neuron-technologies/neuron
3
0
Fork 0
Code Issues 44 Pull Requests Actions Packages Projects Releases Wiki Activity

Unscoped agent write_file lands files in the soul process cwd — deny like run_command #75

New Issue
Open
opened 2026-07-13 14:14:47 +00:00 by tim.lingo · 2 comments
tim.lingo commented 2026-07-13 14:14:47 +00:00
Member
Copy Link
Copy Source

Evidence (2026-07-13, Tim's live review): with no agent_workspace_root set, an agentic write_file succeeded and the file landed in the soul process's own working directory (~/Development/.../neuron-ui/microsoft_stock_report.html) — a location no user would ever find. Root cause: chat.el resolve_in_root/path_within_root deliberately fall back to UNSCOPED when root is empty (backward compat), so the write resolves against cwd. The tier fn already escalates unscoped writes (user consent was asked) but execution still has no legal target. run_command already refuses outright when no workspace is set ('denied: no workspace folder is set…', BUG-8/WS2 fence) — write_file/edit_file should refuse the same way. App-side half is DONE (2026-07-13, Tim-approved): the app now ALWAYS supplies agent_workspace_root (user-chosen folder, else managed default Documents/Neuron), so from current app builds the unscoped state never arrives; this issue is the engine belt-and-suspenders for older/other clients. Verified against Cowork/Copilot/ChatGPT: no mainstream agent writes to an undefined location.

Evidence (2026-07-13, Tim's live review): with no agent_workspace_root set, an agentic write_file succeeded and the file landed in the soul process's own working directory (~/Development/.../neuron-ui/microsoft_stock_report.html) — a location no user would ever find. Root cause: chat.el resolve_in_root/path_within_root deliberately fall back to UNSCOPED when root is empty (backward compat), so the write resolves against cwd. The tier fn already escalates unscoped writes (user consent was asked) but execution still has no legal target. run_command already refuses outright when no workspace is set ('denied: no workspace folder is set…', BUG-8/WS2 fence) — write_file/edit_file should refuse the same way. App-side half is DONE (2026-07-13, Tim-approved): the app now ALWAYS supplies agent_workspace_root (user-chosen folder, else managed default Documents/Neuron), so from current app builds the unscoped state never arrives; this issue is the engine belt-and-suspenders for older/other clients. Verified against Cowork/Copilot/ChatGPT: no mainstream agent writes to an undefined location.
will.anderson commented 2026-07-22 22:00:26 +00:00
Owner
Copy Link
Copy Source

Status: run_command is already workspace-fenced (PR #23 + #73). The write_file/edit_file gap this issue calls out is being addressed by in-flight PRs #100 (agent write_file/edit_file false receipts, BUG-29) and #101 (forget/delete fake receipts, BUG-18) — not yet merged. Leaving open until those land and the deny/scope on unscoped write_file is confirmed.

Status: run_command is already workspace-fenced (PR #23 + #73). The write_file/edit_file gap this issue calls out is being addressed by in-flight PRs #100 (agent write_file/edit_file false receipts, BUG-29) and #101 (forget/delete fake receipts, BUG-18) — not yet merged. Leaving open until those land and the deny/scope on unscoped write_file is confirmed.
will.anderson commented 2026-08-03 19:08:09 +00:00
Owner
Copy Link
Copy Source

GROOMING — 2026-08-03
Status: App-side half DONE (the app now always supplies agent_workspace_root), so the unscoped state never arrives from current builds; the engine belt-and-suspenders is open — unscoped write_file/edit_file still fall back to the soul cwd instead of refusing like run_command does.
Next action: Will to make write_file/edit_file refuse when no workspace root is set, matching the run_command / BUG-8 (WS2) fence, for older/other clients.
Owner: Will
Priority: POST-BETA

**GROOMING — 2026-08-03** **Status:** App-side half DONE (the app now always supplies agent_workspace_root), so the unscoped state never arrives from current builds; the engine belt-and-suspenders is open — unscoped write_file/edit_file still fall back to the soul cwd instead of refusing like run_command does. **Next action:** Will to make write_file/edit_file refuse when no workspace root is set, matching the run_command / BUG-8 (WS2) fence, for older/other clients. **Owner:** Will **Priority:** POST-BETA
will.anderson added the POST-BETA label 2026-08-03 19:08:11 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
BETA-CRITICAL
On the beta critical path — must resolve before ship
 blocks-public-beta
Must be fixed before any public beta
 HELD
Blocked pending an external decision (counsel / dual sign-off)
 ORTHOGONAL
Parallel workstream (testing/hardening) — safe to assign off critical path
 P0
Drop-everything severity
 POST-BETA
Important but not blocking the beta ship
 security
Security vulnerability
No labels POST-BETA
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
andre.almeida (Andre Almeida) tim.lingo (Tim Lingo) will.anderson (Will Anderson)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: neuron-technologies/neuron#75
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?