feat(remotesync): prune forbidden roots nested inside allowed archive roots (#1283)

Builds on #1282, which added the `RemoteSyncExcluded` capability.

Remote sync already skips excluded agents (currently Trae), but an
excluded root nested inside another agent's allowed root — possible with
overlapping directory overrides — would still end up in archives and
tarballs.

Fix: `TargetSet` carries `ForbiddenRoots`, always re-derived server-side,
and every layer enforces them — target resolution omits nested targets,
request validation rejects them, the archive/manifest walkers prune them,
and the SSH path excludes them from the generated tar command.

All checks go through one predicate, `remotesync.PathWithinForbiddenRoots`.
Paths are canonicalized before comparison (absolute, symlinks resolved,
case-folded on Windows/macOS; the SSH script emits physical paths), so an
alias spelling of a forbidden root cannot slip past. Resolver output
parsing fails the sync rather than ever dropping an exclusion boundary.

Notes:

- With an env override (e.g. `TRAE_DIR`), the override is the protected
  root; default locations are not additionally protected — same as
  allowed-agent resolution.
- Tar exclude patterns are glob-escaped and covered by a test against
  real tar.

Where to look: `internal/remotesync/paths.go` (predicate +
canonicalization), `resolve.go` (advertised-set filtering),
`internal/ssh/resolve.go` (script + parsing), `internal/ssh/transfer.go`
(tar exclusion).


Co-authored-by: Wes McKinney <wesm@users.noreply.github.com>

Author: wesm

internal/remotesync/archive.go

@@ -14,6 +14,7 @@ import (
 
 func WriteArchive(w io.Writer, targets TargetSet) error {
 	tw := tar.NewWriter(w)
+	forbidden := newForbiddenRootMatcher(targets.ForbiddenRoots)
 	hermesSQLite := make(map[string]string)
 	for _, stateDB := range hermesStateDBTargets(targets) {
 		for _, path := range hermesSQLitePaths(stateDB) {
@@ -22,6 +23,9 @@ func WriteArchive(w io.Writer, targets TargetSet) error {
 	}
 	writtenHermesState := make(map[string]struct{})
 	writePath := func(path string, optional bool) error {
+		if forbidden.within(path) {
+			return nil
+		}
 		clean := filepath.Clean(path)
 		if stateDB, ok := hermesSQLite[clean]; ok {
 			if _, written := writtenHermesState[stateDB]; written {
@@ -33,9 +37,12 @@ func WriteArchive(w io.Writer, targets TargetSet) error {
 		if optional {
 			return writeOptionalArchiveFile(tw, path)
 		}
-		return writeArchivePath(tw, path)
+		return writeArchivePath(tw, path, forbidden)
 	}
 	for agent, dirs := range targets.Dirs {
+		if parser.RemoteSyncExcludedAgent(agent) {
+			continue
+		}
 		if _, fileScoped := targets.Files[agent]; fileScoped {
 			continue
 		}
@@ -46,8 +53,11 @@ func WriteArchive(w io.Writer, targets TargetSet) error {
 		}
 	}
 	for agent, files := range targets.Files {
+		if parser.RemoteSyncExcludedAgent(agent) {
+			continue
+		}
 		if agent == parser.AgentWindsurf {
-			if err := writeWindsurfArchiveFiles(tw, files); err != nil {
+			if err := writeWindsurfArchiveFiles(tw, files, forbidden); err != nil {
 				return err
 			}
 			continue
@@ -99,9 +109,14 @@ func writeHermesStateDBSnapshot(tw *tar.Writer, stateDB string) error {
 
 var writeHermesSnapshotFile = writeSQLiteSnapshot
 
-func writeWindsurfArchiveFiles(tw *tar.Writer, files []string) error {
+func writeWindsurfArchiveFiles(
+	tw *tar.Writer, files []string, forbidden forbiddenRootMatcher,
+) error {
 	seen := make(map[string]struct{}, len(files))
 	for _, path := range files {
+		if forbidden.within(path) {
+			continue
+		}
 		if _, ok := seen[path]; ok {
 			continue
 		}
@@ -187,7 +202,12 @@ func writeOptionalArchiveFile(tw *tar.Writer, path string) error {
 	return writeArchiveFile(tw, path, info)
 }
 
