aiden-runtime 4.1.4 → 4.5.0

package/dist/tools/v4/browser/browserExtract.js

@@ -18,7 +18,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.browserExtractTool = void 0;
 const playwrightBridge_1 = require("../../../core/playwrightBridge");
-exports.browserExtractTool = {
+const _observer_1 = require("./_observer");
+const _browserExtractTool = {
     schema: {
         name: 'browser_extract',
         description: 'Extract the visible text content of the current browser page. Requires the browser to be on a page (navigate first using a Phase-8 navigation tool, or via the search-then-click flow).',
@@ -30,6 +31,7 @@ exports.browserExtractTool = {
     category: 'browser',
     mutates: false,
     toolset: 'browser',
+    riskTier: 'safe', // v4.4 Phase 1
     async execute() {
         const r = await (0, playwrightBridge_1.pwSnapshot)();
         if (r.ok)
@@ -37,3 +39,5 @@ exports.browserExtractTool = {
         return { success: false, error: r.error };
     },
 };
+// v4.3 Phase 1 — observer HOC.
+exports.browserExtractTool = (0, _observer_1.withBrowserState)(_browserExtractTool);

package/dist/tools/v4/browser/browserFill.js

@@ -17,7 +17,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.browserFillTool = void 0;
 const playwrightBridge_1 = require("../../../core/playwrightBridge");
-exports.browserFillTool = {
+const _observer_1 = require("./_observer");
+const _browserFillTool = {
     schema: {
         name: 'browser_fill',
         description: 'Fill multiple form fields. Pass `fields` as an object mapping CSS selectors to text values.',
@@ -35,6 +36,19 @@ exports.browserFillTool = {
     category: 'browser',
     mutates: true,
     toolset: 'browser',
+    riskTier: 'caution', // v4.4 Phase 1
+    buildPreview(args) {
+        const fields = (args.fields ?? {});
+        const keys = fields && typeof fields === 'object' ? Object.keys(fields) : [];
+        return {
+            tool: 'browser_fill',
+            args,
+            riskTier: 'caution',
+            sideEffects: [{ type: 'browser_action', action: 'fill', target: keys.join(', ') }],
+            detectedRisks: [],
+            summary: `Would fill ${keys.length} form field${keys.length === 1 ? '' : 's'}: ${keys.join(', ')}`,
+        };
+    },
     async execute(args) {
         const fields = (args.fields ?? {});
         if (!fields || typeof fields !== 'object' || Array.isArray(fields)) {
@@ -57,3 +71,5 @@ exports.browserFillTool = {
         return { success: true, filled, count: filled.length };
     },
 };
+// v4.3 Phase 1 — observer HOC.
+exports.browserFillTool = (0, _observer_1.withBrowserState)(_browserFillTool);

package/dist/tools/v4/browser/browserGetUrl.js

@@ -16,7 +16,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.browserGetUrlTool = void 0;
 const playwrightBridge_1 = require("../../../core/playwrightBridge");
-exports.browserGetUrlTool = {
+const _observer_1 = require("./_observer");
+const _browserGetUrlTool = {
     schema: {
         name: 'browser_get_url',
         description: 'Return the URL of the page currently loaded in the browser. Useful for verifying navigation succeeded after a click.',
@@ -28,6 +29,7 @@ exports.browserGetUrlTool = {
     category: 'browser',
     mutates: false,
     toolset: 'browser',
+    riskTier: 'safe', // v4.4 Phase 1
     async execute() {
         const r = await (0, playwrightBridge_1.pwGetUrl)();
         if (r.ok)
@@ -35,3 +37,5 @@ exports.browserGetUrlTool = {
         return { success: false, error: r.error };
     },
 };
+// v4.3 Phase 1 — observer HOC.
+exports.browserGetUrlTool = (0, _observer_1.withBrowserState)(_browserGetUrlTool);

