Scope spill URI sandbox bypass to reader tools only

Author: TheGreatAxios

src/permission/gate.ts

@@ -671,6 +671,7 @@ export function createPermissionGate(
       call.arguments,
       effectiveCwd,
       escapeRoots,
+      call.name,
     );
     if (escapeReason !== undefined) {
       return { kind: "deny", reason: escapeReason };

src/plugins/path-escape-plugin.ts

@@ -35,6 +35,7 @@ export function pathEscapePlugin(
           cwd,
           rootsProvider,
           resolveAllowOutside(options.allowOutside),
+          call.name,
         );
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -50,15 +51,16 @@ function escapeArgs(
   cwd: string,
   rootsProvider: RootsProvider,
   allowOutside: boolean,
+  toolName?: string,
 ): Record<string, unknown> {
   if (!allowOutside) {
-    const reason = pathEscapeBlockReason(args, cwd, rootsProvider);
+    const reason = pathEscapeBlockReason(args, cwd, rootsProvider, toolName);
     if (reason !== undefined) throw new Error(reason);
   }
   const out: Record<string, unknown> = {};
   for (const [key, value] of Object.entries(args)) {
     if (typeof value === "string" && looksLikePath(key)) {
-      out[key] = sanitizePath(value, cwd, rootsProvider, allowOutside);
+      out[key] = sanitizePath(value, cwd, rootsProvider, allowOutside, toolName);
     } else {
       out[key] = value;
     }
@@ -83,17 +85,54 @@ export function looksLikePath(key: string): boolean {
   );
 }
 
+// Only read_file can consume a spilled tool-output blob; every other tool
+// rejects the scheme in toolOutputUriPlugin. The sandbox skips containment
+// for the same tool so a non-reader is denied here too instead of only by
+// plugin order.
+// archive:/// refs are served to read_file, grep, and search_files by
+// evidenceArchiveSearchPlugin (see advertiseArchiveSurface); other tools have
+// no archive reader, so the sandbox only skips containment for those three.
+const TOOL_OUTPUT_URI_TOOL = "read_file";
+const ARCHIVE_URI_TOOLS = new Set(["read_file", "grep", "search_files"]);
+
+// "skip" when this tool may receive the virtual ref, a block message when it
+// may not, undefined when the value is an ordinary filesystem path. An
+// omitted toolName keeps the legacy skip so direct callers that predate the
+// parameter see no behavior change; the middleware and the permission gate
+// always pass a name.
+function virtualRefVerdict(
+  value: string,
+  toolName: string | undefined,
+): "skip" | string | undefined {
+  if (isToolOutputLike(value)) {
+    if (toolName === undefined || toolName === TOOL_OUTPUT_URI_TOOL) {
+      return "skip";
+    }
+    return `cannot ${toolName} a tool-output:// URI: ${value}. Use read_file with that URI to read the spilled output instead.`;
+  }
+  if (isArchiveLike(value)) {
+    if (toolName === undefined || ARCHIVE_URI_TOOLS.has(toolName)) {
+      return "skip";
+    }
+    return `cannot ${toolName} an archive:/// ref: ${value}. Only read_file, grep, and search_files accept archive:/// refs.`;
+  }
+  return undefined;
+}
+
 // Same sandbox pathEscapePlugin enforces at execution. The permission gate
 // consults this at authorize time so it can deny instead of asking for a call
 // the plugin will reject after Accept.
 export function pathEscapeBlockReason(
   args: Record<string, unknown>,
   cwd: string,
   rootsProvider: RootsProvider = () => [],
+  toolName?: string,
 ): string | undefined {
   for (const [key, value] of Object.entries(args)) {
     if (typeof value !== "string" || !looksLikePath(key)) continue;
-    if (isToolOutputLike(value) || isArchiveLike(value)) continue;
+    const verdict = virtualRefVerdict(value, toolName);
+    if (verdict === "skip") continue;
+    if (typeof verdict === "string") return verdict;
     if (resolveWorkspacePath(cwd, value, rootsProvider) === undefined) {
       return `Path escapes working directory: ${value}`;
     }
@@ -106,10 +145,15 @@ function sanitizePath(
   cwd: string,
   rootsProvider: RootsProvider,
   allowOutside: boolean,
+  toolName?: string,
 ): string {
-  if (isToolOutputLike(value) || isArchiveLike(value)) {
+  const verdict = virtualRefVerdict(value, toolName);
+  if (verdict === "skip") {
     return value;
   }
+  if (typeof verdict === "string") {
+    throw new Error(verdict);
+  }
   const resolved = resolveWorkspacePath(cwd, value, rootsProvider);
   if (resolved !== undefined) {
     return resolved;