airaknit 1.1.2-rc.9

package/src/server/claude-pty-mcp/permission-gate.ts

@@ -0,0 +1,243 @@
+import type {
+  ChatPermissionPolicy,
+  PolicyVerdict,
+} from "../../shared/permission-policy"
+import { parse as shellParse } from "shell-quote"
+import path from "node:path"
+import { homedir } from "node:os"
+import { minimatch } from "minimatch"
+
+export interface EvaluateArgs {
+  toolName: string
+  args: Record<string, unknown>
+  chatPolicy: ChatPermissionPolicy
+  cwd: string
+}
+
+export interface EvaluateResult {
+  verdict: PolicyVerdict
+  reason?: string
+}
+
+function argsToText(args: Record<string, unknown>): string {
+  return typeof args.command === "string" ? args.command : JSON.stringify(args)
+}
+
+interface ShellOp { op: string }
+function isShellOp(token: unknown): token is ShellOp {
+  return typeof token === "object" && token !== null && "op" in (token as object)
+}
+
+interface ParsedSimpleCommand {
+  verb: string
+  paths: string[]
+  hadEnvPrefix: boolean
+}
+
+function parseSimpleBash(
+  command: string,
+  cwd: string,
+  autoAllowVerbs: string[],
+): ParsedSimpleCommand | null {
+  const tokens = shellParse(command)
+  for (const t of tokens) {
+    if (isShellOp(t)) return null  // pipe/redirect/subshell/glob/etc.
+  }
+  const stringTokens = tokens.filter((t): t is string => typeof t === "string")
+  if (stringTokens.length === 0) return null
+
+  let hadEnvPrefix = false
+  let i = 0
+  while (i < stringTokens.length && /^[A-Z_][A-Z0-9_]*=/.test(stringTokens[i])) {
+    hadEnvPrefix = true
+    i++
+  }
+  const rest = stringTokens.slice(i)
+  if (rest.length === 0) return null
+
+  let verb: string | null = null
+  let argsStart = 1
+  const sorted = [...autoAllowVerbs].sort((a, b) => b.length - a.length)
+  for (const candidate of sorted) {
+    const parts = candidate.split(/\s+/)
+    if (rest.length >= parts.length && parts.every((p, idx) => rest[idx] === p)) {
+      verb = candidate
+      argsStart = parts.length
+      break
+    }
+  }
+  if (!verb) {
+    verb = rest[0]
+    argsStart = 1
+  }
+
+  const paths: string[] = []
+  for (const arg of rest.slice(argsStart)) {
+    const isPathLike = arg.startsWith("~") || arg.includes("/") || arg.startsWith(".")
+    if (!isPathLike) continue
+    const expanded = arg.startsWith("~")
+      ? path.join(homedir(), arg.slice(1).replace(/^\//, ""))
+      : arg
+    const resolved = path.resolve(cwd, expanded)
+    paths.push(resolved)
+  }
+  return { verb, paths, hadEnvPrefix }
+}
+
+const READ_PATH_TOOLS = new Set([
+  "mcp__kanna__read",
+  "mcp__kanna__glob",
+  "mcp__kanna__grep",
+])
+const WRITE_PATH_TOOLS = new Set([
+  "mcp__kanna__write",
+  "mcp__kanna__edit",
+])
+
+function getPathArg(args: Record<string, unknown>): string | null {
+  if (typeof args.path === "string") return args.path
+  return null
+}
+
+function pathMatchesDeny(absPath: string, deny: string[]): string | null {
+  for (const pattern of deny) {
+    let expanded = pattern.startsWith("~")
+      ? path.join(homedir(), pattern.slice(1).replace(/^\//, ""))
+      : pattern
+    // Normalize trailing slash so "/some/dir/" matches the same as "/some/dir"
+    if (expanded.endsWith("/") && expanded !== "/") expanded = expanded.slice(0, -1)
+    const matchPattern = expanded.endsWith("/**") || expanded.includes("*")
+      ? expanded
+      : `${expanded}/**`
+    if (minimatch(absPath, matchPattern, { dot: true }) || absPath === expanded) {
+      return pattern
+    }
+  }
+  return null
+}
+
+/**
+ * Tools whose entire purpose is to surface a question / plan to the user
+ * and wait for an answer. They MUST always go through the "ask" path so
+ * the durable approval protocol renders UI and the model receives the
+ * user's actual response. Auto-allow/auto-deny would resolve the request
+ * with no payload, leaving the shim's `formatAnswer` with an undefined
+ * payload — producing an empty `text` field and an MCP -32602
+ * "Invalid tools/call result" validation error (issue #215 follow-up).
+ * No `chatPolicy.defaultAction` value can override this.
+ */
+const INTERACTIVE_TOOLS = new Set([
+  "mcp__kanna__ask_user_question",
+  "mcp__kanna__exit_plan_mode",
+])
+
+export const policy = {
+  evaluate(args: EvaluateArgs): EvaluateResult {
+    if (INTERACTIVE_TOOLS.has(args.toolName)) {
+      return { verdict: "ask", reason: "interactive tool: always asks the user" }