package/dist/tools/v4/browser/browserNavigate.js

@@ -18,7 +18,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.browserNavigateTool = void 0;
 const playwrightBridge_1 = require("../../../core/playwrightBridge");
 const captchaCheck_1 = require("./captchaCheck");
-exports.browserNavigateTool = {
+const _observer_1 = require("./_observer");
+const _browserNavigateTool = {
     schema: {
         name: 'browser_navigate',
         description: 'Navigate the browser to a URL. Reuses the active tab; opens one if none exists. ' +
@@ -35,6 +36,18 @@ exports.browserNavigateTool = {
     category: 'browser',
     mutates: true,
     toolset: 'browser',
+    riskTier: 'caution', // v4.4 Phase 1
+    buildPreview(args) {
+        const url = String(args.url ?? '');
+        return {
+            tool: 'browser_navigate',
+            args,
+            riskTier: 'caution',
+            sideEffects: [{ type: 'browser_action', action: 'navigate', url }],
+            detectedRisks: [],
+            summary: `Would navigate browser to: ${url}`,
+        };
+    },
     async execute(args) {
         const url = String(args.url ?? '').trim();
         if (!url)
@@ -73,3 +86,5 @@ exports.browserNavigateTool = {
         return { success: true, url: r.url };
     },
 };
+// v4.3 Phase 1 — observer HOC.
+exports.browserNavigateTool = (0, _observer_1.withBrowserState)(_browserNavigateTool);

package/dist/tools/v4/browser/browserScreenshot.js

@@ -22,7 +22,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.browserScreenshotTool = void 0;
 const playwrightBridge_1 = require("../../../core/playwrightBridge");
-exports.browserScreenshotTool = {
+const _observer_1 = require("./_observer");
+const _browserScreenshotTool = {
     schema: {
         name: 'browser_screenshot',
         description: 'Take a screenshot of the current browser page (the page you previously navigated to). Saves to disk and returns the file path. Requires that the browser was opened earlier in this session.',
@@ -34,6 +35,7 @@ exports.browserScreenshotTool = {
     category: 'browser',
     mutates: false,
     toolset: 'browser',
+    riskTier: 'safe', // v4.4 Phase 1
     async execute() {
         const r = await (0, playwrightBridge_1.pwScreenshot)();
         if (r.ok)
@@ -41,3 +43,5 @@ exports.browserScreenshotTool = {
         return { success: false, error: r.error };
     },
 };
+// v4.3 Phase 1 — observer HOC.
+exports.browserScreenshotTool = (0, _observer_1.withBrowserState)(_browserScreenshotTool);

package/dist/tools/v4/browser/browserScroll.js

@@ -17,7 +17,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.browserScrollTool = void 0;
 const playwrightBridge_1 = require("../../../core/playwrightBridge");
-exports.browserScrollTool = {
+const _observer_1 = require("./_observer");
+const _browserScrollTool = {
     schema: {
         name: 'browser_scroll',
         description: 'Scroll the browser page (or a specific element via `selector`). `direction` ∈ up|down|top|bottom; `amount` is pixels for up/down (default 500).',
@@ -43,6 +44,20 @@ exports.browserScrollTool = {
     category: 'browser',
     mutates: true,
     toolset: 'browser',
+    riskTier: 'caution', // v4.4 Phase 1
+    buildPreview(args) {
+        const direction = String(args.direction ?? 'down');
+        const amount = typeof args.amount === 'number' ? args.amount : 500;
+        const selector = typeof args.selector === 'string' ? args.selector : '';
+        return {
+            tool: 'browser_scroll',
+            args,
+            riskTier: 'caution',
+            sideEffects: [{ type: 'browser_action', action: `scroll:${direction}`, target: selector || 'window' }],
+            detectedRisks: [],
+            summary: `Would scroll browser ${direction}${direction === 'up' || direction === 'down' ? ` ${amount}px` : ''}${selector ? ` (${selector})` : ''}`,
+        };
+    },
     async execute(args) {
         const directionRaw = String(args.direction ?? 'down').toLowerCase();
         const direction = ['up', 'down', 'top', 'bottom'].includes(directionRaw)
@@ -56,3 +71,5 @@ exports.browserScrollTool = {
         return { success: false, error: r.error };
     },
 };
+// v4.3 Phase 1 — observer HOC.
+exports.browserScrollTool = (0, _observer_1.withBrowserState)(_browserScrollTool);