-func writeArchivePath(tw *tar.Writer, root string) error {
+func writeArchivePath(
+	tw *tar.Writer, root string, forbidden forbiddenRootMatcher,
+) error {
+	if forbidden.within(root) {
+		return nil
+	}
 	info, err := os.Lstat(root)
 	if err != nil {
 		return fmt.Errorf("stat archive path %q: %w", root, err)
@@ -205,6 +225,12 @@ func writeArchivePath(tw *tar.Writer, root string) error {
 			}
 			return err
 		}
+		if forbidden.within(path) {
+			if entry.IsDir() {
+				return filepath.SkipDir
+			}
+			return nil
+		}
 		info, err := entry.Info()
 		if err != nil {
 			if os.IsNotExist(err) {
@@ -337,14 +363,15 @@ func writeArchiveHeader(
 // validate.
 func WriteArchiveFiles(w io.Writer, allowed TargetSet, files []string) error {
 	tw := tar.NewWriter(w)
+	forbidden := newForbiddenRootMatcher(allowed.ForbiddenRoots)
 	allowedRoots := allowed.DeltaAllowedRoots()
 	hermesStateDBs := make(map[string]struct{})
 	for _, stateDB := range hermesStateDBTargets(allowed) {
 		hermesStateDBs[filepath.Clean(stateDB)] = struct{}{}
 	}
 	writtenHermesState := make(map[string]struct{})
 	for _, path := range files {
-		local, ok := resolveDeltaFilePath(allowedRoots, path)
+		local, ok := resolveDeltaFilePath(allowedRoots, forbidden, path)
 		if !ok {
 			continue
 		}
@@ -386,18 +413,21 @@ func WriteArchiveFiles(w io.Writer, allowed TargetSet, files []string) error {
 // root returns filepath.Join(root, rel) where rel passed
 // filepath.IsLocal, so the path used for filesystem access is always
 // derived from a trusted base rather than the request string.
-func resolveDeltaFilePath(allowedRoots []string, path string) (string, bool) {
+func resolveDeltaFilePath(
+	allowedRoots []string, forbidden forbiddenRootMatcher, path string,
+) (string, bool) {
 	clean := filepath.Clean(path)
 	for _, root := range allowedRoots {
 		root = filepath.Clean(root)
 		if clean == root {
-			return root, true
+			return root, !forbidden.within(root)
 		}
 		rel, err := filepath.Rel(root, clean)
 		if err != nil || !filepath.IsLocal(rel) {
 			continue
 		}
-		return filepath.Join(root, rel), true
+		local := filepath.Join(root, rel)
+		return local, !forbidden.within(local)
 	}
 	return "", false
 }

internal/remotesync/archive_test.go

@@ -240,6 +240,101 @@ func TestHermesArchivesSnapshotWALCommitBeforeCheckpoint(t *testing.T) {
 	}
 }
 