+    }
+    if (READ_PATH_TOOLS.has(args.toolName)) {
+      const p = getPathArg(args.args)
+      if (p !== null) {
+        const expanded = p.startsWith("~")
+          ? path.join(homedir(), p.slice(1).replace(/^\//, ""))
+          : p
+        const resolved = path.resolve(args.cwd, expanded)
+        const denied = pathMatchesDeny(resolved, args.chatPolicy.readPathDeny)
+        if (denied) {
+          return { verdict: "auto-deny", reason: `readPathDeny: ${denied}` }
+        }
+      }
+    }
+    if (WRITE_PATH_TOOLS.has(args.toolName)) {
+      const p = getPathArg(args.args)
+      if (p !== null) {
+        const expanded = p.startsWith("~")
+          ? path.join(homedir(), p.slice(1).replace(/^\//, ""))
+          : p
+        const resolved = path.resolve(args.cwd, expanded)
+        const deniedW = pathMatchesDeny(resolved, args.chatPolicy.writePathDeny)
+        const deniedR = pathMatchesDeny(resolved, args.chatPolicy.readPathDeny)
+        if (deniedW) return { verdict: "auto-deny", reason: `writePathDeny: ${deniedW}` }
+        if (deniedR) return { verdict: "auto-deny", reason: `readPathDeny: ${deniedR}` }
+      }
+    }
+
+    // Bash path: single block handles all bash decisions.
+    // Path-deny + tool-deny always run; the only thing chatPolicy.defaultAction
+    // changes is the fallback for "didn't hit a deny rule and didn't hit the
+    // verb allowlist". For personal-use (defaultAction: auto-allow) that's
+    // auto-allow; for shared sessions (defaultAction: ask) it's ask.
+    if (args.toolName === "mcp__kanna__bash") {
+      const command = typeof args.args.command === "string" ? args.args.command : ""
+      const parsed = parseSimpleBash(command, args.cwd, args.chatPolicy.bash.autoAllowVerbs)
+      const fallback: PolicyVerdict = args.chatPolicy.defaultAction === "ask"
+        ? "ask"
+        : args.chatPolicy.defaultAction
+      // Deny-list applies regardless of shell-feature parsing.
+      for (const rule of args.chatPolicy.toolDenyList) {
+        if (rule.tool !== args.toolName) continue
+        let re: RegExp
+        try {
+          re = new RegExp(rule.pattern)
+        } catch {
+          console.warn(`[permission-gate] invalid regex pattern: ${rule.pattern}`)
+          continue
+        }
+        if (re.test(argsToText(args.args))) {
+          return { verdict: "auto-deny", reason: `matched denylist: ${rule.pattern}` }
+        }
+      }
+      if (!parsed) {
+        return { verdict: fallback, reason: "bash command uses shell features" }
+      }
+      if (parsed.hadEnvPrefix) {
+        return { verdict: fallback, reason: "bash command has env prefix" }
+      }
+      for (const p of parsed.paths) {
+        const denied = pathMatchesDeny(p, args.chatPolicy.readPathDeny)
+        if (denied) {
+          return { verdict: "auto-deny", reason: `readPathDeny: ${denied}` }
+        }
+      }
+      if (args.chatPolicy.bash.autoAllowVerbs.includes(parsed.verb)) {
+        return { verdict: "auto-allow", reason: `verb in autoAllowVerbs: ${parsed.verb}` }
+      }
+      return { verdict: fallback, reason: "bash verb not on autoAllowVerbs" }
+    }
+
+    // Non-bash path: deny-list, allow-list, default.
+    // 1. Deny list wins over everything.
+    for (const rule of args.chatPolicy.toolDenyList) {
+      if (rule.tool !== args.toolName) continue
+      let re: RegExp
+      try {
+        re = new RegExp(rule.pattern)
+      } catch {
+        console.warn(`[permission-gate] invalid regex pattern: ${rule.pattern}`)
+        continue
+      }
+      if (re.test(argsToText(args.args))) {
+        return { verdict: "auto-deny", reason: `matched denylist: ${rule.pattern}` }
+      }
+    }
+
+    // 2. Allow list
+    for (const rule of args.chatPolicy.toolAllowList) {
+      if (rule.tool !== args.toolName) continue
+      let re: RegExp
+      try {
+        re = new RegExp(rule.pattern)
+      } catch {
+        console.warn(`[permission-gate] invalid regex pattern: ${rule.pattern}`)
+        continue
+      }
+      if (re.test(argsToText(args.args))) {
+        return { verdict: "auto-allow", reason: `matched allowlist: ${rule.pattern}` }
+      }
+    }
+
+    // 4. Default action.
+    return { verdict: args.chatPolicy.defaultAction === "ask" ? "ask" : args.chatPolicy.defaultAction }
+  },
+}

