234, cwd: '/tmp', acpServerType: 'opencode' });
+      expect(registry.get('s1')!.startedAt).toBeTruthy();
+    });
+  });
+
+  describe('deregister', () => {
+    it('should deregister an existing entry', () => {
+      registry.register('s1', { pid: 1234, cwd: '/tmp', acpServerType: 'opencode' });
+      const result = registry.deregister('s1');
+      expect(result).toBe(true);
+      expect(registry.get('s1')).toBeUndefined();
+    });
+
+    it('should return false for non-existent entry', () => {
+      const result = registry.deregister('nonexistent');
+      expect(result).toBe(false);
+    });
+
+    it('should persist to file on deregister', () => {
+      registry.register('s1', { pid: 1234, cwd: '/tmp', acpServerType: 'opencode' });
+      vi.mocked(writeFileSync).mockClear();
+      registry.deregister('s1');
+      expect(fs.writeFileSync).toHaveBeenCalled();
+    });
+
+    it('should not persist if entry did not exist', () => {
+      vi.mocked(writeFileSync).mockClear();
+      registry.deregister('nonexistent');
+      expect(fs.writeFileSync).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('list', () => {
+    it('should return all entries without sessionId', () => {
+      registry.register('s1', { pid: 111, cwd: '/a', acpServerType: 'opencode' });
+      registry.register('s2', { pid: 222, cwd: '/b', acpServerType: 'claude_code' });
+      const list = registry.list();
+      expect(list).toHaveLength(2);
+      expect(list[0]).not.toHaveProperty('sessionId');
+      expect(list[1]).not.toHaveProperty('sessionId');
+    });
+  });
+
+  describe('listEntries', () => {
+    it('should return all entries with sessionId', () => {
+      registry.register('s1', { pid: 111, cwd: '/a', acpServerType: 'opencode' });
+      const entries = registry.listEntries();
+      expect(entries).toHaveLength(1);
+      expect(entries[0].sessionId).toBe('s1');
+    });
+  });
+
+  describe('get', () => {
+    it('should return entry by sessionId without sessionId field', () => {
+      registry.register('s1', { pid: 1234, cwd: '/tmp', acpServerType: 'opencode' });
+      const entry = registry.get('s1');
+      expect(entry).toBeDefined();
+      expect(entry).not.toHaveProperty('sessionId');
+      expect(entry!.pid).toBe(1234);
+    });
+
+    it('should return undefined for non-existent sessionId', () => {
+      expect(registry.get('nonexistent')).toBeUndefined();
+    });
+  });
+});

