daycare-cli 2026.2.12 → 2026.2.22

package/dist/prompts/memory/MEMORY_ROOT.md

@@ -0,0 +1,322 @@
+# Ontology Routing: Placing New Information in a Memory Graph
+
+Given new information, classify it and route it to the correct node in a graph. The graph has a primary tree (entity-centric, traversed top-down) and cross-references (BFO-typed, linking related nodes across entities).
+
+Every piece of incoming information gets two labels: **what it is** (BFO) and **how abstract it is** (Peirce). BFO determines the node's type tag and its cross-references. Peirce determines its depth within the entity.
+
+```mermaid
+graph TD
+    Root[Root] --> Cat1[People]
+    Root --> Cat2[Systems]
+    Root --> Cat3[Projects]
+
+    Cat1 --> Steve[Steve]
+    Cat1 --> Alice[Alice]
+
+    Steve --> S1["Role: Tech Lead"]
+    Steve --> S2["Event: Promoted 2025-03"]
+    Steve --> S3["Disposition: Pushes back on deadlines"]
+
+    Cat2 --> Auth[Auth Service]
+    Auth --> A1["Quality: Latency 200ms"]
+    Auth --> A2["Event: Outage 2025-06-15"]
+    Auth --> A3["Disposition: Degrades under write load"]
+
+    S1 -.->|ref: Role| A1
+    S2 -.->|ref: Event| A2
+    S3 -.->|ref: Disposition| A3
+
+    style S1 fill:#e1f5fe
+    style S2 fill:#fff3e0
+    style S3 fill:#f3e5f5
+    style A1 fill:#e1f5fe
+    style A2 fill:#fff3e0
+    style A3 fill:#f3e5f5
+```
+
+```mermaid
+graph LR
+    New[New Information] --> Classify{Classify}
+    Classify --> Entity[Which entity?]
+    Classify --> BFO[BFO: what type?]
+    Classify --> Peirce[Peirce: how abstract?]
+    Entity --> Place[Place under entity]
+    BFO --> Tag[Tag node + add cross-references]
+    Peirce --> Depth[Determine depth under entity]
+    Place --> Done[Node placed + referenced]
+    Tag --> Done
+    Depth --> Done
+```
+
+## 1.0 Primary Tree — Entity-Centric
+
+The tree is organized by **what you'd ask about**, not by ontological category.
+
+¶1 **Depth 1: Domain Category** — noun title grouping related entities. "People", "Systems", "Projects", "Clients", "Processes". These emerge from the domain, not from BFO. Create them as needed.
+
+¶2 **Depth 2: Entity** — a specific thing with its own identity. "Steve", "Auth Service", "Q3 Launch". Proper noun or unique identifier. One entity, one node. If two pieces of information are about the same entity, they go under the same node.
+
+¶3 **Depth 3+: Detail** — everything you know about the entity. Each detail node gets a BFO type tag and a Peirce abstraction level. All actual content lives here.
+
+¶4 **Rule: "tell me about X" must be answerable by traversing one subtree.** If you'd need to visit three different subtrees to answer a question about Steve, the tree is wrong. Everything about Steve goes under Steve.
+
+### Minimum Depth
+
+```
+Depth 1: Category    (People, Systems, Projects...)
+Depth 2: Entity      (Steve, Auth Service, Q3 Launch...)
+Depth 3+: Detail     (what about it — tagged with BFO type)
+```
+
+Depth 1 and 2 are **structural only**. They hold children, never information. If intermediate nodes don't exist, create them before placing the detail.
+
+## 2.0 BFO Classification — Type Tag + Cross-References
+
+BFO does NOT determine where the node lives. It determines the node's **type tag** and which other nodes it **references** across the graph.
+
+¶1 **Independent Continuant** — things that exist on their own.
+- **Object** — bounded entity: person, system, org. Typically these ARE the depth-2 entity nodes themselves.
+- **Collection** — group of objects: a team, a cluster.
+- **Site** — environment or context: a region, a namespace, a market.
+
+¶2 **Dependent Continuant** — properties that inhere in something.
+- **Quality** — measurable: "latency is 200ms", "churn is 12%", "tone is formal."
+- **Role** — contextual function: "Alice is tech lead", "this service acts as gateway."
+- **Disposition** — latent capability or tendency: "can handle 10k RPS", "tends to push back."
+
+¶3 **Occurrent** — things that unfold in time.
+- **Process** — has duration, transforms: "deployment pipeline", "onboarding flow."
+- **Event** — instantaneous: "deploy succeeded at 14:32", "user signed up."
+- **State** — stable phase: "system is healthy", "project is blocked."
+
+### Decision Tree
+
+```
+Is it a thing that exists on its own?
+├─ YES → Independent Continuant
+│   ├─ Bounded entity? → Object
+│   ├─ Group of entities? → Collection
+│   └─ Context/environment? → Site
+├─ NO, it depends on a bearer
+│   → Dependent Continuant
+│   ├─ Measurable property? → Quality
+│   ├─ Contextual function? → Role
