Share workspace roots with list_dir and delete_file bounds

listDirectory and deleteFilePlugin resolve through the shared workspace-root containment instead of cwd alone, so sibling worktree roots list and delete while genuinely outside paths stay refused. Session roots realpath before the lexical check, fixing aliased-tmp false denies. Wiring threads the worktree roots provider at both tool sites; yolo and allowOutside behavior is unchanged.

Author: TheGreatAxios

src/agent/posix-tool-plugins.ts

@@ -99,6 +99,9 @@ export function buildCorePosixToolPlugins(
   // rebuilding the plugin stack. Secret-guard and authz still hard-deny
   // regardless.
   const allowOutside = (): boolean => permissionGate.getSkipPermissions();
+  // One shared workspace-roots provider for every bound in this stack, so
+  // pathEscape and delete_file admit the same registered sibling worktrees.
+  const rootsProvider = createWorktreeRootsProvider(cwd);
   const truncationOptions =
     getBlobWriter !== undefined ||
     getContextDir !== undefined ||
@@ -112,9 +115,9 @@ export function buildCorePosixToolPlugins(
   return [
     resultTruncationPlugin(truncationOptions),
     toolResultSecretScrubPlugin(),
-    pathEscapePlugin(cwd, createWorktreeRootsProvider(cwd), { allowOutside }),
+    pathEscapePlugin(cwd, rootsProvider, { allowOutside }),
     evidenceArchivePathGuardPlugin(),
-    deleteFilePlugin(cwd, { allowOutside }),
+    deleteFilePlugin(cwd, { allowOutside, rootsProvider }),
     toolOutputUriPlugin(),
     secretGuardPlugin(),
     authzPlugin(),

src/agent/tools.ts

@@ -19,6 +19,7 @@ import { advertiseEditFileLineRange } from "../plugins/edit-file-line-range.js";
 import { advertiseArchiveSurface } from "../plugins/evidence-archive-search-plugin.js";
 import type { Telemetry } from "../telemetry/index.js";
 import type { PermissionGate } from "../permission/gate.js";
+import { createWorktreeRootsProvider } from "../permission/worktree-roots.js";
 import { buildCorePosixToolPlugins } from "./posix-tool-plugins.js";
 import { createLazyBlobReader } from "./lazy-blob-reader.js";
 import type { BlobReader } from "@intx/types/runtime";
@@ -583,6 +584,7 @@ export async function createAgentToolset(
     }),
     createListDirTool(cwd, {
       allowOutside: () => permissionGate.getSkipPermissions(),
+      rootsProvider: createWorktreeRootsProvider(cwd),
     }),
     createUseSkillTool(cwd, skillDirs, args.telemetry),
     createSkillSearchTool({ skills }),

src/list-dir.test.ts

@@ -1,11 +1,5 @@
 import { test, expect, describe } from "bun:test";
-import {
-  mkdtemp,
-  mkdir,
-  realpath,
-  symlink,
-  writeFile,
-} from "node:fs/promises";
+import { mkdtemp, mkdir, realpath, symlink, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { basename, join } from "node:path";
 import { listDirectory } from "./util/list-dir.js";

src/plugins/delete-file-plugin.ts

@@ -1,8 +1,10 @@
-import { lstat, readFile, realpath, unlink } from "node:fs/promises";
-import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { lstat, readFile, unlink } from "node:fs/promises";
+import { resolve } from "node:path";
 import { type } from "arktype";
 import type { ExtraTool, ToolPlugin } from "@intx/tools-posix";
 import type { ToolCall, ToolResult } from "@intx/types/runtime";
+import { resolveWorkspacePath } from "../permission/path-restriction.js";
+import type { RootsProvider } from "../permission/worktree-roots.js";
 import { formatChangeDiff } from "./change-diff.js";
 
 const DeleteFileArgs = type({ path: "string>0" });
@@ -43,19 +45,14 @@ function failureDetail(error: unknown): string {
   return code === undefined ? error.message : `${code}: ${error.message}`;
 }
 
