stitchkit 0.83.1 → 0.84.0

package/CHANGELOG.md

@@ -15,6 +15,69 @@ additive**; the first breaking change landed in 0.10.0. Grep the file for
 
 ## [Unreleased]
 
+## [0.84.0] — 2026-09-07
+
+### ⚠️ Breaking changes
+
+**Who must act:** anyone using `createAgentCodingTools`. The separator fix
+below reaches BOTH callbacks — the required `authorize({ operation, path })`
+and the optional `authorizePath`. The recursion fix reaches `authorizePath`
+only. Anyone passing a non-canonical `cwd` to `run_command` is affected by the
+separator fix even if they implement neither policy shape.
+
+- **A backslash in a requested path is refused instead of silently becoming a
+  separator.** `contained-files` splits a relative path on `[\/]`, so
+  `credentials\token.txt` reached `openat` as two segments while every
+  authorization callback was handed the string whole and read it as one name.
+  A rule denying `credentials/token.txt` refused that spelling and served — then
+  overwrote — the same file spelled with a backslash. This bypassed the
+  **required** `authorize` callback, not only the `authorizePath` added in
+  0.83.2, and it has been reachable since 0.70.0. Requests carrying `\` now get
+  a typed `FORBIDDEN`; `run_command`'s `cwd` goes through the same segment and
+  separator validation as every file tool.
+  `// before: read_file('a\b.txt') → served past a rule denying 'a/b.txt'` →
+  `// after: read_file('a\b.txt') → FORBIDDEN, use 'a/b.txt'`
+
+- **`authorizePath` denies a directory on every surface it governs.** Direct
+  read, write and edit asked the path policy only about the leaf, so `authorizePath: p => p !== 'credentials'`
+  hid the directory from `glob` and served `credentials/token.txt` to
+  `read_file`, created files under it through `write_file` and rewrote it
+  through `edit_file`; `list_directory` and `glob` given a base path *inside* a
+  denied directory disclosed its contents and disagreed about the refusal shape.
+  Direct access and discovery base paths now ask about `.` and each ancestor,
+  outermost first, short-circuiting on the first refusal — segment-wise, so
+  denying `credentials` does not deny `credentials-backup`.
+  `// before: authorizePath asked once, about the leaf` →
+  `// after: asked about '.', then each ancestor, then the leaf`
+
+  **The policy must now admit every directory on the way to a file**, the way
+  POSIX needs `+x` on each directory in a path. A DENY-list is unaffected:
+  refusing `credentials` now refuses everything under it, which is what the rule
+  always read as. An ALLOW-list must be widened to name the directories it
+  leads through — `p => p.startsWith('src/')` refuses `src` itself and so loses
+  `src/index.ts`; write `p => p === 'src' || p.startsWith('src/')`. The
+  workspace root is not asked about: it is the boundary the tools already own.
+  A path of depth N costs N questions, and a policy keeping an audit no longer
+  sees the leaf once an ancestor refused.
+
+  This recursion is `authorizePath` only. The required `authorize({ operation,
+  path })` is still asked once, about the operation's own path, and a broad
+  `search` or `glob` is still one decision covering every file the walk opens —
+  which is the reason `authorizePath` exists at all. → ADR 0172 (amended).
+
+## [0.83.2] — 2026-09-07
+
+### Added
+
+- **Agent coding tools can enforce one path policy before disclosure or content reads.**
+  `createAgentCodingTools({ authorizePath })` accepts an async or synchronous callback shared by
+  direct read/write/edit, `list_directory`, `glob` and both `search_files` modes. Direct access to a
+  denied path returns `FORBIDDEN`; discovery omits it. The contained walker applies the decision
+  before descending into a directory or opening a file, and `search_files.include` now filters
+  before reading instead of after the whole scan. This lets a host protect `.env` or credential
+  paths without copying the framework scanner. Shell remains explicitly outside the guarantee: an
+  executable requires process isolation, not path filtering. → ADR 0172.
+
 ## [0.83.1] — 2026-09-07
 
 ### Fixed

package/dist/agent-runtime/coding-tool-contract.d.ts

@@ -58,9 +58,20 @@ export declare const AgentCodingToolAuthorizationSchema: z.ZodDiscriminatedUnion
 }, z.core.$strict>], "operation">;
 export type AgentCodingToolLimits = z.infer<typeof AgentCodingToolLimitsSchema>;
 export type AgentCodingToolAuthorization = z.infer<typeof AgentCodingToolAuthorizationSchema>;
+export declare const AgentCodingToolPathAuthorizationSchema: z.ZodObject<{
+    path: z.ZodString;
+}, z.core.$strict>;
+export type AgentCodingToolPathAuthorization = z.infer<typeof AgentCodingToolPathAuthorizationSchema>;
 export interface AgentCodingToolConfig {
     root: string;
     authorize(input: AgentCodingToolAuthorization): boolean | Promise<boolean>;
+    /**
+     * One operation-independent admission policy for workspace paths.
+     *
+     * A denied path is refused by direct file tools and omitted from discovery.
+     * The callback runs before a file is opened or its content is read.
+     */
+    authorizePath?(input: AgentCodingToolPathAuthorization): boolean | Promise<boolean>;
     executables?: Readonly<Record<string, string>>;
     environment?: Readonly<Record<string, string>>;
     artifacts?: AgentCodingArtifactStore;