package/dist/tools/v4/browser/browserType.js

@@ -15,7 +15,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.browserTypeTool = void 0;
 const playwrightBridge_1 = require("../../../core/playwrightBridge");
-exports.browserTypeTool = {
+const _observer_1 = require("./_observer");
+const _browserTypeTool = {
     schema: {
         name: 'browser_type',
         description: 'Type text into a browser input identified by CSS selector. Replaces existing value.',
@@ -34,6 +35,19 @@ exports.browserTypeTool = {
     category: 'browser',
     mutates: true,
     toolset: 'browser',
+    riskTier: 'caution', // v4.4 Phase 1
+    buildPreview(args) {
+        const selector = String(args.selector ?? 'input');
+        const text = String(args.text ?? '');
+        return {
+            tool: 'browser_type',
+            args,
+            riskTier: 'caution',
+            sideEffects: [{ type: 'browser_action', action: 'type', target: selector }],
+            detectedRisks: [],
+            summary: `Would type ${text.length} chars into ${selector}`,
+        };
+    },
     async execute(args) {
         const selector = String(args.selector ?? 'input').trim();
         const text = String(args.text ?? '');
@@ -43,3 +57,5 @@ exports.browserTypeTool = {
         return { success: false, error: r.error, selector };
     },
 };
+// v4.3 Phase 1 — observer HOC captures pre/post page state.
+exports.browserTypeTool = (0, _observer_1.withBrowserState)(_browserTypeTool);

package/dist/tools/v4/browser/captchaCheck.js

@@ -57,10 +57,14 @@ exports.CAPTCHA_MARKERS = [
     'request unsuccessful',
     'reference number',
     'this website is using a security service',
-    // hCaptcha / reCAPTCHA explicit
+    // hCaptcha / reCAPTCHA / Turnstile explicit
     'hcaptcha.com',
     'recaptcha',
     'g-recaptcha',
+    // v4.3 Phase 3 — Cloudflare Turnstile (newer than Cloudflare's
+    // older "Just a moment" interstitial; uses its own widget).
+    'cf-turnstile',
+    'turnstile',
     // PerimeterX
     'press and hold',
     'human verification',

package/dist/tools/v4/executeCode.js

@@ -71,6 +71,7 @@ exports.executeCodeTool = {
     category: 'execute',
     mutates: false,
     toolset: 'execute',
+    riskTier: 'caution', // v4.4 Phase 1
     async execute(args) {
         const code = String(args.code ?? '');
         if (!code.trim()) {

package/dist/tools/v4/files/fileCopy.js

@@ -21,6 +21,7 @@ exports.fileCopyTool = void 0;
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
 const paths_1 = require("../utils/paths");
+const sandboxFs_1 = require("../../../core/v4/sandboxFs");
 exports.fileCopyTool = {
     schema: {
         name: 'file_copy',
@@ -37,6 +38,42 @@ exports.fileCopyTool = {
     category: 'write',
     mutates: true,
     toolset: 'files',
+    riskTier: 'caution', // v4.4 Phase 1
+    // v4.4 Phase 4 — dry-run preview.
+    async buildPreview(args, ctx) {
+        const fromRaw = String(args.from ?? args.source ?? '').trim();
+        const toRaw = String(args.to ?? args.dest ?? args.destination ?? '').trim();
+        const src = (0, sandboxFs_1.isPathAllowed)(fromRaw, 'read', ctx.cwd);
+        const dst = (0, sandboxFs_1.isPathAllowed)(toRaw, 'write', ctx.cwd);
+        let srcExists = false;
+        try {
+            await node_fs_1.promises.stat(src.resolvedPath);
+            srcExists = true;
+        }
+        catch { /* missing */ }
+        if (!src.allowed) {
+            return {
+                tool: 'file_copy', args, riskTier: 'caution', detectedRisks: [],
+                sideEffects: [{ type: 'refuse', reason: src.violation.message }],
+                summary: `Refused (source): ${src.violation.code}`,
+            };
+        }
+        if (!dst.allowed) {
+            return {
+                tool: 'file_copy', args, riskTier: 'caution', detectedRisks: [],
+                sideEffects: [{ type: 'refuse', reason: dst.violation.message }],
+                summary: `Refused (dest): ${dst.violation.code}`,
+            };
+        }
+        return {
+            tool: 'file_copy',
+            args,
+            riskTier: 'caution',
+            sideEffects: [{ type: 'copy_path', from: src.resolvedPath, to: dst.resolvedPath, src_exists: srcExists }],
+            detectedRisks: [],
+            summary: `Would copy ${src.resolvedPath} → ${dst.resolvedPath}${srcExists ? '' : ' (source missing)'}`,
+        };
+    },
     async execute(args, ctx) {
         const fromRaw = String(args.from ?? args.source ?? '').trim();
         const toRaw = String(args.to ?? args.dest ?? args.destination ?? '').trim();
@@ -46,8 +83,25 @@ exports.fileCopyTool = {
         if ((0, paths_1.isProtectedPath)(fromRaw) || (0, paths_1.isProtectedPath)(toRaw)) {
             return { success: false, error: 'Access denied: protected path' };
         }
-        const from = (0, paths_1.expandPath)(fromRaw, ctx.cwd);
-        const to = (0, paths_1.expandPath)(toRaw, ctx.cwd);
+        // v4.4 Phase 2 — sandbox preflight (source = read, dest = write).
+        const srcPolicy = (0, sandboxFs_1.isPathAllowed)(fromRaw, 'read', ctx.cwd);
+        if (!srcPolicy.allowed) {
+            return {
+                success: false,
+                error: srcPolicy.violation.message,
+                sandbox_violation: (0, sandboxFs_1.violationEnvelope)(srcPolicy),
+            };
+        }
+        const dstPolicy = (0, sandboxFs_1.isPathAllowed)(toRaw, 'write', ctx.cwd);
+        if (!dstPolicy.allowed) {
+            return {
+                success: false,
+                error: dstPolicy.violation.message,
+                sandbox_violation: (0, sandboxFs_1.violationEnvelope)(dstPolicy),
+            };
+        }
+        const from = srcPolicy.resolvedPath;
+        const to = dstPolicy.resolvedPath;
         try {
             await node_fs_1.promises.mkdir(node_path_1.default.dirname(to), { recursive: true });
             await node_fs_1.promises.cp(from, to, { recursive: true });

