From 1c703e2630fa5fac01f3e1e1a64e16e18c845501 Mon Sep 17 00:00:00 2001
From: Aaron Stannard <aaron@petabridge.com>
Date: Wed, 5 Aug 2026 20:32:40 +0000
Subject: [PATCH 01/11] feat: interactive Personal file reads reach as far as
 shell does (#1724)

Interactive Personal-audience sessions now get shell-equivalent read and
attach reach: file_read, file_list, attach_file resolve outside the
configured trust roots, matching the approval-gated shell surface. This
kills the shell-workaround (cat, cp-into-session) for legitimate
out-of-roots files.

ToolPathPolicy.IsReadDenied now also denies the shell indicator list
(config dir, sqlite DB, pid, lock, restart manifest), so read tools cannot
reach control-plane files that shell cannot even reference.

Autonomous sessions, Team, and Public audiences keep their roots-scoped or
fail-closed behavior. attach_file lifts its session-proximity gate only for
interactive Personal; out-of-session files still copy into the session
attachments dir.

Spec: netclaw-tools carve-out for interactive Personal read reach.
---
 openspec/specs/netclaw-tools/spec.md          |  11 +-
 .../Tools/AttachFileToolTests.cs              |  56 +++++-
 .../InteractivePersonalReadReachTests.cs      | 183 ++++++++++++++++++
 src/Netclaw.Actors/Tools/AttachFileTool.cs    |  12 +-
 .../Tools/ScopedFileAccessPolicy.cs           |  28 ++-
 .../ToolPathPolicyTests.cs                    |  24 ++-
 src/Netclaw.Security/ToolPathPolicy.cs        |  14 +-
 7 files changed, 305 insertions(+), 23 deletions(-)
 create mode 100644 src/Netclaw.Actors.Tests/Tools/InteractivePersonalReadReachTests.cs

diff --git a/openspec/specs/netclaw-tools/spec.md b/openspec/specs/netclaw-tools/spec.md
index 907b79ec1..6c62fa4c4 100644
--- a/openspec/specs/netclaw-tools/spec.md
+++ b/openspec/specs/netclaw-tools/spec.md
@@ -157,7 +157,10 @@ create, modify, or remove any filesystem entry.
 same scoped read-access policy used by `file_read`, so the directories an
 audience may list are exactly that audience's resolved read roots. A target
 outside the audience's read roots SHALL be denied, and the denial message
-SHALL NOT disclose configured root paths.
+SHALL NOT disclose configured root paths. Interactive Personal-audience
+sessions are the exception: they get shell-equivalent reach, so a target
+outside the read roots SHALL resolve when the session is interactive and the
+audience is Personal. Autonomous sessions keep the hard denial.
 
 #### Scenario: Team session lists a directory within its read roots
 
@@ -309,7 +312,11 @@ supported values. The applied filter SHALL be echoed in the result.
 
 The system SHALL provide a `file_read` first-party tool that authorizes the
 requested path through the audience-scoped read-file policy before inspecting or
-reading bytes. Text-like files SHALL return decoded text for UTF-8, UTF-16/UTF-32
+reading bytes. Interactive Personal-audience sessions are the exception: they
+get shell-equivalent reach, so a path outside the read roots SHALL resolve when
+the session is interactive and the audience is Personal. Autonomous sessions
+keep the hard denial. Text-like files SHALL return decoded text for UTF-8,
+UTF-16/UTF-32
 Unicode, and common Windows-1252 text files using the existing offset/limit and
 output-truncation behavior.
 
diff --git a/src/Netclaw.Actors.Tests/Tools/AttachFileToolTests.cs b/src/Netclaw.Actors.Tests/Tools/AttachFileToolTests.cs
index da431a3c6..0dea10d73 100644
--- a/src/Netclaw.Actors.Tests/Tools/AttachFileToolTests.cs
+++ b/src/Netclaw.Actors.Tests/Tools/AttachFileToolTests.cs
@@ -1,10 +1,11 @@
-// -----------------------------------------------------------------------
+// -----------------------------------------------------------------------
 // <copyright file="AttachFileToolTests.cs" company="Petabridge, LLC">
 //      Copyright (C) 2026 - 2026 Petabridge, LLC <https://petabridge.com>
 // </copyright>
 // -----------------------------------------------------------------------
 using Netclaw.Actors.Tools;
 using Netclaw.Configuration;
+using Netclaw.Security;
 using Netclaw.Tests.Utilities;
 using Netclaw.Tools;
 using Xunit;
@@ -40,13 +41,21 @@ public async Task Valid_file_within_session_directory_succeeds()
     [Fact]
     public async Task Path_traversal_attempt_is_rejected()
     {
-        // Create a file outside the session directory
+        // Autonomous Personal: the out-of-session boundary holds for
+        // non-interactive sessions (#1724). Interactive Personal gets
+        // shell-equivalent reach instead.
         var outsidePath = Path.Combine(Path.GetTempPath(), $"netclaw-outside-{Guid.NewGuid():N}.txt");
         await File.WriteAllTextAsync(outsidePath, "sensitive data", TestContext.Current.CancellationToken);
 
         try
         {
-            var context = TestToolExecutionContext.CreateBound("test-session", _dir.Path, TrustAudience.Personal);
+            var context = TestToolExecutionContext.CreateBound("reminder/test-session", _dir.Path, new TestToolExecutionContextOptions
+            {
+                Audience = TrustAudience.Personal,
+                Boundary = SecurityPolicyDefaults.ResolveBoundaryFromAudience(TrustAudience.Personal),
+                InteractiveApproval = TestToolExecutionContext.InteractiveApproval(false),
+                ChannelType = "reminder"
+            });
             var args = ToolInput.Create("Path", outsidePath);
 
             var result = await _tool.ExecuteAsync(args, context, CancellationToken.None);
@@ -63,7 +72,14 @@ public async Task Path_traversal_attempt_is_rejected()
     [Fact]
     public async Task Dotdot_traversal_is_rejected()
     {
-        var context = TestToolExecutionContext.CreateBound("test-session", _dir.Path, TrustAudience.Personal);
+        // Autonomous Personal: dotdot escape is denied outside the zone (#1724).
+        var context = TestToolExecutionContext.CreateBound("reminder/test-session", _dir.Path, new TestToolExecutionContextOptions
+        {
+            Audience = TrustAudience.Personal,
+            Boundary = SecurityPolicyDefaults.ResolveBoundaryFromAudience(TrustAudience.Personal),
+            InteractiveApproval = TestToolExecutionContext.InteractiveApproval(false),
+            ChannelType = "reminder"
+        });
         var args = ToolInput.Create("Path", Path.Combine(_dir.Path, "..", "..", "etc", "passwd"));
 
         var result = await _tool.ExecuteAsync(args, context, CancellationToken.None);
@@ -156,12 +172,20 @@ public async Task Failed_attach_does_not_populate_file_attachments()
     [Fact]
     public async Task Prefix_collision_path_is_rejected()
     {
+        // Autonomous Personal: a sibling directory sharing the session dir's
+        // name prefix is outside the zone and denied (#1724).
         var outsideDir = _dir.Path + "-outside";
         Directory.CreateDirectory(outsideDir);
         var outsideFile = Path.Combine(outsideDir, "secret.txt");
         await File.WriteAllTextAsync(outsideFile, "sensitive", TestContext.Current.CancellationToken);
 
-        var context = TestToolExecutionContext.CreateBound("test-session", _dir.Path, TrustAudience.Personal);
+        var context = TestToolExecutionContext.CreateBound("reminder/test-session", _dir.Path, new TestToolExecutionContextOptions
+        {
+            Audience = TrustAudience.Personal,
+            Boundary = SecurityPolicyDefaults.ResolveBoundaryFromAudience(TrustAudience.Personal),
+            InteractiveApproval = TestToolExecutionContext.InteractiveApproval(false),
+            ChannelType = "reminder"
+        });
         var args = ToolInput.Create("Path", outsideFile);
 
         var result = await _tool.ExecuteAsync(args, context, CancellationToken.None);
@@ -174,6 +198,9 @@ public async Task Prefix_collision_path_is_rejected()
     [Fact]
     public async Task Symlink_to_outside_file_is_rejected()
     {
+        // Autonomous Personal: a symlink in the session dir that resolves
+        // outside is denied by the proximity gate (#1724). Interactive Personal
+        // gets shell-equivalent reach instead.
         var outsideFile = Path.Combine(Path.GetTempPath(), $"netclaw-outside-{Guid.NewGuid():N}.txt");
         var symlinkPath = Path.Combine(_dir.Path, "linked.txt");
 
@@ -183,13 +210,21 @@ public async Task Symlink_to_outside_file_is_rejected()
         {
             File.CreateSymbolicLink(symlinkPath, outsideFile);
 
-            var context = TestToolExecutionContext.CreateBound("test-session", _dir.Path, TrustAudience.Personal);
+            var context = TestToolExecutionContext.CreateBound("reminder/test-session", _dir.Path, new TestToolExecutionContextOptions
+            {
+                Audience = TrustAudience.Personal,
+                Boundary = SecurityPolicyDefaults.ResolveBoundaryFromAudience(TrustAudience.Personal),
+                InteractiveApproval = TestToolExecutionContext.InteractiveApproval(false),
+                ChannelType = "reminder"
+            });
             var args = ToolInput.Create("Path", symlinkPath);
 
             var result = await _tool.ExecuteAsync(args, context, CancellationToken.None);
 
+            // The autonomous zone rejects symlinked paths outright — stricter
+            // than the proximity gate, and the intended behavior (#1724).
             Assert.Contains("Error", result);
-            Assert.Contains("session directory", result, StringComparison.OrdinalIgnoreCase);
+            Assert.Contains("symlink", result, StringComparison.OrdinalIgnoreCase);
             Assert.Empty(context.FileAttachments);
         }
         catch (UnauthorizedAccessException)
@@ -278,11 +313,12 @@ public async Task Symlink_from_sibling_session_to_outside_root_is_rejected()
         {
             File.CreateSymbolicLink(symlinkPath, outsidePath);
 
-            var context = TestToolExecutionContext.CreateBound("signalr/thread-1", currentSessionDir, new TestToolExecutionContextOptions
-        {
+            var context = TestToolExecutionContext.CreateBound("reminder/thread-1", currentSessionDir, new TestToolExecutionContextOptions
+            {
                 Audience = TrustAudience.Personal,
                 Boundary = TrustBoundary.TrustedInstance,
-                ChannelType = "signalr"
+                InteractiveApproval = TestToolExecutionContext.InteractiveApproval(false),
+                ChannelType = "reminder"
             });
             var args = ToolInput.Create("Path", symlinkPath);
 
