{"record":{"id":"3d89b384a990cf33","repo":"Hmbown/CodeWhale","slug":"the-envelope-must-independently-refuse-the-write-capable","errorCode":null,"errorMessage":"the envelope must independently refuse the write-capable filter","messagePattern":"the envelope must independently refuse the write-capable filter","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"crates/tui/src/tools/subagent/tests.rs","lineNumber":8255,"sourceCode":"        std::fs::write(&input_path, \"b\\na\\n\").expect(\"input fixture\");\n        let output_path = tmp.path().join(\"filter-output.txt\");\n        let mut runtime =\n            stub_runtime().with_agent_tool_surface_options(enabled_agent_surface_options());\n        runtime.context = ToolContext::new(tmp.path().to_path_buf());\n        runtime.worker_profile = WorkerRuntimeProfile::for_role(role.clone());\n        seed_read_only_role_deny_list(&mut runtime);\n        let registry = SubAgentToolRegistry::new(\n            runtime,\n            role.clone(),\n            None,\n            crate::tools::todo::new_shared_todo_list(),\n            crate::tools::plan::new_shared_plan_state(),\n        );\n\n        let call = json!({\"command\": \"sort -o filter-output.txt input.txt\"});\n        let envelope_refusal = registry\n            .envelope_refusal(\"bash\", &call)\n            .expect(\"the envelope must independently refuse the write-capable filter\");\n        assert!(\n            envelope_refusal.contains(\"[execution_envelope.executes.write_denied]\"),\n            \"{role:?} envelope refusal did not identify its failed rule: {envelope_refusal}\"\n        );\n\n        let posture_refusal = registry\n            .execute(\"agent_read_only_filter\", \"bash\", call)\n            .await\n            .expect_err(\"a read-only inspection role must not write through sort\")\n            .to_string();\n        assert!(\n            posture_refusal.contains(\"[shell.readonly.command]\"),\n            \"{role:?} posture refusal did not identify its failed rule: {posture_refusal}\"\n        );\n        assert!(\n            !output_path.exists(),\n            \"{role:?} read-only filter created {} from {}\",\n            output_path.display(),","sourceCodeStart":8237,"sourceCodeEnd":8273,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/433685b2024e7bc4c99e1e2e326bcad39b4d9d65/crates/tui/src/tools/subagent/tests.rs#L8237-L8273","documentation":"In the read-only-role enforcement test (crates/tui/src/tools/subagent/tests.rs:8255), `registry.envelope_refusal(\"bash\", &call).expect(\"the envelope must independently refuse the write-capable filter\")` asserts that the execution envelope returns a refusal (an `Option`/`Result` that is `Some`/`Ok`) for `sort -o filter-output.txt input.txt`, a command that writes via an output flag. A panic means the envelope failed to flag the write-capable filter — a security-relevant regression, not an environmental fault.","triggerScenarios":"Modifying the envelope's deny rules (e.g. the `[execution_envelope.executes.write_denied]` rule) so `sort -o <file>` no longer matches write-capable filter usage, or changing how `envelope_refusal` signals refusal (returning `None` on allowed commands).","commonSituations":"Relaxing the bash carve-out for text filters, renaming the refusal rule marker so the assertion string no longer matches, or refactoring rule evaluation order so the write rule is skipped.","solutions":["Run the test and check which deny rules evaluate for `sort -o filter-output.txt input.txt`.","Restore/extend the write-detection rule so output-flag usage of text filters is refused.","If the rule identifier changed, update both the rule and the assertion string together.","Verify `envelope_refusal` returns a refusal rather than `None` for postures where posture permits but envelope denies."],"exampleFix":"// before\nlet envelope_refusal = registry.envelope_refusal(\"bash\", &call).expect(\"the envelope must independently refuse the write-capable filter\");\n// after (test diagnostics)\nlet envelope_refusal = registry.envelope_refusal(\"bash\", &call)\n    .unwrap_or_else(|| panic!(\"envelope did not refuse write-capable filter: {call}\"));","handlingStrategy":"try-catch","validationCode":"// Pre-check the command against write-capable patterns before dispatch\nfn writes_output_file(cmd: &str) -> bool {\n    // e.g. sort -o <file>, tee, redirect targets\n    cmd.contains(\" -o \") || cmd.contains(\">\") || cmd.contains(\"tee \")\n}","typeGuard":null,"tryCatchPattern":"// In tests, assert refusal presence with a diagnostic message\nlet refusal = registry.envelope_refusal(\"bash\", &call)\n    .unwrap_or_else(|| panic!(\"envelope failed to refuse write-capable command: {call}\"));\nassert!(refusal.contains(\"[execution_envelope.executes.write_denied]\"));","preventionTips":["Treat any test asserting sandbox refusal as security-critical; never weaken it to go green.","Keep denial-rule identifiers and their test assertions in sync in one change.","Extend write-detection rules whenever a new output-flag pattern (like sort -o) is added to the carve-out.","Run the read-only-role enforcement tests on every envelope rule change."],"tags":["security","sandbox","test","policy"],"backgroundTag":"permission-denied","analyzedSha":"433685b2024e7bc4c99e1e2e326bcad39b4d9d65","analyzedAt":"2026-09-15T12:24:24.634Z","contentChangedAt":"2026-09-15T12:24:24.634Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}