package/src/server/claude-pty-mcp/terminal-pid-registry.adapter.ts

@@ -0,0 +1,107 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises"
+import path from "node:path"
+import process from "node:process"
+
+export interface TerminalPidEntry {
+  terminalId: string
+  pid: number
+  cwd: string
+  createdAt: number
+}
+
+interface RegistryFile {
+  entries: TerminalPidEntry[]
+}
+
+export class TerminalPidRegistry {
+  private readonly filePath: string
+  private entries: TerminalPidEntry[] = []
+  private writeQueue: Promise<void> = Promise.resolve()
+
+  constructor(filePath: string) {
+    this.filePath = filePath
+  }
+
+  async register(entry: Omit<TerminalPidEntry, "createdAt">): Promise<void> {
+    await this.loadIfNeeded()
+    const next = this.entries.filter((existing) => existing.terminalId !== entry.terminalId)
+    next.push({ ...entry, createdAt: Date.now() })
+    this.entries = next
+    await this.persist()
+  }
+
+  async unregister(terminalId: string): Promise<void> {
+    await this.loadIfNeeded()
+    this.entries = this.entries.filter((entry) => entry.terminalId !== terminalId)
+    await this.persist()
+  }
+
+  async reapStale(): Promise<TerminalPidEntry[]> {
+    const stored = await this.readFromDisk()
+    if (stored.length === 0) {
+      this.entries = []
+      return []
+    }
+    for (const entry of stored) {
+      killPgroup(entry.pid)
+    }
+    this.entries = []
+    await this.persist()
+    return stored
+  }
+
+  private async loadIfNeeded() {
+    if (this.entries.length > 0) return
+    this.entries = await this.readFromDisk()
+  }
+
+  private async readFromDisk(): Promise<TerminalPidEntry[]> {
+    let raw: string
+    try {
+      raw = await readFile(this.filePath, "utf8")
+    } catch {
+      return []
+    }
+    try {
+      const parsed = JSON.parse(raw) as Partial<RegistryFile>
+      if (!parsed || !Array.isArray(parsed.entries)) return []
+      return parsed.entries.filter(isValidEntry)
+    } catch {
+      return []
+    }
+  }
+
+  private async persist() {
+    const snapshot: RegistryFile = { entries: [...this.entries] }
+    const serialized = JSON.stringify(snapshot)
+    this.writeQueue = this.writeQueue
+      .catch(() => undefined)
+      .then(async () => {
+        await mkdir(path.dirname(this.filePath), { recursive: true })
+        await writeFile(this.filePath, serialized, "utf8")
+      })
+    await this.writeQueue
+  }
+}
+
+function isValidEntry(value: unknown): value is TerminalPidEntry {
+  if (!value || typeof value !== "object") return false
+  const candidate = value as Partial<TerminalPidEntry>
+  return (
+    typeof candidate.terminalId === "string"
+    && typeof candidate.pid === "number"
+    && Number.isFinite(candidate.pid)
+    && typeof candidate.cwd === "string"
+    && typeof candidate.createdAt === "number"
+  )
+}
+
+function killPgroup(pid: number) {
+  if (process.platform === "win32") return
+  if (!Number.isFinite(pid) || pid <= 0) return
+  try {
+    process.kill(-pid, "SIGKILL")
+  } catch {
+    // ESRCH (already gone) and EPERM (race with kernel reap) are fine.
+  }
+}

