* Engine: check automation read and write roots on every path a command reads or writes (#769)
* MCP: confine the headless session to the automation roots (#769)
* CLI: add --automation-read-root and --automation-write-root to mcp (#769)
* Docs: document --automation-read-root and --automation-write-root for mcp (#769)
* Review fixes for #798: confine file.printPdf; guard all of engine/src
- print.rs::print_pdf_to_file (file.printPdf, added on main) wrote with std::fs::write
directly, so a confined agent could print a PDF anywhere. It now goes through
io::write_file, which checks the automation write root.
- The guard test now walks every file under crates/engine/src (not only cmd/), except
io.rs, file_access.rs and the tests*.rs modules, and also flags OpenOptions.
- Tests: an engine test that file.printPdf is refused outside the write root, works inside
and is unchanged without roots; the MCP integration test covers it too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Review fixes for #798: list file.printPdf among the confined writes in docs/mcp.md
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Font files added by path go through io, inside the automation read root (#769)
---------
Co-authored-by: Brandon Thomas <echelon@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
64319e0039