stitchkit 0.83.1 → 0.83.2

package/CHANGELOG.md

@@ -15,6 +15,19 @@ additive**; the first breaking change landed in 0.10.0. Grep the file for
 
 ## [Unreleased]
 
+## [0.83.2] — 2026-09-07
+
+### Added
+
+- **Agent coding tools can enforce one path policy before disclosure or content reads.**
+  `createAgentCodingTools({ authorizePath })` accepts an async or synchronous callback shared by
+  direct read/write/edit, `list_directory`, `glob` and both `search_files` modes. Direct access to a
+  denied path returns `FORBIDDEN`; discovery omits it. The contained walker applies the decision
+  before descending into a directory or opening a file, and `search_files.include` now filters
+  before reading instead of after the whole scan. This lets a host protect `.env` or credential
+  paths without copying the framework scanner. Shell remains explicitly outside the guarantee: an
+  executable requires process isolation, not path filtering. → ADR 0172.
+
 ## [0.83.1] — 2026-09-07
 
 ### Fixed

package/dist/agent-runtime/coding-tool-contract.d.ts

@@ -58,9 +58,20 @@ export declare const AgentCodingToolAuthorizationSchema: z.ZodDiscriminatedUnion
 }, z.core.$strict>], "operation">;
 export type AgentCodingToolLimits = z.infer<typeof AgentCodingToolLimitsSchema>;
 export type AgentCodingToolAuthorization = z.infer<typeof AgentCodingToolAuthorizationSchema>;
+export declare const AgentCodingToolPathAuthorizationSchema: z.ZodObject<{
+    path: z.ZodString;
+}, z.core.$strict>;
+export type AgentCodingToolPathAuthorization = z.infer<typeof AgentCodingToolPathAuthorizationSchema>;
 export interface AgentCodingToolConfig {
     root: string;
     authorize(input: AgentCodingToolAuthorization): boolean | Promise<boolean>;
+    /**
+     * One operation-independent admission policy for workspace paths.
+     *
+     * A denied path is refused by direct file tools and omitted from discovery.
+     * The callback runs before a file is opened or its content is read.
+     */
+    authorizePath?(input: AgentCodingToolPathAuthorization): boolean | Promise<boolean>;
     executables?: Readonly<Record<string, string>>;
     environment?: Readonly<Record<string, string>>;
     artifacts?: AgentCodingArtifactStore;

package/dist/agent-runtime/coding-tool-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coding-tool-contract.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;kBAgB7B,CAAC;AAEZ,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAsD7C,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,SAAS,CAAC,EAAE,wBAAwB,CAAC;IACrC,MAAM,CAAC,EAAE;QACP,wEAAwE;QACxE,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACxC,CAAC;IACF,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,KAAK,EAAE;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,UAAU,CAAC;KAClB,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,EAAE;QACV,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GACG;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACzC,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QACR,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;KAC9D,CAAC;IACF,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC;IACnB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,SAAS,CAAC,KAAK,GAAG,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC;IAClD,OAAO,CAAC,OAAO,EAAE;QACf,MAAM,EAAE,SAAS,CAAC;QAClB,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAChC;AAED,eAAO,MAAM,mBAAmB;;;;kBAMrB,CAAC;AAEZ,eAAO,MAAM,oBAAoB;;;;;;;kBAStB,CAAC;AAEZ,eAAO,MAAM,oBAAoB;;;;kBAMtB,CAAC;AAEZ,eAAO,MAAM,qBAAqB;;;;kBAcvB,CAAC;AAEZ,wBAAgB,sBAAsB,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE;;;;;;mBAWxE;AAED,eAAO,MAAM,gBAAgB;;;;kBAMlB,CAAC;AAEZ,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;kBAiBnB,CAAC;AAkBZ,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,CAAC,qBAAqB,CAAC,GAAG,SAAS,GAChD,qBAAqB,CAEvB"}
+{"version":3,"file":"coding-tool-contract.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;kBAgB7B,CAAC;AAEZ,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAsD7C,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,sCAAsC;;kBAExC,CAAC;AAEZ,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,sCAAsC,CAC9C,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E;;;;;OAKG;IACH,aAAa,CAAC,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpF,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,SAAS,CAAC,EAAE,wBAAwB,CAAC;IACrC,MAAM,CAAC,EAAE;QACP,wEAAwE;QACxE,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACxC,CAAC;IACF,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,KAAK,EAAE;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,UAAU,CAAC;KAClB,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,EAAE;QACV,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GACG;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACzC,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QACR,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;KAC9D,CAAC;IACF,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC;IACnB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,SAAS,CAAC,KAAK,GAAG,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC;IAClD,OAAO,CAAC,OAAO,EAAE;QACf,MAAM,EAAE,SAAS,CAAC;QAClB,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAChC;AAED,eAAO,MAAM,mBAAmB;;;;kBAMrB,CAAC;AAEZ,eAAO,MAAM,oBAAoB;;;;;;;kBAStB,CAAC;AAEZ,eAAO,MAAM,oBAAoB;;;;kBAMtB,CAAC;AAEZ,eAAO,MAAM,qBAAqB;;;;kBAcvB,CAAC;AAEZ,wBAAgB,sBAAsB,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE;;;;;;mBAWxE;AAED,eAAO,MAAM,gBAAgB;;;;kBAMlB,CAAC;AAEZ,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;kBAiBnB,CAAC;AAkBZ,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,CAAC,qBAAqB,CAAC,GAAG,SAAS,GAChD,qBAAqB,CAEvB"}