diff --git a/src/Netclaw.Actors.Tests/Tools/InteractivePersonalReadReachTests.cs b/src/Netclaw.Actors.Tests/Tools/InteractivePersonalReadReachTests.cs
new file mode 100644
index 000000000..99ce91b76
--- /dev/null
+++ b/src/Netclaw.Actors.Tests/Tools/InteractivePersonalReadReachTests.cs
@@ -0,0 +1,183 @@
+// -----------------------------------------------------------------------
+// <copyright file="InteractivePersonalReadReachTests.cs" company="Petabridge, LLC">
+//      Copyright (C) 2026 - 2026 Petabridge, LLC <https://petabridge.com>
+// </copyright>
+// -----------------------------------------------------------------------
+using Netclaw.Actors.Tools;
+using Netclaw.Configuration;
+using Netclaw.Security;
+using Netclaw.Tests.Utilities;
+using Netclaw.Tools;
+using Xunit;
+
+namespace Netclaw.Actors.Tests.Tools;
+
+/// <summary>
+/// Interactive Personal-audience sessions get shell-equivalent read/attach
+/// reach: out-of-root paths resolve instead of hard-failing, matching the
+/// approval-gated shell surface. Autonomous sessions, Team, and Public keep
+/// their roots-scoped or fail-closed behavior. Regression guard for
+/// netclaw-dev/netclaw#1724.
+/// </summary>
+public sealed class InteractivePersonalReadReachTests : IDisposable
+{
+    private readonly DisposableTempDir _dir = new();
+    private readonly string _sessionDir;
+    private readonly string _outsideDir;
+    private readonly NetclawPaths _paths;
+
+    public InteractivePersonalReadReachTests()
+    {
+        _sessionDir = Path.Combine(_dir.Path, "sessions", "s1");
+        _outsideDir = Path.Combine(_dir.Path, "outside");
+        Directory.CreateDirectory(_sessionDir);
+        Directory.CreateDirectory(_outsideDir);
+        _paths = new NetclawPaths(_dir.Path);
+    }
+
+    public void Dispose() => _dir.Dispose();
+
+    private ToolInvocationContext Ctx(TrustAudience audience, bool autonomous)
+        => TestToolExecutionContext.CreateBound(
+            autonomous ? "reminder/s1" : "signalr/s1",
+            _sessionDir,
+            new TestToolExecutionContextOptions
+            {
+                Audience = audience,
+                Boundary = SecurityPolicyDefaults.ResolveBoundaryFromAudience(audience),
+                InteractiveApproval = TestToolExecutionContext.InteractiveApproval(!autonomous),
+                ProjectDirectory = null,
+                ChannelType = autonomous ? "reminder" : "signalr"
+            }).Invocation;
+
+    private static ToolConfig BuildPersonalReadRootsConfig(string root)
+    {
+        var toolConfig = new ToolConfig();
+        toolConfig.AudienceProfiles.Personal.ReadFiles = new ToolFilesystemAccessProfile
+        {
+            Mode = ToolFilesystemMode.Roots,
+            Roots = [root]
+        };
+        return toolConfig;
+    }
+
+    public static TheoryData<TrustAudience, bool, bool, bool, bool> ReadReachCases => new()
+    {
+        // audience, interactive, outsideRoots, hardenedPersonalRoots, expectedAllow
+        // Default Personal (Mode.All): blanket interactive grant, autonomous clamp.
+        { TrustAudience.Personal, true, false, false, true },
+        { TrustAudience.Personal, true, true, false, true },
+        { TrustAudience.Personal, false, false, false, true },
+        { TrustAudience.Personal, false, true, false, false },
+        // Hardened Personal (ReadFiles = Roots = session dir): the #1724 trigger.
+        { TrustAudience.Personal, true, false, true, true },
+        { TrustAudience.Personal, true, true, true, true },   // NEW: shell-equivalent reach
+        { TrustAudience.Personal, false, false, true, true },
+        { TrustAudience.Personal, false, true, true, false },
+        // Team (Roots): roots-scoped everywhere.
+        { TrustAudience.Team, true, false, false, true },
+        { TrustAudience.Team, true, true, false, false },
+        { TrustAudience.Team, false, false, false, true },
+        { TrustAudience.Team, false, true, false, false },
+        // Public (session only): never widened.
+        { TrustAudience.Public, true, false, false, true },
+        { TrustAudience.Public, true, true, false, false },
+        { TrustAudience.Public, false, false, false, true },
+        { TrustAudience.Public, false, true, false, false },
+    };
+
+    [Theory]
+    [MemberData(nameof(ReadReachCases))]
+    public void Read_reach_matches_expected(
+        TrustAudience audience,
+        bool interactive,
+        bool outsideRoots,
+        bool hardenedPersonalRoots,
+        bool expectedAllow)
+    {
+        var config = hardenedPersonalRoots
+            ? BuildPersonalReadRootsConfig(_sessionDir)
+            : new ToolConfig();
+        var policy = new ScopedFileAccessPolicy(config, _paths);
+        var ctx = Ctx(audience, autonomous: !interactive);
+
+        var path = outsideRoots
+            ? Path.Combine(_outsideDir, "notes.txt")
+            : Path.Combine(_sessionDir, "notes.txt");
+
+        var allowed = policy.TryResolveReadPath(path, ctx, out _, out _);
+
+        Assert.Equal(expectedAllow, allowed);
+    }
+
+    [Theory]
+    [MemberData(nameof(ReadReachCases))]
+    public void Attach_reach_matches_expected(
+        TrustAudience audience,
+        bool interactive,
+        bool outsideRoots,
+        bool hardenedPersonalRoots,
+        bool expectedAllow)
+    {
+        var config = hardenedPersonalRoots
+            ? BuildPersonalReadRootsConfig(_sessionDir)
+            : new ToolConfig();
+        var policy = new ScopedFileAccessPolicy(config, _paths);
+        var ctx = Ctx(audience, autonomous: !interactive);
+
+        var path = outsideRoots
+            ? Path.Combine(_outsideDir, "report.png")
+            : Path.Combine(_sessionDir, "report.png");
+
+        var allowed = policy.TryResolveAttachPath(path, ctx, out _, out _);
+
+        Assert.Equal(expectedAllow, allowed);
+    }
+
+    public static TheoryData<TrustAudience, bool, bool> AttachToolReachCases => new()
+    {
+        // audience, interactive, expectedAttached
+        { TrustAudience.Personal, true, true },
+        { TrustAudience.Personal, false, false },
+        { TrustAudience.Team, true, false },
+        { TrustAudience.Public, true, false },
+    };
+
+    [Theory]
+    [MemberData(nameof(AttachToolReachCases))]
+    public async Task Attach_tool_outside_session_matches_expected(
+        TrustAudience audience,
+        bool interactive,
+        bool expectedAttached)
+    {
+        var outsideFile = Path.Combine(_outsideDir, "report.png");
+        await File.WriteAllBytesAsync(outsideFile, [0x89, 0x50, 0x4E, 0x47], TestContext.Current.CancellationToken);
+
+        var context = TestToolExecutionContext.CreateBound(
+            interactive ? "signalr/s1" : "reminder/s1",
+            _sessionDir,
+            new TestToolExecutionContextOptions
+            {
+                Audience = audience,
+                Boundary = SecurityPolicyDefaults.ResolveBoundaryFromAudience(audience),
+                InteractiveApproval = TestToolExecutionContext.InteractiveApproval(interactive),
+                ProjectDirectory = null,
+                ChannelType = interactive ? "signalr" : "reminder"
+            });
+        var tool = new AttachFileTool(new ToolConfig(), new NetclawPaths());
+        var args = ToolInput.Create("Path", outsideFile);
+
+        var result = await tool.ExecuteAsync(args, context.Invocation, CancellationToken.None);
+
+        if (expectedAttached)
+        {
+            Assert.Contains("File attached", result);
+            Assert.Single(context.FileAttachments);
+        }
+        else
+        {
+            Assert.Contains("Error", result);
+            Assert.Empty(context.FileAttachments);
+        }
+    }
+}
diff --git a/src/Netclaw.Actors/Tools/AttachFileTool.cs b/src/Netclaw.Actors/Tools/AttachFileTool.cs
index 7c0d1fcd9..593dd14ad 100644
--- a/src/Netclaw.Actors/Tools/AttachFileTool.cs
+++ b/src/Netclaw.Actors/Tools/AttachFileTool.cs
@@ -47,10 +47,18 @@ protected override Task<string> ExecuteAsync(Params args, ToolInvocationContext
         var sessionDir = PathUtility.Normalize(context.SessionDirectory);
         var sessionRoot = TryGetSessionRootDirectory(sessionDir);
 
+        // Interactive Personal-audience sessions get shell-equivalent reach:
+        // shell can attach anything it can read, so the session-proximity
+        // restriction is lifted for them. The out-of-session file is still
+        // copied into this session's attachments directory below, preserving
+        // delivery semantics. Non-interactive, Team, and Public sessions keep
+        // the proximity gate.
+        var interactivePersonalReach = ScopedFileAccessPolicy.HasInteractivePersonalReach(context);
+
         var requestedInCurrentSession = PathUtility.IsWithinRoot(requestedPath, sessionDir);
         var requestedInSessionRoot = sessionRoot is not null && PathUtility.IsWithinRoot(requestedPath, sessionRoot);
 
-        if (!requestedInCurrentSession && !requestedInSessionRoot)
+        if (!interactivePersonalReach && !requestedInCurrentSession && !requestedInSessionRoot)
         {
             return Task.FromResult(
                 $"Error: File path must be within the current session directory ({sessionDir}) or another Netclaw session under {sessionRoot ?? "<unknown>"}.");
@@ -63,7 +71,7 @@ protected override Task<string> ExecuteAsync(Params args, ToolInvocationContext
         var resolvedInCurrentSession = PathUtility.IsWithinRoot(resolvedPath, sessionDir);
         var resolvedInSessionRoot = sessionRoot is not null && PathUtility.IsWithinRoot(resolvedPath, sessionRoot);
 
-        if (!resolvedInCurrentSession && !resolvedInSessionRoot)
+        if (!interactivePersonalReach && !resolvedInCurrentSession && !resolvedInSessionRoot)
         {
             return Task.FromResult(
                 $"Error: File path must be within the current session directory ({sessionDir}) or another Netclaw session under {sessionRoot ?? "<unknown>"}.");
diff --git a/src/Netclaw.Actors/Tools/ScopedFileAccessPolicy.cs b/src/Netclaw.Actors/Tools/ScopedFileAccessPolicy.cs
index 84481b50f..51f1b7a0c 100644
--- a/src/Netclaw.Actors/Tools/ScopedFileAccessPolicy.cs
+++ b/src/Netclaw.Actors/Tools/ScopedFileAccessPolicy.cs
@@ -1,4 +1,4 @@
-// -----------------------------------------------------------------------
+// -----------------------------------------------------------------------
 // <copyright file="ScopedFileAccessPolicy.cs" company="Petabridge, LLC">
 //      Copyright (C) 2026 - 2026 Petabridge, LLC <https://petabridge.com>
 // </copyright>
@@ -36,6 +36,17 @@ public ScopedFileAccessPolicy(ToolConfig toolConfig, NetclawPaths paths)
     public bool TryResolveReadPath(string rawPath, ToolInvocationContext context, out string fullPath, out string error)
         => TryResolvePath(rawPath, context, AccessKind.Read, out fullPath, out error);
 
+    /// <summary>
+    /// True when an interactive Personal-audience session gets shell-equivalent
+    /// file reach: read and attach tools resolve outside the configured roots,
+    /// matching the approval-gated shell surface. Autonomous sessions, Team,
+    /// and Public audiences are never granted this — they keep their
+    /// roots-scoped or fail-closed behavior.
+    /// </summary>
+    public static bool HasInteractivePersonalReach(ToolInvocationContext context)
+        => context.Audience == TrustAudience.Personal
+           && context.RunScope.InteractiveApproval is InteractiveApprovalCapability.Available;
+
     public bool TryResolveWritePath(string rawPath, ToolInvocationContext context, out string fullPath, out string error)
         => TryResolvePath(rawPath, context, AccessKind.Write, out fullPath, out error);
 
@@ -69,6 +80,7 @@ private bool TryResolvePath(
 
         var profile = _profileResolver.ResolveProfile(context);
         var access = GetAccessProfile(profile, accessKind);
+        var audience = context.Audience;
 
         if (access.Mode == ToolFilesystemMode.All)
         {
@@ -86,7 +98,6 @@ private bool TryResolvePath(
             return true;
         }
 
-        var audience = context.Audience;
         var label = GetAudienceLabel(audience);
 
         if (access.Mode == ToolFilesystemMode.None)
@@ -95,6 +106,19 @@ private bool TryResolvePath(
             return false;
         }
 
+        // Interactive Personal-audience reads are shell-equivalent: shell reaches
+        // any path in an interactive session (approval gate + ToolPathPolicy hard
+        // deny), so read/attach tools do too. This kills the shell-workaround
+        // (cat, cp-into-session) for legitimate out-of-roots files. The hard deny
+        // surface still applies inside the tools via ToolPathPolicy.IsReadDenied,
+        // and autonomous sessions never reach this branch — InteractiveApproval
+        // is Unavailable there, so they clamp to the zone or fail closed below.
+        if (accessKind is AccessKind.Read or AccessKind.Attach && HasInteractivePersonalReach(context))
+        {
+            error = string.Empty;
+            return true;
+        }
+
         var roots = ResolveAndMergeRoots(access, context, audience, accessKind);
 
         if (roots.Count == 0)
diff --git a/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs b/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs
index fa5b1f4fd..243646168 100644
--- a/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs
+++ b/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs
@@ -1,4 +1,4 @@
-// -----------------------------------------------------------------------
+// -----------------------------------------------------------------------
 // <copyright file="ToolPathPolicyTests.cs" company="Petabridge, LLC">
 //      Copyright (C) 2026 - 2026 Petabridge, LLC <https://petabridge.com>
 // </copyright>
@@ -219,9 +219,29 @@ public void IsReadDenied_blocks_sensitive_paths(string path)
         Assert.True(policy.IsReadDenied(path));
     }
 
+    // The read deny surface is the union of the read deny list and the shell
+    // indicator list, so read tools cannot reach control-plane lifecycle files
+    // that shell cannot even reference (#1724).
     [Theory]
-    [InlineData("/home/user/.netclaw/config/netclaw.json")]
     [InlineData("/home/user/.netclaw/netclaw.db")]
+    [InlineData("/home/user/.netclaw/netclaw.pid")]
+    [InlineData("/home/user/.netclaw/netclaw.lock")]
+    [InlineData("/home/user/.netclaw/cache/restart-manifest.json")]
+    public void IsReadDenied_blocks_control_plane_files(string path)
+    {
+        var policy = CreateProductionPolicy();
+        Assert.True(policy.IsReadDenied(path));
+    }
+
+    // The fixture deliberately omits ConfigDirectory from shellIndicators (see
+    // CommandReferencesDeniedPath_still_allows_ls_of_config_directory), so
+    // config-dir files are not asserted read-denied here. Production wiring in
+    // src/Netclaw.Daemon/Program.cs includes paths.ConfigDirectory in the shell
+    // indicator list, which makes the whole config dir read-denied in practice.
+    [Theory]
+    [InlineData("/home/user/repositories/foo.cs")]
+    [InlineData("/tmp/notes.txt")]
+    [InlineData("/home/user/downloads/report.pdf")]
     public void IsReadDenied_allows_non_sensitive_paths(string path)
     {
         var policy = CreateProductionPolicy();
diff --git a/src/Netclaw.Security/ToolPathPolicy.cs b/src/Netclaw.Security/ToolPathPolicy.cs
index 05ec9708c..ffc02a7af 100644
--- a/src/Netclaw.Security/ToolPathPolicy.cs
+++ b/src/Netclaw.Security/ToolPathPolicy.cs
@@ -1,4 +1,4 @@
-// -----------------------------------------------------------------------
+// -----------------------------------------------------------------------
 // <copyright file="ToolPathPolicy.cs" company="Petabridge, LLC">
 //      Copyright (C) 2026 - 2026 Petabridge, LLC <https://petabridge.com>
 // </copyright>
@@ -13,7 +13,9 @@ namespace Netclaw.Security;
 /// <remarks>
 /// Three independent deny surfaces: write (<see cref="IsDenied"/>), read
 /// (<see cref="IsReadDenied"/>), and shell indicators
-/// (<see cref="CommandReferencesDeniedPath"/>). The shell indicator list must
+/// (<see cref="CommandReferencesDeniedPath"/>). Read denies the union of the
+/// read deny list and the shell indicator list, so file tools cannot reach the
+/// control plane that shell cannot reference. The shell indicator list must
 /// stay narrow — file-level only — because that path does a raw substring scan
 /// against the command text, so directory-scoped entries would block legitimate
 /// commands whose arguments happen to contain the directory name.
@@ -97,11 +99,13 @@ public bool IsDenied(string path)
         => IsDeniedAgainst(path, _writeDeniedPaths);
 
     /// <summary>
-    /// Returns true if the given path is denied for read by policy. Narrower
-    /// than <see cref="IsDenied"/>: only covers files that leak credentials.
+    /// Returns true if the given path is denied for read by policy. Covers the
+    /// credential-leaking surfaces (secrets, keys, webhooks) plus the shell
+    /// indicator list (config dir, sqlite DB, pid, lock, restart manifest), so
+    /// read tools cannot reach files that shell cannot even reference.
     /// </summary>
     public bool IsReadDenied(string path)
-        => IsDeniedAgainst(path, _readDeniedPaths);
+        => IsDeniedAgainst(path, _readDeniedPaths) || IsDeniedAgainst(path, _shellDeniedPaths);
 
     private static bool IsDeniedAgainst(string path, HashSet<string> deniedSet)
     {

From 6642a0480ac50aba7e38e7acd581604059090829 Mon Sep 17 00:00:00 2001
From: Aaron Stannard <aaron@petabridge.com>
Date: Wed, 5 Aug 2026 22:26:18 +0000
Subject: [PATCH 02/11] fix: keep set_working_directory roots-scoped; deny
 control-plane attaches (#1724)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adversarial review (PR #1770) found two blockers:
1. attach_file had no ToolPathPolicy, so the lifted proximity gate let
   interactive Personal attach secrets/keys/db/pid/lock — a full bypass
   of the read-deny surface. AttachFileTool now takes ToolPathPolicy and
   applies IsReadDenied after path resolution, matching file_read/list.
2. set_working_directory inherited shell-equivalent reach via the shared
   TryResolveReadPath, widening the safe-verb auto-approve zone and
   letting a planted AGENTS.md become system-prompt content. New
   TryResolveWorkingDirectory opts out of interactive Personal reach;
   SetWorkingDirectoryTool stays roots-scoped.

