ZeroClaw closes a workspace exception in its forbidden-path policy

zeroclaw-labs/zeroclaw PR #9776 is the inspected primary source: “feat(security): extend forbidden_paths with workspace-relative glob patterns.” The related records below were inspected as supporting context rather than independent confirmation.

The facts

- zeroclaw-labs/zeroclaw PR #9776 was created 2026-08-06T00:56:19Z and was open at inspection; its title is “feat(security): extend forbidden_paths with workspace-relative glob patterns.” - zeroclaw-labs/zeroclaw issue #8424 was created 2026-06-28T11:55:54Z and was open at inspection; its title is “RFC: Workspace-relative forbidden path patterns and optional.zeroclawignore.” - zeroclaw-labs/zeroclaw PR #9737 was created 2026-08-04T02:45:16Z and was open at inspection; its title is “fix(tools): enforce agent policy in pipelines.” - The repository reported 32521 stars, 698 open issues, default branch master, and last push 2026-08-05T19:29:33Z. - The latest tagged-release baseline checked was v0.8.4 published 2026-08-02T21:00:00Z.

What changed

zeroclaw-labs/zeroclaw PR #9776 reports: Summary **Base branch:** master **What changed and why:** Added ForbiddenPatternSet struct in new forbidden_patterns.rs module that categorizes forbidden_paths entries into globs, exact relative paths, directory prefixes, and basename patterns Modified is_path_allowed, is_resolved_path_readable, and is_resolved_path_allowed to check workspace-relative patterns *before* the workspace allow short-circuit — closing the gap where files inside the workspace (e.g. rust-toolchain.toml,.env,.cargo/config.toml) were unconditionally allowed ForbiddenPatternSet is lazily built on first access via OnceLock and cached for the policy lifetime, so there is no per-check rebuild cost Added glob = "0.3" dependency to zeroclaw-config (already a workspace dep, now required for this crate) Added 30 unit tests covering the full cross-platform conformance matrix **Scope boundary:** Does NOT add forbidden_paths_file,.zeroclawignore, or any project-local file mechanism — deferred to follow-up per Audacity88's status update. Does NOT change ensure_no_escalation_beyond mechanics (uses same forbidden_paths Vec). **Blast radius:** SecurityPolicy struct gains a new public field forbidden_patterns: OnceLock with..Default::default() fallback.

zeroclaw-labs/zeroclaw issue #8424 reports: 1. Problem Users need to protect sensitive files (config, credentials, project settings) from AI agent access. The current forbidden_paths mechanism only blocks paths **outside** the workspace — workspace-internal files like rust-toolchain.toml,.cargo/config.toml,.env config.yaml are fully accessible with no way to deny them. Root cause** in is_resolved_path_readable() and is_resolved_path_allowed(): Additionally, forbidden_paths uses **prefix-only matching** (starts_with), so patterns like *.toml, **/*.log, or.env* cannot be expressed. User pain points:** Agent modifies rust-toolchain.toml,.cargo/config.toml to bypass project rules No way to declaratively mark files as off-limits within the workspace No glob/pattern support for fine-grained control forbidden_paths is not project-local — requires config.toml editing 2. Proposal Extend the existing forbidden_paths mechanism with: 1. **Glob pattern support** — extend starts_with prefix matching with glob::Pattern matching for workspace-relative entries 2. **Workspace-relative entries** — paths relative to workspace root are checked BEFORE the workspace short-circuit 3. **Project-local file** — optional.zeroclawignore at workspace root (unique name,

zeroclaw-labs/zeroclaw PR #9737 reports: Summary **Base branch:** master **What changed and why:** Builds execute_pipeline only after the effective per-agent tool policy and optional caller allowlist are known. Applies the outer registry's memory and ACP delivery predicate to eager pipeline children and builtin skill resolution, preventing either path from recovering context-excluded tools. Requires every pipeline step to pass the global pipeline allowlist, the caller's exact-name tool policy, and child availability before any sequential or parallel step starts. Reuses the same policy-bound pipeline instance for top-level registration and skill-scoped elevation. **Scope boundary:** Delegate policy propagation is unchanged; #8279 remains out of scope. **Blast radius:** Pipeline assembly and execution for agent tool registries built through the shared scoped assembly seam. **Linked issue(s):** Closes #7947. Supersedes #7960. **Labels:** bug, runtime, tool, domain:security, priority:p1, needs-author-action, risk:high, size:M Testing (required) How you can test (when useful) **Reviewer testing requested?** N/A. The behavior is an internal registry policy boundary covered directly

Why it matters

Calling the workspace trusted made the denylist least effective where agents do most of their work. The patch improves accidental-change resistance, but its own RFC correctly says in-process path checks are not a confidentiality boundary. The operator test is whether persisted state, execution authority and the visible outcome describe the same event after retries, restarts or delegation.

Current

The primary record was open when captured on 2026-08-06. The release baseline was v0.8.4 published 2026-08-02T21:00:00Z. Repository metadata, pull requests, issues, release records, Google News discovery, Hacker News discovery, Lobsters, Metamesh and the rendered ClawCharts row were checked. ClawCharts selected the subject; it did not prove the claim.

Evidence

The primary URL is https://github.com/zeroclaw-labs/zeroclaw/pull/9776. Supporting records are https://github.com/zeroclaw-labs/zeroclaw/issues/8424 and https://github.com/zeroclaw-labs/zeroclaw/pull/9737. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts, reproductions and deployment observations remain attributed to their authors unless explicitly identified as independently rerun.

Source boundary

Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.

Operator take

Test exact, directory and glob patterns across resolved symlinks; enforce the same policy in pipelines; use OS isolation when secrets must remain unreadable. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently after intervention.

Caveat

Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.

Source inspected; source state, environment and release boundary remain explicit.