package/dist/agent-runtime/coding-tool-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coding-tool-files.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-files.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAK3B,MAAM,wBAAwB,CAAC;AA2BhC,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,qBAAqB,GAC5B,SAAS,yBAAyB,EAAE,CAsJtC"}
+{"version":3,"file":"coding-tool-files.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-files.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAK3B,MAAM,wBAAwB,CAAC;AA+BhC,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,qBAAqB,GAC5B,SAAS,yBAAyB,EAAE,CAwJtC"}

package/dist/agent-runtime/coding-tool-listing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coding-tool-listing.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-listing.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACtB,MAAM,wBAAwB,CAAC;AAShC,iFAAiF;AACjF,eAAO,MAAM,4BAA4B,UAQxC,CAAC;AAoCF;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,qBAAqB,GAC5B,SAAS,yBAAyB,EAAE,CAmGtC"}
+{"version":3,"file":"coding-tool-listing.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-listing.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACtB,MAAM,wBAAwB,CAAC;AAchC,iFAAiF;AACjF,eAAO,MAAM,4BAA4B,UAQxC,CAAC;AAoCF;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,qBAAqB,GAC5B,SAAS,yBAAyB,EAAE,CAuGtC"}

package/dist/agent-runtime/coding-tool-paths.d.ts

@@ -13,6 +13,8 @@ export declare function editableCodingPath(root: string, requested: string, maxP
     relative: string;
 }>;
 export declare function authorizeCodingTool(config: AgentCodingToolConfig, request: AgentCodingToolAuthorization): Promise<void>;
+export declare function isCodingPathAuthorized(config: AgentCodingToolConfig, path: string): Promise<boolean>;
+export declare function authorizeCodingPath(config: AgentCodingToolConfig, path: string): Promise<void>;
 /** Serialize framework-owned compare-and-replace transactions for one canonical target. */
 export declare function withCodingPathLock<T>(target: string, work: () => Promise<T>): Promise<T>;
 export declare function textOccurrences(source: string, search: string): number;

package/dist/agent-runtime/coding-tool-paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coding-tool-paths.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-paths.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,4BAA4B,EAEjC,KAAK,qBAAqB,EAC3B,MAAM,wBAAwB,CAAC;AAkChC,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAezF;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM;;;GAKrB;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM;;;GAarB;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM;;;GAQrB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAGf;AAID,2FAA2F;AAC3F,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACrB,OAAO,CAAC,CAAC,CAAC,CAeZ;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAUtE"}
+{"version":3,"file":"coding-tool-paths.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-paths.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,4BAA4B,EAEjC,KAAK,qBAAqB,EAE3B,MAAM,wBAAwB,CAAC;AAkChC,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAezF;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM;;;GAKrB;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM;;;GAarB;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM;;;GAQrB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAGf;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC,CAIlB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAIf;AAID,2FAA2F;AAC3F,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACrB,OAAO,CAAC,CAAC,CAAC,CAeZ;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAUtE"}