package/dist/agent-runtime/coding-tool-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coding-tool-contract.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;kBAgB7B,CAAC;AAEZ,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAsD7C,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,SAAS,CAAC,EAAE,wBAAwB,CAAC;IACrC,MAAM,CAAC,EAAE;QACP,wEAAwE;QACxE,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACxC,CAAC;IACF,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,KAAK,EAAE;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,UAAU,CAAC;KAClB,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,EAAE;QACV,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GACG;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACzC,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QACR,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;KAC9D,CAAC;IACF,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC;IACnB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,SAAS,CAAC,KAAK,GAAG,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC;IAClD,OAAO,CAAC,OAAO,EAAE;QACf,MAAM,EAAE,SAAS,CAAC;QAClB,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAChC;AAED,eAAO,MAAM,mBAAmB;;;;kBAMrB,CAAC;AAEZ,eAAO,MAAM,oBAAoB;;;;;;;kBAStB,CAAC;AAEZ,eAAO,MAAM,oBAAoB;;;;kBAMtB,CAAC;AAEZ,eAAO,MAAM,qBAAqB;;;;kBAcvB,CAAC;AAEZ,wBAAgB,sBAAsB,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE;;;;;;mBAWxE;AAED,eAAO,MAAM,gBAAgB;;;;kBAMlB,CAAC;AAEZ,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;kBAiBnB,CAAC;AAkBZ,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,CAAC,qBAAqB,CAAC,GAAG,SAAS,GAChD,qBAAqB,CAEvB"}
+{"version":3,"file":"coding-tool-contract.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;kBAgB7B,CAAC;AAEZ,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAsD7C,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,sCAAsC;;kBAExC,CAAC;AAEZ,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,sCAAsC,CAC9C,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E;;;;;OAKG;IACH,aAAa,CAAC,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpF,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,SAAS,CAAC,EAAE,wBAAwB,CAAC;IACrC,MAAM,CAAC,EAAE;QACP,wEAAwE;QACxE,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACxC,CAAC;IACF,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,KAAK,EAAE;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,UAAU,CAAC;KAClB,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,EAAE;QACV,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GACG;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACzC,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QACR,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;KAC9D,CAAC;IACF,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC;IACnB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,SAAS,CAAC,KAAK,GAAG,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC;IAClD,OAAO,CAAC,OAAO,EAAE;QACf,MAAM,EAAE,SAAS,CAAC;QAClB,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAChC;AAED,eAAO,MAAM,mBAAmB;;;;kBAMrB,CAAC;AAEZ,eAAO,MAAM,oBAAoB;;;;;;;kBAStB,CAAC;AAEZ,eAAO,MAAM,oBAAoB;;;;kBAMtB,CAAC;AAEZ,eAAO,MAAM,qBAAqB;;;;kBAcvB,CAAC;AAEZ,wBAAgB,sBAAsB,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE;;;;;;mBAWxE;AAED,eAAO,MAAM,gBAAgB;;;;kBAMlB,CAAC;AAEZ,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;kBAiBnB,CAAC;AAkBZ,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,CAAC,qBAAqB,CAAC,GAAG,SAAS,GAChD,qBAAqB,CAEvB"}

package/dist/agent-runtime/coding-tool-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coding-tool-files.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-files.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAK3B,MAAM,wBAAwB,CAAC;AA2BhC,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,qBAAqB,GAC5B,SAAS,yBAAyB,EAAE,CAsJtC"}
+{"version":3,"file":"coding-tool-files.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-files.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAK3B,MAAM,wBAAwB,CAAC;AA+BhC,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,qBAAqB,GAC5B,SAAS,yBAAyB,EAAE,CAwJtC"}

package/dist/agent-runtime/coding-tool-listing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coding-tool-listing.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-listing.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACtB,MAAM,wBAAwB,CAAC;AAShC,iFAAiF;AACjF,eAAO,MAAM,4BAA4B,UAQxC,CAAC;AAoCF;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,qBAAqB,GAC5B,SAAS,yBAAyB,EAAE,CAmGtC"}
+{"version":3,"file":"coding-tool-listing.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-listing.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACtB,MAAM,wBAAwB,CAAC;AAchC,iFAAiF;AACjF,eAAO,MAAM,4BAA4B,UAQxC,CAAC;AAoCF;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,qBAAqB,GAC5B,SAAS,yBAAyB,EAAE,CAuGtC"}

