premiere-pro-mcp 1.16.1 → 1.16.2

package/CHANGELOG.md

@@ -6,6 +6,19 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.16.2] - 2026-09-18
+
+### Fixed
+
+- Direct UXP `.ccx` packages now use a plugin-id bundle root and Unix 644/755
+  permission bits so Creative Cloud / UPI can extract plugin metadata. (#566)
+- Path-based UXP commands now resolve native paths through the granted
+  workspace folder instead of advertising them as unsupported on every host.
+  (#567)
+
+Automated checks do not establish licensed Premiere or After Effects playback or
+rendered-output verification.
+
 ## [1.16.1] - 2026-09-17
 
 ### Added

package/README.md

@@ -108,10 +108,10 @@ The current source exposes 381 core tools for supported workflow steps spanning
 
 <a id="latest-release"></a>
 
-### Latest release: 1.16.1
+### Latest release: 1.16.2
 
-The published v1.16.0 npm artifact contains **373 core tools**, 371 in its default profile,
-and 466 with a compatible UXP connection. The development catalog above can include
+The published v1.16.1 npm artifact contains **381 core tools**, 379 in its default profile,
+and 474 with a compatible UXP connection. The development catalog above can include
 unreleased work. See the [versioned facts and package provenance](https://premiere-pro-mcp.com/facts/).
 
 ### Try a bounded workflow
@@ -160,7 +160,7 @@ if the connection is unavailable.
   local Premiere processes. See the generated [supported action catalog](docs/supported-actions.md)
   for individual capability and verification contracts.
 
-See the [v1.16.1 release notes](https://github.com/leancoderkavy/premiere-pro-mcp/releases/tag/v1.16.1)
+See the [v1.16.2 release notes](https://github.com/leancoderkavy/premiere-pro-mcp/releases/tag/v1.16.2)
 for complete details. Live installation in Premiere Pro still requires host verification.
 
 ### Current MCP protocol support
@@ -208,7 +208,7 @@ their bins, media rules, and organization rules before a facility uses one.
 > ### Install the published package (verify the name)
 >
 > ```bash
-> npm i -g premiere-pro-mcp@1.16.1
+> npm i -g premiere-pro-mcp@1.16.2
 > ```
 >
 > This repository publishes only **`premiere-pro-mcp`**. A differently named package (`adobe-premiere-pro-mcp`) may also declare a `premiere-pro-mcp` executable. Before configuring a client, confirm:
@@ -216,7 +216,7 @@ their bins, media rules, and organization rules before a facility uses one.
 > | Check | Expected |
 > | --- | --- |
 > | Package name | `premiere-pro-mcp` (not `adobe-premiere-pro-mcp`) |
-> | Version | `1.16.1` |
+> | Version | `1.16.2` |
 > | Homepage / repo | https://premiere-pro-mcp.com/ · https://github.com/leancoderkavy/premiere-pro-mcp |
 >
 > ```bash
@@ -229,9 +229,9 @@ their bins, media rules, and organization rules before a facility uses one.
 
 ### Easiest supported path: Claude Desktop
 
-1. Download the current [Claude Desktop bundle (`.mcpb`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.16.1/premiere-pro-mcp-1.16.1.mcpb).
+1. Download the current [Claude Desktop bundle (`.mcpb`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.16.2/premiere-pro-mcp-1.16.2.mcpb).
 2. In Claude Desktop, open **Settings > Extensions > Advanced settings > Install Extension**, select the downloaded bundle, and restart Claude Desktop.
-3. Download the separate [signed Premiere connector (`.zxp`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.16.1/MCPBridgeCEP.zxp). Open it with your trusted ZXP installer. If your computer has no ZXP installer, use the npm connector installer in **Advanced setup** below.
+3. Download the separate [signed Premiere connector (`.zxp`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.16.2/MCPBridgeCEP.zxp). Open it with your trusted ZXP installer. If your computer has no ZXP installer, use the npm connector installer in **Advanced setup** below.
 4. Restart Premiere, open a project, then open **Window > Extensions > MCP for Adobe Premiere Pro**.
 5. In Claude, enter: `Safely check my Premiere connection with verify_premiere_connection. Make no changes.`
 