package/src/server/claude-pty-mcp/tools/ask-user-question.test.ts

@@ -0,0 +1,119 @@
+import { describe, expect, test } from "bun:test"
+import { mkdtemp, rm } from "node:fs/promises"
+import { tmpdir } from "node:os"
+import path from "node:path"
+import { POLICY_DEFAULT } from "../../../shared/permission-policy"
+import { createToolCallbackService } from "../../claude-pty/tool-callback"
+import { createTestEventStore } from "../../storage/test-helpers"
+import { createAskUserQuestionTool } from "./ask-user-question"
+
+async function newStore() {
+  const dir = await mkdtemp(path.join(tmpdir(), "kanna-mcp-aq-"))
+  const store = createTestEventStore(dir)
+  await store.initialize()
+  const cleanup = async () => {
+    await new Promise<void>((r) => setTimeout(r, 50))
+    await rm(dir, { recursive: true, force: true })
+  }
+  return { store, dir, cleanup }
+}
+
+const handlerCtx = () => ({
+  chatId: "c1",
+  sessionId: "s1",
+  toolUseId: "tu1",
+  cwd: "/tmp",
+  chatPolicy: POLICY_DEFAULT,
+})
+
+describe("mcp__kanna__ask_user_question", () => {
+  test("calls policy.evaluate then routes to tool-callback", async () => {
+    const { store, cleanup } = await newStore()
+    try {
+      const svc = createToolCallbackService({
+        store, serverSecret: "k", now: () => 1, timeoutMs: 600_000,
+      })
+      const tool = createAskUserQuestionTool({ toolCallback: svc })
+      const inputArgs = {
+        questions: [{
+          text: "ok?",
+          header: "OK",
+          options: [{ label: "yes", description: "" }, { label: "no", description: "" }],
+          multiSelect: false,
+        }],
+      }
+      const promise = tool.handler(inputArgs, handlerCtx())
+      const pending = await store.listPendingToolRequests("c1")
+      expect(pending).toHaveLength(1)
+      await svc.answer(pending[0].id, { kind: "answer", payload: { answers: { "ok?": "yes" } } })
+      const result = await promise
+      expect(result.content[0].type).toBe("text")
+      expect(JSON.parse(result.content[0].text).answers).toEqual({ "ok?": "yes" })
+      expect(result.isError).toBeFalsy()
+    } finally { await cleanup() }
+  })
+
+  // Issue #215 follow-up: even under chatPolicy.defaultAction "auto-deny"
+  // the tool must take the ask path (UI is the only meaningful outcome),
+  // then deny only when the user / cancel resolves it that way.
+  test("auto-deny chatPolicy still routes through ask (UI), denial only via cancel/cancelAllForChat", async () => {
+    const { store, cleanup } = await newStore()
+    try {
+      const svc = createToolCallbackService({
+        store, serverSecret: "k", now: () => 1, timeoutMs: 600_000,
+      })
+      const tool = createAskUserQuestionTool({ toolCallback: svc })
+      const promise = tool.handler(
+        {
+          questions: [{
+            text: "x",
+            header: "X",
+            options: [{ label: "a", description: "" }, { label: "b", description: "" }],
+            multiSelect: false,
+          }],
+        },
+        { ...handlerCtx(), chatPolicy: { ...POLICY_DEFAULT, defaultAction: "auto-deny" } },
+      )
+      const pending = await store.listPendingToolRequests("c1")
+      expect(pending).toHaveLength(1)
+      await svc.cancelAllForChat("c1", "user-cancel")
+      const result = await promise
+      expect(result.isError).toBe(true)
+      expect(result.content[0].type).toBe("text")
+      expect(typeof result.content[0].text).toBe("string")
+    } finally { await cleanup() }
+  })
+
+  // Issue #215 follow-up: fail fast on empty/undefined answer payload.
+  // The earlier bug silently produced `text: JSON.stringify(undefined)` =
+  // `text: undefined` and crashed the MCP SDK validator with -32602.
+  // Coercing to `{}` would hide the underlying policy-gate bug (interactive
+  // tool auto-allowed without user input). Instead the shim throws so the
+  // failure is loud and the root cause is detectable.
+  test("answer decision with no payload → throws loudly (no silent {} coercion)", async () => {
+    const { store, cleanup } = await newStore()
+    try {
+      const svc = createToolCallbackService({
+        store, serverSecret: "k", now: () => 1, timeoutMs: 600_000,
+      })
+      const tool = createAskUserQuestionTool({ toolCallback: svc })
+      const promise = tool.handler(
+        {
+          questions: [{
+            text: "ok?",
+            header: "OK",
+            options: [{ label: "yes", description: "" }, { label: "no", description: "" }],
+            multiSelect: false,
+          }],
+        },
+        handlerCtx(),
+      )
+      const pending = await store.listPendingToolRequests("c1")
+      expect(pending).toHaveLength(1)
+      // Resolve with kind:"allow" and no payload — the exact auto-allow
+      // shape that previously slipped through.
+      await svc.answer(pending[0].id, { kind: "allow" as const })
+      await expect(promise).rejects.toThrow(/empty answer payload/i)
+    } finally { await cleanup() }
+  })
+})