package/dist/agent-runtime/coding-tool-paths.d.ts

@@ -13,6 +13,36 @@ export declare function editableCodingPath(root: string, requested: string, maxP
     relative: string;
 }>;
 export declare function authorizeCodingTool(config: AgentCodingToolConfig, request: AgentCodingToolAuthorization): Promise<void>;
+export declare function isCodingPathAuthorized(config: AgentCodingToolConfig, path: string): Promise<boolean>;
+export declare function authorizeCodingPath(config: AgentCodingToolConfig, path: string): Promise<void>;
+/**
+ * Ask the policy about the target AND every directory above it.
+ *
+ * A denied directory means two different things until this exists. The walk
+ * refuses to descend into one, so denial is recursive during discovery; direct
+ * access asked only about the leaf, so a host writing the obvious rule —
+ * `path !== 'credentials'` — got a listing that hid the directory and a
+ * `read_file` that served the secret inside it, plus a `write_file` that
+ * created directories under it and an `edit_file` that rewrote it.
+ *
+ * Outermost first, so the broadest refusal is the one the caller is told about
+ * and nothing below a denied directory is ever asked about. Segment-wise, not
+ * `startsWith`: a rule denying `credentials` must not also deny
+ * `credentials-backup`.
+ *
+ * The chain asks about the ANCESTORS OF THE PATH, and `.` is one only when the
+ * path itself is `.`. Asking about `.` unconditionally looks symmetrical with
+ * the walk — `search_files` and `list_directory('.')` do ask it — but there `.`
+ * is the base path the caller named, not an ancestor of it. Asked on every
+ * direct access it silently inverts every ALLOW-list: a host exposing one
+ * subtree with `p => p.startsWith('src/')` answers `false` for `.` and loses
+ * `src/index.ts` too, having denied nothing.
+ *
+ * The cost is stated rather than hidden: a path of depth N costs N questions,
+ * and a policy that keeps an audit no longer sees the leaf once an ancestor has
+ * refused.
+ */
+export declare function authorizeCodingPathChain(config: AgentCodingToolConfig, relative: string): Promise<void>;
 /** Serialize framework-owned compare-and-replace transactions for one canonical target. */
 export declare function withCodingPathLock<T>(target: string, work: () => Promise<T>): Promise<T>;
 export declare function textOccurrences(source: string, search: string): number;

package/dist/agent-runtime/coding-tool-paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coding-tool-paths.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-paths.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,4BAA4B,EAEjC,KAAK,qBAAqB,EAC3B,MAAM,wBAAwB,CAAC;AAkChC,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAezF;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM;;;GAKrB;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM;;;GAarB;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM;;;GAQrB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAGf;AAID,2FAA2F;AAC3F,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACrB,OAAO,CAAC,CAAC,CAAC,CAeZ;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAUtE"}
+{"version":3,"file":"coding-tool-paths.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-paths.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,4BAA4B,EAEjC,KAAK,qBAAqB,EAE3B,MAAM,wBAAwB,CAAC;AAkChC,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAmCzF;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM;;;GAKrB;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM;;;GAarB;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM;;;GAQrB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAGf;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC,CAIlB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAWf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAMf;AAID,2FAA2F;AAC3F,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACrB,OAAO,CAAC,CAAC,CAAC,CAeZ;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAUtE"}

package/dist/agent-runtime/coding-tool-search-patch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coding-tool-search-patch.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-search-patch.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACtB,MAAM,wBAAwB,CAAC;AAuHhC,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,qBAAqB,GAC5B,SAAS,yBAAyB,EAAE,CAkMtC"}
+{"version":3,"file":"coding-tool-search-patch.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-search-patch.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACtB,MAAM,wBAAwB,CAAC;AA0HhC,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,qBAAqB,GAC5B,SAAS,yBAAyB,EAAE,CAuMtC"}

package/dist/agent-runtime/coding-tool-shell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coding-tool-shell.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-shell.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAG3B,MAAM,wBAAwB,CAAC;AAgKhC,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,qBAAqB,GAC5B,yBAAyB,CAkD3B"}
+{"version":3,"file":"coding-tool-shell.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/coding-tool-shell.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAG3B,MAAM,wBAAwB,CAAC;AAoKhC,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,qBAAqB,GAC5B,yBAAyB,CA4D3B"}

package/dist/agent-runtime/contained-files.d.ts

@@ -31,7 +31,7 @@ interface ContainedEntryMetadata {
     isSymbolicLink(): boolean;
 }
 /** One directory's direct children, read through pinned descriptors. */
-export declare function listContainedDirectory(root: string, relative: string, maxEntries: number): Promise<{
+export declare function listContainedDirectory(root: string, relative: string, maxEntries: number, authorizePath?: (relative: string) => boolean | Promise<boolean>): Promise<{
     entries: {
         name: string;
         kind: 'file' | 'directory' | 'symlink' | 'other';
@@ -93,6 +93,7 @@ export declare function scanContainedFiles(input: {
     readMaxBytes?: number;
     skipUnreadable?: boolean;
     excludeDirectory?: (relative: string) => boolean;
+    authorizePath?: (relative: string, kind: 'file' | 'directory' | 'symlink' | 'other') => boolean | Promise<boolean>;
 }): Promise<ContainedFileScan>;
 export {};
 //# sourceMappingURL=contained-files.d.ts.map