@@ -760,7 +760,7 @@ The bounded UXP migration surface also exposes guarded static Color effect-param
 
 The bounded UXP migration surface also exposes guarded typed Project metadata schema-field creation. It requires the exact inspected active-project identity and 12 KiB-bounded panel XML, an explicit confirmation and operation ID, and serializes this bridge's schema and panel-replacement calls per project. Adobe provides no atomic compare-and-set or field-level schema getter: native acceptance and a changed panel XML are evidence only, so the command always returns `committed_unverified` and does not claim field presence, persistence, UI results, Undo, cancellation, or licensed-host validation.
 
-The panel now requests access to one operator-selected workspace instead of declaring full filesystem access. Choose the folder in the panel before invoking a path-based UXP workflow. Media, relink, preset, export, and Source Monitor file paths must remain inside it; the persistent capability token and native root path are never returned over MCP. Lexical containment alone cannot exclude symlink, junction, or reparse-point escapes, and Adobe's request-scoped UXP filesystem API does not document canonical-path resolution. Builds without a host-supplied canonical resolver therefore advertise path-based UXP commands as unsupported and fail closed at invocation; use the existing CEP fallback for those operations.
+The panel now requests access to one operator-selected workspace instead of declaring full filesystem access. Choose the folder in the panel before invoking a path-based UXP workflow. Media, relink, preset, export, and Source Monitor file paths must remain inside it; the persistent capability token and native root path are never returned over MCP. After a folder is granted, path-based commands resolve each native path through that folder's Entry tree and compare the host `nativePath` against the approved root, so symlink or junction targets outside the workspace still fail closed. If the host Entry cannot be walked and no resolver is supplied, those commands stay unsupported and the CEP fallback remains the path-based compatibility route.
 
 Native transcript editing starts with a read-only, revision-locked planning flow. Use
 `get_clip_transcript_uxp` to export the transcript Premiere generated for a source

package/after-effects-cep-plugin/CSXS/manifest.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.aftereffects.bridge" ExtensionBundleVersion="1.16.1" ExtensionBundleName="MCP for Adobe After Effects">
+<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.aftereffects.bridge" ExtensionBundleVersion="1.16.2" ExtensionBundleName="MCP for Adobe After Effects">
   <ExtensionList>
-    <Extension Id="com.mcp.aftereffects.bridge.panel" Version="1.16.1"/>
+    <Extension Id="com.mcp.aftereffects.bridge.panel" Version="1.16.2"/>
   </ExtensionList>
   <ExecutionEnvironment>
     <HostList>

package/cep-plugin/CSXS/manifest.xml

@@ -1,8 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.premiere.bridge" ExtensionBundleVersion="1.16.1" ExtensionBundleName="MCP for Adobe Premiere Pro">
+<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.premiere.bridge" ExtensionBundleVersion="1.16.2" ExtensionBundleName="MCP for Adobe Premiere Pro">
   <ExtensionList>
-    <Extension Id="com.mcp.premiere.bridge.panel" Version="1.16.1"/>
-    <Extension Id="com.mcp.premiere.bridge.headless" Version="1.16.1"/>
+    <Extension Id="com.mcp.premiere.bridge.panel" Version="1.16.2"/>
+    <Extension Id="com.mcp.premiere.bridge.headless" Version="1.16.2"/>
   </ExtensionList>
   <ExecutionEnvironment>
     <HostList>

package/cep-plugin/index.html

@@ -81,7 +81,7 @@
     <section class="update-section" aria-live="polite">
       <div class="update-copy">
         <span class="section-label">MCP updates</span>
-        <strong id="updateTitle">Version 1.16.1</strong>
+        <strong id="updateTitle">Version 1.16.2</strong>
         <span id="updateDetail">Checking the global MCP server and connector release…</span>
       </div>
       <button id="btnUpdate" class="button button-update" onclick="handleUpdateClick()" type="button" aria-describedby="updateDetail" disabled>

package/cep-plugin/updater.cjs

@@ -7,7 +7,7 @@
 })(this, function () {
   "use strict";
 