package/src/server/claude-pty-mcp/tools/ask-user-question.ts

@@ -0,0 +1,61 @@
+import { z } from "zod"
+import type { ToolCallbackService } from "../../claude-pty/tool-callback"
+import type { ToolHandlerContext, ToolHandlerResult } from "./tool-callback-shim"
+import { gatedToolCall } from "./tool-callback-shim"
+
+const QuestionSchema = z.object({
+  text: z.string(),
+  header: z.string(),
+  options: z.array(z.object({ label: z.string(), description: z.string() })).min(2).max(4),
+  multiSelect: z.boolean(),
+})
+
+const InputSchema = z.object({
+  questions: z.array(QuestionSchema).min(1).max(4),
+})
+
+export type AskUserQuestionInput = z.infer<typeof InputSchema>
+
+export interface AskUserQuestionTool {
+  name: "ask_user_question"
+  schema: typeof InputSchema
+  handler: (input: AskUserQuestionInput, ctx: ToolHandlerContext) => Promise<ToolHandlerResult>
+}
+
+export function createAskUserQuestionTool(deps: { toolCallback: ToolCallbackService }): AskUserQuestionTool {
+  return {
+    name: "ask_user_question",
+    schema: InputSchema,
+    async handler(input, ctx) {
+      return gatedToolCall({
+        toolCallback: deps.toolCallback,
+        toolName: "mcp__kanna__ask_user_question",
+        ctx,
+        args: input as unknown as Record<string, unknown>,
+        formatAnswer: (payload) => {
+          // Fail fast — silently coercing an undefined payload to `{}` would
+          // hide the real bug (an interactive tool being auto-allowed with
+          // no user answer). The policy gate is supposed to force "ask" for
+          // this tool (issue #215 follow-up); if we ever see an allow/answer
+          // with no payload here, surface it loudly so it gets reported and
+          // fixed instead of producing a silent empty UI answer downstream.
+          if (payload === undefined || payload === null || typeof payload !== "object") {
+            throw new Error(
+              "mcp__kanna__ask_user_question: empty answer payload "
+              + `(received ${payload === undefined ? "undefined" : typeof payload}). `
+              + "This means the policy gate or tool-callback resolved the request without a user response — "
+              + "interactive tools must always go through the ask/UI path. See issue #215.",
+            )
+          }
+          return {
+            content: [{ type: "text" as const, text: JSON.stringify(payload) }],
+          }
+        },
+        formatDeny: (reason) => ({
+          content: [{ type: "text" as const, text: `Denied: ${reason}` }],
+          isError: true,
+        }),
+      })
+    },
+  }
+}