+│   └─ Latent capability? → Disposition
+└─ NO, it unfolds in time
+    → Occurrent
+    ├─ Has duration + transformation? → Process
+    ├─ Instantaneous boundary? → Event
+    └─ Stable phase? → State
+```
+
+### Cross-Reference Rule
+
+After placing a node under its entity, **add references to every other node in the graph that shares the same BFO type or that participates in the same fact.** This is what makes it a graph, not just a tree.
+
+Examples:
+- "Steve got promoted" (Event under Steve) → references "Q3 Launch completed" (Event under Projects) if the promotion was tied to it
+- "Auth Service latency 200ms" (Quality under Auth Service) → references "API Response Time 340ms" (Quality under API Gateway) if they're related metrics
+- "Alice is tech lead" (Role under Alice) → references "Auth Service" (Object under Systems) because the role is scoped to that system
+
+**Every node with the same BFO type is a candidate for cross-reference.** Not all will be linked — only those that share a factual relationship. But the type tag makes them discoverable.
+
+## 3.0 Peirce Classification — Depth Within Entity
+
+Determines ordering among an entity's children. Shallow = abstract patterns, deep = raw data.
+
+¶1 **Firstness (Raw Datum)** — direct observation, no interpretation. "CPU at 92%." "Steve said he's frustrated." "Deploy took 4 minutes." → **Deepest within entity.** Leaf nodes.
+
+¶2 **Secondness (Causal Link)** — relationship between two things. "High CPU caused timeout." "Steve's frustration led to the rewrite." → **Intermediate.** Must reference ≥ 2 other nodes (which may be under different entities — this creates cross-references).
+
+¶3 **Thirdness (Pattern / Rule)** — generalization from multiple observations. "This service degrades under write-heavy load." "Steve delivers best after deadline pressure." → **Shallowest within entity (but still depth 3+).** Must be supported by Secondness nodes beneath it.
+
+### Depth Within Entity
+
+```
+Entity (depth 2 — structural)
+├── Thirdness: patterns, rules (depth 3)
+│   ├── Secondness: causal links (depth 4)
+│   │   ├── Firstness: raw data (depth 5)
+│   │   └── Firstness: raw data (depth 5)
+│   └── Secondness: causal link
+│       └── Firstness: raw data
+└── Thirdness: another pattern
+    └── ...
+```
+
+## 4.0 The Routing Algorithm
+
+```
+ROUTE(I, root):
+
+  1. CLASSIFY
+     bfo_type  ← ask §2.0 decision tree
+     peirce    ← ask §3.0 → Firstness | Secondness | Thirdness
+
+  2. IDENTIFY ENTITY
+     Which entity is this about? Find or create:
+     - Category node at depth 1 (create if missing)
+     - Entity node at depth 2 (create if missing)
+     current ← entity node
+
+  3. DETERMINE DEPTH from Peirce level
+     IF peirce == Thirdness:
+       insert as direct child of entity (shallowest detail level)
+     IF peirce == Secondness:
+       insert below any Thirdness siblings, above Firstness
+     IF peirce == Firstness:
+       insert as leaf under most specific matching parent
+
+  4. TAG
+     Attach bfo_type to the new node as its type tag.
+
+  5. CROSS-REFERENCE
+     Scan the graph for related nodes:
+     a) Same BFO type under different entities
+        → add reference if factually related
+     b) Nodes mentioned in this fact (for Secondness: both cause and effect;
+        for Thirdness: the Secondness nodes it generalizes)
+        → add reference regardless of where they live
+     c) Same entity, different BFO type
+        → add reference if they describe the same situation
+
+     This step is what prevents information silos. "Steve got promoted"
+     under People→Steve now references "Q3 Launch completed" under
+     Projects→Q3 Launch and "Tech Lead role" under the same Steve node.
+
+  6. CHECK
+     - Duplicate? → merge, don't add
+     - Contradicts sibling or ancestor? → keep both, flag conflict
+     - Thirdness above now has ≥ 3 supporting nodes? → it's strong
+     - Thirdness above loses last support? → it's weak
+```
+
+## 5.0 Conflict Resolution
+
+¶1 **Same level, same parent, contradictory claims** — keep both. Do not silently overwrite. Surface the conflict on next retrieval.
+
+¶2 **New Firstness contradicts existing Thirdness** — the pattern might be wrong. Attach the new datum under it. If contradicting data accumulates, flag the pattern for review.
+
+¶3 **New Thirdness overlaps existing Thirdness** — check if one subsumes the other. If yes, make the narrower one a child of the broader one. If truly equivalent, merge. If partially overlapping, split into MECE sub-patterns.
+