package/dist/tools/v4/files/fileDelete.js

@@ -19,6 +19,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.fileDeleteTool = void 0;
 const node_fs_1 = require("node:fs");
 const paths_1 = require("../utils/paths");
+const sandboxFs_1 = require("../../../core/v4/sandboxFs");
 exports.fileDeleteTool = {
     schema: {
         name: 'file_delete',
@@ -38,6 +39,33 @@ exports.fileDeleteTool = {
     category: 'write',
     mutates: true,
     toolset: 'files',
+    riskTier: 'dangerous', // v4.4 Phase 1 — irreversible filesystem mutation
+    // v4.4 Phase 4 — dry-run preview.
+    async buildPreview(args, ctx) {
+        const raw = String(args.path ?? args.file ?? '').trim();
+        const recursive = args.recursive === true;
+        const policy = (0, sandboxFs_1.isPathAllowed)(raw, 'delete', ctx.cwd);
+        const resolved = policy.resolvedPath;
+        let exists = false;
+        try {
+            await node_fs_1.promises.stat(resolved);
+            exists = true;
+        }
+        catch { /* missing */ }
+        const sideEffects = policy.allowed
+            ? [{ type: 'delete_file', path: resolved, exists, recursive }]
+            : [{ type: 'refuse', reason: policy.violation.message }];
+        return {
+            tool: 'file_delete',
+            args,
+            riskTier: 'dangerous',
+            sideEffects,
+            detectedRisks: policy.allowed && recursive ? ['recursive_delete'] : [],
+            summary: policy.allowed
+                ? `Would ${recursive ? 'recursively ' : ''}delete ${resolved}${exists ? '' : ' (does not exist)'}`
+                : `Refused: ${policy.violation.code}`,
+        };
+    },
     async execute(args, ctx) {
         const raw = String(args.path ?? args.file ?? '').trim();
         if (!raw)
@@ -45,7 +73,16 @@ exports.fileDeleteTool = {
         if ((0, paths_1.isProtectedPath)(raw)) {
             return { success: false, error: 'Access denied: protected path' };
         }
-        const resolved = (0, paths_1.expandPath)(raw, ctx.cwd);
+        // v4.4 Phase 2 — sandbox preflight (no-op when AIDEN_SANDBOX!=1).
+        const policy = (0, sandboxFs_1.isPathAllowed)(raw, 'delete', ctx.cwd);
+        if (!policy.allowed) {
+            return {
+                success: false,
+                error: policy.violation.message,
+                sandbox_violation: (0, sandboxFs_1.violationEnvelope)(policy),
+            };
+        }
+        const resolved = policy.resolvedPath;
         if ((0, paths_1.isFilesystemRoot)(resolved)) {
             return { success: false, error: 'Refusing to delete filesystem root' };
         }

