Clarify filesystem workspace write policy

tests/tools/test_apply_patch_tool.py

@@ -256,14 +256,56 @@ def test_apply_patch_edits_dry_run_validates_without_writing(tmp_path):
     assert not (tmp_path / "added.txt").exists()
 
 
-def test_apply_patch_edits_rejects_absolute_and_parent_paths(tmp_path):
-    tool = ApplyPatchTool(workspace=tmp_path)
+def test_apply_patch_edits_allows_absolute_and_parent_paths_when_unrestricted(tmp_path):
+    workspace = tmp_path / "workspace"
+    outside = tmp_path / "outside"
+    workspace.mkdir()
+    outside.mkdir()
+    absolute_target = outside / "absolute.txt"
+    parent_target = outside / "parent.txt"
+    tool = ApplyPatchTool(workspace=workspace, restrict_to_workspace=False)
 
     absolute = asyncio.run(
         tool.execute(
             edits=[
                 {
-                    "path": "/tmp/owned.txt",
+                    "path": str(absolute_target),
+                    "action": "add",
+                    "new_text": "absolute",
+                }
+            ]
+        )
+    )
+    parent = asyncio.run(
+        tool.execute(
+            edits=[
+                {
+                    "path": "../outside/parent.txt",
+                    "action": "add",
+                    "new_text": "parent",
+                }
+            ]
+        )
+    )
+
+    assert "Patch applied" in absolute
+    assert "Patch applied" in parent
+    assert absolute_target.read_text() == "absolute\n"
+    assert parent_target.read_text() == "parent\n"
+
+
+def test_apply_patch_edits_rejects_outside_paths_when_restricted(tmp_path):
+    workspace = tmp_path / "workspace"
+    outside = tmp_path / "outside"
+    workspace.mkdir()
+    outside.mkdir()
+    tool = ApplyPatchTool(workspace=workspace, allowed_dir=workspace)
+
+    absolute = asyncio.run(
+        tool.execute(
+            edits=[
+                {
+                    "path": str(outside / "absolute.txt"),
                     "action": "add",
                     "new_text": "nope",
                 }
@@ -274,29 +316,7 @@ def test_apply_patch_edits_rejects_absolute_and_parent_paths(tmp_path):
         tool.execute(
             edits=[
                 {
-                    "path": "../owned.txt",
-                    "action": "add",
-                    "new_text": "nope",
-                }
-            ]
-        )
-    )
-    windows_absolute = asyncio.run(
-        tool.execute(
-            edits=[
-                {
-                    "path": r"C:\owned.txt",
-                    "action": "add",
-                    "new_text": "nope",
-                }
-            ]
-        )
-    )
-    windows_parent = asyncio.run(
-        tool.execute(
-            edits=[
-                {
-                    "path": r"..\owned.txt",
+                    "path": "../outside/parent.txt",
                     "action": "add",
                     "new_text": "nope",
                 }
@@ -304,11 +324,95 @@ def test_apply_patch_edits_rejects_absolute_and_parent_paths(tmp_path):
         )
     )
 
-    assert "must be relative" in absolute
-    assert "must not contain '..'" in parent
-    assert "must be relative" in windows_absolute
-    assert "must not contain '..'" in windows_parent
-    assert not (tmp_path.parent / "owned.txt").exists()
+    assert "outside allowed directory" in absolute
+    assert "outside allowed directory" in parent
+    assert not (outside / "absolute.txt").exists()
+    assert not (outside / "parent.txt").exists()
+
+
+def test_apply_patch_legacy_extra_allowed_dirs_are_read_only(tmp_path):
+    workspace = tmp_path / "workspace"
+    skills = tmp_path / "skills"
+    workspace.mkdir()
+    skills.mkdir()
+    target = skills / "demo.md"
+    target.write_text("before\n", encoding="utf-8")
+    tool = ApplyPatchTool(
+        workspace=workspace,
+        allowed_dir=workspace,
+        extra_allowed_dirs=[skills],
+    )
+
+    result = asyncio.run(
+        tool.execute(
+            edits=[
+                {
+                    "path": str(target),
+                    "action": "replace",
+                    "old_text": "before",
+                    "new_text": "after",
+                }
+            ]
+        )
+    )
+
+    assert "outside allowed directory" in result
+    assert target.read_text(encoding="utf-8") == "before\n"
+
+
+def test_apply_patch_media_dir_is_read_only_by_default(tmp_path, monkeypatch):
+    workspace = tmp_path / "workspace"
+    media = tmp_path / "media"
+    workspace.mkdir()
+    media.mkdir()
+    target = media / "demo.md"
+    target.write_text("before\n", encoding="utf-8")
+    monkeypatch.setattr("nanobot.agent.tools.path_utils.get_media_dir", lambda: media)
+    tool = ApplyPatchTool(workspace=workspace, allowed_dir=workspace)
+
+    result = asyncio.run(
+        tool.execute(
+            edits=[
+                {
+                    "path": str(target),
+                    "action": "replace",
+                    "old_text": "before",
+                    "new_text": "after",
+                }
+            ]
+        )
+    )
+
+    assert "outside allowed directory" in result
+    assert target.read_text(encoding="utf-8") == "before\n"
+
+
+def test_apply_patch_allows_explicit_extra_write_allowed_dirs_when_restricted(tmp_path):
+    workspace = tmp_path / "workspace"
+    writable = tmp_path / "writable"
+    workspace.mkdir()
+    writable.mkdir()
+    target = writable / "allowed.txt"
+    tool = ApplyPatchTool(
+        workspace=workspace,
+        allowed_dir=workspace,
+        extra_write_allowed_dirs=[writable],
+    )
+
+    result = asyncio.run(
+        tool.execute(
+            edits=[
+                {
+                    "path": str(target),
+                    "action": "add",
+                    "new_text": "allowed",
+                }
+            ]
+        )
+    )
+
+    assert "Patch applied" in result
+    assert target.read_text(encoding="utf-8") == "allowed\n"
 
 
 def test_apply_patch_edits_reports_invalid_edit_shapes(tmp_path):