Also: ToolPathPolicyTests fixture now includes ConfigDirectory in shell
indicators to match production (Program.cs), and the ls regression test
asserts the production behavior (denied). New tests cover attach deny of
control-plane files and set_working_directory roots-scoping.
---
 .../Tools/AttachFileToolTests.cs              |  2 +-
 .../InteractivePersonalReadReachTests.cs      | 49 ++++++++++++++++++-
 src/Netclaw.Actors/Tools/AttachFileTool.cs    | 12 ++++-
 .../Tools/ScopedFileAccessPolicy.cs           | 26 +++++++---
 .../Tools/SetWorkingDirectoryTool.cs          |  4 +-
 .../Tools/ToolRegistrationExtensions.cs       |  4 +-
 .../ToolPathPolicyTests.cs                    | 18 ++++---
 7 files changed, 95 insertions(+), 20 deletions(-)

diff --git a/src/Netclaw.Actors.Tests/Tools/AttachFileToolTests.cs b/src/Netclaw.Actors.Tests/Tools/AttachFileToolTests.cs
index 0dea10d73..3d8a581d0 100644
--- a/src/Netclaw.Actors.Tests/Tools/AttachFileToolTests.cs
+++ b/src/Netclaw.Actors.Tests/Tools/AttachFileToolTests.cs
@@ -15,7 +15,7 @@ namespace Netclaw.Actors.Tests.Tools;
 public class AttachFileToolTests : IDisposable
 {
     private readonly DisposableTempDir _dir = new();
-    private readonly AttachFileTool _tool = new(new ToolConfig(), new NetclawPaths());
+    private readonly AttachFileTool _tool = new(new ToolConfig(), new NetclawPaths(), new ToolPathPolicy([]));
 
     public void Dispose()
     {
diff --git a/src/Netclaw.Actors.Tests/Tools/InteractivePersonalReadReachTests.cs b/src/Netclaw.Actors.Tests/Tools/InteractivePersonalReadReachTests.cs
index 99ce91b76..29f214873 100644
--- a/src/Netclaw.Actors.Tests/Tools/InteractivePersonalReadReachTests.cs
+++ b/src/Netclaw.Actors.Tests/Tools/InteractivePersonalReadReachTests.cs
@@ -164,7 +164,7 @@ public async Task Attach_tool_outside_session_matches_expected(
                 ProjectDirectory = null,
                 ChannelType = interactive ? "signalr" : "reminder"
             });
-        var tool = new AttachFileTool(new ToolConfig(), new NetclawPaths());
+        var tool = new AttachFileTool(new ToolConfig(), new NetclawPaths(), new ToolPathPolicy([]));
         var args = ToolInput.Create("Path", outsideFile);
 
         var result = await tool.ExecuteAsync(args, context.Invocation, CancellationToken.None);
@@ -180,4 +180,51 @@ public async Task Attach_tool_outside_session_matches_expected(
             Assert.Empty(context.FileAttachments);
         }
     }
+
+    [Fact]
+    public async Task Attach_tool_denies_control_plane_files_even_with_interactive_reach()
+    {
+        // BLOCKER regression (#1724): attach must use the same hard-deny surface
+        // as file_read/file_list, so interactive Personal reach cannot ship
+        // secrets/keys/db/pid/lock that shell cannot even reference.
+        var secretsPath = Path.Combine(_outsideDir, "secrets.json");
+        await File.WriteAllTextAsync(secretsPath, """{"apiKey":"top-secret"}""", TestContext.Current.CancellationToken);
+
+        var context = TestToolExecutionContext.CreateBound(
+            "signalr/s1",
+            _sessionDir,
+            new TestToolExecutionContextOptions
+            {
+                Audience = TrustAudience.Personal,
+                Boundary = SecurityPolicyDefaults.ResolveBoundaryFromAudience(TrustAudience.Personal),
+                InteractiveApproval = TestToolExecutionContext.InteractiveApproval(true),
+                ProjectDirectory = null,
+                ChannelType = "signalr"
+            });
+        var tool = new AttachFileTool(new ToolConfig(), new NetclawPaths(), new ToolPathPolicy([secretsPath]));
+        var args = ToolInput.Create("Path", secretsPath);
+
+        var result = await tool.ExecuteAsync(args, context.Invocation, CancellationToken.None);
+
+        Assert.Contains("cannot be read", result, StringComparison.OrdinalIgnoreCase);
+        Assert.Empty(context.FileAttachments);
+    }
+
+    [Fact]
+    public void Set_working_directory_stays_roots_scoped_for_interactive_personal()
+    {
+        // BLOCKER regression (#1724): set_working_directory must NOT inherit
+        // shell-equivalent reach — its declaration widens the safe-verb
+        // auto-approve zone and feeds project identity files into the prompt.
+        var config = BuildPersonalReadRootsConfig(_sessionDir);
+        var policy = new ScopedFileAccessPolicy(config, _paths);
+        var ctx = Ctx(TrustAudience.Personal, autonomous: false);
+
+        var outside = Path.Combine(_outsideDir, "notes.txt");
+
+        // Reads resolve (shell-equivalent reach)...
+        Assert.True(policy.TryResolveReadPath(outside, ctx, out _, out _));
+        // ...but the working-directory declaration stays roots-scoped.
+        Assert.False(policy.TryResolveWorkingDirectory(outside, ctx, out _, out _));
+    }
 }
diff --git a/src/Netclaw.Actors/Tools/AttachFileTool.cs b/src/Netclaw.Actors/Tools/AttachFileTool.cs
index 593dd14ad..4d3e82729 100644
--- a/src/Netclaw.Actors/Tools/AttachFileTool.cs
+++ b/src/Netclaw.Actors/Tools/AttachFileTool.cs
@@ -1,4 +1,4 @@
-// -----------------------------------------------------------------------
+// -----------------------------------------------------------------------
 // <copyright file="AttachFileTool.cs" company="Petabridge, LLC">
 //      Copyright (C) 2026 - 2026 Petabridge, LLC <https://petabridge.com>
 // </copyright>
@@ -23,14 +23,16 @@ namespace Netclaw.Actors.Tools;
 public sealed partial class AttachFileTool : NetclawTool<AttachFileTool.Params>
 {
     private readonly ScopedFileAccessPolicy _fileAccessPolicy;
+    private readonly ToolPathPolicy _pathPolicy;
 
     public record Params(
         [property: Description("Absolute path to the file to attach")] string Path,
         [property: Description("Optional display name for the file")] string? DisplayName = null);
 
-    public AttachFileTool(ToolConfig config, NetclawPaths paths)
+    public AttachFileTool(ToolConfig config, NetclawPaths paths, ToolPathPolicy pathPolicy)
     {
         _fileAccessPolicy = new ScopedFileAccessPolicy(config, paths);
+        _pathPolicy = pathPolicy;
     }
 
     protected override Task<string> ExecuteAsync(Params args, ToolInvocationContext context, CancellationToken ct)
@@ -44,6 +46,12 @@ protected override Task<string> ExecuteAsync(Params args, ToolInvocationContext
         if (!_fileAccessPolicy.TryResolveAttachPath(args.Path, context, out var requestedPath, out var accessError))
             return Task.FromResult(accessError);
 
+        // Same hard-deny surface as file_read/file_list: attach must never ship
+        // control-plane files (secrets, keys, webhooks, config, sqlite, pid,
+        // lock, restart manifest) that shell cannot even reference (#1724).
+        if (_pathPolicy.IsReadDenied(requestedPath))
+            return Task.FromResult(FileToolErrors.CredentialReadDenied(requestedPath));
+
         var sessionDir = PathUtility.Normalize(context.SessionDirectory);
         var sessionRoot = TryGetSessionRootDirectory(sessionDir);
 
diff --git a/src/Netclaw.Actors/Tools/ScopedFileAccessPolicy.cs b/src/Netclaw.Actors/Tools/ScopedFileAccessPolicy.cs
index 51f1b7a0c..40306165b 100644
--- a/src/Netclaw.Actors/Tools/ScopedFileAccessPolicy.cs
+++ b/src/Netclaw.Actors/Tools/ScopedFileAccessPolicy.cs
@@ -36,6 +36,15 @@ public ScopedFileAccessPolicy(ToolConfig toolConfig, NetclawPaths paths)
     public bool TryResolveReadPath(string rawPath, ToolInvocationContext context, out string fullPath, out string error)
         => TryResolvePath(rawPath, context, AccessKind.Read, out fullPath, out error);
 
+    /// <summary>
+    /// Resolves a path for <c>set_working_directory</c>. Deliberately does NOT
+    /// grant interactive Personal shell-equivalent reach: the working directory
+    /// becomes the safe-verb auto-approve zone and feeds project identity files
+    /// into the system prompt, so it stays roots-scoped even when reads are not.
+    /// </summary>
+    public bool TryResolveWorkingDirectory(string rawPath, ToolInvocationContext context, out string fullPath, out string error)
+        => TryResolvePath(rawPath, context, AccessKind.Read, out fullPath, out error, allowInteractivePersonalReach: false);
+
     /// <summary>
     /// True when an interactive Personal-audience session gets shell-equivalent
     /// file reach: read and attach tools resolve outside the configured roots,
@@ -43,7 +52,7 @@ public bool TryResolveReadPath(string rawPath, ToolInvocationContext context, ou
     /// and Public audiences are never granted this — they keep their
     /// roots-scoped or fail-closed behavior.
     /// </summary>
-    public static bool HasInteractivePersonalReach(ToolInvocationContext context)
+    internal static bool HasInteractivePersonalReach(ToolInvocationContext context)
         => context.Audience == TrustAudience.Personal
            && context.RunScope.InteractiveApproval is InteractiveApprovalCapability.Available;
 
@@ -65,7 +74,8 @@ private bool TryResolvePath(
         ToolInvocationContext context,
         AccessKind accessKind,
         out string fullPath,
-        out string error)
+        out string error,
+        bool allowInteractivePersonalReach = true)
     {
         try
         {
@@ -110,10 +120,14 @@ private bool TryResolvePath(
         // any path in an interactive session (approval gate + ToolPathPolicy hard
         // deny), so read/attach tools do too. This kills the shell-workaround
         // (cat, cp-into-session) for legitimate out-of-roots files. The hard deny
-        // surface still applies inside the tools via ToolPathPolicy.IsReadDenied,
-        // and autonomous sessions never reach this branch — InteractiveApproval
-        // is Unavailable there, so they clamp to the zone or fail closed below.
-        if (accessKind is AccessKind.Read or AccessKind.Attach && HasInteractivePersonalReach(context))
+        // surface still applies inside the tools via ToolPathPolicy.IsReadDenied
+        // (file_read, file_list, attach_file), and autonomous sessions never reach
+        // this branch — InteractiveApproval is Unavailable there, so they clamp to
+        // the zone or fail closed below. set_working_directory opts out via
+        // TryResolveWorkingDirectory because its reach widens the safe-verb zone.
+        if (allowInteractivePersonalReach
+            && accessKind is (AccessKind.Read or AccessKind.Attach)
+            && HasInteractivePersonalReach(context))
         {
             error = string.Empty;
             return true;
diff --git a/src/Netclaw.Actors/Tools/SetWorkingDirectoryTool.cs b/src/Netclaw.Actors/Tools/SetWorkingDirectoryTool.cs
index b1d6da65b..651a35b7d 100644
--- a/src/Netclaw.Actors/Tools/SetWorkingDirectoryTool.cs
+++ b/src/Netclaw.Actors/Tools/SetWorkingDirectoryTool.cs
@@ -1,4 +1,4 @@
-// -----------------------------------------------------------------------
+// -----------------------------------------------------------------------
 // <copyright file="SetWorkingDirectoryTool.cs" company="Petabridge, LLC">
 //      Copyright (C) 2026 - 2026 Petabridge, LLC <https://petabridge.com>
 // </copyright>
@@ -47,7 +47,7 @@ protected override Task<string> ExecuteAsync(Params args, ToolInvocationContext
         if (string.IsNullOrEmpty(raw))
             return Task.FromResult("Error: path is required.");
 