package/dist/tools/v4/files/fileList.js

@@ -22,6 +22,7 @@ exports.fileListTool = void 0;
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
 const node_os_1 = __importDefault(require("node:os"));
+const sandboxFs_1 = require("../../../core/v4/sandboxFs");
 function expandPath(input, cwd) {
     const home = node_os_1.default.homedir();
     let p = input;
@@ -54,9 +55,19 @@ exports.fileListTool = {
     category: 'read',
     mutates: false,
     toolset: 'files',
+    riskTier: 'safe', // v4.4 Phase 1
     async execute(args, ctx) {
         const raw = String(args.path ?? args.dir ?? ctx.cwd).trim();
-        const resolved = expandPath(raw || ctx.cwd, ctx.cwd);
+        // v4.4 Phase 2 — sandbox preflight (no-op when AIDEN_SANDBOX!=1).
+        const policy = (0, sandboxFs_1.isPathAllowed)(raw || ctx.cwd, 'read', ctx.cwd);
+        if (!policy.allowed) {
+            return {
+                success: false,
+                error: policy.violation.message,
+                sandbox_violation: (0, sandboxFs_1.violationEnvelope)(policy),
+            };
+        }
+        const resolved = policy.resolvedPath;
         try {
             const entries = await node_fs_1.promises.readdir(resolved, { withFileTypes: true });
             const items = entries.map((e) => ({

package/dist/tools/v4/files/fileMove.js

@@ -22,6 +22,7 @@ exports.fileMoveTool = void 0;
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
 const paths_1 = require("../utils/paths");
+const sandboxFs_1 = require("../../../core/v4/sandboxFs");
 exports.fileMoveTool = {
     schema: {
         name: 'file_move',
@@ -38,6 +39,42 @@ exports.fileMoveTool = {
     category: 'write',
     mutates: true,
     toolset: 'files',
+    riskTier: 'caution', // v4.4 Phase 1
+    // v4.4 Phase 4 — dry-run preview.
+    async buildPreview(args, ctx) {
+        const fromRaw = String(args.from ?? args.source ?? '').trim();
+        const toRaw = String(args.to ?? args.dest ?? args.destination ?? '').trim();
+        const src = (0, sandboxFs_1.isPathAllowed)(fromRaw, 'write', ctx.cwd);
+        const dst = (0, sandboxFs_1.isPathAllowed)(toRaw, 'write', ctx.cwd);
+        let srcExists = false;
+        try {
+            await node_fs_1.promises.stat(src.resolvedPath);
+            srcExists = true;
+        }
+        catch { /* missing */ }
+        if (!src.allowed) {
+            return {
+                tool: 'file_move', args, riskTier: 'caution', detectedRisks: [],
+                sideEffects: [{ type: 'refuse', reason: src.violation.message }],
+                summary: `Refused (source): ${src.violation.code}`,
+            };
+        }
+        if (!dst.allowed) {
+            return {
+                tool: 'file_move', args, riskTier: 'caution', detectedRisks: [],
+                sideEffects: [{ type: 'refuse', reason: dst.violation.message }],
+                summary: `Refused (dest): ${dst.violation.code}`,
+            };
+        }
+        return {
+            tool: 'file_move',
+            args,
+            riskTier: 'caution',
+            sideEffects: [{ type: 'move_path', from: src.resolvedPath, to: dst.resolvedPath, src_exists: srcExists }],
+            detectedRisks: [],
+            summary: `Would move ${src.resolvedPath} → ${dst.resolvedPath}${srcExists ? '' : ' (source missing)'}`,
+        };
+    },
     async execute(args, ctx) {
         const fromRaw = String(args.from ?? args.source ?? '').trim();
         const toRaw = String(args.to ?? args.dest ?? args.destination ?? '').trim();
@@ -47,8 +84,28 @@ exports.fileMoveTool = {
         if ((0, paths_1.isProtectedPath)(fromRaw) || (0, paths_1.isProtectedPath)(toRaw)) {
             return { success: false, error: 'Access denied: protected path' };
         }
-        const from = (0, paths_1.expandPath)(fromRaw, ctx.cwd);
-        const to = (0, paths_1.expandPath)(toRaw, ctx.cwd);
+        // v4.4 Phase 2 — sandbox preflight. Move = read source + write dest;
+        // since the source is also being deleted, this could arguably be
+        // 'delete' on source — but delete and write share the same allowlist
+        // semantics in the policy. 'read' on source matches copy's shape.
+        const srcPolicy = (0, sandboxFs_1.isPathAllowed)(fromRaw, 'write', ctx.cwd);
+        if (!srcPolicy.allowed) {
+            return {
+                success: false,
+                error: srcPolicy.violation.message,
+                sandbox_violation: (0, sandboxFs_1.violationEnvelope)(srcPolicy),
+            };
+        }
+        const dstPolicy = (0, sandboxFs_1.isPathAllowed)(toRaw, 'write', ctx.cwd);
+        if (!dstPolicy.allowed) {
+            return {
+                success: false,
+                error: dstPolicy.violation.message,
+                sandbox_violation: (0, sandboxFs_1.violationEnvelope)(dstPolicy),
+            };
+        }
+        const from = srcPolicy.resolvedPath;
+        const to = dstPolicy.resolvedPath;
         try {
             await node_fs_1.promises.mkdir(node_path_1.default.dirname(to), { recursive: true });
             try {