+¶4 **Temporal conflict** — same claim, different times. The newer one doesn't delete the older one; it supersedes it. Keep both.
+
+¶5 **Cross-entity conflict** — two entities have contradictory claims about a shared fact. Both stay. Add references between them and flag the disagreement.
+
+## 6.0 Worked Examples
+
+### Example A: Something happens to a person
+
+**Input:** "Steve got promoted to senior engineer on 2025-03-01"
+
+```
+1. CLASSIFY
+   BFO: Event (instantaneous change)
+   Peirce: Firstness (raw fact)
+
+2. IDENTIFY ENTITY
+   Category: "People"    (depth 1 — create if missing)
+   Entity:   "Steve"     (depth 2 — create if missing)
+
+3. DEPTH: Firstness → leaf under Steve
+   Node title: "Promoted to senior engineer 2025-03"
+   Tag: Event
+
+4. CROSS-REFERENCE:
+   → Does a "Q3 Launch" node exist under Projects? If the promotion
+     was tied to it, add reference.
+   → Does Steve already have a Role node "Junior Engineer"?
+     If so, add reference (this Event changed that Role).
+   → Any other Events in the graph around 2025-03? Reference if related.
+```
+
+### Example B: Raw metric
+
+**Input:** "API response time hit 340ms at 2025-06-15T14:00Z"
+
+```
+1. CLASSIFY
+   BFO: Quality (measurable property)
+   Peirce: Firstness (raw measurement)
+
+2. IDENTIFY ENTITY
+   Category: "Systems"             (depth 1)
+   Entity:   "API Gateway"         (depth 2)
+
+3. DEPTH: Firstness → leaf under API Gateway
+   Node title: "Response time 340ms at 2025-06-15"
+   Tag: Quality
+
+4. CROSS-REFERENCE:
+   → Other Quality nodes under other Systems? (e.g., "Auth Service latency")
+     Reference if they're correlated.
+   → Any Secondness node like "High response time correlates with
+     deploy frequency"? This datum supports it.
+```
+
+### Example C: Causal observation
+
+**Input:** "Switching to connection pooling reduced DB timeouts by 60%"
+
+```
+1. CLASSIFY
+   BFO: Process (change over time with outcome)
+   Peirce: Secondness (causal link)
+
+2. IDENTIFY ENTITY
+   Category: "Systems"                  (depth 1)
+   Entity:   "Database"                 (depth 2)
+
+3. DEPTH: Secondness → intermediate under Database
+   Node title: "Connection pooling reduced timeouts 60%"
+   Tag: Process
+
+4. CROSS-REFERENCE:
+   → "Connection pooling" may also be an Object node under
+     Systems→Infrastructure. Reference it.
+   → "DB timeout rate" is a Quality under Database. Reference it.
+   → These TWO references are mandatory for Secondness (cause + effect).
+   → Does this + similar nodes support a Thirdness?
+     If ≥ 3 Secondness nodes point to the same pattern, propose it.
+```
+
+### Example D: Learned principle
+
+**Input:** "Users consistently abandon onboarding flows with more than 3 steps"
+
+```
+1. CLASSIFY
+   BFO: Disposition (tendency)
+   Peirce: Thirdness (general rule)
+
+2. IDENTIFY ENTITY
+   Category: "People"                (depth 1)
+   Entity:   "Users"                 (depth 2, collective entity)
+
+3. DEPTH: Thirdness → shallowest detail under Users
+   Node title: "Abandon flows with >3 steps"
+   Tag: Disposition
+
+4. CROSS-REFERENCE:
+   → Needs ≥ 2 supporting Secondness beneath it or elsewhere:
+     e.g., "Flow A: 5 steps, 70% drop-off" under Projects→Onboarding
+           "Flow B: 2 steps, 15% drop-off" under Projects→Onboarding v2
+   → Reference both. These may live under different entities — that's fine,
+     the references bridge them.
+   → Check for broader Thirdness like "Shorter flows convert better"
+     under the same or different entity. If found, this is a child of that.
+```
+
+## 7.0 Maintenance Heuristics
+
+¶1 **Promote on evidence** — when a Secondness gains its 3rd supporting Firstness, it's strong. When a Thirdness gains its 3rd supporting Secondness, it's reliable. Surface strong patterns to the user.
+
+¶2 **Decay on silence** — nodes that are never accessed or referenced lose relevance. Don't delete — demote. Move to an archive subtree after threshold.
+
+¶3 **Split on growth** — if any node accumulates more than 7 children, split into sub-categories (MECE). The parent becomes a category node, children redistribute.
+
+¶4 **Rebalance on contradiction** — if most of a Thirdness node's supporting nodes are contradicted, demote it to a contested claim. Don't let stale patterns persist.
+
+¶5 **Merge on redundancy** — during traversal, if two sibling nodes have > 80% semantic overlap, merge them. Keep the richer one, redirect references from the other.
+
+¶6 **Prune dead references** — when a node is merged or archived, update all nodes that reference it. Stale references are noise.