-        if (!_fileAccessPolicy.TryResolveReadPath(raw, context, out var fullPath, out var accessError))
+        if (!_fileAccessPolicy.TryResolveWorkingDirectory(raw, context, out var fullPath, out var accessError))
             return Task.FromResult(accessError);
 
         if (!Directory.Exists(fullPath))
diff --git a/src/Netclaw.Actors/Tools/ToolRegistrationExtensions.cs b/src/Netclaw.Actors/Tools/ToolRegistrationExtensions.cs
index 831efbc2f..3796059ac 100644
--- a/src/Netclaw.Actors/Tools/ToolRegistrationExtensions.cs
+++ b/src/Netclaw.Actors/Tools/ToolRegistrationExtensions.cs
@@ -1,4 +1,4 @@
-// -----------------------------------------------------------------------
+// -----------------------------------------------------------------------
 // <copyright file="ToolRegistrationExtensions.cs" company="Petabridge, LLC">
 //      Copyright (C) 2026 - 2026 Petabridge, LLC <https://petabridge.com>
 // </copyright>
@@ -40,7 +40,7 @@ public static ToolRegistry WithFirstPartyTools(
         registry.Register(new FileListTool(config, paths, pathPolicy));
         registry.Register(new FileWriteTool(config, paths, pathPolicy));
         registry.Register(new FileEditTool(config, paths, pathPolicy));
-        registry.Register(new AttachFileTool(config, paths));
+        registry.Register(new AttachFileTool(config, paths, pathPolicy));
         if (webhookRouteStore is not null)
         {
             registry.Register(new SetWebhookTool(webhookRouteStore));
diff --git a/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs b/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs
index 243646168..ac1271abb 100644
--- a/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs
+++ b/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs
@@ -169,6 +169,10 @@ private static ToolPathPolicy CreateProductionPolicy()
         };
         var shellIndicators = new[]
         {
+            // ConfigDirectory is a directory-scoped shell indicator in production
+            // (src/Netclaw.Daemon/Program.cs), so the whole config dir is denied
+            // for shell references AND (via the IsReadDenied union) for reads.
+            "/home/user/.netclaw/config",
             "/home/user/.netclaw/config/secrets.json",
             "/home/user/.netclaw/config/webhooks",
             "/home/user/.netclaw/keys",
@@ -223,6 +227,7 @@ public void IsReadDenied_blocks_sensitive_paths(string path)
     // indicator list, so read tools cannot reach control-plane lifecycle files
     // that shell cannot even reference (#1724).
     [Theory]
+    [InlineData("/home/user/.netclaw/config/netclaw.json")]
     [InlineData("/home/user/.netclaw/netclaw.db")]
     [InlineData("/home/user/.netclaw/netclaw.pid")]
     [InlineData("/home/user/.netclaw/netclaw.lock")]
@@ -249,14 +254,15 @@ public void IsReadDenied_allows_non_sensitive_paths(string path)
     }
 
     [Fact]
-    public void CommandReferencesDeniedPath_still_allows_ls_of_config_directory()
+    public void CommandReferencesDeniedPath_denies_ls_of_config_directory()
     {
-        // Regression guard: directory-scoped writeDeny entries must not bleed
-        // into the shell substring indicator set, otherwise every shell command
-        // whose text contains ".netclaw/config" would be rejected.
+        // Production includes ConfigDirectory in the shell indicator list
+        // (src/Netclaw.Daemon/Program.cs), so `ls ~/.netclaw/config` is denied
+        // by the substring indicator scan. This mirrors production behavior;
+        // the fixture now includes ConfigDirectory to match.
         var policy = CreateProductionPolicy();
-        Assert.False(policy.CommandReferencesDeniedPath("ls ~/.netclaw/config"));
-        Assert.False(policy.CommandReferencesDeniedPath("stat ~/.netclaw/config"));
+        Assert.True(policy.CommandReferencesDeniedPath("ls ~/.netclaw/config"));
+        Assert.True(policy.CommandReferencesDeniedPath("stat ~/.netclaw/config"));
     }
 
     [Fact]

From bd2ca0940c69a7fd632eecc8657d187e606cccec Mon Sep 17 00:00:00 2001
From: Aaron Stannard <aaron@petabridge.com>
Date: Thu, 6 Aug 2026 00:07:26 +0000
Subject: [PATCH 03/11] fix: close symlinked-dir and sqlite-sidecar read-deny
 gaps; clamp set_working_directory in Mode.All (#1724)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Second adversarial review found:
1. IsReadDenied bypass via symlinked INTERMEDIATE directory (ln -s config
   /tmp/x then read /tmp/x/netclaw.json). IsDeniedAgainst now resolves
   intermediate symlinks segment-by-segment via TryResolveSymlinksInPath,
   mirroring the shell scanner. attach_file re-checks the deny against the
   resolved path as defense-in-depth.
2. set_working_directory opt-out was inert for the default Mode.All
   Personal profile — the Mode.All branch fired before the opt-out flag was
   consulted. The branch now clamps set_working_directory to the autonomous
   zone in every mode.
3. Prefix-collision gap: sqlite sidecar files (wal/shm/journal) held raw
   page data (secrets) but path-boundary matching allowed reads while shell
   denied them. Program.cs shell indicator list now includes the sidecars;
   fixture mirrors production.
4. CredentialReadDenied message now covers control-plane state, not just
   credentials/keys; ToolPathPolicy remarks updated to match production
   (directory-scoped shell entries are intentional).
5. Spec: attach_file and set_working_directory requirements added.

Tests: symlinked-dir read-deny regression, Mode.All working-dir clamp,
Roots-mode attach branch (was untested), sidecar read-deny cases.
---
 COMMIT_MSG.md                                 | 23 ++++++++
 openspec/specs/netclaw-tools/spec.md          | 24 ++++++++
 .../Tools/AttachFileToolTests.cs              |  2 +-
 .../InteractivePersonalReadReachTests.cs      | 56 +++++++++++++++++-
 src/Netclaw.Actors/Tools/AttachFileTool.cs    |  9 ++-
 src/Netclaw.Actors/Tools/FileToolErrors.cs    |  6 +-
 .../Tools/ScopedFileAccessPolicy.cs           | 16 +++--
 .../Tools/SetWorkingDirectoryTool.cs          |  2 +-
 .../Tools/ToolRegistrationExtensions.cs       |  2 +-
 src/Netclaw.Daemon/Program.cs                 |  8 +++
 .../ToolPathPolicyTests.cs                    | 58 +++++++++++++++++--
 src/Netclaw.Security/ToolPathPolicy.cs        | 25 +++++---
 12 files changed, 205 insertions(+), 26 deletions(-)
 create mode 100644 COMMIT_MSG.md

diff --git a/COMMIT_MSG.md b/COMMIT_MSG.md
new file mode 100644
index 000000000..d1d707a97
--- /dev/null
+++ b/COMMIT_MSG.md
@@ -0,0 +1,23 @@
+fix: close symlinked-dir and sqlite-sidecar read-deny gaps; clamp set_working_directory in Mode.All (#1724)
+
+Second adversarial review found:
+1. IsReadDenied bypass via symlinked INTERMEDIATE directory (ln -s config
+   /tmp/x then read /tmp/x/netclaw.json). IsDeniedAgainst now resolves
+   intermediate symlinks segment-by-segment via TryResolveSymlinksInPath,
+   mirroring the shell scanner. attach_file re-checks the deny against the
+   resolved path as defense-in-depth.
+2. set_working_directory opt-out was inert for the default Mode.All
+   Personal profile — the Mode.All branch fired before the opt-out flag was
+   consulted. The branch now clamps set_working_directory to the autonomous
+   zone in every mode.
+3. Prefix-collision gap: sqlite sidecar files (wal/shm/journal) held raw
+   page data (secrets) but path-boundary matching allowed reads while shell
+   denied them. Program.cs shell indicator list now includes the sidecars;
+   fixture mirrors production.
+4. CredentialReadDenied message now covers control-plane state, not just
+   credentials/keys; ToolPathPolicy remarks updated to match production
+   (directory-scoped shell entries are intentional).
+5. Spec: attach_file and set_working_directory requirements added.
+
+Tests: symlinked-dir read-deny regression, Mode.All working-dir clamp,
+Roots-mode attach branch (was untested), sidecar read-deny cases.
diff --git a/openspec/specs/netclaw-tools/spec.md b/openspec/specs/netclaw-tools/spec.md
index 6c62fa4c4..5b5f04698 100644
--- a/openspec/specs/netclaw-tools/spec.md
+++ b/openspec/specs/netclaw-tools/spec.md
@@ -333,6 +333,30 @@ references needed to recreate the handoff nudge during recovery.
 PDF extraction, OCR, audio transcription, and video keyframe extraction SHALL NOT
 be built into `file_read`.
 
+### Requirement: Attachment tool reach
+
+The system SHALL provide an `attach_file` first-party tool that sends a file to
+the user. Non-interactive, Team, and Public sessions SHALL only attach files
+inside the current session directory or a sibling Netclaw session directory.
+Interactive Personal-audience sessions get shell-equivalent reach: any path that
+resolves through the read-access policy SHALL be attachable, and the file SHALL
+be copied into the current session's attachments directory before delivery.
+
+All audiences SHALL apply the `ToolPathPolicy` read-deny surface to attached
+files: a path that `IsReadDenied` (credentials, keys, secrets, control-plane
+state, or the shell indicator list) SHALL NOT be attachable, even when the
+proximity restriction is lifted.
+
+### Requirement: Working directory declaration stays scoped
+
+The system SHALL provide a `set_working_directory` first-party tool that sets
+the session's project root. Its target SHALL be resolved through the read-access
+policy WITHOUT interactive Personal shell-equivalent reach: the working
+directory widens the shell safe-verb auto-approve zone and loads project
+identity files into the system prompt, so it SHALL be clamped to the autonomous
+zone (session directory, project directory, and global read roots) in every
+audience and mode.
+
 #### Scenario: Text file read preserves existing behavior
 
 - **GIVEN** a readable text file using UTF-8, UTF-16/UTF-32 Unicode, or Windows-1252
diff --git a/src/Netclaw.Actors.Tests/Tools/AttachFileToolTests.cs b/src/Netclaw.Actors.Tests/Tools/AttachFileToolTests.cs
index 3d8a581d0..258bb0275 100644
--- a/src/Netclaw.Actors.Tests/Tools/AttachFileToolTests.cs
+++ b/src/Netclaw.Actors.Tests/Tools/AttachFileToolTests.cs
@@ -1,4 +1,4 @@
-// -----------------------------------------------------------------------
+// -----------------------------------------------------------------------
 // <copyright file="AttachFileToolTests.cs" company="Petabridge, LLC">
 //      Copyright (C) 2026 - 2026 Petabridge, LLC <https://petabridge.com>
 // </copyright>
diff --git a/src/Netclaw.Actors.Tests/Tools/InteractivePersonalReadReachTests.cs b/src/Netclaw.Actors.Tests/Tools/InteractivePersonalReadReachTests.cs
index 29f214873..f3816f351 100644
--- a/src/Netclaw.Actors.Tests/Tools/InteractivePersonalReadReachTests.cs
+++ b/src/Netclaw.Actors.Tests/Tools/InteractivePersonalReadReachTests.cs
@@ -184,7 +184,7 @@ public async Task Attach_tool_outside_session_matches_expected(
     [Fact]
     public async Task Attach_tool_denies_control_plane_files_even_with_interactive_reach()
     {
-        // BLOCKER regression (#1724): attach must use the same hard-deny surface
+        // Regression (#1724): attach must use the same hard-deny surface
         // as file_read/file_list, so interactive Personal reach cannot ship
         // secrets/keys/db/pid/lock that shell cannot even reference.
         var secretsPath = Path.Combine(_outsideDir, "secrets.json");
@@ -213,7 +213,7 @@ public async Task Attach_tool_denies_control_plane_files_even_with_interactive_r
     [Fact]
     public void Set_working_directory_stays_roots_scoped_for_interactive_personal()
     {
-        // BLOCKER regression (#1724): set_working_directory must NOT inherit
+        // Regression (#1724): set_working_directory must NOT inherit
         // shell-equivalent reach — its declaration widens the safe-verb
         // auto-approve zone and feeds project identity files into the prompt.
         var config = BuildPersonalReadRootsConfig(_sessionDir);
@@ -227,4 +227,56 @@ public void Set_working_directory_stays_roots_scoped_for_interactive_personal()
         // ...but the working-directory declaration stays roots-scoped.
         Assert.False(policy.TryResolveWorkingDirectory(outside, ctx, out _, out _));
     }
+
+    [Fact]
+    public void Set_working_directory_stays_roots_scoped_for_default_mode_all()
+    {
+        // Regression (#1724): the opt-out must also hold for the DEFAULT
+        // Personal profile (Mode.All) — the most common configuration. The
+        // Mode.All interactive blanket grant must not leak into the
+        // working-directory declaration.
+        var policy = new ScopedFileAccessPolicy(new ToolConfig(), _paths);
+        var ctx = Ctx(TrustAudience.Personal, autonomous: false);
+
+        var outside = Path.Combine(_outsideDir, "notes.txt");
+
+        // Reads resolve under Mode.All interactive...
+        Assert.True(policy.TryResolveReadPath(outside, ctx, out _, out _));
+        // ...but the working-directory declaration clamps to the autonomous zone.
+        Assert.False(policy.TryResolveWorkingDirectory(outside, ctx, out _, out _));
+    }
+
+    public static TheoryData<bool, bool> AttachRootsModeCases => new()
+    {
+        // interactive, expectedAllow
+        { true, true },
+        { false, false },
+    };
+
+    [Theory]
+    [MemberData(nameof(AttachRootsModeCases))]
+    public void Attach_reach_roots_mode_matches_expected(bool interactive, bool expectedAllow)
+    {
+        // Regression (#1724): the new Roots-mode attach branch must actually be
+        // exercised — the main matrix hardens only ReadFiles, so its attach rows
+        // hit the Mode.All branch. This pins the AccessKind.Attach clause.
+        var config = new ToolConfig();
+        config.AudienceProfiles.Personal.ReadFiles = new ToolFilesystemAccessProfile
+        {
+            Mode = ToolFilesystemMode.Roots,
+            Roots = [_sessionDir]
+        };
+        config.AudienceProfiles.Personal.AttachFiles = new ToolFilesystemAccessProfile
+        {
+            Mode = ToolFilesystemMode.Roots,
+            Roots = [_sessionDir]
+        };
+        var policy = new ScopedFileAccessPolicy(config, _paths);
+        var ctx = Ctx(TrustAudience.Personal, autonomous: !interactive);
+
+        var path = Path.Combine(_outsideDir, "report.png");
+        var allowed = policy.TryResolveAttachPath(path, ctx, out _, out _);
+
+        Assert.Equal(expectedAllow, allowed);
+    }
 }
diff --git a/src/Netclaw.Actors/Tools/AttachFileTool.cs b/src/Netclaw.Actors/Tools/AttachFileTool.cs
index 4d3e82729..053a86a81 100644
--- a/src/Netclaw.Actors/Tools/AttachFileTool.cs
+++ b/src/Netclaw.Actors/Tools/AttachFileTool.cs
@@ -1,4 +1,4 @@
-// -----------------------------------------------------------------------
+// -----------------------------------------------------------------------
 // <copyright file="AttachFileTool.cs" company="Petabridge, LLC">
 //      Copyright (C) 2026 - 2026 Petabridge, LLC <https://petabridge.com>
 // </copyright>
@@ -76,6 +76,13 @@ protected override Task<string> ExecuteAsync(Params args, ToolInvocationContext
             return Task.FromResult($"Error: File not found: {requestedPath}");
 