package/dist/tools/v4/files/filePatch.js

@@ -19,6 +19,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.filePatchTool = void 0;
 const node_fs_1 = require("node:fs");
 const paths_1 = require("../utils/paths");
+const sandboxFs_1 = require("../../../core/v4/sandboxFs");
 exports.filePatchTool = {
     schema: {
         name: 'file_patch',
@@ -40,6 +41,38 @@ exports.filePatchTool = {
     category: 'write',
     mutates: true,
     toolset: 'files',
+    riskTier: 'caution', // v4.4 Phase 1
+    // v4.4 Phase 4 — dry-run preview.
+    async buildPreview(args, ctx) {
+        const raw = String(args.path ?? args.file ?? '').trim();
+        const find = typeof args.find === 'string' ? args.find : '';
+        const replace = typeof args.replace === 'string' ? args.replace : '';
+        const policy = (0, sandboxFs_1.isPathAllowed)(raw, 'write', ctx.cwd);
+        const resolved = policy.resolvedPath;
+        let matches = 0;
+        let bytesDelta = 0;
+        if (policy.allowed && find) {
+            try {
+                const txt = await node_fs_1.promises.readFile(resolved, 'utf-8');
+                matches = txt.split(find).length - 1;
+                bytesDelta = matches * (Buffer.byteLength(replace, 'utf-8') - Buffer.byteLength(find, 'utf-8'));
+            }
+            catch { /* file may not exist — surfaced as 0 matches */ }
+        }
+        const sideEffects = policy.allowed
+            ? [{ type: 'patch_file', path: resolved, matches, bytes_delta: bytesDelta }]
+            : [{ type: 'refuse', reason: policy.violation.message }];
+        return {
+            tool: 'file_patch',
+            args,
+            riskTier: 'caution',
+            sideEffects,
+            detectedRisks: [],
+            summary: policy.allowed
+                ? `Would patch ${resolved} (${matches} match${matches === 1 ? '' : 'es'}, Δ ${bytesDelta} bytes)`
+                : `Refused: ${policy.violation.code}`,
+        };
+    },
     async execute(args, ctx) {
         const raw = String(args.path ?? args.file ?? '').trim();
         if (!raw)
@@ -47,12 +80,21 @@ exports.filePatchTool = {
         if ((0, paths_1.isProtectedPath)(raw)) {
             return { success: false, error: 'Access denied: protected path' };
         }
+        // v4.4 Phase 2 — sandbox preflight (no-op when AIDEN_SANDBOX!=1).
+        const policy = (0, sandboxFs_1.isPathAllowed)(raw, 'write', ctx.cwd);
+        if (!policy.allowed) {
+            return {
+                success: false,
+                error: policy.violation.message,
+                sandbox_violation: (0, sandboxFs_1.violationEnvelope)(policy),
+            };
+        }
         const find = typeof args.find === 'string' ? args.find : '';
         const replace = typeof args.replace === 'string' ? args.replace : '';
         if (!find)
             return { success: false, error: 'Empty find string' };
         const replaceAll = args.replace_all === true;
-        const resolved = (0, paths_1.expandPath)(raw, ctx.cwd);
+        const resolved = policy.resolvedPath;
         try {
             const original = await node_fs_1.promises.readFile(resolved, 'utf-8');
             const occurrences = original.split(find).length - 1;