package/dist/agent-runtime/coding-tool-search-patch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coding-tool-search-patch.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-search-patch.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACtB,MAAM,wBAAwB,CAAC;AAuHhC,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,qBAAqB,GAC5B,SAAS,yBAAyB,EAAE,CAkMtC"}
+{"version":3,"file":"coding-tool-search-patch.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-search-patch.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACtB,MAAM,wBAAwB,CAAC;AAyHhC,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,qBAAqB,GAC5B,SAAS,yBAAyB,EAAE,CAuMtC"}

package/dist/agent-runtime/contained-files.d.ts

@@ -31,7 +31,7 @@ interface ContainedEntryMetadata {
     isSymbolicLink(): boolean;
 }
 /** One directory's direct children, read through pinned descriptors. */
-export declare function listContainedDirectory(root: string, relative: string, maxEntries: number): Promise<{
+export declare function listContainedDirectory(root: string, relative: string, maxEntries: number, authorizePath?: (relative: string) => boolean | Promise<boolean>): Promise<{
     entries: {
         name: string;
         kind: 'file' | 'directory' | 'symlink' | 'other';
@@ -93,6 +93,7 @@ export declare function scanContainedFiles(input: {
     readMaxBytes?: number;
     skipUnreadable?: boolean;
     excludeDirectory?: (relative: string) => boolean;
+    authorizePath?: (relative: string, kind: 'file' | 'directory' | 'symlink' | 'other') => boolean | Promise<boolean>;
 }): Promise<ContainedFileScan>;
 export {};
 //# sourceMappingURL=contained-files.d.ts.map

package/dist/agent-runtime/contained-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contained-files.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/contained-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,KAAK,EAEX,MAAM,SAAS,CAAC;AAejB,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACzD;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CACF,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;CACxB;AAwKD,UAAU,sBAAsB;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,IAAI,OAAO,CAAC;IACvB,MAAM,IAAI,OAAO,CAAC;IAClB,cAAc,IAAI,OAAO,CAAC;CAC3B;AA8CD,wEAAwE;AACxE,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IACT,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;QACjD,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,EAAE,CAAC;IACJ,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC,CAkDD;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAoBD;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,EAAE,CAAC,CAgCnB;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC,eAAe,CAAC,CA0B1B;AAED,+FAA+F;AAC/F,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,mBAAmB,CAAC,CAa9B;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CASf;AAED,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CASf;AAsDD,0FAA0F;AAC1F,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAsChB;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAExC;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,mBAAmB,CAAC,CAO9B;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,mBAAmB,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAsBxD;AAED,yFAAyF;AACzF,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAOxD;AAED,+FAA+F;AAC/F,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAIpC;AAED,4FAA4F;AAC5F,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;CAClD,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA+E7B"}
+{"version":3,"file":"contained-files.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/contained-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,KAAK,EAEX,MAAM,SAAS,CAAC;AAejB,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACzD;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CACF,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;CACxB;AAwKD,UAAU,sBAAsB;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,IAAI,OAAO,CAAC;IACvB,MAAM,IAAI,OAAO,CAAC;IAClB,cAAc,IAAI,OAAO,CAAC;CAC3B;AA8CD,wEAAwE;AACxE,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAC/D,OAAO,CAAC;IACT,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;QACjD,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,EAAE,CAAC;IACJ,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC,CAuDD;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAoBD;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,EAAE,CAAC,CAgCnB;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC,eAAe,CAAC,CA0B1B;AAED,+FAA+F;AAC/F,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,mBAAmB,CAAC,CAa9B;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CASf;AAED,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CASf;AAsDD,0FAA0F;AAC1F,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAsChB;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAExC;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,mBAAmB,CAAC,CAO9B;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,mBAAmB,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAsBxD;AAED,yFAAyF;AACzF,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAOxD;AAED,+FAA+F;AAC/F,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAIpC;AAED,4FAA4F;AAC5F,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,aAAa,CAAC,EAAE,CACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,KAC7C,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuF7B"}