package/dist/prompts/memory/OBSERVE.md

@@ -0,0 +1,70 @@
+Extract observations from a conversation between a person and an AI assistant. Each observation is a discrete fact worth remembering across sessions.
+
+Capture everything with signal — intents, actions, outcomes, preferences, decisions, tool failures/recoveries, working strategies, processes, people, relationships, context. No fixed categories. If it matters later, extract it.
+
+## 1.0 Density
+
+¶1 Maximum information per token. Cut filler, hedging, preamble. Every word carries meaning or gets cut.
+
+¶2 Contrast:
+- ✗ "The person mentioned that they would prefer to have shorter responses in the future"
+- ✓ "Prefers short direct answers — said 'get to the point' when preamble preceded the answer"
+- ✗ "There was an issue with the image generation tool where it failed to produce good results"
+- ✓ "Image generation: photo-realistic portrait → distorted faces. Fix: illustration style + shorter prompt"
+
+## 2.0 What to Extract
+
+¶1 **Intents** — what the person wanted, why, motivation. Specific: "watercolor cat on windowsill, soft pastels" not "wanted an image".
+
+¶2 **Actions + outcomes** — what was done, what was produced, result quality. "Generated birthday card for Marco: hand-drawn, warm colors, dog in party hat, witty message. Person happy, printing it."
+
+¶3 **Preferences** — style, tone, format, detail level. Corrections are strong signal — when they asked for something different, record both the rejected and preferred approach.
+
+¶4 **Decisions** — what was chosen over what, why. Reasoning reveals priorities.
+
+¶5 **Tool failures + recoveries** — which tool, what input caused failure, what the bad output looked like, what fixed it. Most valuable observations — prevent repeating mistakes. "Web search: restaurant name without city → wrong results. Adding city fixed it. Rule: always include city for local queries."
+
+¶6 **Working strategies** — approaches that produced good results. Reusable recipes: "illustration style > photo-realistic for people-portraits", "image prompts under 30 words avoid truncation".
+
+¶7 **Processes** — multi-step workflows, order of operations, workarounds, tool chains.
+
+¶8 **Reactions** — liked result? Frustrated? Iterated? Abandoned?
+
+¶9 **People + context** — names mentioned, projects, recurring topics, background facts, relationships.
+
+## 3.0 Structure
+
+¶1 Each observation has two fields:
+- `text` — the observation: one fact, intent, preference, outcome, or lesson. Dense, self-contained.
+- `context` — situation that makes it meaningful: what was discussed, what prompted it, surrounding details. Also dense.
+
+¶2 Self-contained — readable without the original conversation.
+
+¶3 Specific over vague. Vague = worthless.
+
+¶4 Skip zero-signal mechanical exchanges. Empty list if nothing to remember.
+
+## 4.0 Output
+
+XML. No preamble, no markdown fences, no explanation.
+
+```xml
+<observations>
+<observation>
+<text>Wanted birthday card for Marco — hand-drawn, warm colors, witty message, dog in party hat. Happy with result, printing it.</text>
+<context>Marco's birthday. Wanted personal over store-bought. Marco likes humor + dogs. Card matched all criteria.</context>
+</observation>
+<observation>
+<text>Prefers direct concise answers — said "get to the point" when preamble preceded the actual answer.</text>
