Tim Lingo
01446e644b
Enforcement moves from the client into the engine, where the tools execute: - classify_tool_risk() tiers every tool call read/reversible/escalate. The agentic loop REFUSES to auto-run the escalate tier — being a builtin is no longer a free pass, and 'always allow' can never bypass escalate (irreversible actions always confirm, the value line). Escalate suspends to the client's existing consent bridge; the /approve round-trip is the only path that runs it. risk_tier rides the tool_pending envelope so the client renders consent weight. - run_command_guard() is a real fence, not a cwd suggestion: refuses parent traversal, ~, command substitution, and absolute paths outside the workspace, and refuses shell entirely when no workspace is set. Applied in dispatch_tool so BOTH the loop auto-run and the post-consent approve-dispatch path are fenced. - web_get gained an http(s)-only scheme guard (previously unguarded — file:// etc). Adversarially verified against a compiled soul in an isolated container (soul hit directly, app gate out of the loop): read-outside-workspace denied, write-class shell suspends for consent, approve-swapped absolute/chaining/ command-substitution escapes all refused with no file created, file:// denied; legit in-workspace approve executes and read commands auto-run (no over-block). Still lexical (symlinks); OS-level confinement in el_runtime.c remains the ceiling, flagged in the LIMITATION note. This closes BUG-8's client-only-gate and escapable-run_command at the engine. dist/soul.c must be regenerated from this chat.el via elb at merge (hand-port used only to verify behavior). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>