Unscoped agent write_file lands files in the soul process cwd — deny like run_command #75
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: neuron-technologies/neuron#75
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Evidence (2026-07-13, Tim's live review): with no agent_workspace_root set, an agentic write_file succeeded and the file landed in the soul process's own working directory (~/Development/.../neuron-ui/microsoft_stock_report.html) — a location no user would ever find. Root cause: chat.el resolve_in_root/path_within_root deliberately fall back to UNSCOPED when root is empty (backward compat), so the write resolves against cwd. The tier fn already escalates unscoped writes (user consent was asked) but execution still has no legal target. run_command already refuses outright when no workspace is set ('denied: no workspace folder is set…', BUG-8/WS2 fence) — write_file/edit_file should refuse the same way. App-side half is DONE (2026-07-13, Tim-approved): the app now ALWAYS supplies agent_workspace_root (user-chosen folder, else managed default Documents/Neuron), so from current app builds the unscoped state never arrives; this issue is the engine belt-and-suspenders for older/other clients. Verified against Cowork/Copilot/ChatGPT: no mainstream agent writes to an undefined location.