+<context>Thailand visa question. Response led with culture paragraph before visa info. Person cut it short. Shorter follow-ups landed better.</context>
+</observation>
+<observation>
+<text>Image generation: photo-realistic people-portraits → distorted faces. Fix: illustration style + simpler prompt. Worked first retry.</text>
+<context>Family portrait as gift. Two photo-realistic attempts failed. Warm illustrated style + fewer details succeeded. Use illustration-first for people.</context>
+</observation>
+<observation>
+<text>Web search: local business name without city → wrong results. Adding city to query fixed immediately.</text>
+<context>"La Petite Maison" search hit other cities. Adding "Kyiv" found it. Rule: always include city for location-specific queries.</context>
+</observation>
+</observations>
+```

package/dist/sandbox/sandboxCanRead.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandboxCanRead.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxCanRead.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAIlD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,WAAW,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASrG"}
+{"version":3,"file":"sandboxCanRead.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxCanRead.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAMlD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,WAAW,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBrG"}

package/dist/sandbox/sandboxCanRead.js

@@ -1,18 +1,42 @@
+import { promises as fs } from "node:fs";
+import os from "node:os";
 import path from "node:path";
-import { pathResolveSecure } from "./pathResolveSecure.js";
+import { isWithinSecure, pathResolveSecure } from "./pathResolveSecure.js";
 import { sandboxAppsAccessCheck } from "./sandboxAppsAccessCheck.js";
+import { sandboxPathDenyCheck } from "./sandboxPathDenyCheck.js";
+import { sandboxSensitiveDenyPathsBuild } from "./sandboxSensitiveDenyPathsBuild.js";
 /**
  * Resolves a read target against the current read allowlist.
  * Expects: target is an absolute path.
  */
 export async function sandboxCanRead(permissions, target) {
-    // Tool-level reads are always allowed across the filesystem.
+    // Read uses a broad allowlist, then applies explicit deny-lists to match sandbox safety policy.
     const allowedDirs = [path.parse(target).root];
     const result = await pathResolveSecure(allowedDirs, target);
     const access = sandboxAppsAccessCheck(permissions, result.realPath);
     if (!access.allowed) {
         throw new Error(access.reason ?? "Read access denied.");
     }
+    if (sandboxPathDenyCheck(result.realPath, sandboxSensitiveDenyPathsBuild())) {
+        throw new Error("Read access denied for sensitive paths.");
+    }
+    const explicitlyAllowedDirs = [permissions.workingDir, ...permissions.writeDirs, ...(permissions.readDirs ?? [])];
+    for (const allowedDir of explicitlyAllowedDirs) {
+        if (isWithinSecure(await existingPathResolve(allowedDir), result.realPath)) {
+            return result.realPath;
+        }
+    }
+    if (isWithinSecure(await existingPathResolve(os.homedir()), result.realPath)) {
+        throw new Error("Read access denied for OS home paths without explicit permission.");
+    }
     return result.realPath;
 }
+async function existingPathResolve(target) {
+    try {
+        return await fs.realpath(target);
+    }
+    catch {
+        return path.resolve(target);
+    }
+}
 //# sourceMappingURL=sandboxCanRead.js.map