-  var CURRENT_VERSION = "1.16.1";
+  var CURRENT_VERSION = "1.16.2";
   var PACKAGE_NAME = "premiere-pro-mcp";
   var LATEST_PACKAGE_API = "https://registry.npmjs.org/" + PACKAGE_NAME;
   var LATEST_RELEASE_API =

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "premiere-pro-mcp",
   "mcpName": "io.github.leancoderkavy/premiere-pro",
-  "version": "1.16.1",
+  "version": "1.16.2",
   "description": "MCP server for Adobe Premiere Pro with 381 core AI video editing tools, a guarded After Effects MOGRT studio, and a capability-aware UXP bridge for supported Premiere workflows.",
   "main": "dist/index.js",
   "types": "./dist/index.d.ts",

package/public-product-manifest.json

@@ -10,7 +10,7 @@
     "name": "MCP for Adobe Premiere Pro",
     "mcpName": "io.github.leancoderkavy/premiere-pro",
     "npmPackage": "premiere-pro-mcp",
-    "version": "1.16.1",
+    "version": "1.16.2",
     "repository": "https://github.com/leancoderkavy/premiere-pro-mcp",
     "homepage": "https://premiere-pro-mcp.com/",
     "license": "MIT",

package/scripts/build-uxp-ccx.mjs

@@ -41,6 +41,27 @@ function u32(value) {
   return value;
 }
 
+function unixExternalAttributes(kind) {
+  const mode = kind === "directory" ? 0o040755 : 0o100644;
+  const dos = kind === "directory" ? 0x10 : 0x20;
+  return u32(((mode * 0x10000) + dos) >>> 0);
+}
+
+function withBundleRoot(files, pluginId) {
+  const prefix = `${pluginId}/`;
+  const directories = new Set([prefix]);
+  const prefixed = files.map((file) => {
+    const name = `${prefix}${file.name.replaceAll("\\", "/")}`;
+    const segments = name.split("/");
+    for (let index = 1; index < segments.length; index += 1) {
+      directories.add(`${segments.slice(0, index).join("/")}/`);
+    }
+    return { name, data: file.data, kind: "file" };
+  });
+  const dirEntries = [...directories].map((name) => ({ name, data: Buffer.alloc(0), kind: "directory" }));
+  return [...dirEntries, ...prefixed].sort((left, right) => left.name.localeCompare(right.name));
+}
+
 async function collectFiles(directory, relative = "") {
   const entries = await readdir(directory, { withFileTypes: true });
   const files = [];
@@ -66,8 +87,10 @@ function buildStoredZip(files) {
   let offset = 0;
 
   for (const file of files) {
+    const isDirectory = file.kind === "directory" || file.name.endsWith("/");
+    const data = isDirectory ? Buffer.alloc(0) : file.data;
     const name = Buffer.from(file.name, "utf8");
-    const checksum = crc32(file.data);
+    const checksum = crc32(data);
     const local = Buffer.alloc(30);
     local.writeUInt32LE(0x04034b50, 0);
     local.writeUInt16LE(20, 4);
@@ -76,8 +99,8 @@ function buildStoredZip(files) {
     local.writeUInt16LE(0, 10);
     local.writeUInt16LE(0x0021, 12);
     local.writeUInt32LE(u32(checksum), 14);
-    local.writeUInt32LE(u32(file.data.length), 18);
-    local.writeUInt32LE(u32(file.data.length), 22);
+    local.writeUInt32LE(u32(data.length), 18);
+    local.writeUInt32LE(u32(data.length), 22);
     local.writeUInt16LE(u16(name.length), 26);
     local.writeUInt16LE(0, 28);
 