         var resolvedPath = ResolveFinalPath(requestedPath);
+
+        // Defense-in-depth: re-check the deny against the symlink-resolved
+        // target so any future divergence between requestedPath and resolvedPath
+        // cannot widen attach's surface.
+        if (_pathPolicy.IsReadDenied(resolvedPath))
+            return Task.FromResult(FileToolErrors.CredentialReadDenied(resolvedPath));
+
         var resolvedInCurrentSession = PathUtility.IsWithinRoot(resolvedPath, sessionDir);
         var resolvedInSessionRoot = sessionRoot is not null && PathUtility.IsWithinRoot(resolvedPath, sessionRoot);
 
diff --git a/src/Netclaw.Actors/Tools/FileToolErrors.cs b/src/Netclaw.Actors/Tools/FileToolErrors.cs
index 6585952e1..5420bd261 100644
--- a/src/Netclaw.Actors/Tools/FileToolErrors.cs
+++ b/src/Netclaw.Actors/Tools/FileToolErrors.cs
@@ -1,4 +1,4 @@
-// -----------------------------------------------------------------------
+// -----------------------------------------------------------------------
 // <copyright file="FileToolErrors.cs" company="Petabridge, LLC">
 //      Copyright (C) 2026 - 2026 Petabridge, LLC <https://petabridge.com>
 // </copyright>
@@ -14,6 +14,6 @@ public static string ControlPlaneWriteDenied(string path)
            + "(e.g. `netclaw doctor --fix`, `netclaw secrets set`) or edit the file directly.";
 
     public static string CredentialReadDenied(string path)
-        => $"Error: Access denied: '{path}' contains credentials or keys "
-           + "and cannot be read by agent tools.";
+        => $"Error: Access denied: '{path}' is a protected Netclaw file "
+           + "(credentials, keys, secrets, or control-plane state) and cannot be read by agent tools.";
 }
diff --git a/src/Netclaw.Actors/Tools/ScopedFileAccessPolicy.cs b/src/Netclaw.Actors/Tools/ScopedFileAccessPolicy.cs
index 40306165b..b4f8a1f44 100644
--- a/src/Netclaw.Actors/Tools/ScopedFileAccessPolicy.cs
+++ b/src/Netclaw.Actors/Tools/ScopedFileAccessPolicy.cs
@@ -1,4 +1,4 @@
-// -----------------------------------------------------------------------
+// -----------------------------------------------------------------------
 // <copyright file="ScopedFileAccessPolicy.cs" company="Petabridge, LLC">
 //      Copyright (C) 2026 - 2026 Petabridge, LLC <https://petabridge.com>
 // </copyright>
@@ -40,7 +40,9 @@ public bool TryResolveReadPath(string rawPath, ToolInvocationContext context, ou
     /// Resolves a path for <c>set_working_directory</c>. Deliberately does NOT
     /// grant interactive Personal shell-equivalent reach: the working directory
     /// becomes the safe-verb auto-approve zone and feeds project identity files
-    /// into the system prompt, so it stays roots-scoped even when reads are not.
+    /// into the system prompt, so it is clamped to the autonomous zone (session
+    /// dir + project dir + global read roots) in every mode, even the default
+    /// <c>Mode.All</c> Personal profile.
     /// </summary>
     public bool TryResolveWorkingDirectory(string rawPath, ToolInvocationContext context, out string fullPath, out string error)
         => TryResolvePath(rawPath, context, AccessKind.Read, out fullPath, out error, allowInteractivePersonalReach: false);
@@ -100,9 +102,15 @@ private bool TryResolvePath(
             // granted blanket filesystem access. Interactive channels keep the
             // blanket grant — the live approval gate is their backstop. This is the
             // single seam that covers shell (via TryResolveWritePath) and every file
-            // tool at once.
-            if (context.RunScope.InteractiveApproval is InteractiveApprovalCapability.Unavailable)
+            // tool at once. set_working_directory opts out (allowInteractivePersonalReach
+            // == false) and is clamped to the autonomous zone even for default
+            // Mode.All profiles: its declaration widens the safe-verb auto-approve
+            // zone and feeds project identity files into the system prompt.
+            if (!allowInteractivePersonalReach
+                || context.RunScope.InteractiveApproval is InteractiveApprovalCapability.Unavailable)
+            {
                 return TryResolveWithinAutonomousZone(fullPath, context, accessKind, out error);
+            }
 
             error = string.Empty;
             return true;
diff --git a/src/Netclaw.Actors/Tools/SetWorkingDirectoryTool.cs b/src/Netclaw.Actors/Tools/SetWorkingDirectoryTool.cs
index 651a35b7d..10574ddb2 100644
--- a/src/Netclaw.Actors/Tools/SetWorkingDirectoryTool.cs
+++ b/src/Netclaw.Actors/Tools/SetWorkingDirectoryTool.cs
@@ -1,4 +1,4 @@
-// -----------------------------------------------------------------------
+// -----------------------------------------------------------------------
 // <copyright file="SetWorkingDirectoryTool.cs" company="Petabridge, LLC">
 //      Copyright (C) 2026 - 2026 Petabridge, LLC <https://petabridge.com>
 // </copyright>
diff --git a/src/Netclaw.Actors/Tools/ToolRegistrationExtensions.cs b/src/Netclaw.Actors/Tools/ToolRegistrationExtensions.cs
index 3796059ac..4e67dd059 100644
--- a/src/Netclaw.Actors/Tools/ToolRegistrationExtensions.cs
+++ b/src/Netclaw.Actors/Tools/ToolRegistrationExtensions.cs
@@ -1,4 +1,4 @@
-// -----------------------------------------------------------------------
+// -----------------------------------------------------------------------
 // <copyright file="ToolRegistrationExtensions.cs" company="Petabridge, LLC">
 //      Copyright (C) 2026 - 2026 Petabridge, LLC <https://petabridge.com>
 // </copyright>
diff --git a/src/Netclaw.Daemon/Program.cs b/src/Netclaw.Daemon/Program.cs
index 38eb8eb1b..8614491f4 100644
--- a/src/Netclaw.Daemon/Program.cs
+++ b/src/Netclaw.Daemon/Program.cs
@@ -603,6 +603,14 @@ static void ConfigureDaemonServices(
         paths.WebhooksDirectory,
         paths.KeysDirectory,
         paths.SqliteDbPath,
+        // SQLite sidecars hold raw page data (webhook secrets, OAuth tokens)
+        // and are reachable via the read-deny union, so they must be denied
+        // exactly like the DB itself. Shell's substring scan already catches
+        // them (command text contains "netclaw.db"); the path-boundary matcher
+        // in ToolPathPolicy does not, hence the explicit entries (#1724).
+        paths.SqliteDbPath + "-wal",
+        paths.SqliteDbPath + "-shm",
+        paths.SqliteDbPath + "-journal",
         paths.PidFilePath,
         paths.LockFilePath,
         paths.RestartManifestPath,
diff --git a/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs b/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs
index ac1271abb..d65da6231 100644
--- a/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs
+++ b/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs
@@ -1,4 +1,4 @@
-// -----------------------------------------------------------------------
+// -----------------------------------------------------------------------
 // <copyright file="ToolPathPolicyTests.cs" company="Petabridge, LLC">
 //      Copyright (C) 2026 - 2026 Petabridge, LLC <https://petabridge.com>
 // </copyright>
@@ -177,6 +177,11 @@ private static ToolPathPolicy CreateProductionPolicy()
             "/home/user/.netclaw/config/webhooks",
             "/home/user/.netclaw/keys",
             "/home/user/.netclaw/netclaw.db",
+            // SQLite sidecars mirror production (Program.cs) — the path-boundary
+            // matcher would otherwise allow netclaw.db-wal/journal/shm reads.
+            "/home/user/.netclaw/netclaw.db-wal",
+            "/home/user/.netclaw/netclaw.db-shm",
+            "/home/user/.netclaw/netclaw.db-journal",
             "/home/user/.netclaw/netclaw.pid",
             "/home/user/.netclaw/netclaw.lock",
             "/home/user/.netclaw/cache/restart-manifest.json",
@@ -229,6 +234,9 @@ public void IsReadDenied_blocks_sensitive_paths(string path)
     [Theory]
     [InlineData("/home/user/.netclaw/config/netclaw.json")]
     [InlineData("/home/user/.netclaw/netclaw.db")]
+    [InlineData("/home/user/.netclaw/netclaw.db-wal")]
+    [InlineData("/home/user/.netclaw/netclaw.db-shm")]
+    [InlineData("/home/user/.netclaw/netclaw.db-journal")]
     [InlineData("/home/user/.netclaw/netclaw.pid")]
     [InlineData("/home/user/.netclaw/netclaw.lock")]
     [InlineData("/home/user/.netclaw/cache/restart-manifest.json")]
@@ -238,11 +246,49 @@ public void IsReadDenied_blocks_control_plane_files(string path)
         Assert.True(policy.IsReadDenied(path));
     }
 
-    // The fixture deliberately omits ConfigDirectory from shellIndicators (see
-    // CommandReferencesDeniedPath_still_allows_ls_of_config_directory), so
-    // config-dir files are not asserted read-denied here. Production wiring in
-    // src/Netclaw.Daemon/Program.cs includes paths.ConfigDirectory in the shell
-    // indicator list, which makes the whole config dir read-denied in practice.
+    [Fact]
+    public void IsReadDenied_blocks_symlinked_directory_traversal()
+    {
+        // Regression (#1724): a symlinked INTERMEDIATE directory into a denied
+        // location must not bypass IsReadDenied. Shell catches this via
+        // TryResolveSymlinksInPath; the read side must too, since interactive
+        // Personal reads have IsReadDenied as their sole backstop.
+        var scratch = Path.Combine(Path.GetTempPath(), $"netclaw-symlink-{Guid.NewGuid():N}");
+        var deniedDir = Path.Combine(scratch, "denied");
+        var linkDir = Path.Combine(scratch, "link");
+        Directory.CreateDirectory(deniedDir);
+        File.WriteAllText(Path.Combine(deniedDir, "netclaw.json"), """{"secret":true}""");
+
+        try
+        {
+            Directory.CreateSymbolicLink(linkDir, deniedDir);
+
+            // Deny the REAL deniedDir (fixture paths don't exist on disk, and
+            // symlink resolution needs an on-disk target to resolve).
+            var policy = new ToolPathPolicy([deniedDir]);
+
+            // Lexically this path lives in scratch/link, outside any denied
+            // root — only segment-walk symlink resolution catches it.
+            var viaLink = Path.Combine(linkDir, "netclaw.json");
+            Assert.True(policy.IsReadDenied(viaLink));
+        }
+        catch (UnauthorizedAccessException)
+        {
+            return; // Windows without developer mode
+        }
+        finally
+        {
+            if (Directory.Exists(linkDir) && new DirectoryInfo(linkDir).LinkTarget is not null)
+                Directory.Delete(linkDir);
+            if (Directory.Exists(scratch))
+                Directory.Delete(scratch, recursive: true);
+        }
+    }
+
+    // The fixture mirrors production (Program.cs): ConfigDirectory is a
+    // directory-scoped shell indicator, so the whole config dir is read-denied
+    // via the IsReadDenied union. Sidecar files (db-wal/db-shm/db-journal) are
+    // also in the fixture, matching the production shell indicator list.
     [Theory]
     [InlineData("/home/user/repositories/foo.cs")]
     [InlineData("/tmp/notes.txt")]
diff --git a/src/Netclaw.Security/ToolPathPolicy.cs b/src/Netclaw.Security/ToolPathPolicy.cs
index ffc02a7af..6e8c754b2 100644
--- a/src/Netclaw.Security/ToolPathPolicy.cs
+++ b/src/Netclaw.Security/ToolPathPolicy.cs
@@ -1,4 +1,4 @@
-// -----------------------------------------------------------------------
+// -----------------------------------------------------------------------
 // <copyright file="ToolPathPolicy.cs" company="Petabridge, LLC">
 //      Copyright (C) 2026 - 2026 Petabridge, LLC <https://petabridge.com>
 // </copyright>
@@ -15,10 +15,10 @@ namespace Netclaw.Security;
 /// (<see cref="IsReadDenied"/>), and shell indicators
 /// (<see cref="CommandReferencesDeniedPath"/>). Read denies the union of the
 /// read deny list and the shell indicator list, so file tools cannot reach the
-/// control plane that shell cannot reference. The shell indicator list must
-/// stay narrow — file-level only — because that path does a raw substring scan
-/// against the command text, so directory-scoped entries would block legitimate
-/// commands whose arguments happen to contain the directory name.
+/// control plane that shell cannot reference. The shell indicator list is
+/// scanned as raw substrings of the command text, so directory-scoped entries
+/// (e.g. the config dir) over-block commands whose text merely mentions them —
+/// that is the accepted trade-off for keeping the control plane unreachable.
 /// </remarks>
 public sealed class ToolPathPolicy
 {
@@ -115,8 +115,19 @@ private static bool IsDeniedAgainst(string path, HashSet<string> deniedSet)
         if (PathUtility.TryNormalize(path, null, out var normalized) && IsDeniedNormalized(normalized, deniedSet))
             return true;
 
-        return TryResolveSymlinkTarget(path, out var resolvedTarget)
-            && IsDeniedNormalized(resolvedTarget, deniedSet);
+        // TryResolveSymlinkTarget only resolves the final path element. A path
+        // whose INTERMEDIATE directory is a symlink into a denied location
+        // (e.g. /tmp/x -> ~/.netclaw/config, then /tmp/x/netclaw.json) would
+        // slip past that check. Mirror the shell side (CommandReferencesDeniedPath)
+        // by also walking the path segment by segment — same infrastructure.
+        if (TryResolveSymlinkTarget(path, out var resolvedTarget)
+            && IsDeniedNormalized(resolvedTarget, deniedSet))
+        {
+            return true;
+        }
+
+        return TryResolveSymlinksInPath(path, out var canonical)
+            && IsDeniedNormalized(canonical, deniedSet);
     }
 
     /// <summary>

From 657807f23ea2bad03d8d70acbc31e98b8d27e0ef Mon Sep 17 00:00:00 2001
From: Aaron Stannard <aaron@petabridge.com>
Date: Thu, 6 Aug 2026 00:07:45 +0000
Subject: [PATCH 04/11] chore: remove stray commit-message scratch file

---
 COMMIT_MSG.md | 23 -----------------------
 1 file changed, 23 deletions(-)
 delete mode 100644 COMMIT_MSG.md

diff --git a/COMMIT_MSG.md b/COMMIT_MSG.md
deleted file mode 100644
index d1d707a97..000000000
--- a/COMMIT_MSG.md
+++ /dev/null
@@ -1,23 +0,0 @@
-fix: close symlinked-dir and sqlite-sidecar read-deny gaps; clamp set_working_directory in Mode.All (#1724)
-
-Second adversarial review found:
-1. IsReadDenied bypass via symlinked INTERMEDIATE directory (ln -s config
-   /tmp/x then read /tmp/x/netclaw.json). IsDeniedAgainst now resolves
-   intermediate symlinks segment-by-segment via TryResolveSymlinksInPath,
-   mirroring the shell scanner. attach_file re-checks the deny against the
-   resolved path as defense-in-depth.
-2. set_working_directory opt-out was inert for the default Mode.All
-   Personal profile — the Mode.All branch fired before the opt-out flag was
-   consulted. The branch now clamps set_working_directory to the autonomous
-   zone in every mode.
-3. Prefix-collision gap: sqlite sidecar files (wal/shm/journal) held raw
-   page data (secrets) but path-boundary matching allowed reads while shell
-   denied them. Program.cs shell indicator list now includes the sidecars;
-   fixture mirrors production.
-4. CredentialReadDenied message now covers control-plane state, not just
-   credentials/keys; ToolPathPolicy remarks updated to match production
-   (directory-scoped shell entries are intentional).
-5. Spec: attach_file and set_working_directory requirements added.
-
-Tests: symlinked-dir read-deny regression, Mode.All working-dir clamp,
-Roots-mode attach branch (was untested), sidecar read-deny cases.