package/dist/sandbox/sandboxCanRead.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandboxCanRead.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxCanRead.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,WAA+B,EAAE,MAAc;IAChF,6DAA6D;IAC7D,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,qBAAqB,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"sandboxCanRead.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxCanRead.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAErF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,WAA+B,EAAE,MAAc;IAChF,gGAAgG;IAChG,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,qBAAqB,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,8BAA8B,EAAE,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,qBAAqB,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,GAAG,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;IAClH,KAAK,MAAM,UAAU,IAAI,qBAAqB,EAAE,CAAC;QAC7C,IAAI,cAAc,CAAC,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,OAAO,MAAM,CAAC,QAAQ,CAAC;QAC3B,CAAC;IACL,CAAC;IAED,IAAI,cAAc,CAAC,MAAM,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACzF,CAAC;IAED,OAAO,MAAM,CAAC,QAAQ,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,MAAc;IAC7C,IAAI,CAAC;QACD,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;AACL,CAAC"}

package/dist/sandbox/sandboxCanRead.spec.js

@@ -1,19 +1,41 @@
 import { promises as fs } from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { sandboxCanRead } from "./sandboxCanRead.js";
 describe("sandboxCanRead", () => {
     let workingDir;
     let outsideDir;
     let outsideFile;
+    let homeDir;
+    let homeSensitiveFile;
+    let homeRandomFile;
+    let homeWorkspaceFile;
+    let homeWriteDirFile;
+    let homeReadDirFile;
     let appFile;
     let otherAppFile;
     beforeEach(async () => {
         workingDir = await fs.mkdtemp(path.join(os.tmpdir(), "sandbox-can-read-workspace-"));
         outsideDir = await fs.mkdtemp(path.join(os.tmpdir(), "sandbox-can-read-outside-"));
+        homeDir = await fs.mkdtemp(path.join(os.tmpdir(), "sandbox-can-read-home-"));
+        vi.spyOn(os, "homedir").mockReturnValue(homeDir);
         outsideFile = path.join(outsideDir, "outside.txt");
         await fs.writeFile(outsideFile, "outside-content", "utf8");
+        homeSensitiveFile = path.join(homeDir, ".ssh", "id_rsa");
+        homeRandomFile = path.join(homeDir, "random.txt");
+        homeWorkspaceFile = path.join(homeDir, "workspace", "notes.txt");
+        homeWriteDirFile = path.join(homeDir, "allowed", "data.txt");
+        homeReadDirFile = path.join(homeDir, ".daycare", "skills", "my-skill", "SKILL.md");
+        await fs.mkdir(path.dirname(homeSensitiveFile), { recursive: true });
+        await fs.mkdir(path.dirname(homeWorkspaceFile), { recursive: true });
+        await fs.mkdir(path.dirname(homeWriteDirFile), { recursive: true });
+        await fs.mkdir(path.dirname(homeReadDirFile), { recursive: true });
+        await fs.writeFile(homeSensitiveFile, "sensitive", "utf8");
+        await fs.writeFile(homeRandomFile, "home-file", "utf8");
+        await fs.writeFile(homeWorkspaceFile, "workspace-file", "utf8");
+        await fs.writeFile(homeWriteDirFile, "allowed-file", "utf8");
+        await fs.writeFile(homeReadDirFile, "skill-body", "utf8");