package/dist/agent-runtime-coding-tools.d.ts

@@ -1,2 +1,2 @@
-export { type AgentCodingArtifactStore, type AgentCodingToolAuthorization, AgentCodingToolAuthorizationSchema, type AgentCodingToolConfig, type AgentCodingToolDefinition, type AgentCodingToolLimits, AgentCodingToolLimitsSchema, createAgentCodingTools, } from './agent-runtime/coding-tools.js';
+export { type AgentCodingArtifactStore, type AgentCodingToolAuthorization, AgentCodingToolAuthorizationSchema, type AgentCodingToolConfig, type AgentCodingToolDefinition, type AgentCodingToolLimits, AgentCodingToolLimitsSchema, type AgentCodingToolPathAuthorization, AgentCodingToolPathAuthorizationSchema, createAgentCodingTools, } from './agent-runtime/coding-tools.js';
 //# sourceMappingURL=agent-runtime-coding-tools.d.ts.map

package/dist/agent-runtime-coding-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-runtime-coding-tools.d.ts","sourceRoot":"","sources":["../src/agent-runtime-coding-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,EACjC,kCAAkC,EAClC,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"agent-runtime-coding-tools.d.ts","sourceRoot":"","sources":["../src/agent-runtime-coding-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,EACjC,kCAAkC,EAClC,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,2BAA2B,EAC3B,KAAK,gCAAgC,EACrC,sCAAsC,EACtC,sBAAsB,GACvB,MAAM,8BAA8B,CAAC"}