@@ -90,19 +113,19 @@ function buildStoredZip(files) {
     central.writeUInt16LE(0, 12);
     central.writeUInt16LE(0x0021, 14);
     central.writeUInt32LE(u32(checksum), 16);
-    central.writeUInt32LE(u32(file.data.length), 20);
-    central.writeUInt32LE(u32(file.data.length), 24);
+    central.writeUInt32LE(u32(data.length), 20);
+    central.writeUInt32LE(u32(data.length), 24);
     central.writeUInt16LE(u16(name.length), 28);
     central.writeUInt16LE(0, 30);
     central.writeUInt16LE(0, 32);
     central.writeUInt16LE(0, 34);
     central.writeUInt16LE(0, 36);
-    central.writeUInt32LE(0, 38);
+    central.writeUInt32LE(unixExternalAttributes(isDirectory ? "directory" : "file"), 38);
     central.writeUInt32LE(u32(offset), 42);
 
-    localRecords.push(local, name, file.data);
+    localRecords.push(local, name, data);
     centralRecords.push(central, name);
-    offset += local.length + name.length + file.data.length;
+    offset += local.length + name.length + data.length;
   }
 
   const centralDirectory = Buffer.concat(centralRecords);
@@ -118,7 +141,7 @@ function buildStoredZip(files) {
   return Buffer.concat([...localRecords, centralDirectory, end]);
 }
 
-function verifyStoredZip(archive, expectedNames) {
+function verifyStoredZip(archive, expectedNames, pluginId) {
   const endOffset = archive.length - 22;
   assert(endOffset >= 0 && archive.readUInt32LE(endOffset) === 0x06054b50, "archive is missing a ZIP end record");
   assert(archive.readUInt16LE(endOffset + 20) === 0, "archive must not contain a ZIP comment");
@@ -128,20 +151,33 @@ function verifyStoredZip(archive, expectedNames) {
   assert(cursor + centralSize === endOffset, "archive central directory has an unexpected length");
   assert(entryCount === expectedNames.length, "archive entry count does not match the staged plugin files");
   const names = [];
+  const bundleRoot = `${pluginId}/`;
 
   for (let index = 0; index < entryCount; index += 1) {
     assert(archive.readUInt32LE(cursor) === 0x02014b50, "archive central directory entry is invalid");
     assert(archive.readUInt16LE(cursor + 10) === 0, "archive must use stored ZIP entries");
+    assert((archive.readUInt16LE(cursor + 4) >>> 8) === 3, "archive entries must declare a Unix origin");
     const checksum = archive.readUInt32LE(cursor + 16);
     const compressedSize = archive.readUInt32LE(cursor + 20);
     const uncompressedSize = archive.readUInt32LE(cursor + 24);
     const nameLength = archive.readUInt16LE(cursor + 28);
     const extraLength = archive.readUInt16LE(cursor + 30);
     const commentLength = archive.readUInt16LE(cursor + 32);
+    const externalAttributes = archive.readUInt32LE(cursor + 38);
     const localOffset = archive.readUInt32LE(cursor + 42);
     const name = archive.subarray(cursor + 46, cursor + 46 + nameLength).toString("utf8");
     assert(!names.includes(name), `archive contains duplicate entry ${name}`);
     names.push(name);
+    assert(name === bundleRoot || name.startsWith(bundleRoot), `archive entry ${name} must stay under ${bundleRoot}`);
+    const unixMode = externalAttributes >>> 16;
+    const isDirectory = name.endsWith("/");
+    if (isDirectory) {
+      assert((unixMode & 0o170000) === 0o040000, `archive directory ${name} must use Unix directory bits`);
+      assert((unixMode & 0o777) === 0o755, `archive directory ${name} must be mode 755`);
+    } else {
+      assert((unixMode & 0o170000) === 0o100000, `archive file ${name} must use Unix regular-file bits`);
+      assert((unixMode & 0o777) === 0o644, `archive file ${name} must be mode 644`);
+    }
     assert(archive.readUInt32LE(localOffset) === 0x04034b50, `archive local entry is invalid for ${name}`);
     const localNameLength = archive.readUInt16LE(localOffset + 26);
     const localExtraLength = archive.readUInt16LE(localOffset + 28);
@@ -157,6 +193,7 @@ function verifyStoredZip(archive, expectedNames) {
     cursor += 46 + nameLength + extraLength + commentLength;
   }
 