-function isWithin(root: string, path: string): boolean {
-  const rel = relative(root, path);
-  return (
-    rel === "" ||
-    (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel))
-  );
-}
-
 export interface DeleteFilePluginOptions {
   // When true (yolo / --dangerously-skip-permissions), delete outside the
   // working directory. A getter is resolved per call so `/yolo` mid-session
   // takes effect without rebuilding the plugin stack.
   allowOutside?: boolean | (() => boolean);
+  // Workspace roots beyond cwd (the session's registered git worktrees).
+  // Defaults to cwd alone.
+  rootsProvider?: RootsProvider;
 }
 
 function resolveAllowOutside(
@@ -84,18 +81,24 @@ export function deleteFilePlugin(
       }
 
       const allowOutside = resolveAllowOutside(options.allowOutside);
+      // Containment is delegated to the shared workspace resolver, which
+      // realpaths the session root before comparing and admits registered
+      // sibling worktree roots — the same boundary pathEscapePlugin enforces.
+      if (
+        !allowOutside &&
+        resolveWorkspacePath(
+          cwd,
+          args.path,
+          options.rootsProvider ?? (() => []),
+        ) === undefined
+      ) {
+        return errorResult(
+          call.id,
+          `${args.path} resolves outside the working directory`,
+        );
+      }
       const target = resolve(cwd, args.path);
       try {
-        const [physicalRoot, physicalParent] = await Promise.all([
-          realpath(cwd),
-          realpath(dirname(target)),
-        ]);
-        if (!allowOutside && !isWithin(physicalRoot, physicalParent)) {
-          return errorResult(
-            call.id,
-            `${args.path} resolves outside the working directory`,
-          );
-        }
         const info = await lstat(target);
         if (info.isDirectory()) {
           return errorResult(

src/util/list-dir.ts

@@ -1,9 +1,11 @@
 import { type } from "arktype";
 import { readdir, realpath } from "node:fs/promises";
-import { resolve, sep } from "node:path";
+import { resolve } from "node:path";
 import { stringTool } from "@intx/agent";
 import type { AgentTool } from "@intx/agent";
 import type { ToolDefinition } from "@intx/types/runtime";
+import { resolveWorkspacePath } from "../permission/path-restriction.js";
+import type { RootsProvider } from "../permission/worktree-roots.js";
 
 const ListDirArgs = type({ "path?": "string" });
 
@@ -31,6 +33,9 @@ export interface ListDirectoryOptions {
   // workspace. A getter is resolved per call so `/yolo` mid-session takes
   // effect without rebuilding the tool.
   allowOutside?: boolean | (() => boolean);
+  // Workspace roots beyond cwd (the session's registered git worktrees).
+  // Defaults to cwd alone.
+  rootsProvider?: RootsProvider;
 }
 
 function resolveAllowOutside(
@@ -47,29 +52,26 @@ export async function listDirectory(
 ): Promise<string> {
   const allowOutside = resolveAllowOutside(options.allowOutside);
   const rel = path.length > 0 ? path : ".";
-  const abs = resolve(cwd, rel);
-  if (!allowOutside && abs !== cwd && !abs.startsWith(cwd + sep)) {
-    return `Error: ${rel} is outside the workspace.`;
-  }
+  const rootsProvider = options.rootsProvider ?? (() => []);
 
-  // A symlink inside the workspace can resolve to a target outside it; the
-  // string prefix check above only sees the lexical path. Resolve the real path
-  // of both the target and the root before comparing so symlink escapes are
-  // refused (unless allowOutside, which is the yolo-mode escape hatch).
+  // Containment is delegated to the shared workspace resolver: it realpaths
+  // the session root before comparing (so an aliased cwd such as macOS
+  // /tmp -> /private/tmp never false-denies) and admits registered sibling
+  // worktree roots. The canonical path feeds readdir directly, so a symlink
+  // retargeted after the check cannot redirect the read.
   let realAbs: string;
-  let realCwd: string;
-  try {
-    realAbs = await realpath(abs);
-    realCwd = await realpath(cwd);
-  } catch (err) {
-    return `Error: cannot list ${rel}: ${err instanceof Error ? err.message : String(err)}`;
-  }
-  if (
-    !allowOutside &&
-    realAbs !== realCwd &&
-    !realAbs.startsWith(realCwd + sep)
-  ) {
-    return `Error: ${rel} is outside the workspace.`;
+  if (allowOutside) {
+    try {
+      realAbs = await realpath(resolve(cwd, rel));
+    } catch (err) {
+      return `Error: cannot list ${rel}: ${err instanceof Error ? err.message : String(err)}`;
+    }
+  } else {
+    const resolved = resolveWorkspacePath(cwd, rel, rootsProvider);
+    if (resolved === undefined) {
+      return `Error: ${rel} is outside the workspace.`;
+    }
+    realAbs = resolved;
   }
 
   let entries;