From 2c37270caf64a5734d0c84223e1814d378841c02 Mon Sep 17 00:00:00 2001
From: Aaron Stannard <aaron@petabridge.com>
Date: Thu, 6 Aug 2026 00:28:31 +0000
Subject: [PATCH 05/11] fix: update session-cwd spec for working-dir clamp;
 deny sqlite sidecars on write (#1724)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Verification review (approve-with-nits) flagged a stale scenario in
openspec/specs/session-cwd/spec.md that promised set_working_directory
allows any valid directory under Personal Mode.All — the opposite of the
new autonomous-zone clamp. Updated the requirement + scenario to codify
the clamp and cross-reference the interactive read reach.

Also add sqlite sidecars to writeDenyList for defense-in-depth parity
with the shell indicator list (read already denied via the union).
---
 openspec/specs/session-cwd/spec.md | 20 ++++++++++++++++----
 src/Netclaw.Daemon/Program.cs      |  5 +++++
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/openspec/specs/session-cwd/spec.md b/openspec/specs/session-cwd/spec.md
index 228b2cc7d..2ddccd4ac 100644
--- a/openspec/specs/session-cwd/spec.md
+++ b/openspec/specs/session-cwd/spec.md
@@ -54,7 +54,13 @@ The tool SHALL validate that the target path is a real directory,
 resolve it to an absolute path, and validate it against the audience
 trust profile's read-allowed roots. The tool SHALL be profile-managed
 so that audiences without directory navigation privileges (Public,
-Team by default) cannot use it.
+Team by default) cannot use it. The working-directory declaration is
+deliberately NOT granted interactive Personal shell-equivalent reach
+(netclaw-dev/netclaw#1724): it SHALL be clamped to the autonomous zone
+(session directory, project directory, and configured global read
+roots) in every audience and mode, because declaring a working
+directory widens the shell safe-verb auto-approve zone and loads
+project identity files into the system prompt.
 
 The tool description visible to the model SHALL frame the tool as
 "declare your project root and expand your trusted scope so shell
@@ -92,11 +98,17 @@ approval friction depends on doing so when the work is project-scoped.
 - **THEN** the project directory remains unchanged
 - **AND** the tool returns an error indicating the directory does not exist
 
-#### Scenario: Personal audience allows any valid directory
+#### Scenario: Personal audience clamps to the autonomous zone
 
 - **GIVEN** a session with personal audience (`ToolFilesystemMode.All`)
-- **WHEN** the agent invokes `set_working_directory` with any valid directory
-- **THEN** the project directory is updated
+- **AND** the target directory is outside the autonomous zone
+  (session directory, project directory, and configured global read roots)
+- **WHEN** the agent invokes `set_working_directory` with that valid directory
+- **THEN** the project directory is NOT updated
+- **AND** the tool returns an error indicating the target is outside the
+  session, project, or configured autonomous roots
+- **AND** `file_read` / `file_list` / `attach_file` on the same path still
+  resolve (interactive Personal shell-equivalent reach, netclaw-dev/netclaw#1724)
 
 #### Scenario: set_working_directory not exposed to public audience
 
diff --git a/src/Netclaw.Daemon/Program.cs b/src/Netclaw.Daemon/Program.cs
index 8614491f4..bc2eadca9 100644
--- a/src/Netclaw.Daemon/Program.cs
+++ b/src/Netclaw.Daemon/Program.cs
@@ -581,6 +581,11 @@ static void ConfigureDaemonServices(
         paths.SecretsPath,
         paths.KeysDirectory,
         paths.SqliteDbPath,
+        // SQLite sidecars mirror the shell indicator list — they hold the same
+        // raw page data as the DB and must not be writable through tools either.
+        paths.SqliteDbPath + "-wal",
+        paths.SqliteDbPath + "-shm",
+        paths.SqliteDbPath + "-journal",
         paths.PidFilePath,
         paths.LockFilePath,
         paths.RestartManifestPath,

From 7f3b0a991f37277b60ff142f9ed92fbd4f262bae Mon Sep 17 00:00:00 2001
From: Aaron Stannard <aaron@petabridge.com>
Date: Thu, 6 Aug 2026 00:43:54 +0000
Subject: [PATCH 06/11] fix: preserve Windows drive root in symlink path walk
 (windows CI #1770)

TryResolveSymlinksInPath built partial paths with a bare directory
separator, so on Windows every probe looked like '\Users\...' instead of
'C:\Users\...' and symlink resolution silently no-oped. This surfaced in
IsReadDenied_blocks_symlinked_directory_traversal on the Windows CI job:
the symlink was created but IsReadDenied returned false.

Path.GetPathRoot preserves the full root on every platform ('C:\' on
Windows, '/' on Unix), so the segment walk resolves symlinks correctly
everywhere. The shell scanner (CommandReferencesDeniedPath) shares this
function and was affected on Windows too.
---
 src/Netclaw.Security/ToolPathPolicy.cs | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/Netclaw.Security/ToolPathPolicy.cs b/src/Netclaw.Security/ToolPathPolicy.cs
index 6e8c754b2..2d12acc62 100644
--- a/src/Netclaw.Security/ToolPathPolicy.cs
+++ b/src/Netclaw.Security/ToolPathPolicy.cs
@@ -1,4 +1,4 @@
-// -----------------------------------------------------------------------
+// -----------------------------------------------------------------------
 // <copyright file="ToolPathPolicy.cs" company="Petabridge, LLC">
 //      Copyright (C) 2026 - 2026 Petabridge, LLC <https://petabridge.com>
 // </copyright>
@@ -250,8 +250,12 @@ private static bool TryResolveSymlinksInPath(string path, out string canonical)
                 [Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar],
                 StringSplitOptions.RemoveEmptyEntries);
             var sb = new StringBuilder();
+            // Preserve the full root (drive letter + separator on Windows, "/"
+            // on Unix) — appending a bare separator yields "\Users\..." on
+            // Windows, so every Directory.Exists/File.Exists probe below would
+            // miss and symlink resolution would silently no-op.
             if (Path.IsPathRooted(fullPath))
-                sb.Append(Path.DirectorySeparatorChar);
+                sb.Append(Path.GetPathRoot(fullPath));
 
             foreach (var segment in segments)
             {

From 04af199a0acbdf44507f661e8c38bc575cd95852 Mon Sep 17 00:00:00 2001
From: Aaron Stannard <aaron@petabridge.com>
Date: Thu, 6 Aug 2026 02:46:12 +0000
Subject: [PATCH 07/11] test(security): dump compared paths when symlink deny
 fails

The test IsReadDenied_blocks_symlinked_directory_traversal fails on
Windows CI. We do not know the exact cause yet.

This diagnostic shows the paths that IsReadDenied compares. It shows
the raw link path, the resolved link target, the candidate path, and
the denied directory. It shows the result of the StartsWith check.

The message appears only when the assert fails. On Linux the assert
passes, so the message stays hidden. This proves the diagnostic code
compiles and does not throw.
---
 .../ToolPathPolicyTests.cs                    | 22 ++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs b/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs
index d65da6231..98589c4ed 100644
--- a/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs
+++ b/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs
@@ -270,7 +270,27 @@ public void IsReadDenied_blocks_symlinked_directory_traversal()
             // Lexically this path lives in scratch/link, outside any denied
             // root — only segment-walk symlink resolution catches it.
             var viaLink = Path.Combine(linkDir, "netclaw.json");
-            Assert.True(policy.IsReadDenied(viaLink));
+
+            // Diagnostic (#1724): when this assert fails on Windows, the message
+            // must show WHICH form diverges — the \\?\ extended prefix or an 8.3
+            // short/long-name mismatch — so the deny fix targets the real cause.
+            // linkResolved mirrors exactly what ToolPathPolicy.TryResolveSymlinksInPath
+            // appends: DirectoryInfo(link).ResolveLinkTarget(returnFinalTarget: true).FullName.
+            var linkResolved = new DirectoryInfo(linkDir)
+                .ResolveLinkTarget(returnFinalTarget: true)?.FullName ?? "<null>";
+            var candidateCanonical = Path.Combine(linkResolved, "netclaw.json");
+            var deniedFull = Path.GetFullPath(deniedDir);
+            var diagnostic =
+                "IsReadDenied returned false for a symlinked-directory traversal.\n" +
+                $"  input viaLink                   = {viaLink}\n" +
+                $"  Path.GetFullPath(viaLink)       = {Path.GetFullPath(viaLink)}\n" +
+                $"  link ResolveLinkTarget.FullName = {linkResolved}\n" +
+                $"  candidateCanonical              = {candidateCanonical}\n" +
+                $"  input deniedDir                 = {deniedDir}\n" +
+                $"  Path.GetFullPath(deniedDir)     = {deniedFull}\n" +
+                "  candidate.StartsWith(denied, OrdinalIgnoreCase) = " +
+                candidateCanonical.StartsWith(deniedFull, StringComparison.OrdinalIgnoreCase);
+            Assert.True(policy.IsReadDenied(viaLink), diagnostic);
         }
         catch (UnauthorizedAccessException)
         {

From 2cc074b88117ab5ad853d7601891dede10896102 Mon Sep 17 00:00:00 2001
From: Aaron Stannard <aaron@petabridge.com>
Date: Thu, 6 Aug 2026 03:25:22 +0000
Subject: [PATCH 08/11] test(security): trace symlink walk step by step for
 Windows diagnosis

The old diagnostic showed the two paths only. It did not show which
segment of TryResolveSymlinksInPath diverges on Windows.

The new diagnostic replays the segment walk. It logs, for each
segment, the directory and file existence check, the
ResolveLinkTarget outcome, and the rebuilt path. The message prints
only when the assert fails.
---
 .../ToolPathPolicyTests.cs                    | 77 ++++++++++++++-----
 1 file changed, 57 insertions(+), 20 deletions(-)

diff --git a/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs b/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs
index 98589c4ed..1f947664b 100644
--- a/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs
+++ b/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs
@@ -271,26 +271,63 @@ public void IsReadDenied_blocks_symlinked_directory_traversal()
             // root — only segment-walk symlink resolution catches it.
             var viaLink = Path.Combine(linkDir, "netclaw.json");
 