package/dist/agent-runtime/contained-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contained-files.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/contained-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,KAAK,EAEX,MAAM,SAAS,CAAC;AAejB,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACzD;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CACF,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;CACxB;AAwKD,UAAU,sBAAsB;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,IAAI,OAAO,CAAC;IACvB,MAAM,IAAI,OAAO,CAAC;IAClB,cAAc,IAAI,OAAO,CAAC;CAC3B;AA8CD,wEAAwE;AACxE,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IACT,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;QACjD,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,EAAE,CAAC;IACJ,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC,CAkDD;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAoBD;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,EAAE,CAAC,CAgCnB;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC,eAAe,CAAC,CA0B1B;AAED,+FAA+F;AAC/F,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,mBAAmB,CAAC,CAa9B;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CASf;AAED,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CASf;AAsDD,0FAA0F;AAC1F,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAsChB;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAExC;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,mBAAmB,CAAC,CAO9B;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,mBAAmB,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAsBxD;AAED,yFAAyF;AACzF,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAOxD;AAED,+FAA+F;AAC/F,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAIpC;AAED,4FAA4F;AAC5F,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;CAClD,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA+E7B"}
+{"version":3,"file":"contained-files.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/contained-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,KAAK,EAEX,MAAM,SAAS,CAAC;AAejB,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACzD;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CACF,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;CACxB;AAwKD,UAAU,sBAAsB;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,IAAI,OAAO,CAAC;IACvB,MAAM,IAAI,OAAO,CAAC;IAClB,cAAc,IAAI,OAAO,CAAC;CAC3B;AA8CD,wEAAwE;AACxE,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAC/D,OAAO,CAAC;IACT,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;QACjD,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,EAAE,CAAC;IACJ,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC,CAuDD;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAoBD;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,EAAE,CAAC,CAgCnB;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC,eAAe,CAAC,CA0B1B;AAED,+FAA+F;AAC/F,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,mBAAmB,CAAC,CAa9B;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CASf;AAED,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CASf;AAsDD,0FAA0F;AAC1F,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAsChB;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAExC;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,mBAAmB,CAAC,CAO9B;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,mBAAmB,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAsBxD;AAED,yFAAyF;AACzF,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAOxD;AAED,+FAA+F;AAC/F,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAIpC;AAED,4FAA4F;AAC5F,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,aAAa,CAAC,EAAE,CACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,KAC7C,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuF7B"}

package/dist/agent-runtime-coding-tools.d.ts

@@ -1,2 +1,2 @@
-export { type AgentCodingArtifactStore, type AgentCodingToolAuthorization, AgentCodingToolAuthorizationSchema, type AgentCodingToolConfig, type AgentCodingToolDefinition, type AgentCodingToolLimits, AgentCodingToolLimitsSchema, createAgentCodingTools, } from './agent-runtime/coding-tools.js';
+export { type AgentCodingArtifactStore, type AgentCodingToolAuthorization, AgentCodingToolAuthorizationSchema, type AgentCodingToolConfig, type AgentCodingToolDefinition, type AgentCodingToolLimits, AgentCodingToolLimitsSchema, type AgentCodingToolPathAuthorization, AgentCodingToolPathAuthorizationSchema, createAgentCodingTools, } from './agent-runtime/coding-tools.js';
 //# sourceMappingURL=agent-runtime-coding-tools.d.ts.map

package/dist/agent-runtime-coding-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-runtime-coding-tools.d.ts","sourceRoot":"","sources":["../src/agent-runtime-coding-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,EACjC,kCAAkC,EAClC,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"agent-runtime-coding-tools.d.ts","sourceRoot":"","sources":["../src/agent-runtime-coding-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,EACjC,kCAAkC,EAClC,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,2BAA2B,EAC3B,KAAK,gCAAgC,EACrC,sCAAsC,EACtC,sBAAsB,GACvB,MAAM,8BAA8B,CAAC"}