package/dist/agent-runtime-coding-tools.js

@@ -10,7 +10,7 @@ import {
   readContainedUtf8Handle,
   scanContainedFiles,
   writeContainedFile
-} from "./index-rqpdar1e.js";
+} from "./index-t7gh5w3v.js";
 import {
   defineRuntimeTool
 } from "./index-dx9xehwt.js";
@@ -89,6 +89,7 @@ var AgentCodingToolAuthorizationSchema = z.discriminatedUnion("operation", [
     cwd: z.string().min(1)
   }).strict()
 ]);
+var AgentCodingToolPathAuthorizationSchema = z.object({ path: z.string().min(1) }).strict();
 var FileReadInputSchema = z.object({
   path: z.string().min(1),
   offset: z.int().nonnegative().default(0),
@@ -262,6 +263,17 @@ async function authorizeCodingTool(config, request) {
   if (!await config.authorize(parsed))
     forbidden("Coding tool permission denied");
 }
+async function isCodingPathAuthorized(config, path2) {
+  if (!config.authorizePath)
+    return true;
+  const parsed = AgentCodingToolPathAuthorizationSchema.parse({ path: path2 });
+  return await config.authorizePath(parsed);
+}
+async function authorizeCodingPath(config, path2) {
+  if (!await isCodingPathAuthorized(config, path2)) {
+    forbidden("Coding tool path permission denied");
+  }
+}
 var codingPathLocks = new Map;
 async function withCodingPathLock(target, work) {
   const previous = codingPathLocks.get(target) ?? Promise.resolve();
@@ -320,6 +332,7 @@ function createFileCodingTools(config, limits) {
     handler: async ({ input }) => {
       const root = await realpath2(config.root);
       const relative = boundedCodingRelativePath(input.path, limits.maxPathBytes);
+      await authorizeCodingPath(config, relative);
       const handle = await openContainedFile(root, relative).catch((error) => refuseMissingCodingPath(error, relative));
       const maximum = Math.min(input.maxBytes ?? limits.maxReadBytes, limits.maxReadBytes);
       let selected;
@@ -366,6 +379,7 @@ function createFileCodingTools(config, limits) {
     handler: async ({ input }) => {
       const root = await realpath2(config.root);
       const relative = boundedCodingRelativePath(input.path, limits.maxPathBytes);
+      await authorizeCodingPath(config, relative);
       const bytes = Buffer.byteLength(input.content);
       if (bytes > limits.maxWriteBytes) {
         codingPathRefusal("BAD_REQUEST", `The content is ${bytes} bytes, over the ${limits.maxWriteBytes}-byte limit`, relative, {
@@ -500,8 +514,9 @@ function createListingCodingTools(config, limits) {
     handler: async ({ input }) => {
       const root = await realpath3(config.root);
       const relative = input.path === "." ? "." : boundedCodingRelativePath(input.path, limits.maxPathBytes);
+      await authorizeCodingPath(config, relative);
       await authorizeCodingTool(config, { operation: "list", path: relative });
-      const listing = await listContainedDirectory(root, relative, limits.maxListEntries).catch((error) => {
+      const listing = await listContainedDirectory(root, relative, limits.maxListEntries, (candidate) => isCodingPathAuthorized(config, candidate)).catch((error) => {
         if (error instanceof Error && error.message.includes("ancestor is not a directory")) {
           codingPathRefusal("BAD_REQUEST", "This path is not a directory", relative, {
             hint: "Pass a directory; use read_file for a file."
@@ -533,6 +548,7 @@ function createListingCodingTools(config, limits) {
     transports: ["AGENT"],
     handler: async ({ input }) => {
       const relative = input.path === "." ? "." : boundedCodingRelativePath(input.path, limits.maxPathBytes);
+      await authorizeCodingPath(config, relative);
       await authorizeCodingTool(config, {
         operation: "glob",
         pattern: input.pattern,
@@ -553,7 +569,8 @@ function createListingCodingTools(config, limits) {
         maxDepth: limits.maxSearchDepth,
         maxFiles: limits.maxSearchFiles,
         symlinks: "skip",
-        excludeDirectory: (directory) => directory.split(path2.sep).some((segment) => excluded.has(segment))
+        excludeDirectory: (directory) => directory.split(path2.sep).some((segment) => excluded.has(segment)),
+        authorizePath: (candidate) => isCodingPathAuthorized(config, candidate)
       });
       const prefix = relative === "." ? "" : `${relative}${path2.sep}`;
       const matched = scan.files.filter((file) => file.relative.startsWith(prefix)).map((file) => file.relative).filter((candidate) => matcher.test(candidate.slice(prefix.length))).sort();
@@ -646,7 +663,9 @@ function createSearchAndPatchCodingTools(config, limits) {
         mode: input.mode
       });
       const root = await realpath4(config.root);
+      await authorizeCodingPath(config, ".");
       const excluded = new Set(config.search?.excludeDirectories ?? DEFAULT_EXCLUDED_DIRECTORIES);
+      const included = input.include ? compileWorkspaceGlob(input.include) : null;
       const scan = await scanContainedFiles({
         root,
         maxDepth: limits.maxSearchDepth,
@@ -656,10 +675,14 @@ function createSearchAndPatchCodingTools(config, limits) {
           readMaxBytes: limits.maxReadBytes,
           skipUnreadable: true
         },
-        excludeDirectory: (relative) => relative.split(path3.sep).some((segment) => excluded.has(segment))
+        excludeDirectory: (relative) => relative.split(path3.sep).some((segment) => excluded.has(segment)),
+        authorizePath: async (candidate, kind) => {
+          if (kind === "file" && included && !included.test(candidate))
+            return false;
+          return await isCodingPathAuthorized(config, candidate);
+        }
       });
       const matcher = input.regex ? compileSearchRegex(input.query) : null;
-      const included = input.include ? compileWorkspaceGlob(input.include) : null;
       const hit = (line) => {
         if (line.length > MAX_SEARCHED_LINE_BYTES)
           return false;
@@ -672,8 +695,6 @@ function createSearchAndPatchCodingTools(config, limits) {
       const matches = [];
       let truncated = false;
       for (const file of scan.files) {
-        if (included && !included.test(file.relative))
-          continue;
         if (input.mode === "path") {
           if (hit(file.relative))
             matches.push({ path: file.relative });
@@ -724,6 +745,7 @@ function createSearchAndPatchCodingTools(config, limits) {
     handler: async ({ input }) => {
       const root = await realpath4(config.root);
       const relative = boundedCodingRelativePath(input.path, limits.maxPathBytes);
+      await authorizeCodingPath(config, relative);
       const parent = await openContainedParent(root, relative).catch((error) => refuseMissingCodingPath(error, relative));
       try {
         return await withCodingPathLock(`${root}:${relative}`, async () => {
@@ -1073,6 +1095,7 @@ function createAgentCodingTools(config) {
 }
 export {
   createAgentCodingTools,
+  AgentCodingToolPathAuthorizationSchema,
   AgentCodingToolLimitsSchema,
   AgentCodingToolAuthorizationSchema
 };