+func TestWriteArchiveExcludesRemoteSyncExcludedAgentState(t *testing.T) {
+	root := t.TempDir()
+	chatDB := filepath.Join(root, "chat.db")
+	require.NoError(t, os.WriteFile(chatDB, []byte("authentication state"), 0o600))
+	require.NoError(t, os.WriteFile(
+		filepath.Join(root, "credentials.json"), []byte("secret"), 0o600,
+	))
+
+	targets := TargetSet{
+		Dirs: map[parser.AgentType][]string{
+			parser.AgentTrae: {root},
+		},
+		Files: map[parser.AgentType][]string{
+			parser.AgentTrae: {chatDB},
+		},
+	}
+	for _, tt := range []struct {
+		name  string
+		write func(io.Writer) error
+	}{
+		{
+			name: "full",
+			write: func(w io.Writer) error {
+				return WriteArchive(w, targets)
+			},
+		},
+		{
+			name: "delta",
+			write: func(w io.Writer) error {
+				return WriteArchiveFiles(w, targets, []string{chatDB})
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			var archive bytes.Buffer
+			require.NoError(t, tt.write(&archive))
+			_, err := tar.NewReader(&archive).Next()
+			assert.ErrorIs(t, err, io.EOF,
+				"a remote-sync-excluded agent's state must never enter a remote archive")
+		})
+	}
+}
+
+func TestWriteArchivePrunesForbiddenRootNestedInAllowedRoot(t *testing.T) {
+	root := t.TempDir()
+	allowed := filepath.Join(root, "sessions")
+	forbidden := filepath.Join(allowed, ".forbidden-provider")
+	keep := filepath.Join(allowed, "session.jsonl")
+	secret := filepath.Join(forbidden, "chat.db")
+	require.NoError(t, os.MkdirAll(forbidden, 0o755))
+	require.NoError(t, os.WriteFile(keep, []byte("session"), 0o644))
+	require.NoError(t, os.WriteFile(secret, []byte("authentication state"), 0o600))
+
+	targets := TargetSet{
+		Dirs:           map[parser.AgentType][]string{parser.AgentClaude: {allowed}},
+		ForbiddenRoots: []string{forbidden},
+	}
+	for _, tt := range []struct {
+		name  string
+		write func(io.Writer) error
+	}{
+		{
+			name: "full archive",
+			write: func(w io.Writer) error {
+				return WriteArchive(w, targets)
+			},
+		},
+		{
+			name: "delta archive",
+			write: func(w io.Writer) error {
+				return WriteArchiveFiles(w, targets, []string{keep, secret})
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			var archive bytes.Buffer
+			require.NoError(t, tt.write(&archive))
+
+			var names []string
+			tr := tar.NewReader(&archive)
+			for {
+				hdr, err := tr.Next()
+				if errors.Is(err, io.EOF) {
+					break
+				}
+				require.NoError(t, err)
+				names = append(names, hdr.Name)
+			}
+			assert.Contains(t, names, archiveNameForTest(t, keep))
+			assert.NotContains(t, names, archiveNameForTest(t, secret),
+				"a forbidden nested root must not enter the transfer artifact")
+		})
+	}
+}
+
 func TestWriteArchivePropagatesAdvertisedHermesSnapshotFailure(t *testing.T) {
 	stateDB := filepath.Join(t.TempDir(), "profile", "state.db")
 	require.NoError(t, os.MkdirAll(filepath.Dir(stateDB), 0o755))
@@ -563,7 +658,7 @@ func TestResolveDeltaFilePath(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got, ok := resolveDeltaFilePath(
-				fromSlashAll(tt.roots), filepath.FromSlash(tt.path))
+				fromSlashAll(tt.roots), forbiddenRootMatcher{}, filepath.FromSlash(tt.path))
 			require.Equal(t, tt.ok, ok)
 			assert.Equal(t, filepath.FromSlash(tt.want), got)
 		})

internal/remotesync/manifest.go

@@ -6,6 +6,8 @@ import (
 	"os"
 	"path/filepath"
 	"sort"
+
+	"go.kenn.io/agentsview/internal/parser"
 )
 