-            // Diagnostic (#1724): when this assert fails on Windows, the message
-            // must show WHICH form diverges — the \\?\ extended prefix or an 8.3
-            // short/long-name mismatch — so the deny fix targets the real cause.
-            // linkResolved mirrors exactly what ToolPathPolicy.TryResolveSymlinksInPath
-            // appends: DirectoryInfo(link).ResolveLinkTarget(returnFinalTarget: true).FullName.
-            var linkResolved = new DirectoryInfo(linkDir)
-                .ResolveLinkTarget(returnFinalTarget: true)?.FullName ?? "<null>";
-            var candidateCanonical = Path.Combine(linkResolved, "netclaw.json");
-            var deniedFull = Path.GetFullPath(deniedDir);
-            var diagnostic =
-                "IsReadDenied returned false for a symlinked-directory traversal.\n" +
-                $"  input viaLink                   = {viaLink}\n" +
-                $"  Path.GetFullPath(viaLink)       = {Path.GetFullPath(viaLink)}\n" +
-                $"  link ResolveLinkTarget.FullName = {linkResolved}\n" +
-                $"  candidateCanonical              = {candidateCanonical}\n" +
-                $"  input deniedDir                 = {deniedDir}\n" +
-                $"  Path.GetFullPath(deniedDir)     = {deniedFull}\n" +
-                "  candidate.StartsWith(denied, OrdinalIgnoreCase) = " +
-                candidateCanonical.StartsWith(deniedFull, StringComparison.OrdinalIgnoreCase);
-            Assert.True(policy.IsReadDenied(viaLink), diagnostic);
+            // Diagnostic (#1724): replicate ToolPathPolicy.TryResolveSymlinksInPath
+            // step by step so a Windows failure pins the exact diverging call. Each
+            // segment logs Directory/File existence, the ResolveLinkTarget outcome
+            // (target, null, or a thrown exception), and how the rebuilt path
+            // evolves. The message prints only when the assert fails.
+            var separators = new[] { Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar };
+            var trace = new System.Text.StringBuilder();
+            trace.Append("IsReadDenied returned false. Replicated TryResolveSymlinksInPath walk:\n");
+            trace.Append($"  [step2] File.Exists(viaLink)={File.Exists(viaLink)} Dir.Exists(viaLink)={Directory.Exists(viaLink)}\n");
+            try
+            {
+                var fullPath = Path.GetFullPath(viaLink);
+                trace.Append($"  fullPath = {fullPath}\n");
+                var segments = fullPath.Split(separators, StringSplitOptions.RemoveEmptyEntries);
+                var sb = new System.Text.StringBuilder();
+                if (Path.IsPathRooted(fullPath))
+                    sb.Append(Path.GetPathRoot(fullPath));
+                trace.Append($"  root = '{sb}'\n");
+                foreach (var segment in segments)
+                {
+                    if (sb.Length > 0 && sb[^1] != Path.DirectorySeparatorChar)
+                        sb.Append(Path.DirectorySeparatorChar);
+                    sb.Append(segment);
+                    var partial = sb.ToString();
+                    var dirExists = Directory.Exists(partial);
+                    var fileExists = !dirExists && File.Exists(partial);
+                    var linkStep = "no-resolve";
+                    try
+                    {
+                        if (dirExists)
+                        {
+                            var target = new DirectoryInfo(partial).ResolveLinkTarget(returnFinalTarget: true);
+                            if (target is not null) { linkStep = $"DIR-link -> {target.FullName}"; sb.Clear(); sb.Append(target.FullName); }
+                        }
+                        else if (fileExists)
+                        {
+                            var target = new FileInfo(partial).ResolveLinkTarget(returnFinalTarget: true);
+                            if (target is not null) { linkStep = $"FILE-link -> {target.FullName}"; sb.Clear(); sb.Append(target.FullName); }
+                        }
+                    }
+                    catch (Exception ex)
+                    {
+                        linkStep = $"THREW {ex.GetType().Name}: {ex.Message}";
+                    }
+                    trace.Append($"  seg '{segment}': dirExists={dirExists} fileExists={fileExists} -> {linkStep}  sb='{sb}'\n");
+                    if (fileExists) break;
+                }
+                trace.Append($"  walked            = {sb}\n");
+                trace.Append($"  Normalize(walked) = {Path.GetFullPath(sb.ToString()).TrimEnd(separators)}\n");
+                trace.Append($"  Normalize(input)  = {fullPath.TrimEnd(separators)}\n");
+            }
+            catch (Exception ex)
+            {
+                trace.Append($"  WALK-LEVEL EXCEPTION {ex.GetType().Name}: {ex.Message}\n");
+            }
+
+            Assert.True(policy.IsReadDenied(viaLink), trace.ToString());
         }
         catch (UnauthorizedAccessException)
         {

From 665dd6216f98a7346cdff0586633f18e07869fe9 Mon Sep 17 00:00:00 2001
From: Aaron Stannard <aaron@petabridge.com>
Date: Thu, 6 Aug 2026 03:42:08 +0000
Subject: [PATCH 09/11] fix(security): stop doubling the drive root in the
 symlink deny walk

TryResolveSymlinksInPath seeded the builder with the path root and then
split the full path. On Windows the first split token is the drive, so
the walk built "C:\C:\Users\..." and every existence probe missed. The
symlink walk then no-oped and IsReadDenied failed open. Now the split
covers only the remainder after the root. This also removes the
temporary CI diagnostic block from the regression test for #1724.
---
 .../ToolPathPolicyTests.cs                    | 59 +------------------
 src/Netclaw.Security/ToolPathPolicy.cs        | 17 +++---
 2 files changed, 11 insertions(+), 65 deletions(-)

diff --git a/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs b/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs
index 1f947664b..d65da6231 100644
--- a/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs
+++ b/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs
@@ -270,64 +270,7 @@ public void IsReadDenied_blocks_symlinked_directory_traversal()
             // Lexically this path lives in scratch/link, outside any denied
             // root — only segment-walk symlink resolution catches it.
             var viaLink = Path.Combine(linkDir, "netclaw.json");
-
-            // Diagnostic (#1724): replicate ToolPathPolicy.TryResolveSymlinksInPath
-            // step by step so a Windows failure pins the exact diverging call. Each
-            // segment logs Directory/File existence, the ResolveLinkTarget outcome
-            // (target, null, or a thrown exception), and how the rebuilt path
-            // evolves. The message prints only when the assert fails.
-            var separators = new[] { Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar };
-            var trace = new System.Text.StringBuilder();
-            trace.Append("IsReadDenied returned false. Replicated TryResolveSymlinksInPath walk:\n");
-            trace.Append($"  [step2] File.Exists(viaLink)={File.Exists(viaLink)} Dir.Exists(viaLink)={Directory.Exists(viaLink)}\n");
-            try
-            {
-                var fullPath = Path.GetFullPath(viaLink);
-                trace.Append($"  fullPath = {fullPath}\n");
-                var segments = fullPath.Split(separators, StringSplitOptions.RemoveEmptyEntries);
-                var sb = new System.Text.StringBuilder();
-                if (Path.IsPathRooted(fullPath))
-                    sb.Append(Path.GetPathRoot(fullPath));
-                trace.Append($"  root = '{sb}'\n");
-                foreach (var segment in segments)
-                {
-                    if (sb.Length > 0 && sb[^1] != Path.DirectorySeparatorChar)
-                        sb.Append(Path.DirectorySeparatorChar);
-                    sb.Append(segment);
-                    var partial = sb.ToString();
-                    var dirExists = Directory.Exists(partial);
-                    var fileExists = !dirExists && File.Exists(partial);
-                    var linkStep = "no-resolve";
-                    try
-                    {
-                        if (dirExists)
-                        {
-                            var target = new DirectoryInfo(partial).ResolveLinkTarget(returnFinalTarget: true);
-                            if (target is not null) { linkStep = $"DIR-link -> {target.FullName}"; sb.Clear(); sb.Append(target.FullName); }
-                        }
-                        else if (fileExists)
-                        {
-                            var target = new FileInfo(partial).ResolveLinkTarget(returnFinalTarget: true);
-                            if (target is not null) { linkStep = $"FILE-link -> {target.FullName}"; sb.Clear(); sb.Append(target.FullName); }
-                        }
-                    }
-                    catch (Exception ex)
-                    {
-                        linkStep = $"THREW {ex.GetType().Name}: {ex.Message}";
-                    }
-                    trace.Append($"  seg '{segment}': dirExists={dirExists} fileExists={fileExists} -> {linkStep}  sb='{sb}'\n");
-                    if (fileExists) break;
-                }
-                trace.Append($"  walked            = {sb}\n");
-                trace.Append($"  Normalize(walked) = {Path.GetFullPath(sb.ToString()).TrimEnd(separators)}\n");
-                trace.Append($"  Normalize(input)  = {fullPath.TrimEnd(separators)}\n");
-            }
-            catch (Exception ex)
-            {
-                trace.Append($"  WALK-LEVEL EXCEPTION {ex.GetType().Name}: {ex.Message}\n");
-            }
-
-            Assert.True(policy.IsReadDenied(viaLink), trace.ToString());
+            Assert.True(policy.IsReadDenied(viaLink));
         }
         catch (UnauthorizedAccessException)
         {
diff --git a/src/Netclaw.Security/ToolPathPolicy.cs b/src/Netclaw.Security/ToolPathPolicy.cs
index 2d12acc62..9f06daa59 100644
--- a/src/Netclaw.Security/ToolPathPolicy.cs
+++ b/src/Netclaw.Security/ToolPathPolicy.cs
@@ -246,16 +246,19 @@ private static bool TryResolveSymlinksInPath(string path, out string canonical)
             // entity it's invoked against — it does not see symlinks earlier
             // in the path. Hence the explicit segment walk.
             var fullPath = Path.GetFullPath(path);
-            var segments = fullPath.Split(
+            // Seed the builder with the full root (drive + separator on Windows,
+            // "/" on Unix) and split only the REMAINDER after the root. Splitting
+            // the whole path re-emits the drive segment ("C:"), which the root
+            // already provides — appending it again yields "C:\C:\Users\..." so
+            // every Directory.Exists/File.Exists probe below misses and symlink
+            // resolution silently no-ops, failing the deny open. See #1724.
+            var root = Path.GetPathRoot(fullPath) ?? string.Empty;
+            var remainder = fullPath.Length > root.Length ? fullPath[root.Length..] : string.Empty;
+            var segments = remainder.Split(
                 [Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar],
                 StringSplitOptions.RemoveEmptyEntries);
             var sb = new StringBuilder();
-            // Preserve the full root (drive letter + separator on Windows, "/"
-            // on Unix) — appending a bare separator yields "\Users\..." on
-            // Windows, so every Directory.Exists/File.Exists probe below would
-            // miss and symlink resolution would silently no-op.
-            if (Path.IsPathRooted(fullPath))
-                sb.Append(Path.GetPathRoot(fullPath));
+            sb.Append(root);
 
             foreach (var segment in segments)
             {

From 5382afff4fcde490b6e802f6bf3f99362a4a034c Mon Sep 17 00:00:00 2001
From: Aaron Stannard <aaron@petabridge.com>
Date: Thu, 6 Aug 2026 15:11:19 +0000
Subject: [PATCH 10/11] fix(security): fail closed when symlink deny resolution
 throws

IsDeniedAgainst is the sole backstop for interactive Personal reads.
Before this change, a resolution error returned false, and the read
passed. Now a resolution error returns true, and Netclaw denies the
read.

CommandReferencesDeniedPath also denies the command when its symlink
check throws, for the same reason.

BuildNormalizedSet still skips a failed resolution at startup. The
lexical form of the path is still in the deny set, so startup stays
safe and the process does not crash on a bad path.

TryResolveSymlinksInPath and TryResolveSymlinkTarget no longer catch
and swallow the error. Each caller now owns the exception policy for
its own context, per the repo rule against silent fallbacks.

Relates to #1724.
---
 .../ToolPathPolicyTests.cs                    |  89 ++++++--
 src/Netclaw.Security/ToolPathPolicy.cs        | 205 ++++++++++--------
 2 files changed, 192 insertions(+), 102 deletions(-)

diff --git a/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs b/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs
index d65da6231..e8598c473 100644
--- a/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs
+++ b/src/Netclaw.Security.Tests/ToolPathPolicyTests.cs
@@ -246,30 +246,89 @@ public void IsReadDenied_blocks_control_plane_files(string path)
         Assert.True(policy.IsReadDenied(path));
     }
 
-    [Fact]
-    public void IsReadDenied_blocks_symlinked_directory_traversal()
+    public enum SymlinkTraversalShape
+    {
+        SingleSymlinkedDirectory,
+        MultiDepthSymlinkChain,
+        DotDotTraversalAfterResolvedLink,
+    }
+
+    // Regression (#1724): a symlinked INTERMEDIATE directory into a denied
+    // location must not bypass IsReadDenied. Shell catches this via
+    // TryResolveSymlinksInPath; the read side must too, since interactive
+    // Personal reads have IsReadDenied as their sole backstop.
+    [Theory]
+    [InlineData(SymlinkTraversalShape.SingleSymlinkedDirectory)]
+    [InlineData(SymlinkTraversalShape.MultiDepthSymlinkChain)]
+    [InlineData(SymlinkTraversalShape.DotDotTraversalAfterResolvedLink)]
+    public void IsReadDenied_blocks_symlinked_directory_traversal(SymlinkTraversalShape shape)
     {
-        // Regression (#1724): a symlinked INTERMEDIATE directory into a denied
-        // location must not bypass IsReadDenied. Shell catches this via
-        // TryResolveSymlinksInPath; the read side must too, since interactive
-        // Personal reads have IsReadDenied as their sole backstop.
         var scratch = Path.Combine(Path.GetTempPath(), $"netclaw-symlink-{Guid.NewGuid():N}");
         var deniedDir = Path.Combine(scratch, "denied");
-        var linkDir = Path.Combine(scratch, "link");
         Directory.CreateDirectory(deniedDir);
         File.WriteAllText(Path.Combine(deniedDir, "netclaw.json"), """{"secret":true}""");
 
+        var createdLinks = new List<string>();
+
         try
         {
-            Directory.CreateSymbolicLink(linkDir, deniedDir);
+            string viaLink;
+
+            switch (shape)
+            {
+                case SymlinkTraversalShape.SingleSymlinkedDirectory:
+                {
+                    var linkDir = Path.Combine(scratch, "link");
+                    Directory.CreateSymbolicLink(linkDir, deniedDir);
+                    createdLinks.Add(linkDir);
+
+                    // Lexically this path lives in scratch/link, outside any
+                    // denied root — only segment-walk symlink resolution
+                    // catches it.
+                    viaLink = Path.Combine(linkDir, "netclaw.json");
+                    break;
+                }
+
+                case SymlinkTraversalShape.MultiDepthSymlinkChain:
+                {
+                    // linkA -> linkB -> deniedDir. A resolver that only
+                    // follows one hop would stop at linkB; the walk must
+                    // reach the final real target.
+                    var linkB = Path.Combine(scratch, "linkB");
+                    var linkA = Path.Combine(scratch, "linkA");
+                    Directory.CreateSymbolicLink(linkB, deniedDir);
+                    Directory.CreateSymbolicLink(linkA, linkB);
+                    createdLinks.Add(linkB);
+                    createdLinks.Add(linkA);
+
+                    viaLink = Path.Combine(linkA, "netclaw.json");
+                    break;
+                }
+
+                case SymlinkTraversalShape.DotDotTraversalAfterResolvedLink:
+                {
+                    var linkDir = Path.Combine(scratch, "link");
+                    Directory.CreateSymbolicLink(linkDir, deniedDir);
+                    createdLinks.Add(linkDir);
+
+                    // "nested" need not exist: Path.GetFullPath collapses the
+                    // ".." lexically before any symlink is resolved, leaving
+                    // "link/netclaw.json" — the link segment itself survives
+                    // the collapse untouched, so resolution still lands
+                    // inside deniedDir. Locks in that a decoy ".." placed
+                    // after the link cannot be used to dodge the walk.
+                    viaLink = Path.Combine(linkDir, "nested", "..", "netclaw.json");
+                    break;
+                }
+
+                default:
+                    throw new ArgumentOutOfRangeException(nameof(shape), shape, null);
+            }
 
             // Deny the REAL deniedDir (fixture paths don't exist on disk, and
             // symlink resolution needs an on-disk target to resolve).
             var policy = new ToolPathPolicy([deniedDir]);
 