         appFile = path.join(workingDir, "apps", "my-app", "APP.md");
         otherAppFile = path.join(workingDir, "apps", "other-app", "APP.md");
         await fs.mkdir(path.dirname(appFile), { recursive: true });
@@ -24,14 +46,34 @@ describe("sandboxCanRead", () => {
     afterEach(async () => {
         await fs.rm(workingDir, { recursive: true, force: true });
         await fs.rm(outsideDir, { recursive: true, force: true });
+        await fs.rm(homeDir, { recursive: true, force: true });
+        vi.restoreAllMocks();
     });
-    it("allows reading any absolute path", async () => {
+    it("denies reading sensitive paths", async () => {
+        const permissions = buildPermissions(workingDir, [homeDir]);
+        await expect(sandboxCanRead(permissions, homeSensitiveFile)).rejects.toThrow("Read access denied for sensitive paths.");
+    });
+    it("denies reading random home-directory files by default", async () => {
         const permissions = buildPermissions(workingDir, []);
-        const result = await sandboxCanRead(permissions, outsideFile);
-        expect(result).toBe(await fs.realpath(outsideFile));
+        await expect(sandboxCanRead(permissions, homeRandomFile)).rejects.toThrow("Read access denied for OS home paths without explicit permission.");
+    });
+    it("allows reading files in workingDir even when workingDir is inside home", async () => {
+        const permissions = buildPermissions(path.join(homeDir, "workspace"), []);
+        const result = await sandboxCanRead(permissions, homeWorkspaceFile);
+        expect(result).toBe(await fs.realpath(homeWorkspaceFile));
     });
-    it("ignores write grants for read access checks", async () => {
-        const permissions = buildPermissions(workingDir, [outsideFile]);
+    it("allows reading files in explicitly granted writeDirs inside home", async () => {
+        const permissions = buildPermissions(workingDir, [path.join(homeDir, "allowed")]);
+        const result = await sandboxCanRead(permissions, homeWriteDirFile);
+        expect(result).toBe(await fs.realpath(homeWriteDirFile));
+    });
+    it("allows reading files in explicitly granted readDirs inside home", async () => {
+        const permissions = buildPermissions(workingDir, [], [path.join(homeDir, ".daycare", "skills")]);
+        const result = await sandboxCanRead(permissions, homeReadDirFile);
+        expect(result).toBe(await fs.realpath(homeReadDirFile));
+    });
+    it("allows reading system paths outside home", async () => {
+        const permissions = buildPermissions(workingDir, []);
         const result = await sandboxCanRead(permissions, outsideFile);
         expect(result).toBe(await fs.realpath(outsideFile));
     });
@@ -53,10 +95,11 @@ describe("sandboxCanRead", () => {
         await expect(sandboxCanRead(permissions, otherAppFile)).rejects.toThrow("App agents can only access their own app directory.");
     });
 });
-function buildPermissions(workingDir, writeDirs) {
+function buildPermissions(workingDir, writeDirs, readDirs = []) {
     return {
         workingDir: path.resolve(workingDir),
-        writeDirs: writeDirs.map((entry) => path.resolve(entry))
+        writeDirs: writeDirs.map((entry) => path.resolve(entry)),
+        readDirs: readDirs.map((entry) => path.resolve(entry))
     };
 }
 //# sourceMappingURL=sandboxCanRead.spec.js.map