package/src/server/claude-pty-mcp/tools/bash.adapter.ts

@@ -0,0 +1,76 @@
+import { z } from "zod"
+import type { ToolCallbackService } from "../../claude-pty/tool-callback"
+import type { ToolHandlerContext, ToolHandlerResult } from "./tool-callback-shim"
+import { gatedToolCall } from "./tool-callback-shim"
+
+const InputSchema = z.object({
+  command: z.string(),
+})
+
+export type BashInput = z.infer<typeof InputSchema>
+
+export interface BashTool {
+  name: "bash"
+  schema: typeof InputSchema
+  handler: (input: BashInput, ctx: ToolHandlerContext) => Promise<ToolHandlerResult>
+}
+
+const OUTPUT_CAP = 1_000_000 // 1 MB per stream
+
+async function readBounded(stream: ReadableStream<Uint8Array> | null, maxBytes: number): Promise<string> {
+  if (!stream) return ""
+  const reader = stream.getReader()
+  const chunks: Uint8Array[] = []
+  let total = 0
+  while (total < maxBytes) {
+    const { value, done } = await reader.read()
+    if (done) break
+    chunks.push(value)
+    total += value.byteLength
+  }
+  reader.cancel().catch(() => {})
+  let text = Buffer.concat(chunks.map(c => Buffer.from(c))).toString("utf8")
+  if (total >= maxBytes) text += "\n\n[output truncated at 1 MB]"
+  return text
+}
+
+export function createBashTool(deps: { toolCallback: ToolCallbackService }): BashTool {
+  return {
+    name: "bash",
+    schema: InputSchema,
+    async handler(input, ctx) {
+      return gatedToolCall({
+        toolCallback: deps.toolCallback,
+        toolName: "mcp__kanna__bash",
+        ctx,
+        args: input as unknown as Record<string, unknown>,
+        formatAnswer: async () => {
+          const proc = Bun.spawn(["/bin/sh", "-c", input.command], {
+            cwd: ctx.cwd,
+            stdin: "ignore",
+            stdout: "pipe",
+            stderr: "pipe",
+          })
+          const [stdoutBuf, stderrBuf, exitCode] = await Promise.all([
+            readBounded(proc.stdout, OUTPUT_CAP),
+            readBounded(proc.stderr, OUTPUT_CAP),
+            proc.exited,
+          ])
+          const text = [
+            stdoutBuf,
+            stderrBuf ? `STDERR:\n${stderrBuf}` : "",
+            `Exit code: ${exitCode}`,
+          ].filter(Boolean).join("\n")
+          return {
+            content: [{ type: "text" as const, text }],
+            isError: exitCode !== 0,
+          }
+        },
+        formatDeny: (reason) => ({
+          content: [{ type: "text" as const, text: `Denied: ${reason}` }],
+          isError: true,
+        }),
+      })
+    },
+  }
+}

package/src/server/claude-pty-mcp/tools/bash.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, test } from "bun:test"
+import { mkdtemp, rm } from "node:fs/promises"
+import { tmpdir } from "node:os"
+import path from "node:path"
+import { POLICY_DEFAULT } from "../../../shared/permission-policy"
+import { createTestEventStore } from "../../storage/test-helpers"
+import { createToolCallbackService } from "../../claude-pty/tool-callback"
+import { createBashTool } from "./bash.adapter"
+
+async function newStore() {
+  const dir = await mkdtemp(path.join(tmpdir(), "kanna-mcp-bash-"))
+  const store = createTestEventStore(dir)
+  await store.initialize()
+  // Delay before removing dir so background persist tasks (fired by auto-allow/auto-deny)
+  // have time to complete before the tmpdir is removed.
+  const cleanup = async () => {
+    await new Promise<void>((r) => setTimeout(r, 50))
+    await rm(dir, { recursive: true, force: true })
+  }
+  return { store, dir, cleanup }
+}
+
+const ctx = (cwd: string) => ({
+  chatId: "c",
+  sessionId: "s",
+  toolUseId: "tu",
+  cwd,
+  chatPolicy: { ...POLICY_DEFAULT, defaultAction: "auto-allow" as const },
+})
+
+describe("mcp__kanna__bash", () => {
+  test("auto-allowed verb (pwd) → stdout contains cwd, no isError", async () => {
+    const { store, dir, cleanup } = await newStore()
+    try {
+      const svc = createToolCallbackService({ store, serverSecret: "k", now: () => 1, timeoutMs: 600_000 })
+      const tool = createBashTool({ toolCallback: svc })
+      const result = await tool.handler({ command: "pwd" }, ctx(dir))
+      expect(result.isError).toBeFalsy()
+      // pwd resolves symlinks; use realpath comparison
+      const realDir = await Bun.spawn(["realpath", dir], { stdout: "pipe" })
+      const realDirStr = (await new Response(realDir.stdout).text()).trim()
+      const resultText = result.content[0].text
+      expect(resultText).toContain(realDirStr)
+    } finally { await cleanup() }
+  }, 30_000)
+
+  test("toolDenyList match (rm -rf /) → isError true", async () => {
+    const { store, dir, cleanup } = await newStore()
+    try {
+      const svc = createToolCallbackService({ store, serverSecret: "k", now: () => 1, timeoutMs: 600_000 })
+      const tool = createBashTool({ toolCallback: svc })
+      const result = await tool.handler({ command: "rm -rf /" }, ctx(dir))
+      expect(result.isError).toBe(true)
+    } finally { await cleanup() }
+  }, 30_000)
+})