-            // Lexically this path lives in scratch/link, outside any denied
-            // root — only segment-walk symlink resolution catches it.
-            var viaLink = Path.Combine(linkDir, "netclaw.json");
             Assert.True(policy.IsReadDenied(viaLink));
         }
         catch (UnauthorizedAccessException)
@@ -278,8 +337,12 @@ public void IsReadDenied_blocks_symlinked_directory_traversal()
         }
         finally
         {
-            if (Directory.Exists(linkDir) && new DirectoryInfo(linkDir).LinkTarget is not null)
-                Directory.Delete(linkDir);
+            foreach (var link in createdLinks)
+            {
+                if (Directory.Exists(link) && new DirectoryInfo(link).LinkTarget is not null)
+                    Directory.Delete(link);
+            }
+
             if (Directory.Exists(scratch))
                 Directory.Delete(scratch, recursive: true);
         }
diff --git a/src/Netclaw.Security/ToolPathPolicy.cs b/src/Netclaw.Security/ToolPathPolicy.cs
index 9f06daa59..0eff355d6 100644
--- a/src/Netclaw.Security/ToolPathPolicy.cs
+++ b/src/Netclaw.Security/ToolPathPolicy.cs
@@ -61,8 +61,20 @@ private static HashSet<string> BuildNormalizedSet(IEnumerable<string> paths)
             // checks canonicalize the *candidate* path (TryResolveSymlinksInPath /
             // TryResolveSymlinkTarget); without the resolved denied form here, a
             // candidate resolving to /private/etc/... would slip past a /etc deny.
-            if (TryResolveSymlinksInPath(normalized, out var canonical))
-                set.Add(canonical);
+            //
+            // Construction skips a resolution failure (the lexical form above is
+            // still added); the deny CHECKS fail closed on the same failure. A
+            // startup-time resolution throw must not crash the process, and the
+            // lexical entry alone still denies exact and lexical-child matches.
+            try
+            {
+                if (TryResolveSymlinksInPath(normalized, out var canonical))
+                    set.Add(canonical);
+            }
+            catch
+            {
+                // Skip: this path's canonical form just does not get added.
+            }
         }
 
         return set;
@@ -115,19 +127,30 @@ private static bool IsDeniedAgainst(string path, HashSet<string> deniedSet)
         if (PathUtility.TryNormalize(path, null, out var normalized) && IsDeniedNormalized(normalized, deniedSet))
             return true;
 
-        // TryResolveSymlinkTarget only resolves the final path element. A path
-        // whose INTERMEDIATE directory is a symlink into a denied location
-        // (e.g. /tmp/x -> ~/.netclaw/config, then /tmp/x/netclaw.json) would
-        // slip past that check. Mirror the shell side (CommandReferencesDeniedPath)
-        // by also walking the path segment by segment — same infrastructure.
-        if (TryResolveSymlinkTarget(path, out var resolvedTarget)
-            && IsDeniedNormalized(resolvedTarget, deniedSet))
+        try
+        {
+            // TryResolveSymlinkTarget only resolves the final path element. A path
+            // whose INTERMEDIATE directory is a symlink into a denied location
+            // (e.g. /tmp/x -> ~/.netclaw/config, then /tmp/x/netclaw.json) would
+            // slip past that check. Mirror the shell side (CommandReferencesDeniedPath)
+            // by also walking the path segment by segment — same infrastructure.
+            if (TryResolveSymlinkTarget(path, out var resolvedTarget)
+                && IsDeniedNormalized(resolvedTarget, deniedSet))
+            {
+                return true;
+            }
+
+            return TryResolveSymlinksInPath(path, out var canonical)
+                && IsDeniedNormalized(canonical, deniedSet);
+        }
+        catch
         {
+            // This method is the SOLE backstop for interactive Personal reads
+            // (IsReadDenied has no other gate above it). An undetermined
+            // resolution must deny, not silently allow — the same defect class
+            // as the double-drive fail-open fixed for #1724. Fail closed.
             return true;
         }
-
-        return TryResolveSymlinksInPath(path, out var canonical)
-            && IsDeniedNormalized(canonical, deniedSet);
     }
 
     /// <summary>
@@ -168,11 +191,23 @@ public bool CommandReferencesDeniedPath(string command, string? workingDirectory
             // approved root and waves it through, and the static path check
             // here would never see /etc unless we resolve link targets along
             // every component of the path.
-            if (normalized is not null
-                && TryResolveSymlinksInPath(normalized, out var canonical)
-                && IsDeniedNormalized(canonical, _shellDeniedPaths))
+            if (normalized is not null)
             {
-                return true;
+                try
+                {
+                    if (TryResolveSymlinksInPath(normalized, out var canonical)
+                        && IsDeniedNormalized(canonical, _shellDeniedPaths))
+                    {
+                        return true;
+                    }
+                }
+                catch
+                {
+                    // Fail closed: an undetermined resolution means we cannot
+                    // rule out this token reaching a denied path via symlink,
+                    // so treat the command as referencing one.
+                    return true;
+                }
             }
 
             var expanded = PathUtility.ExpandHome(token);
@@ -232,104 +267,96 @@ private static bool IsSamePathOrChild(string candidate, string denied)
         return boundary == Path.DirectorySeparatorChar || boundary == Path.AltDirectorySeparatorChar;
     }
 
+    // Callers own exception policy here on purpose: BuildNormalizedSet (startup)
+    // skips a failed resolution, while the deny-check call sites (IsDeniedAgainst,
+    // CommandReferencesDeniedPath) fail closed. A blanket catch here would hide
+    // that distinction and force every caller back to the same (wrong) answer.
     private static bool TryResolveSymlinksInPath(string path, out string canonical)
     {
         canonical = string.Empty;
         if (string.IsNullOrEmpty(path))
             return false;
 
-        try
+        // Walk the path component by component, resolving any directory
+        // or file symlinks encountered. ResolveLinkTarget(returnFinalTarget:
+        // true) follows the chain to a non-link, but only operates on the
+        // entity it's invoked against — it does not see symlinks earlier
+        // in the path. Hence the explicit segment walk.
+        var fullPath = Path.GetFullPath(path);
+        // Seed the builder with the full root (drive + separator on Windows,
+        // "/" on Unix) and split only the REMAINDER after the root. Splitting
+        // the whole path re-emits the drive segment ("C:"), which the root
+        // already provides — appending it again yields "C:\C:\Users\..." so
+        // every Directory.Exists/File.Exists probe below misses and symlink
+        // resolution silently no-ops, failing the deny open. See #1724.
+        var root = Path.GetPathRoot(fullPath) ?? string.Empty;
+        var remainder = fullPath.Length > root.Length ? fullPath[root.Length..] : string.Empty;
+        var segments = remainder.Split(
+            [Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar],
+            StringSplitOptions.RemoveEmptyEntries);
+        var sb = new StringBuilder();
+        sb.Append(root);
+
+        foreach (var segment in segments)
         {
-            // Walk the path component by component, resolving any directory
-            // or file symlinks encountered. ResolveLinkTarget(returnFinalTarget:
-            // true) follows the chain to a non-link, but only operates on the
-            // entity it's invoked against — it does not see symlinks earlier
-            // in the path. Hence the explicit segment walk.
-            var fullPath = Path.GetFullPath(path);
-            // Seed the builder with the full root (drive + separator on Windows,
-            // "/" on Unix) and split only the REMAINDER after the root. Splitting
-            // the whole path re-emits the drive segment ("C:"), which the root
-            // already provides — appending it again yields "C:\C:\Users\..." so
-            // every Directory.Exists/File.Exists probe below misses and symlink
-            // resolution silently no-ops, failing the deny open. See #1724.
-            var root = Path.GetPathRoot(fullPath) ?? string.Empty;
-            var remainder = fullPath.Length > root.Length ? fullPath[root.Length..] : string.Empty;
-            var segments = remainder.Split(
-                [Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar],
-                StringSplitOptions.RemoveEmptyEntries);
-            var sb = new StringBuilder();
-            sb.Append(root);
-
-            foreach (var segment in segments)
-            {
-                if (sb.Length > 0 && sb[^1] != Path.DirectorySeparatorChar)
-                    sb.Append(Path.DirectorySeparatorChar);
-                sb.Append(segment);
+            if (sb.Length > 0 && sb[^1] != Path.DirectorySeparatorChar)
+                sb.Append(Path.DirectorySeparatorChar);
+            sb.Append(segment);
 
-                var partial = sb.ToString();
-                if (Directory.Exists(partial))
+            var partial = sb.ToString();
+            if (Directory.Exists(partial))
+            {
+                var target = new DirectoryInfo(partial).ResolveLinkTarget(returnFinalTarget: true);
+                if (target is not null)
                 {
-                    var target = new DirectoryInfo(partial).ResolveLinkTarget(returnFinalTarget: true);
-                    if (target is not null)
-                    {
-                        sb.Clear();
-                        sb.Append(target.FullName);
-                    }
+                    sb.Clear();
+                    sb.Append(target.FullName);
                 }
-                else if (File.Exists(partial))
+            }
+            else if (File.Exists(partial))
+            {
+                var target = new FileInfo(partial).ResolveLinkTarget(returnFinalTarget: true);
+                if (target is not null)
                 {
-                    var target = new FileInfo(partial).ResolveLinkTarget(returnFinalTarget: true);
-                    if (target is not null)
-                    {
-                        sb.Clear();
-                        sb.Append(target.FullName);
-                    }
-
-                    break;
+                    sb.Clear();
+                    sb.Append(target.FullName);
                 }
-            }
 
-            canonical = PathUtility.Normalize(sb.ToString());
-            return !string.IsNullOrEmpty(canonical) && !string.Equals(canonical, PathUtility.Normalize(fullPath), StringComparison.Ordinal);
-        }
-        catch
-        {
-            return false;
+                break;
+            }
         }
+
+        canonical = PathUtility.Normalize(sb.ToString());
+        return !string.IsNullOrEmpty(canonical) && !string.Equals(canonical, PathUtility.Normalize(fullPath), StringComparison.Ordinal);
     }
 
+    // Only IsDeniedAgainst calls this; it owns exception policy (fails closed).
+    // See the comment on TryResolveSymlinksInPath for why this does not catch.
     private static bool TryResolveSymlinkTarget(string path, out string normalizedTarget)
     {
         normalizedTarget = string.Empty;
 
-        try
+        if (File.Exists(path))
         {
-            if (File.Exists(path))
-            {
-                var target = new FileInfo(path).ResolveLinkTarget(returnFinalTarget: true);
-                if (target is null)
-                    return false;
-
-                normalizedTarget = PathUtility.Normalize(target.FullName);
-                return true;
-            }
+            var target = new FileInfo(path).ResolveLinkTarget(returnFinalTarget: true);
+            if (target is null)
+                return false;
 
-            if (Directory.Exists(path))
-            {
-                var target = new DirectoryInfo(path).ResolveLinkTarget(returnFinalTarget: true);
-                if (target is null)
-                    return false;
-
-                normalizedTarget = PathUtility.Normalize(target.FullName);
-                return true;
-            }
-
-            return false;
+            normalizedTarget = PathUtility.Normalize(target.FullName);
+            return true;
         }
-        catch
+
+        if (Directory.Exists(path))
         {
-            return false;
+            var target = new DirectoryInfo(path).ResolveLinkTarget(returnFinalTarget: true);
+            if (target is null)
+                return false;
+
+            normalizedTarget = PathUtility.Normalize(target.FullName);
+            return true;
         }
+
+        return false;
     }
 
     private static bool LooksLikePath(string token)

From d7e5e9676b6c6a7011514629566dd765273a1473 Mon Sep 17 00:00:00 2001
From: Aaron Stannard <aaron@petabridge.com>
Date: Thu, 6 Aug 2026 15:25:59 +0000
Subject: [PATCH 11/11] fix(security): replace empty construction catch to
 satisfy slopwatch SW003

Slopwatch flags an empty catch block as SW003. The catch is in
BuildNormalizedSet, in the constructor path of ToolPathPolicy.

This change moves the catch into a new private helper,
TryResolveCanonicalForDenySet. The helper returns false and sets an
empty canonical form on a resolution failure. BuildNormalizedSet calls
the helper and adds the canonical form only on success.

The change is behavior-neutral. Construction still skips an
unresolvable denied path. The deny check sites, IsDeniedAgainst and
CommandReferencesDeniedPath, still fail closed on the same failure.
---
 src/Netclaw.Security/ToolPathPolicy.cs | 28 +++++++++++++++++---------
 1 file changed, 19 insertions(+), 9 deletions(-)

diff --git a/src/Netclaw.Security/ToolPathPolicy.cs b/src/Netclaw.Security/ToolPathPolicy.cs
index 0eff355d6..e948cd50e 100644
--- a/src/Netclaw.Security/ToolPathPolicy.cs
+++ b/src/Netclaw.Security/ToolPathPolicy.cs
@@ -66,20 +66,30 @@ private static HashSet<string> BuildNormalizedSet(IEnumerable<string> paths)
             // still added); the deny CHECKS fail closed on the same failure. A
             // startup-time resolution throw must not crash the process, and the
             // lexical entry alone still denies exact and lexical-child matches.
-            try
-            {
-                if (TryResolveSymlinksInPath(normalized, out var canonical))
-                    set.Add(canonical);
-            }
-            catch
-            {
-                // Skip: this path's canonical form just does not get added.
-            }
+            if (TryResolveCanonicalForDenySet(normalized, out var canonical))
+                set.Add(canonical);
         }
 
         return set;
     }
 
+    // Construction-only: resolve a denied path's canonical form, but never crash the
+    // policy build if resolution throws. The lexical form is already in the set, and
+    // the runtime deny checks (IsDeniedAgainst / CommandReferencesDeniedPath) fail
+    // CLOSED on a resolution exception — so swallowing here is safe for construction.
+    private static bool TryResolveCanonicalForDenySet(string path, out string canonical)
+    {
+        try
+        {
+            return TryResolveSymlinksInPath(path, out canonical);
+        }
+        catch
+        {
+            canonical = string.Empty;
+            return false;
+        }
+    }
+
     private static HashSet<string> BuildCommandIndicators(IEnumerable<string> paths)
     {
         var materialized = paths.ToList();