package/src/acp/process-registry.ts

@@ -0,0 +1,139 @@
+import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+
+const REGISTRY_DIR = join(homedir(), '.zag');
+const REGISTRY_FILE = join(REGISTRY_DIR, 'processes.json');
+
+interface ProcessEntry {
+  sessionId: string;
+  pid: number;
+  cwd: string;
+  acpServerType: string;
+  startedAt: string;
+}
+
+interface RegistryFile {
+  version: 1;
+  processes: ProcessEntry[];
+}
+
+export interface ProcessInfo {
+  pid: number;
+  cwd: string;
+  acpServerType: string;
+  startedAt: string;
+}
+
+function ensureDir(): void {
+  if (!existsSync(REGISTRY_DIR)) {
+    mkdirSync(REGISTRY_DIR, { recursive: true });
+  }
+}
+
+export function isProcessAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    // EPERM: process exists but is owned by another user — alive, not dead
+    return (err as NodeJS.ErrnoException).code === 'EPERM';
+  }
+}
+
+function readRaw(): RegistryFile | null {
+  if (!existsSync(REGISTRY_FILE)) return null;
+  try {
+    const content = readFileSync(REGISTRY_FILE, 'utf-8');
+    const parsed = JSON.parse(content) as unknown;
+    if (!parsed || typeof parsed !== 'object') return null;
+    const obj = parsed as Record<string, unknown>;
+    if (obj.version !== 1 || !Array.isArray(obj.processes)) return null;
+    return { version: 1, processes: obj.processes as ProcessEntry[] };
+  } catch {
+    return null;
+  }
+}
+
+function writeRaw(data: RegistryFile): void {
+  ensureDir();
+  // Temp file lives inside REGISTRY_DIR: rename is only atomic on the same
+  // filesystem (writing to os.tmpdir() first breaks with EXDEV on Linux).
+  const tmpFile = join(REGISTRY_DIR, `processes-${Date.now()}-${Math.random().toString(36).slice(2)}.json.tmp`);
+  writeFileSync(tmpFile, JSON.stringify(data, null, 2), 'utf-8');
+  renameSync(tmpFile, REGISTRY_FILE);
+}
+
+export class ProcessRegistry {
+  private processes: Map<string, ProcessEntry> = new Map();
+
+  constructor() {
+    this.load();
+  }
+
+  private load(): void {
+    const raw = readRaw();
+    if (!raw) {
+      this.processes = new Map();
+      return;
+    }
+
+    const alive = new Map<string, ProcessEntry>();
+    for (const entry of raw.processes) {
+      if (isProcessAlive(entry.pid)) {
+        alive.set(entry.sessionId, entry);
+      }
+    }
+
+    if (alive.size !== raw.processes.length) {
+      writeRaw({ version: 1, processes: Array.from(alive.values()) });
+    }
+
+    this.processes = alive;
+  }
+
+  register(sessionId: string, info: Omit<ProcessInfo, 'startedAt'> & { startedAt?: string }): void {
+    const entry: ProcessEntry = {
+      sessionId,
+      pid: info.pid,
+      cwd: info.cwd,
+      acpServerType: info.acpServerType,
+      startedAt: info.startedAt ?? new Date().toISOString(),
+    };
+    this.processes.set(sessionId, entry);
+    this.flush();
+  }
+
+  deregister(sessionId: string): boolean {
+    const existed = this.processes.delete(sessionId);
+    if (existed) this.flush();
+    return existed;
+  }
+
+  list(): ProcessInfo[] {
+    return Array.from(this.processes.values()).map(({ sessionId: _, ...rest }) => rest);
+  }
+
+  listEntries(): ProcessEntry[] {
+    return Array.from(this.processes.values());
+  }
+
+  get(sessionId: string): ProcessInfo | undefined {
+    const entry = this.processes.get(sessionId);
+    if (!entry) return undefined;
+    const { sessionId: _, ...rest } = entry;
+    return rest;
+  }
+
+  private flush(): void {
+    try {
+      writeRaw({ version: 1, processes: Array.from(this.processes.values()) });
+    } catch (err) {
+      // Persistence is best-effort: a flush failure must never crash the
+      // controller (this can be called from timer callbacks).
+      console.warn(`[ProcessRegistry] flush failed: ${(err as Error).message}`);
+    }
+  }
+}
+
+export const processRegistry = new ProcessRegistry();

package/src/acp/spawner.ts

@@ -1,4 +1,4 @@
-import { spawn, execFileSync, type ChildProcess, type SpawnOptions } from 'child_process';
+import { spawn, execFileSync, execFile, type ChildProcess, type SpawnOptions } from 'child_process';
 import { Writable, Readable } from 'node:stream';
 import { existsSync, mkdirSync } from 'fs';
 import { platform } from 'os';
@@ -37,7 +37,14 @@ export class AcpSpawner {
       stdio: ['pipe', 'pipe', 'pipe'],
     };
     if (platform() === 'win32') {
-      spawnOptions.shell = true;
+      // .cmd/.bat cannot be spawned without a shell since Node 18.20.2/20.12.2
+      // (CVE-2024-27980, spawn throws EINVAL); real executables spawn directly
+      // (no shell) for reliable taskkill targeting.
+      if (/\.(cmd|bat)$/i.test(cmd)) {
+        spawnOptions.shell = true;
+      }
+    } else {
+      spawnOptions.detached = true;
     }
 
     this.process = spawn(cmd, this.args, spawnOptions);
@@ -71,20 +78,29 @@ export class AcpSpawner {
     return this._closed;
   }
 
+  get pid(): number | null {
+    return this.process?.pid ?? null;
+  }
+
   stop(): void {
     if (!this.process) return;
-    if (platform() === 'win32') {
+    const pid = this.process.pid;
+    if (!pid) {
       this.process.kill();
-      setTimeout(() => {
-        if (this.process) {
-          this.process.kill();
+      return;
+    }
+    if (platform() === 'win32') {
+      execFile('taskkill', ['/PID', String(pid), '/T', '/F'], (err) => {
+        if (err) {
+          try { process.kill(pid, 'SIGKILL'); } catch { /* process already gone */ }
         }
-      }, 5000);
+      });
     } else {
-      this.process.kill('SIGTERM');
+      process.kill(-pid, 'SIGTERM');
       setTimeout(() => {
-        if (this.process) {
-          this.process.kill('SIGKILL');
+        // Only send SIGKILL if process is still running
+        if (this.process && this.process.pid === pid) {
+          try { process.kill(-pid, 'SIGKILL'); } catch { /* process already gone */ }
         }
       }, 5000);
     }

package/src/fs-handler.test.ts

@@ -2,9 +2,15 @@ import { describe, it, expect, vi, beforeEach } from 'vitest';
 
