Keep the default write paths out of a read-denied directory

src/sandbox/sandbox-manager.ts

@@ -672,7 +672,7 @@ async function initialize(
         // (allowed or not). Only paths bwrap would actually refuse — outside
         // allowWrite or inside a denyWrite carve-out — go to the store.
         allowWritePaths: [
-          ...getDefaultWritePaths(),
+          ...getDefaultWritePaths(config.filesystem.denyRead),
           ...config.filesystem.allowWrite,
         ],
         denyWritePaths: config.filesystem.denyWrite,
@@ -1247,8 +1247,12 @@ function getFsWriteConfig(): FsWriteRestrictionConfig {
       return true
     })
 
-  // Build allowOnly list: default paths + configured allow paths
-  const allowOnly = [...getDefaultWritePaths(), ...allowPaths]
+  // Build allowOnly list: default paths (less any the config read-denies)
+  // + configured allow paths
+  const allowOnly = [
+    ...getDefaultWritePaths(config.filesystem.denyRead),
+    ...allowPaths,
+  ]
 
   return {
     allowOnly,
@@ -1576,21 +1580,23 @@ async function wrapWithSandbox(
         config?.filesystem.allowWrite ??
         [],
     )
+    // Credential deny paths are unioned with the caller's denyRead — never
+    // replacing it — so explicit filesystem restrictions always survive.
+    // Computed ahead of the write config: a default write path under a
+    // read-denied directory is dropped from it.
+    const rawDenyRead = unionDenyReadPaths(
+      customConfig?.filesystem?.denyRead ?? config?.filesystem.denyRead ?? [],
+      credentialRestrictions,
+    )
     writeConfig = {
-      allowOnly: [...getDefaultWritePaths(), ...userAllowWrite],
+      allowOnly: [...getDefaultWritePaths(rawDenyRead), ...userAllowWrite],
       denyWithinAllow: stripWriteGlobs(
         customConfig?.filesystem?.denyWrite ??
           config?.filesystem.denyWrite ??
           [],
       ),
     }
 
-    // Credential deny paths are unioned with the caller's denyRead — never
-    // replacing it — so explicit filesystem restrictions always survive.
-    const rawDenyRead = unionDenyReadPaths(
-      customConfig?.filesystem?.denyRead ?? config?.filesystem.denyRead ?? [],
-      credentialRestrictions,
-    )
     const expandedDenyRead: string[] = []
     for (const p of rawDenyRead) {
       const stripped = removeTrailingGlobSuffix(p)

src/sandbox/sandbox-utils.ts

@@ -414,7 +414,9 @@ export function normalizePathForSandbox(pathPattern: string): string {
  * allow access to files from other processes. In highly security-sensitive
  * environments, you should configure more restrictive write paths.
  */
-export function getDefaultWritePaths(): string[] {
+export function getDefaultWritePaths(
+  denyRead: readonly string[] = [],
+): string[] {
   const homeDir = homedir()
   const recommendedPaths = [
     '/dev/stdout',
@@ -428,8 +430,25 @@ export function getDefaultWritePaths(): string[] {
     path.join(homeDir, '.npm/_logs'),
     path.join(homeDir, '.claude/debug'),
   ]
-
-  return recommendedPaths
+  if (denyRead.length === 0) return recommendedPaths
+
+  // These are conveniences the caller never asked for. One that lies at or
+  // under a directory the caller read-denies would be bound back over that
+  // deny on Linux (readable and writable again) and writable on macOS, so
+  // an explicit denyRead wins over an implicit allowWrite. A caller who
+  // wants the path writable lists it in allowWrite.
+  const denied = denyRead
+    .filter(p => !containsGlobChars(removeTrailingGlobSuffix(p)))
+    .map(p => normalizePathForSandbox(p))
+  const atOrUnder = (p: string, dir: string): boolean =>
+    p === dir || p.startsWith(dir === '/' ? '/' : dir + '/')
+  // Both spellings of the recommended path: as listed, and as the sandbox
+  // normalizes it (symlinks such as /tmp -> /private/tmp resolved).
+  return recommendedPaths.filter(recommended =>
+    [recommended, normalizePathForSandbox(recommended)].every(
+      form => !denied.some(d => atOrUnder(form, d)),
+    ),
+  )
 }
 
 /**

test/sandbox/default-write-paths.test.ts

@@ -0,0 +1,48 @@
+import { describe, it, expect } from 'bun:test'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import { getDefaultWritePaths } from '../../src/sandbox/sandbox-utils.js'
+
+/**
+ * The default write paths are conveniences the caller never asked for; one
+ * that lies at or under a directory the caller read-denies must not be bound
+ * back over that deny.
+ */
+describe('getDefaultWritePaths', () => {
+  const npmLogs = join(homedir(), '.npm/_logs')
+  const claudeDebug = join(homedir(), '.claude/debug')
+
+  it('includes the home conveniences by default', () => {
+    expect(getDefaultWritePaths()).toContain(npmLogs)
+    expect(getDefaultWritePaths([])).toContain(claudeDebug)
+  })
+
+  it('drops a convenience under a read-denied directory', () => {
+    const underDeniedHome = getDefaultWritePaths([homedir()])
+    expect(underDeniedHome).not.toContain(npmLogs)
+    expect(underDeniedHome).not.toContain(claudeDebug)
+    expect(underDeniedHome).toContain('/dev/null')
+
+    // Tilde and trailing-slash spellings name the same directory.
+    expect(getDefaultWritePaths(['~/'])).not.toContain(npmLogs)
+    // The denied directory itself, exactly.
+    expect(getDefaultWritePaths([join(homedir(), '.npm', '_logs')])).toEqual(
+      getDefaultWritePaths().filter(p => p !== npmLogs),
+    )
+  })
+
+  it('keeps a convenience beside, not beneath, a read-denied directory', () => {
+    const kept = getDefaultWritePaths([
+      join(homedir(), '.npmrc'),
+      join(homedir(), '.np'),
+    ])
+    expect(kept).toContain(npmLogs)
+    expect(kept).toContain(claudeDebug)
+  })
+
+  it('ignores glob entries, which name no directory to compare against', () => {
+    expect(getDefaultWritePaths([join(homedir(), '**/*.log')])).toContain(
+      npmLogs,
+    )
+  })
+})