Security
- Lazy nested/out-of-cwd context loading now fails closed by default.
context.autoLoadNested is off unless explicitly enabled, and the decision is read from a global-only trust policy that project-local .dreb/settings.json can never widen. This closes a prompt-injection boundary where a repository could previously grant itself context-loading trust.
- Canonical, scope-aware trust enforcement. Trusted roots are resolved through strict native realpaths with path-segment containment checks, collection is bounded to the matched trusted root, and collected context-file realpaths are re-verified after read — so directory/file symlink swaps and upward walks cannot escape the approved scope. Malformed or unreadable global policy data fails closed and reports an error rather than silently broadening trust.
- Main-agent and subagent parity. Child subagents independently consume the same external global policy regardless of their cwd or project-local settings; no project path can grant itself trust or unrestricted loading.
Added
- Global-only trusted-folder controls. An auditable list of configured trusted roots with add-by-path and per-row revoke, plus a prominently warned expert trust-all toggle (default off). Revocation uses a dedicated
remove_trusted_context_folder command that removes configured roots by exact string — independent of unrestricted mode and directory existence — so invalid or legacy entries can be cleaned up too.
- Dashboard Files trust workflow. Each canonical directory listing reports whether it is untrusted, trusted by a specific granting root, or covered by unrestricted trust, with immediate trust this folder and descendants / untrust actions, inherited-scope reporting, live updates on navigation, and visible persistence errors — no page reload.
- Typed RPC contract. New
evaluate_context_trust, trust_context_folder, untrust_context_folder, and remove_trusted_context_folder commands, with settings snapshots distinguishing the raw configured list from the fail-closed effective enforcement roots.
Fixed
- Separated the configured trusted-folders list (for editing and display) from the fail-closed enforcement policy, so a valid-JSON-but-malformed
autoLoadNested sibling can no longer silently destroy a valid trustedFolders list on add/remove/trust, nor hide it from the dashboard Settings revoke controls.
- Made
set_settings context-trust persistence request-atomic and refresh only the context policy slice on cross-process re-read, so a partial write failure can no longer leave a permissive policy durable and a policy re-read no longer clobbers unrelated pending global settings.
Testing
- Comprehensive core, session, subagent (cross-repo, file-backed child manager), RPC (real JSONL dispatcher), and dashboard server/client coverage, including symlink-swap TOCTOU defense, malformed-valid-JSON fail-closed shapes, configured-vs-effective separation, cross-process refresh, and read-failure fail-closed branches.
Documentation
- Root, coding-agent, and dashboard READMEs plus the settings, RPC, and dashboard docs and
AGENTS.md updated to document the default-off model, trusted-root inheritance, canonical/symlink behavior, global-only storage, the Files-view workflow, all four trust RPC commands, and the expert warning — explicitly distinguishing lazy nested loading from the unconditional initial upward scan performed at startup.
Closes #364. Closes #370.