+  assert(names.includes(bundleRoot), `archive must contain the ${bundleRoot} directory`);
   assert(
     JSON.stringify(names.sort()) === JSON.stringify([...expectedNames].sort()),
     "archive contents do not match the staged plugin files",
@@ -193,11 +230,13 @@ async function main() {
     data: Buffer.from(`${JSON.stringify(manifest, null, 2)}\n`, "utf8"),
   };
   files.sort((left, right) => left.name.localeCompare(right.name));
+  const packaged = withBundleRoot(files, pluginId);
 
-  const archive = buildStoredZip(files);
+  const archive = buildStoredZip(packaged);
   verifyStoredZip(
     archive,
-    files.map((file) => file.name),
+    packaged.map((file) => file.name),
+    pluginId,
   );
   await mkdir(artifacts, { recursive: true });
   const output = path.join(

package/uxp-plugin/DISTRIBUTION.md

@@ -21,14 +21,20 @@ This writes:
 artifacts/premiere-pro-mcp-uxp-<version>-direct.ccx
 ```
 
-The builder uses a fixed ZIP timestamp, lexical file order, and stored entries,
-then reads the generated central directory and checks every entry and CRC. The
-result is reproducible for identical source bytes. It also rejects symlinks,
-requires the UXP v5 Premiere manifest, checks the version against
-`package.json`. Adobe's Premiere 26.3 runtime requires the compatible `domains: "all"`
+The builder uses a fixed ZIP timestamp, lexical file order, and stored entries
+under a single bundle root (`<plugin-id>/manifest.json`), with Unix file mode
+644 and directory mode 755. It then reads the generated central directory and
+checks every entry, CRC, bundle prefix, and permission bits. The result is
+reproducible for identical source bytes. It also rejects symlinks, requires
+the UXP v5 Premiere manifest, and checks the version against `package.json`.
+Adobe's Premiere 26.3 runtime requires the compatible `domains: "all"`
 manifest form for the WebSocket connection; `workspace.cjs` remains the enforced authority and
 accepts only `ws://127.0.0.1:<port>/uxp` or `ws://localhost:<port>/uxp`.
 
+Adobe's Unified Plugin Installer accepts `--install <path>`. The
+`--install="<path>"` form can exit 0 without installing; use the space-separated
+form when diagnosing a local CCX.
+
 For an Adobe Creative Cloud Marketplace submission, Adobe Developer
 Distribution must first create the Marketplace plugin ID. Build a separate
 package without changing the checked-in direct manifest:

package/uxp-plugin/commands.cjs

@@ -239,7 +239,7 @@
         if (definition.conditionalWorkspace) commands[name].workspaceRequired = "path_variant_only";
         if (definition.targetCapabilityProbe) commands[name].targetCapabilityProbe = "invocation";
         if (!apiSupported) commands[name].reason = "Required Premiere UXP API is unavailable in this host";
-        else if (!pathValidationSupported) commands[name].reason = "This UXP host cannot canonically validate native paths; use the CEP fallback for path-based workflows";
+        else if (!pathValidationSupported) commands[name].reason = "canonical path validation is not implemented in this build; use the CEP fallback for path-based workflows";
       }
       return {
         backend: "uxp", protocolVersion: Protocol.PROTOCOL_VERSION, hostMinVersion: "25.6.0",

package/uxp-plugin/manifest.json

@@ -2,7 +2,7 @@
   "manifestVersion": 5,
   "id": "com.ppmcp.premiere.uxp",
   "name": "MCP for Adobe Premiere Pro",
-  "version": "1.16.1",
+  "version": "1.16.2",
   "main": "index.html",
   "host": { "app": "premierepro", "minVersion": "25.6.0" },
   "entrypoints": [

package/uxp-plugin/workspace.cjs

@@ -74,6 +74,45 @@
     return url;
   }
 
+  function nativePathOf(fs, entry) {
+    if (entry && typeof entry.nativePath === "string" && entry.nativePath) return entry.nativePath;