package/dist/agent-runtime-harness.js

@@ -10,7 +10,7 @@ import"./index-y2s6h5bf.js";
 import"./index-wnfk50r0.js";
 import {
   walkContainedFiles
-} from "./index-rqpdar1e.js";
+} from "./index-t7gh5w3v.js";
 import {
   AgentControlRequestSchema,
   AgentControlResponseSchema

package/dist/{index-rqpdar1e.js → index-t7gh5w3v.js}

@@ -156,7 +156,7 @@ async function listAt(directory) {
   }
   return readdir(descriptorPath(directory), { withFileTypes: true });
 }
-async function listContainedDirectory(root, relative, maxEntries) {
+async function listContainedDirectory(root, relative, maxEntries, authorizePath) {
   let current = await openPinnedDirectory(root);
   try {
     if (relative !== ".") {
@@ -173,8 +173,14 @@ async function listContainedDirectory(root, relative, maxEntries) {
     }
     const raw = [...await listAt(current)];
     raw.sort((left, right) => left.name.localeCompare(right.name));
+    const admitted = [];
+    for (const entry of raw) {
+      const entryPath = relative === "." ? entry.name : path.join(relative, entry.name);
+      if (!authorizePath || await authorizePath(entryPath))
+        admitted.push(entry);
+    }
     const entries = [];
-    for (const entry of raw.slice(0, maxEntries)) {
+    for (const entry of admitted.slice(0, maxEntries)) {
       const kind = entry.isDirectory() ? "directory" : entry.isSymbolicLink() ? "symlink" : entry.isFile() ? "file" : "other";
       if (kind !== "file") {
         entries.push({ name: entry.name, kind });
@@ -192,7 +198,7 @@ async function listContainedDirectory(root, relative, maxEntries) {
         return left.name.localeCompare(right.name);
       return left.kind === "directory" ? -1 : right.kind === "directory" ? 1 : 0;
     });
-    return { entries, truncated: raw.length > maxEntries };
+    return { entries, truncated: admitted.length > maxEntries };
   } finally {
     await current.close();
   }
@@ -430,6 +436,9 @@ async function scanContainedFiles(input) {
     entries.sort((left, right) => left.name.localeCompare(right.name));
     for (const entry of entries) {
       const relative = relativeDirectory ? path.join(relativeDirectory, entry.name) : entry.name;
+      const kind = entry.isDirectory() ? "directory" : entry.isSymbolicLink() ? "symlink" : entry.isFile() ? "file" : "other";
+      if (input.authorizePath && !await input.authorizePath(relative, kind))
+        continue;
       if (entry.isSymbolicLink()) {
         if (input.symlinks === "refuse") {
           throw new Error(`Contained file traversal refuses symlink: ${relative}`);

package/llms-full.txt

@@ -4716,8 +4716,11 @@ approval input fails the run with a private diagnostic rather than starting a fr
 