package/dist/agent-runtime-coding-tools.js

@@ -10,7 +10,7 @@ import {
   readContainedUtf8Handle,
   scanContainedFiles,
   writeContainedFile
-} from "./index-rqpdar1e.js";
+} from "./index-t7gh5w3v.js";
 import {
   defineRuntimeTool
 } from "./index-dx9xehwt.js";
@@ -89,6 +89,7 @@ var AgentCodingToolAuthorizationSchema = z.discriminatedUnion("operation", [
     cwd: z.string().min(1)
   }).strict()
 ]);
+var AgentCodingToolPathAuthorizationSchema = z.object({ path: z.string().min(1) }).strict();
 var FileReadInputSchema = z.object({
   path: z.string().min(1),
   offset: z.int().nonnegative().default(0),
@@ -242,7 +243,13 @@ function inputPath(root, requested, maxPathBytes) {
 }
 function boundedCodingRelativePath(requested, maxPathBytes) {
   inputPath(path.parse(process.cwd()).root, requested, maxPathBytes);
-  const segments = requested.split(/[\\/]/u);
+  if (requested.includes("\\")) {
+    codingRefusal("FORBIDDEN", "Path separators must be `/`", {
+      details: { path: requested },
+      hint: "Use `/` between segments; a backslash is refused because the workspace walk reads it as a separator."
+    });
+  }
+  const segments = requested.split("/");
   if (segments.some((segment) => segment === "" || segment === "." || segment === "..")) {
     codingRefusal("FORBIDDEN", "Path segments must name real entries under the root", {
       details: { path: requested },
@@ -262,6 +269,28 @@ async function authorizeCodingTool(config, request) {
   if (!await config.authorize(parsed))
     forbidden("Coding tool permission denied");
 }
+async function isCodingPathAuthorized(config, path2) {
+  if (!config.authorizePath)
+    return true;
+  const parsed = AgentCodingToolPathAuthorizationSchema.parse({ path: path2 });
+  return await config.authorizePath(parsed);
+}
+async function authorizeCodingPath(config, path2) {
+  if (!await isCodingPathAuthorized(config, path2)) {
+    codingRefusal("FORBIDDEN", "Coding tool path permission denied", {
+      details: { path: path2 },
+      hint: "The host policy refused this path or a directory above it."
+    });
+  }
+}
+async function authorizeCodingPathChain(config, relative) {
+  if (!config.authorizePath)
+    return;
+  const segments = relative === "." ? ["."] : relative.split("/");
+  for (let depth = 1;depth <= segments.length; depth += 1) {
+    await authorizeCodingPath(config, segments.slice(0, depth).join("/"));
+  }
+}
 var codingPathLocks = new Map;
 async function withCodingPathLock(target, work) {
   const previous = codingPathLocks.get(target) ?? Promise.resolve();
@@ -320,6 +349,7 @@ function createFileCodingTools(config, limits) {
     handler: async ({ input }) => {
       const root = await realpath2(config.root);
       const relative = boundedCodingRelativePath(input.path, limits.maxPathBytes);
+      await authorizeCodingPathChain(config, relative);
       const handle = await openContainedFile(root, relative).catch((error) => refuseMissingCodingPath(error, relative));
       const maximum = Math.min(input.maxBytes ?? limits.maxReadBytes, limits.maxReadBytes);
       let selected;
@@ -366,6 +396,7 @@ function createFileCodingTools(config, limits) {
     handler: async ({ input }) => {
       const root = await realpath2(config.root);
       const relative = boundedCodingRelativePath(input.path, limits.maxPathBytes);
+      await authorizeCodingPathChain(config, relative);
       const bytes = Buffer.byteLength(input.content);
       if (bytes > limits.maxWriteBytes) {
         codingPathRefusal("BAD_REQUEST", `The content is ${bytes} bytes, over the ${limits.maxWriteBytes}-byte limit`, relative, {
@@ -500,8 +531,9 @@ function createListingCodingTools(config, limits) {
     handler: async ({ input }) => {
       const root = await realpath3(config.root);
       const relative = input.path === "." ? "." : boundedCodingRelativePath(input.path, limits.maxPathBytes);
+      await authorizeCodingPathChain(config, relative);
       await authorizeCodingTool(config, { operation: "list", path: relative });
-      const listing = await listContainedDirectory(root, relative, limits.maxListEntries).catch((error) => {
+      const listing = await listContainedDirectory(root, relative, limits.maxListEntries, (candidate) => isCodingPathAuthorized(config, candidate)).catch((error) => {
         if (error instanceof Error && error.message.includes("ancestor is not a directory")) {
           codingPathRefusal("BAD_REQUEST", "This path is not a directory", relative, {
             hint: "Pass a directory; use read_file for a file."
@@ -533,6 +565,7 @@ function createListingCodingTools(config, limits) {
     transports: ["AGENT"],
     handler: async ({ input }) => {
       const relative = input.path === "." ? "." : boundedCodingRelativePath(input.path, limits.maxPathBytes);
+      await authorizeCodingPathChain(config, relative);
       await authorizeCodingTool(config, {
         operation: "glob",
         pattern: input.pattern,
@@ -553,7 +586,8 @@ function createListingCodingTools(config, limits) {
         maxDepth: limits.maxSearchDepth,
         maxFiles: limits.maxSearchFiles,
         symlinks: "skip",
-        excludeDirectory: (directory) => directory.split(path2.sep).some((segment) => excluded.has(segment))
+        excludeDirectory: (directory) => directory.split(path2.sep).some((segment) => excluded.has(segment)),
+        authorizePath: (candidate) => isCodingPathAuthorized(config, candidate)
       });
       const prefix = relative === "." ? "" : `${relative}${path2.sep}`;
       const matched = scan.files.filter((file) => file.relative.startsWith(prefix)).map((file) => file.relative).filter((candidate) => matcher.test(candidate.slice(prefix.length))).sort();
@@ -646,7 +680,9 @@ function createSearchAndPatchCodingTools(config, limits) {
         mode: input.mode
       });
       const root = await realpath4(config.root);
+      await authorizeCodingPath(config, ".");
       const excluded = new Set(config.search?.excludeDirectories ?? DEFAULT_EXCLUDED_DIRECTORIES);
+      const included = input.include ? compileWorkspaceGlob(input.include) : null;
       const scan = await scanContainedFiles({
         root,
         maxDepth: limits.maxSearchDepth,
@@ -656,10 +692,14 @@ function createSearchAndPatchCodingTools(config, limits) {
           readMaxBytes: limits.maxReadBytes,
           skipUnreadable: true
         },
-        excludeDirectory: (relative) => relative.split(path3.sep).some((segment) => excluded.has(segment))
+        excludeDirectory: (relative) => relative.split(path3.sep).some((segment) => excluded.has(segment)),
+        authorizePath: async (candidate, kind) => {
+          if (kind === "file" && included && !included.test(candidate))
+            return false;
+          return await isCodingPathAuthorized(config, candidate);
+        }
       });
       const matcher = input.regex ? compileSearchRegex(input.query) : null;
-      const included = input.include ? compileWorkspaceGlob(input.include) : null;
       const hit = (line) => {
         if (line.length > MAX_SEARCHED_LINE_BYTES)
           return false;
@@ -672,8 +712,6 @@ function createSearchAndPatchCodingTools(config, limits) {
       const matches = [];
       let truncated = false;
       for (const file of scan.files) {
-        if (included && !included.test(file.relative))
-          continue;
         if (input.mode === "path") {
           if (hit(file.relative))
             matches.push({ path: file.relative });
@@ -724,6 +762,7 @@ function createSearchAndPatchCodingTools(config, limits) {
     handler: async ({ input }) => {
       const root = await realpath4(config.root);
       const relative = boundedCodingRelativePath(input.path, limits.maxPathBytes);
+      await authorizeCodingPathChain(config, relative);
       const parent = await openContainedParent(root, relative).catch((error) => refuseMissingCodingPath(error, relative));
       try {
         return await withCodingPathLock(`${root}:${relative}`, async () => {
@@ -967,7 +1006,7 @@ function createShellCodingTool(config, limits) {
       if (!executable)
         throw new Error("Coding tool executable is not declared");
       const root = await realpath5(config.root);
-      const cwd = await existingCodingPath(root, input.cwd, limits.maxPathBytes);
+      const cwd = await existingCodingPath(root, input.cwd === "." ? "." : boundedCodingRelativePath(input.cwd, limits.maxPathBytes), limits.maxPathBytes);
       if (!(await stat(cwd.absolute)).isDirectory()) {
         throw new Error("Coding tool cwd is not a directory");
       }
@@ -1073,6 +1112,7 @@ function createAgentCodingTools(config) {
 }
 export {
   createAgentCodingTools,
+  AgentCodingToolPathAuthorizationSchema,
   AgentCodingToolLimitsSchema,
   AgentCodingToolAuthorizationSchema
 };

