filesystemModeToPermissions
filesystemModeToPermissions(
fs,cwd?,virtual?):FilesystemPermission[]
Defined in: _worktrees/docs-release/gaunt-sloth/packages/agent/src/core/deepAgentPermissions.ts:129
Map gsloth’s filesystem mode onto deepagents permission rules for the DEFAULT (non-widen) code-mode sandbox.
EXT-13: the default backend now runs WITHOUT virtualMode (real absolute paths), so
containment can no longer lean on the virtual-root chroot — it is enforced entirely by
these globs anchored at the REAL absolute cwd. We therefore allow read+write within
cwd/** (and cwd) and deny everything else (/**), mirroring what virtualMode gave
for free. An explicit string[] allow-list resolves each entry against the real cwd.
all→ no extra restriction beyond the cwd sandbox (matches the old virtualMode behavior, where/already meant cwd).read→ deny all writes (the cwd sandbox still applies for reads).none→ deny all reads and writes.string[]→ allow each (cwd-resolved) dir, deny everything else.
The cwd argument is injected (defaults to getCurrentWorkDir) so callers/tests
can anchor deterministically.
Parameters
Section titled “Parameters”string[] | "read" | "all" | "none"
string = ...
virtual?
Section titled “virtual?”boolean = false