package/dist/sandbox/sandboxCanRead.spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandboxCanRead.spec.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxCanRead.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAGrE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC5B,IAAI,UAAkB,CAAC;IACvB,IAAI,UAAkB,CAAC;IACvB,IAAI,WAAmB,CAAC;IACxB,IAAI,OAAe,CAAC;IACpB,IAAI,YAAoB,CAAC;IAEzB,UAAU,CAAC,KAAK,IAAI,EAAE;QAClB,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,6BAA6B,CAAC,CAAC,CAAC;QACrF,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC;QACnF,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QACnD,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAC3D,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC5D,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACpE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAE9D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAEhE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAE9D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAE/D,MAAM,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC9D,yDAAyD,CAC5D,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAE/D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAE1D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAE/D,MAAM,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACnE,qDAAqD,CACxD,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,UAAkB,EAAE,SAAmB;IAC7D,OAAO;QACH,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACpC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;KAC3D,CAAC;AACN,CAAC"}
+{"version":3,"file":"sandboxCanRead.spec.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxCanRead.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAGzE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC5B,IAAI,UAAkB,CAAC;IACvB,IAAI,UAAkB,CAAC;IACvB,IAAI,WAAmB,CAAC;IACxB,IAAI,OAAe,CAAC;IACpB,IAAI,iBAAyB,CAAC;IAC9B,IAAI,cAAsB,CAAC;IAC3B,IAAI,iBAAyB,CAAC;IAC9B,IAAI,gBAAwB,CAAC;IAC7B,IAAI,eAAuB,CAAC;IAC5B,IAAI,OAAe,CAAC;IACpB,IAAI,YAAoB,CAAC;IAEzB,UAAU,CAAC,KAAK,IAAI,EAAE;QAClB,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,6BAA6B,CAAC,CAAC,CAAC;QACrF,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC;QACnF,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;QAC7E,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAEjD,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QACnD,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAE3D,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACzD,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAClD,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QACjE,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAC7D,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QACnF,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,EAAE,CAAC,SAAS,CAAC,iBAAiB,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,EAAE,CAAC,SAAS,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QAE1D,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC5D,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACpE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,EAAE,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAE5D,MAAM,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACxE,yCAAyC,CAC5C,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAErD,MAAM,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACrE,mEAAmE,CACtE,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;QAE1E,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QAEpE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QAElF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAEnE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QAEjG,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QAElE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAE9D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAE/D,MAAM,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC9D,yDAAyD,CAC5D,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAE/D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAE1D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAE/D,MAAM,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACnE,qDAAqD,CACxD,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,UAAkB,EAAE,SAAmB,EAAE,WAAqB,EAAE;IACtF,OAAO;QACH,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACpC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxD,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;KACzD,CAAC;AACN,CAAC"}

package/dist/sandbox/sandboxCanWrite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandboxCanWrite.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxCanWrite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAIlD;;;GAGG;AACH,wBAAsB,eAAe,CAAC,WAAW,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQtG"}
+{"version":3,"file":"sandboxCanWrite.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxCanWrite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAQlD;;;GAGG;AACH,wBAAsB,eAAe,CAAC,WAAW,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBtG"}

package/dist/sandbox/sandboxCanWrite.js

@@ -1,5 +1,9 @@
 import { pathResolveSecure } from "./pathResolveSecure.js";
 import { sandboxAppsAccessCheck } from "./sandboxAppsAccessCheck.js";
+import { sandboxDangerousFileCheck } from "./sandboxDangerousFileCheck.js";
+import { sandboxDangerousFilesBuild } from "./sandboxDangerousFilesBuild.js";
+import { sandboxPathDenyCheck } from "./sandboxPathDenyCheck.js";
+import { sandboxSensitiveDenyPathsBuild } from "./sandboxSensitiveDenyPathsBuild.js";
 /**
  * Resolves a write target against the current write allowlist.
  * Expects: target is an absolute path.
@@ -11,6 +15,13 @@ export async function sandboxCanWrite(permissions, target) {
     if (!access.allowed) {
         throw new Error(access.reason ?? "Write access denied.");
     }
+    // Keep write behavior aligned with sandbox-runtime deny protections.
+    if (sandboxPathDenyCheck(result.realPath, sandboxSensitiveDenyPathsBuild())) {
+        throw new Error("Write access denied for sensitive paths.");
+    }
+    if (sandboxDangerousFileCheck(result.realPath, sandboxDangerousFilesBuild())) {
+        throw new Error("Write access denied for dangerous files or directories.");
+    }
     return result.realPath;
 }
 //# sourceMappingURL=sandboxCanWrite.js.map

package/dist/sandbox/sandboxCanWrite.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandboxCanWrite.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxCanWrite.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,WAA+B,EAAE,MAAc;IACjF,MAAM,WAAW,GAAG,CAAC,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,sBAAsB,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"sandboxCanWrite.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxCanWrite.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAErF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,WAA+B,EAAE,MAAc;IACjF,MAAM,WAAW,GAAG,CAAC,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,sBAAsB,CAAC,CAAC;IAC7D,CAAC;IAED,qEAAqE;IACrE,IAAI,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,8BAA8B,EAAE,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,yBAAyB,CAAC,MAAM,CAAC,QAAQ,EAAE,0BAA0B,EAAE,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO,MAAM,CAAC,QAAQ,CAAC;AAC3B,CAAC"}