package/dist/agent-runtime-harness.js

@@ -10,7 +10,7 @@ import"./index-y2s6h5bf.js";
 import"./index-wnfk50r0.js";
 import {
   walkContainedFiles
-} from "./index-rqpdar1e.js";
+} from "./index-t7gh5w3v.js";
 import {
   AgentControlRequestSchema,
   AgentControlResponseSchema

package/dist/{index-rqpdar1e.js → index-t7gh5w3v.js}

@@ -156,7 +156,7 @@ async function listAt(directory) {
   }
   return readdir(descriptorPath(directory), { withFileTypes: true });
 }
-async function listContainedDirectory(root, relative, maxEntries) {
+async function listContainedDirectory(root, relative, maxEntries, authorizePath) {
   let current = await openPinnedDirectory(root);
   try {
     if (relative !== ".") {
@@ -173,8 +173,14 @@ async function listContainedDirectory(root, relative, maxEntries) {
     }
     const raw = [...await listAt(current)];
     raw.sort((left, right) => left.name.localeCompare(right.name));
+    const admitted = [];
+    for (const entry of raw) {
+      const entryPath = relative === "." ? entry.name : path.join(relative, entry.name);
+      if (!authorizePath || await authorizePath(entryPath))
+        admitted.push(entry);
+    }
     const entries = [];
-    for (const entry of raw.slice(0, maxEntries)) {
+    for (const entry of admitted.slice(0, maxEntries)) {
       const kind = entry.isDirectory() ? "directory" : entry.isSymbolicLink() ? "symlink" : entry.isFile() ? "file" : "other";
       if (kind !== "file") {
         entries.push({ name: entry.name, kind });
@@ -192,7 +198,7 @@ async function listContainedDirectory(root, relative, maxEntries) {
         return left.name.localeCompare(right.name);
       return left.kind === "directory" ? -1 : right.kind === "directory" ? 1 : 0;
     });
-    return { entries, truncated: raw.length > maxEntries };
+    return { entries, truncated: admitted.length > maxEntries };
   } finally {
     await current.close();
   }
@@ -430,6 +436,9 @@ async function scanContainedFiles(input) {
     entries.sort((left, right) => left.name.localeCompare(right.name));
     for (const entry of entries) {
       const relative = relativeDirectory ? path.join(relativeDirectory, entry.name) : entry.name;
+      const kind = entry.isDirectory() ? "directory" : entry.isSymbolicLink() ? "symlink" : entry.isFile() ? "file" : "other";
+      if (input.authorizePath && !await input.authorizePath(relative, kind))
+        continue;
       if (entry.isSymbolicLink()) {
         if (input.symlinks === "refuse") {
           throw new Error(`Contained file traversal refuses symlink: ${relative}`);