+    if (entry && fs && typeof fs.getNativePath === "function") return fs.getNativePath(entry);
+    return "";
+  }
+
+  function toFileUrl(nativePath) {
+    const parsed = parseAbsolutePath(nativePath, "path");
+    if (parsed.kind === "windows") return "file:/" + parsed.normalized;
+    return "file:" + parsed.normalized;
+  }
+
+  function createCanonicalPathResolver(deps) {
+    const fs = deps && deps.fs;
+    if (!fs || typeof fs.getEntryWithUrl !== "function") return undefined;
+    return async function resolveCanonicalPath(value, options) {
+      const label = options && options.label || "path";
+      const kind = options && options.kind || "file";
+      let entry;
+      try {
+        entry = await fs.getEntryWithUrl(toFileUrl(value));
+      } catch (error) {
+        if (error && /^UXP_[A-Z0-9_]+$/.test(error.code || "")) throw error;
+        throw workspaceError("UXP_CANONICAL_PATH_UNAVAILABLE", "This UXP host could not resolve " + label + " to a canonical filesystem path");
+      }
+      const native = nativePathOf(fs, entry);
+      if (!native) {
+        throw workspaceError("UXP_CANONICAL_PATH_UNAVAILABLE", "This UXP host could not resolve " + label + " to a canonical filesystem path");
+      }
+      if (kind === "directory" && entry && entry.isFile) {
+        throw workspaceError("UXP_INVALID_ARGUMENT", label + " must be a directory");
+      }
+      if (kind === "file" && entry && entry.isFolder) {
+        throw workspaceError("UXP_INVALID_ARGUMENT", label + " must be a file");
+      }
+      return parseAbsolutePath(native, label).normalized;
+    };
+  }
+
   function createWorkspaceBroker(deps) {
     const fs = deps && deps.fs;
     const resolveCanonicalPath = deps && deps.resolveCanonicalPath;
@@ -82,9 +121,7 @@
     let initialized = false;
 
     function nativePathFor(entry) {
-      if (entry && typeof entry.nativePath === "string" && entry.nativePath) return entry.nativePath;
-      if (entry && fs && typeof fs.getNativePath === "function") return fs.getNativePath(entry);
-      return "";
+      return nativePathOf(fs, entry);
     }
 
     async function dataFolder() {
@@ -168,6 +205,10 @@
       return status();
     }
 
+    function canWalkGrantedFolder() {
+      return !!(rootEntry && typeof rootEntry.getEntry === "function");
+    }
+
     function status() {
       return {
         configured: !!rootEntry,
@@ -175,10 +216,46 @@
         rootName: rootEntry && typeof rootEntry.name === "string" ? rootEntry.name : null,
         persistent: !!persistentToken,
         pathDisclosure: "redacted",
-        canonicalPathValidation: typeof resolveCanonicalPath === "function" ? "available" : "unavailable"
+        canonicalPathValidation: typeof resolveCanonicalPath === "function" || canWalkGrantedFolder() ? "available" : "unavailable"
       };
     }
 
+    function relativeSegments(rootPath, candidatePath, label) {
+      const root = parseAbsolutePath(rootPath, "workspace root");
+      const candidate = parseAbsolutePath(candidatePath, label);
+      if (candidate.comparison === root.comparison) return [];
+      if (candidate.comparison.indexOf(root.comparison + "/") !== 0) {
+        throw workspaceError("UXP_PATH_OUTSIDE_WORKSPACE", label + " must stay inside the approved workspace folder");
+      }
+      return candidate.normalized.slice(root.normalized.length).replace(/^\//, "").split("/").filter(Boolean);
+    }
+
+    async function resolveThroughGrantedFolder(candidatePath, options) {
+      const label = options && options.label || "path";
+      if (!canWalkGrantedFolder()) {
+        throw workspaceError("UXP_CANONICAL_PATH_UNAVAILABLE", "Canonical path validation is not implemented in this build; use the CEP fallback for path-based workflows");
