fix: enforce exact Dream memory file writes

maintainer edit: Dream write tools used file paths as directory roots, so a missing canonical memory file could be treated as a parent directory. Add exact-file allowlist support and keep skills/ as the only Dream write directory.

nanobot/agent/tools/filesystem.py

@@ -47,6 +47,8 @@ class _FsTool(Tool):
         extra_allowed_dirs: list[Path] | None = None,
         extra_read_allowed_dirs: list[Path] | None = None,
         extra_write_allowed_dirs: list[Path] | None = None,
+        extra_read_allowed_files: list[Path] | None = None,
+        extra_write_allowed_files: list[Path] | None = None,
         file_states: FileStates | None = None,
         restrict_to_workspace: bool | None = None,
         sandbox_restricts_workspace: bool = False,
@@ -60,6 +62,8 @@ class _FsTool(Tool):
             *(extra_read_allowed_dirs or []),
         ]
         self._extra_write_allowed_dirs = list(extra_write_allowed_dirs or [])
+        self._extra_read_allowed_files = list(extra_read_allowed_files or [])
+        self._extra_write_allowed_files = list(extra_write_allowed_files or [])
         self._extra_allowed_dirs = self._extra_read_allowed_dirs
         self._restrict_to_workspace = (
             bool(restrict_to_workspace)
@@ -117,6 +121,7 @@ class _FsTool(Tool):
         self,
         path: str,
         extra_allowed_dirs: list[Path] | None,
+        extra_allowed_files: list[Path] | None,
         *,
         include_media_dir: bool,
     ) -> Path:
@@ -130,6 +135,7 @@ class _FsTool(Tool):
             access.project_path,
             self._effective_allowed_root(access.allowed_root),
             extra_allowed_dirs,
+            extra_allowed_files,
             include_media_dir=include_media_dir,
         )
 
@@ -137,6 +143,7 @@ class _FsTool(Tool):
         return self._resolve_with_extra(
             path,
             self._extra_read_allowed_dirs,
+            self._extra_read_allowed_files,
             include_media_dir=True,
         )
 
@@ -144,6 +151,7 @@ class _FsTool(Tool):
         return self._resolve_with_extra(
             path,
             self._extra_write_allowed_dirs,
+            self._extra_write_allowed_files,
             include_media_dir=False,
         )
 

nanobot/agent/tools/path_utils.py

@@ -19,6 +19,7 @@ def resolve_workspace_path(
     workspace: Path | None = None,
     allowed_dir: Path | None = None,
     extra_allowed_dirs: list[Path] | None = None,
+    extra_allowed_files: list[Path] | None = None,
     include_media_dir: bool = True,
 ) -> Path:
     """Resolve path against workspace and enforce allowed directory containment."""
@@ -29,4 +30,5 @@ def resolve_workspace_path(
         workspace=workspace,
         allowed_root=allowed_dir,
         extra_allowed_roots=extra_roots,
+        extra_allowed_files=extra_allowed_files,
     )