package/llms-full.txt

@@ -63,11 +63,11 @@ own, recorded as an ADR.
 | `stitchkit/tracking/server` | server (Bun or Node) | evolving | the decisions a tracking backend makes — dispositions, visit lease over an application-owned store, active intervals, presence; no database |
 | `stitchkit/release` | browser **and** server | evolving | a page follows the release it was built for — `createReleaseMarker` on the server, `createReleaseWatcher` in the browser, the `X-Build-Id` header and a socket event between them |
 | `stitchkit/geo` | server (Bun or Node) | evolving | managed GeoIP reader generations, last-known-good reload and the optional MaxMind adapter |
-| `stitchkit/observability` | server | stable<br>_redefined in 1 of the 28 minors since 0.56.2, most recently 0.83.0_ | request/tool event projections — `createObservability`, trace context, sanitisation |
+| `stitchkit/observability` | server | stable<br>_redefined in 1 of the 29 minors since 0.56.2, most recently 0.83.0_ | request/tool event projections — `createObservability`, trace context, sanitisation |
 | `stitchkit/testing` | tests on Bun or Node | stable | in-process generated clients over a real Fetch handler, plus the store and managed-resource conformance kits |
 | `stitchkit/declaration` | browser + build and deployment tooling (Bun or Node) | evolving | `ProjectDeclarationSchema` — the one machine-readable statement a repository makes about itself |
 | `stitchkit/react` | browser + server rendering | stable | `createCursorQuery`, `createCacheBridge`, QueryClient and `ApiError` retry policy |
-| `stitchkit/agent-runtime` | server | evolving<br>_redefined in 12 of the 28 minors since 0.56.2, most recently 0.83.0_ | optional durable conversation/run loop, history, models, prompts, fencing and events |
+| `stitchkit/agent-runtime` | server | evolving<br>_redefined in 15 of the 29 minors since 0.56.2, most recently 0.84.0_ | optional durable conversation/run loop, history, models, prompts, fencing and events |
 | `stitchkit/agent-runtime/harness` | server | evolving | resource-aware process-local facade over the canonical Agent runtime; supervision stays outside |
 | `stitchkit/agent-runtime/coding-tools` | server (Bun or Node) | evolving | bounded host-authorized direct file and shell tools; a root boundary, not an OS sandbox |
 | `stitchkit/agent-runtime/openrouter` | server | evolving | isolated OpenRouter language-model adapter |
@@ -75,7 +75,7 @@ own, recorded as an ADR.
 | `stitchkit/agent-runtime/sqlite/bun` | server (Bun) | evolving | durable built-in SQLite store for the agent runtime |
 | `stitchkit/agent-runtime/sqlite/node` | server (Node ≥ 22.5) | evolving | durable built-in SQLite store for the agent runtime |
 | `stitchkit-tui` | terminal (Bun) | evolving | optional official OpenTUI host over a caller-composed headless runtime |
-| `stitchkit/application` | browser + server | evolving<br>_redefined in 7 of the 28 minors since 0.56.2, most recently 0.83.0_ | managed resource graph, readiness, admission, schedules, subtree restart and bounded shutdown |
+| `stitchkit/application` | browser + server | evolving<br>_redefined in 7 of the 29 minors since 0.56.2, most recently 0.83.0_ | managed resource graph, readiness, admission, schedules, subtree restart and bounded shutdown |
 | `stitchkit/application/grammy` | server | evolving | isolated grammY polling and webhook lifecycle adapters |
 | `stitchkit/application/opentelemetry` | server | evolving | maps application snapshots onto an injected OpenTelemetry `Meter` |
 | `stitchkit/application/schemas` | browser + server | evolving | the application's snapshot, health and shutdown schemas alone, without the kernel |
@@ -4716,8 +4716,16 @@ approval input fails the run with a private diagnostic rather than starting a fr
 
 `stitchkit/agent-runtime/coding-tools` returns ordinary direct runtime tools named `read_file`,
 `write_file`, `edit_file`, `list_directory`, `glob`, `search_files`, `run_command` and optional
-`read_output`. Every call passes a
-required host authorization callback. File paths are relative, bounded and contained after
+`read_output`. Every call passes a required host authorization callback. An optional async/sync
+`authorizePath({ path })` is the one operation-independent policy for direct file access and
+discovery: direct read/write/edit refuses a denied path, while listing, glob and search omit it.
+Denial is recursive on every surface — direct access and discovery base paths ask about `.` and each
+ancestor, outermost first, stopping at the first refusal, so denying `credentials` denies everything
+under it. The comparison is segment-wise, so it does not deny `credentials-backup`, and a path of
+depth N costs N+1 questions. Directory decisions happen before descent; file decisions and
+`search_files.include` happen before opening content. Requested paths use `/`: a backslash is
+refused rather than normalised, because the workspace walk reads it as a separator and every
+authorization callback would otherwise be asked about a different decomposition than the one opened. File paths are relative, bounded and contained after
 descriptor-relative resolution: each ancestor is opened without following symlinks and remains
 pinned through authorization and the filesystem effect. Reads revalidate the pinned file identity;
 writes and patches revalidate the pinned parent identity; search and resource discovery descend
@@ -4730,7 +4738,8 @@ UTF-8 and retained bytes are finite. Shell accepts a finite alias mapped by the
 argument array — never a shell command string — and uses only the explicitly supplied environment.
 Arguments, output and time are bounded, while cancellation terminates the child. The configured
 root and cwd are path boundaries, not a security sandbox: isolate the process when an executable
-must not access the rest of the machine.
+must not access the rest of the machine. Path admission does not constrain `run_command`; an
+executable requires process isolation for that guarantee. → ADR 0172
 
 `edit_file` replaces one exact snippet. `oldText` is itself the freshness guard for the region it
 changes, so the digest is the optional `expectedSha256` and an edit is one call; pass the digest
@@ -11027,6 +11036,59 @@ makes one thing your job rather than the resolver's:
 The mechanical part is identical either way. Only the *noticing* differs, and an
 exact pin moves it onto you.
 