+      }
+      const rootPath = nativePathFor(rootEntry);
+      const segments = relativeSegments(rootPath, candidatePath, label);
+      let entry = rootEntry;
+      for (let index = 0; index < segments.length; index += 1) {
+        if (!entry || typeof entry.getEntry !== "function") {
+          throw workspaceError("UXP_CANONICAL_PATH_UNAVAILABLE", "Canonical path validation is not implemented in this build; use the CEP fallback for path-based workflows");
+        }
+        try {
+          entry = await entry.getEntry(segments[index]);
+        } catch (error) {
+          if (error && /^UXP_[A-Z0-9_]+$/.test(error.code || "")) throw error;
+          throw workspaceError("UXP_CANONICAL_PATH_UNAVAILABLE", "This UXP host could not resolve " + label + " to a canonical filesystem path");
+        }
+      }
+      const native = nativePathFor(entry);
+      if (!native) {
+        throw workspaceError("UXP_CANONICAL_PATH_UNAVAILABLE", "This UXP host could not resolve " + label + " to a canonical filesystem path");
+      }
+      return parseAbsolutePath(native, label).normalized;
+    }
+
     async function assertPathAllowed(value, options) {
       const label = options && options.label || "path";
       const kind = options && options.kind || "file";
@@ -190,17 +267,18 @@
       if (!isContained(rootPath, candidate.normalized, kind === "directory")) {
         throw workspaceError("UXP_PATH_OUTSIDE_WORKSPACE", label + " must stay inside the approved workspace folder");
       }
-      // A lexical prefix check cannot detect symlinks, Windows junctions, or
-      // other reparse points. Adobe's request-scoped UXP filesystem API does
-      // not expose a documented realpath/link-inspection primitive, so raw
-      // native paths must fail closed unless the embedding host supplies one.
-      if (typeof resolveCanonicalPath !== "function") {
-        throw workspaceError("UXP_CANONICAL_PATH_UNAVAILABLE", "This UXP host cannot prove that " + label + " stays inside the approved workspace after resolving filesystem links");
-      }
+      // Lexical containment cannot detect symlink, junction, or reparse-point
+      // escapes. Prefer an embedder-supplied resolver; otherwise walk from the
+      // granted folder Entry so nativePath reflects the host's resolved target.
       let canonicalRootValue, canonicalCandidateValue;
       try {
-        canonicalRootValue = await resolveCanonicalPath(rootPath, { label: "workspace root", kind: "directory" });
-        canonicalCandidateValue = await resolveCanonicalPath(candidate.normalized, { label, kind });
+        if (typeof resolveCanonicalPath === "function") {
+          canonicalRootValue = await resolveCanonicalPath(rootPath, { label: "workspace root", kind: "directory" });
+          canonicalCandidateValue = await resolveCanonicalPath(candidate.normalized, { label, kind });
+        } else {
+          canonicalRootValue = await resolveThroughGrantedFolder(rootPath, { label: "workspace root", kind: "directory" });
+          canonicalCandidateValue = await resolveThroughGrantedFolder(candidate.normalized, { label, kind });
+        }
       } catch (error) {
         if (error && /^UXP_[A-Z0-9_]+$/.test(error.code || "")) throw error;
         throw workspaceError("UXP_CANONICAL_PATH_UNAVAILABLE", "This UXP host could not resolve " + label + " to a canonical filesystem path");
@@ -216,5 +294,5 @@
     return { initialize, requestRoot, revoke, status, assertPathAllowed };
   }
 
-  return { createWorkspaceBroker, parseAbsolutePath, isContained, validateLoopbackBridgeUrl, workspaceError };
+  return { createWorkspaceBroker, createCanonicalPathResolver, parseAbsolutePath, isContained, validateLoopbackBridgeUrl, workspaceError };
 });