 vi.mock('fs', () => ({
   mkdirSync: vi.fn(),
+  rmSync: vi.fn(),
+}));
+
+vi.mock('os', () => ({
+  homedir: vi.fn(() => '/home/testuser'),
 }));
 
 import { FsHandler } from './fs-handler.js';
+import { mkdirSync, rmSync } from 'fs';
 
 describe('FsHandler', () => {
   let handler: FsHandler;
@@ -24,7 +30,6 @@ describe('FsHandler', () => {
     });
 
     it('should handle creation failure', async () => {
-      const { mkdirSync } = await import('fs');
       vi.mocked(mkdirSync).mockImplementation(() => {
         throw new Error('EEXIST: file already exists');
       });
@@ -34,5 +39,104 @@ describe('FsHandler', () => {
       expect(result.success).toBe(false);
       expect(result.error).toBeDefined();
     });
+
+    it('should reject system-critical paths', async () => {
+      const result = await handler.mkdir('/etc', 'evil');
+
+      expect(result.success).toBe(false);
+      expect(mkdirSync).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('removeDir whitelist', () => {
+    it('should reject the filesystem root', async () => {
+      const result = await handler.removeDir('/');
+
+      expect(result.success).toBe(false);
+      expect(rmSync).not.toHaveBeenCalled();
+    });
+
+    it('should reject the user home directory', async () => {
+      const result = await handler.removeDir('/home/testuser');
+
+      expect(result.success).toBe(false);
+      expect(rmSync).not.toHaveBeenCalled();
+    });
+
+    it('should reject ancestors of the home directory', async () => {
+      const result = await handler.removeDir('/home');
+
+      expect(result.success).toBe(false);
+      expect(rmSync).not.toHaveBeenCalled();
+    });
+
+    it('should reject the current working directory and its ancestors', async () => {
+      for (const target of [process.cwd(), '/']) {
+        const result = await handler.removeDir(target);
+        expect(result.success).toBe(false);
+      }
+      expect(rmSync).not.toHaveBeenCalled();
+    });
+
+    it('should reject Windows drive roots and system paths', async () => {
+      for (const target of ['C:\\', 'C:\\Windows', 'c:\\Users', 'D:\\']) {
+        const result = await handler.removeDir(target);
+        expect(result.success).toBe(false);
+      }
+      expect(rmSync).not.toHaveBeenCalled();
+    });
+
+    it('should reject arbitrary unregistered directories under home', async () => {
+      const result = await handler.removeDir('/home/testuser/Documents');
+
+      expect(result.success).toBe(false);
+      expect(rmSync).not.toHaveBeenCalled();
+    });
+
+    it('should allow a registered worktree path', async () => {
+      handler.registerAllowedPath('/home/testuser/workspaces/wt-1');
+
+      const result = await handler.removeDir('/home/testuser/workspaces/wt-1');
+
+      expect(result.success).toBe(true);
+      expect(rmSync).toHaveBeenCalledWith('/home/testuser/workspaces/wt-1', { recursive: true, force: true });
+    });
+
+    it('should allow subpaths of a registered worktree path', async () => {
+      handler.registerAllowedPath('/home/testuser/workspaces/wt-1');
+
+      const result = await handler.removeDir('/home/testuser/workspaces/wt-1/nested/dir');
+
+      expect(result.success).toBe(true);
+      expect(rmSync).toHaveBeenCalled();
+    });
+
+    it('should reject sibling paths that merely share a prefix', async () => {
+      handler.registerAllowedPath('/home/testuser/workspaces/wt-1');
+
+      const result = await handler.removeDir('/home/testuser/workspaces/wt-1-evil');
+
+      expect(result.success).toBe(false);
+      expect(rmSync).not.toHaveBeenCalled();
+    });
+
+    it('should reject a path after it is unregistered', async () => {
+      handler.registerAllowedPath('/home/testuser/workspaces/wt-1');
+      handler.unregisterAllowedPath('/home/testuser/workspaces/wt-1');
+
+      const result = await handler.removeDir('/home/testuser/workspaces/wt-1');
+
+      expect(result.success).toBe(false);
+      expect(rmSync).not.toHaveBeenCalled();
+    });
+
+    it('should refuse to register explicitly denied paths as allowed roots', async () => {
+      handler.registerAllowedPath('/');
+      handler.registerAllowedPath('/home/testuser');
+
+      expect((await handler.removeDir('/home/testuser/Documents')).success).toBe(false);
+      expect((await handler.removeDir('/')).success).toBe(false);
+      expect(rmSync).not.toHaveBeenCalled();
+    });
   });
-});
+});