 // ManifestEntry describes one regular file available for remote sync.
@@ -41,6 +43,7 @@ func BuildManifest(targets TargetSet) (Manifest, error) {
 			"manifest not supported for sanitized file-scoped agents")
 	}
 	m := Manifest{Files: []ManifestEntry{}}
+	forbidden := newForbiddenRootMatcher(targets.ForbiddenRoots)
 	hermesStateDBs := hermesStateDBTargets(targets)
 	hermesSQLite := make(map[string]struct{}, len(hermesStateDBs)*4)
 	for _, stateDB := range hermesStateDBs {
@@ -56,6 +59,9 @@ func BuildManifest(targets TargetSet) (Manifest, error) {
 		})
 	}
 	addLstat := func(path string) error {
+		if forbidden.within(path) {
+			return nil
+		}
 		info, err := os.Lstat(path)
 		if err != nil {
 			if os.IsNotExist(err) {
@@ -69,19 +75,25 @@ func BuildManifest(targets TargetSet) (Manifest, error) {
 		return nil
 	}
 	for agent, dirs := range targets.Dirs {
+		if parser.RemoteSyncExcludedAgent(agent) {
+			continue
+		}
 		if _, fileScoped := targets.Files[agent]; fileScoped {
 			continue
 		}
 		for _, root := range dirs {
 			if _, ok := hermesSQLite[filepath.Clean(root)]; ok {
 				continue
 			}
-			if err := manifestWalk(root, add); err != nil {
+			if err := manifestWalk(root, forbidden, add); err != nil {
 				return Manifest{}, err
 			}
 		}
 	}
-	for _, files := range targets.Files {
+	for agent, files := range targets.Files {
+		if parser.RemoteSyncExcludedAgent(agent) {
+			continue
+		}
 		for _, path := range files {
 			if _, ok := hermesSQLite[filepath.Clean(path)]; ok {
 				continue
@@ -100,6 +112,9 @@ func BuildManifest(targets TargetSet) (Manifest, error) {
 		}
 	}
 	for _, stateDB := range hermesStateDBs {
+		if forbidden.within(stateDB) {
+			continue
+		}
 		size, modTime, exists := hermesSQLiteSnapshotIdentity(stateDB)
 		if exists {
 			m.Files = append(m.Files, ManifestEntry{
@@ -113,7 +128,12 @@ func BuildManifest(targets TargetSet) (Manifest, error) {
 	return m, nil
 }
 
-func manifestWalk(root string, add func(string, os.FileInfo)) error {
+func manifestWalk(
+	root string, forbidden forbiddenRootMatcher, add func(string, os.FileInfo),
+) error {
+	if forbidden.within(root) {
+		return nil
+	}
 	info, err := os.Lstat(root)
 	if err != nil {
 		if os.IsNotExist(err) {
@@ -137,6 +157,12 @@ func manifestWalk(root string, add func(string, os.FileInfo)) error {
 			}
 			return err
 		}
+		if forbidden.within(path) {
+			if entry.IsDir() {
+				return filepath.SkipDir
+			}
+			return nil
+		}
 		info, err := entry.Info()
 		if err != nil {
 			if os.IsNotExist(err) {

internal/remotesync/manifest_test.go

@@ -57,6 +57,28 @@ func TestBuildManifestToleratesMissingRootsAndExtraFiles(t *testing.T) {
 	assert.Empty(t, m.Files)
 }
 
+func TestBuildManifestPrunesForbiddenRootNestedInAllowedRoot(t *testing.T) {
+	root := t.TempDir()
+	allowed := filepath.Join(root, "sessions")
+	forbidden := filepath.Join(allowed, ".forbidden-provider")
+	keep := filepath.Join(allowed, "session.jsonl")
+	secret := filepath.Join(forbidden, "chat.db")
+	require.NoError(t, os.MkdirAll(forbidden, 0o755))
+	require.NoError(t, os.WriteFile(keep, []byte("session"), 0o644))
+	require.NoError(t, os.WriteFile(secret, []byte("authentication state"), 0o600))
+
+	manifest, err := BuildManifest(TargetSet{
+		Dirs:           map[parser.AgentType][]string{parser.AgentClaude: {allowed}},
+		ForbiddenRoots: []string{forbidden},
+	})
+
+	require.NoError(t, err)
+	require.Len(t, manifest.Files, 1)
+	assert.Equal(t, keep, manifest.Files[0].Path)
+	assert.NotEqual(t, secret, manifest.Files[0].Path,
+		"the manifest must never advertise a file under a forbidden root")
+}
+
 func TestBuildManifestRejectsFileScopedAgents(t *testing.T) {
 	_, err := BuildManifest(TargetSet{
 		Dirs: map[parser.AgentType][]string{parser.AgentWindsurf: {"/srv/Windsurf/User"}},