+## Released migration: 0.84.0
+
+Only if you call `createAgentCodingTools`.
+
+```bash
+rg -n "createAgentCodingTools"
+```
+
+**1. Backslashes are refused.** If anything in your system hands the tools a Windows-style path,
+it now gets `FORBIDDEN`. Convert to `/` at the boundary:
+
+```ts
+// before: read_file({ path: 'src\\index.ts' })   // reached openat as two segments
+// after:  read_file({ path: 'src/index.ts' })
+```
+
+This is the half that matters most: until now a backslash bypassed your **required**
+`authorize({ operation, path })` callback, not just `authorizePath`. A rule denying
+`credentials/token.txt` refused that spelling and served — and overwrote — the same file spelled
+`credentials\token.txt`. If your policy denies specific files, re-read your audit logs for
+backslash spellings.
+
+**2. Denying a directory now denies everything under it — and a policy must admit every directory
+on the way to a file**, the way POSIX needs `+x` on each directory in a path.
+
+If your policy is a DENY-list, it now does what it read as:
+
+```ts
+authorizePath: ({ path }) => path !== 'credentials'
+// before: hid `credentials` from glob, served `credentials/token.txt` to read_file
+// after:  refuses `credentials/token.txt`, `credentials/nested/deep.txt` and writes under it
+```
+
+If you relied on the old behaviour — a directory hidden from discovery but readable directly — you
+were relying on a defect, and the two halves of one callback disagreeing. Name the paths you
+actually want reachable instead.
+
+If your policy is an ALLOW-list, widen it to the directories it leads through, or nothing under
+them is reachable:
+
+```ts
+// before: allowed src/index.ts, because only the leaf was ever asked
+authorizePath: ({ path }) => path.startsWith('src/')
+// after: `src` itself is asked first and refused, so the file is refused too
+authorizePath: ({ path }) => path === 'src' || path.startsWith('src/')
+```
+
+The workspace root is not asked about — it is the boundary the tools already own.
+
+**3. The policy is called more often.** A path of depth N costs N+1 calls (`.`, then each ancestor,
+then the leaf), outermost first, stopping at the first refusal. A policy that logs or meters will
+see a different sequence, and will no longer see the leaf once an ancestor has refused.
+
 ## Released migration: 0.83.0
 
 Two things, both mechanical, and only if you touch an observability sink.
@@ -15253,8 +15315,9 @@ artifact store is supplied, `read_output`.
 | `createAgentCodingTools` | function | construct direct host-authorized bounded file, listing, glob, search, exact-snippet edit, shell and artifact runtime-tool definitions; every ordinary refusal is a typed code with an instructive `hint`, and filesystem operations use Linux `/proc/self/fd` or the packaged macOS Node-API backend and otherwise fail closed |
 | `AGENT_CODING_TOOL_NAMES` | const | the mounted tool names — `read_file`, `write_file`, `edit_file`, `list_directory`, `glob`, `search_files`, `run_command`, `read_output` |
 | `AgentCodingToolDefinition` | _type_ | peer-free structural direct-tool shape accepted by the canonical runtime-tool surface |
-| `AgentCodingToolConfig` | _type_ | absolute root, required authorization callback, finite executable alias map, exact child environment and optional limits |
+| `AgentCodingToolConfig` | _type_ | absolute root, required operation authorization, optional async/sync `authorizePath({ path })` shared by direct file effects and discovery, finite executable alias map, exact child environment and optional limits |
 | `AgentCodingToolAuthorizationSchema` / `AgentCodingToolAuthorization` | schema / _type_ | discriminated read/write/search/patch/shell/artifact decision presented to host policy before effect |
+| `AgentCodingToolPathAuthorizationSchema` / `AgentCodingToolPathAuthorization` | schema / _type_ | strict workspace-relative path presented to the shared path policy before disclosure, opening or mutation |
 | `AgentCodingToolLimitsSchema` / `AgentCodingToolLimits` | schema / _type_ | explicit path/read/write/argument-count/argument-byte/output/artifact/timeout/termination-grace ceilings |
 | `AgentCodingArtifactStore` | _type_ | host-owned opaque artifact write and bounded read boundary |
 | `FileReadInputSchema` / `FileReadOutputSchema` | schema | bounded strict-UTF-8 byte slice; offsets must align with UTF-8 code-point boundaries |
@@ -15268,6 +15331,16 @@ of aggregate argument text, 4 MiB per artifact and 30 seconds. The root is a pat
 boundary, not an OS sandbox; executable behavior, process
 isolation, credentials and external-effect idempotency remain host responsibilities.
 
+When `authorizePath` denies a path, direct read/write/edit returns `FORBIDDEN`, while
+`list_directory`, `glob` and `search_files` omit it. Denial is recursive: direct access and
+discovery base paths are checked against `.` and every ancestor, outermost first and segment-wise,
+so denying `credentials` denies `credentials/token.txt` but not `credentials-backup`. Directory
+admission happens before descent and file admission before opening; `search_files.include` is also
+applied before content is read. Requested paths must use `/` — a backslash is refused, because the
+containment walk reads it as a separator while a callback would read it as one name.
+`run_command` is intentionally outside this guarantee because an executable needs process isolation,
+not path filtering, to constrain its filesystem access. → ADR 0172.
+
 ## `stitchkit/agent-runtime/browser`
 
 Browser-safe canonical agent data. It re-exports the run, message, part, usage,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stitchkit",
-  "version": "0.83.1",
+  "version": "0.84.0",
   "description": "Contract-first backend framework — one defineContract() into an HTTP API, MCP tools, AI-agent tools and a typed client. Bun and Node.",
   "keywords": [
     "bun",