 `stitchkit/agent-runtime/coding-tools` returns ordinary direct runtime tools named `read_file`,
 `write_file`, `edit_file`, `list_directory`, `glob`, `search_files`, `run_command` and optional
-`read_output`. Every call passes a
-required host authorization callback. File paths are relative, bounded and contained after
+`read_output`. Every call passes a required host authorization callback. An optional async/sync
+`authorizePath({ path })` is the one operation-independent policy for direct file access and
+discovery: direct read/write/edit refuses a denied path, while listing, glob and search omit it.
+Directory decisions happen before descent; file decisions and `search_files.include` happen before
+opening content. File paths are relative, bounded and contained after
 descriptor-relative resolution: each ancestor is opened without following symlinks and remains
 pinned through authorization and the filesystem effect. Reads revalidate the pinned file identity;
 writes and patches revalidate the pinned parent identity; search and resource discovery descend
@@ -4730,7 +4733,8 @@ UTF-8 and retained bytes are finite. Shell accepts a finite alias mapped by the
 argument array — never a shell command string — and uses only the explicitly supplied environment.
 Arguments, output and time are bounded, while cancellation terminates the child. The configured
 root and cwd are path boundaries, not a security sandbox: isolate the process when an executable
-must not access the rest of the machine.
+must not access the rest of the machine. Path admission does not constrain `run_command`; an
+executable requires process isolation for that guarantee. → ADR 0172
 
 `edit_file` replaces one exact snippet. `oldText` is itself the freshness guard for the region it
 changes, so the digest is the optional `expectedSha256` and an edit is one call; pass the digest
@@ -15253,8 +15257,9 @@ artifact store is supplied, `read_output`.
 | `createAgentCodingTools` | function | construct direct host-authorized bounded file, listing, glob, search, exact-snippet edit, shell and artifact runtime-tool definitions; every ordinary refusal is a typed code with an instructive `hint`, and filesystem operations use Linux `/proc/self/fd` or the packaged macOS Node-API backend and otherwise fail closed |
 | `AGENT_CODING_TOOL_NAMES` | const | the mounted tool names — `read_file`, `write_file`, `edit_file`, `list_directory`, `glob`, `search_files`, `run_command`, `read_output` |
 | `AgentCodingToolDefinition` | _type_ | peer-free structural direct-tool shape accepted by the canonical runtime-tool surface |
-| `AgentCodingToolConfig` | _type_ | absolute root, required authorization callback, finite executable alias map, exact child environment and optional limits |
+| `AgentCodingToolConfig` | _type_ | absolute root, required operation authorization, optional async/sync `authorizePath({ path })` shared by direct file effects and discovery, finite executable alias map, exact child environment and optional limits |
 | `AgentCodingToolAuthorizationSchema` / `AgentCodingToolAuthorization` | schema / _type_ | discriminated read/write/search/patch/shell/artifact decision presented to host policy before effect |
+| `AgentCodingToolPathAuthorizationSchema` / `AgentCodingToolPathAuthorization` | schema / _type_ | strict workspace-relative path presented to the shared path policy before disclosure, opening or mutation |
 | `AgentCodingToolLimitsSchema` / `AgentCodingToolLimits` | schema / _type_ | explicit path/read/write/argument-count/argument-byte/output/artifact/timeout/termination-grace ceilings |
 | `AgentCodingArtifactStore` | _type_ | host-owned opaque artifact write and bounded read boundary |
 | `FileReadInputSchema` / `FileReadOutputSchema` | schema | bounded strict-UTF-8 byte slice; offsets must align with UTF-8 code-point boundaries |
@@ -15268,6 +15273,12 @@ of aggregate argument text, 4 MiB per artifact and 30 seconds. The root is a pat
 boundary, not an OS sandbox; executable behavior, process
 isolation, credentials and external-effect idempotency remain host responsibilities.
 
+When `authorizePath` denies a path, direct read/write/edit returns `FORBIDDEN`, while
+`list_directory`, `glob` and `search_files` omit it. Directory admission happens before descent and
+file admission before opening; `search_files.include` is also applied before content is read.
+`run_command` is intentionally outside this guarantee because an executable needs process isolation,
+not path filtering, to constrain its filesystem access. → ADR 0172.
+
 ## `stitchkit/agent-runtime/browser`
 
 Browser-safe canonical agent data. It re-exports the run, message, part, usage,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stitchkit",
-  "version": "0.83.1",
+  "version": "0.83.2",
   "description": "Contract-first backend framework — one defineContract() into an HTTP API, MCP tools, AI-agent tools and a typed client. Bun and Node.",
   "keywords": [
     "bun",