package/dist/tools/v4/files/fileRead.js

@@ -24,6 +24,7 @@ exports.fileReadTool = void 0;
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
 const node_os_1 = __importDefault(require("node:os"));
+const sandboxFs_1 = require("../../../core/v4/sandboxFs");
 const MAX_OUTPUT = 5000;
 const DENY_PATTERNS = [
     /[\\/]\.ssh[\\/]/i,
@@ -73,6 +74,7 @@ exports.fileReadTool = {
     category: 'read',
     mutates: false,
     toolset: 'files',
+    riskTier: 'safe', // v4.4 Phase 1
     async execute(args, ctx) {
         const raw = String(args.path ?? args.file ?? '').trim();
         if (!raw)
@@ -83,7 +85,16 @@ exports.fileReadTool = {
                 error: 'Access denied: protected path (credentials/keys/.env)',
             };
         }
-        const resolved = expandPath(raw, ctx.cwd);
+        // v4.4 Phase 2 — sandbox preflight (no-op when AIDEN_SANDBOX!=1).
+        const policy = (0, sandboxFs_1.isPathAllowed)(raw, 'read', ctx.cwd);
+        if (!policy.allowed) {
+            return {
+                success: false,
+                error: policy.violation.message,
+                sandbox_violation: (0, sandboxFs_1.violationEnvelope)(policy),
+            };
+        }
+        const resolved = policy.resolvedPath;
         try {
             const content = await node_fs_1.promises.readFile(resolved, 'utf-8');
             return {

package/dist/tools/v4/files/fileWrite.js

@@ -23,6 +23,8 @@ exports.fileWriteTool = void 0;
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
 const paths_1 = require("../utils/paths");
+const sandboxFs_1 = require("../../../core/v4/sandboxFs");
+const dryRun_1 = require("../../../core/v4/dryRun");
 exports.fileWriteTool = {
     schema: {
         name: 'file_write',
@@ -39,6 +41,35 @@ exports.fileWriteTool = {
     category: 'write',
     mutates: true,
     toolset: 'files',
+    riskTier: 'caution', // v4.4 Phase 1
+    // v4.4 Phase 4 — dry-run preview.
+    async buildPreview(args, ctx) {
+        const raw = String(args.path ?? args.file ?? '').trim();
+        const content = typeof args.content === 'string' ? args.content : '';
+        const policy = (0, sandboxFs_1.isPathAllowed)(raw, 'write', ctx.cwd);
+        const resolved = policy.resolvedPath;
+        let prevBytes;
+        try {
+            prevBytes = (await node_fs_1.promises.stat(resolved)).size;
+        }
+        catch { /* didn't exist */ }
+        const newBytes = Buffer.byteLength(content, 'utf-8');
+        const sideEffects = policy.allowed
+            ? [prevBytes !== undefined
+                    ? { type: 'overwrite_file', path: resolved, prev_bytes: prevBytes, new_bytes: newBytes, preview: (0, dryRun_1.truncatePreview)(content) }
+                    : { type: 'create_file', path: resolved, bytes: newBytes, preview: (0, dryRun_1.truncatePreview)(content) }]
+            : [{ type: 'refuse', reason: policy.violation.message }];
+        return {
+            tool: 'file_write',
+            args,
+            riskTier: 'caution',
+            sideEffects,
+            detectedRisks: [],
+            summary: policy.allowed
+                ? `Would write ${newBytes} bytes to ${resolved}`
+                : `Refused: ${policy.violation.code}`,
+        };
+    },
     async execute(args, ctx) {
         const raw = String(args.path ?? args.file ?? '').trim();
         if (!raw)
@@ -46,8 +77,17 @@ exports.fileWriteTool = {
         if ((0, paths_1.isProtectedPath)(raw)) {
             return { success: false, error: 'Access denied: protected path' };
         }
+        // v4.4 Phase 2 — sandbox preflight (no-op when AIDEN_SANDBOX!=1).
+        const policy = (0, sandboxFs_1.isPathAllowed)(raw, 'write', ctx.cwd);
+        if (!policy.allowed) {
+            return {
+                success: false,
+                error: policy.violation.message,
+                sandbox_violation: (0, sandboxFs_1.violationEnvelope)(policy),
+            };
+        }
         const content = typeof args.content === 'string' ? args.content : '';
-        const resolved = (0, paths_1.expandPath)(raw, ctx.cwd);
+        const resolved = policy.resolvedPath;
         try {
             await node_fs_1.promises.mkdir(node_path_1.default.dirname(resolved), { recursive: true });
             await node_fs_1.promises.writeFile(resolved, content, 'utf-8');