From f439b634f021199493c546c0218395ee66105cda Mon Sep 17 00:00:00 2001 From: Jason Date: Sun, 1 Nov 2026 15:50:56 -0500 Subject: [PATCH] fix: fall back to config sandbox paths in scanAgents The orchestrator invokes the raw scanAgents singleton without runtime options, so options.allowedPaths was undefined and every path was denied as "outside sandbox scope". Fall back to loadConfig().sandbox.paths when options.allowedPaths is absent, mirroring the other path tools. --- src/tools/scanAgents/index.js | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/tools/scanAgents/index.js b/src/tools/scanAgents/index.js index 12f70775a..86ec4d0f7 100644 --- a/src/tools/scanAgents/index.js +++ b/src/tools/scanAgents/index.js @@ -24,7 +24,11 @@ const ScanAgentsSchema = z.object({ */ export async function scanAgentsImpl(input, options) { const targetPath = input.path || getProjectCwd() || config.cwd || process.cwd(); - const resolved = validatePath(targetPath, options.allowedPaths); + // The orchestrator invokes the raw singleton without runtime options, so + // options.allowedPaths is undefined there. Fall back to the live config's + // sandbox allowlist — loadConfig() is cached, so this reflects app mutations. + const allowedPaths = options.allowedPaths || loadConfig().sandbox?.paths || []; + const resolved = validatePath(targetPath, allowedPaths); if (!resolved.allowed) { return { ok: false, error: resolved.error }; }