Cover write mode in sandbox and runner specs

Write mode previously had zero coverage in the pipeline tests: every
runner.smoke and sandbox.spec scenario hardcoded mode='read-only'. The
writeSettings call in sandbox.ts and the WRITE_TOOLS branch in
runner.buildArgs were both untested, so a regression in either would
have shipped silently.

Sandbox spec adds two scenarios. One asserts that write mode plants
.claude/settings.json with the exact allow (Write/Edit(../outputs/**))
and deny (Write/Edit(**)) rules, AND that the relative path between
projectDir and outputsDir is exactly '../outputs' — those two
invariants have to stay in sync or the planted rule fails to match
real writes. The other asserts read-only mode plants no settings file.

Runner spec adds two scenarios. One inspects the spawned argv and
confirms both --tools and --allowedTools carry Write,Edit on top of
the read-only baseline, and that the persisted toolAllowlist on the
final config matches. The other is end-to-end: a new write-output
fake-claude scenario writes to ../outputs/<name> from cwd (mimicking
the side effect of claude's Write tool) and emits a tool_use; the
test reads the file from mdredd's reported outputsDir, verifies the
outputs event payload, and confirms the toolUse made it into the
transcript.

withSandbox in runner.smoke.ts grew an optional { mode } argument so
the helper can serve both modes without duplicating its 50-line setup.

Author: slaFFik

test/fake-claude.mjs

@@ -13,6 +13,10 @@
  *   FAKE_CLAUDE_SCENARIO=long           FAKE_CLAUDE_DELAY_MS=N  — sleep N ms before any output
  *   FAKE_CLAUDE_SCENARIO=novel          — emit an unknown top-level event type
  *   FAKE_CLAUDE_SCENARIO=permission-denied — emit a permission denial event
+ *   FAKE_CLAUDE_SCENARIO=write-output   FAKE_CLAUDE_OUTPUT_NAME=N FAKE_CLAUDE_OUTPUT_BODY=B
+ *                                       — synthesize a Write tool_use targeting ../outputs/<N> and
+ *                                         actually create that file (the real claude would have
+ *                                         done it via its Write tool implementation)
  *
  * Flags are intentionally ignored (except --json-schema which causes an early JSON result).
  */
@@ -382,6 +386,31 @@ async function runNovel() {
   emitResult({ numTurns: 1, result: 'hello despite novelty' });
 }
 
+async function runWriteOutput() {
+  // Real claude's Write tool would create the file as a side effect of the
+  // tool_use; we mimic that here so the test can verify the file lands at
+  // mdredd's reported outputsDir. cwd is <run>/project/, so '../outputs/<name>'
+  // resolves to <run>/outputs/<name>.
+  const name = env.FAKE_CLAUDE_OUTPUT_NAME ?? 'result.txt';
+  const body = env.FAKE_CLAUDE_OUTPUT_BODY ?? 'hello from fake claude';
+  const target = `../outputs/${name}`;
+  const { mkdir, writeFile } = await import('node:fs/promises');
+  const path = await import('node:path');
+  const absTarget = path.resolve(process.cwd(), target);
+  await mkdir(path.dirname(absTarget), { recursive: true });
+  await writeFile(absTarget, body, 'utf8');
+
+  emitSystemInit();
+  emitMessageStart();
+  emitToolUse('Write', { file_path: target, content: body });
+  emitMessageEnd('tool_use');
+  emitUserToolResult('tu-0', `wrote ${body.length} bytes to ${target}`);
+  emitMessageStart();
+  emitTextBlock(`wrote ${name}`);
+  emitMessageEnd('end_turn');
+  emitResult({ numTurns: 1, result: `wrote ${name}` });
+}
+
 async function runPermissionDenied() {
   emitSystemInit();
   emitMessageStart();
@@ -429,6 +458,9 @@ async function main() {
       case 'permission-denied':
         await runPermissionDenied();
         break;
+      case 'write-output':
+        await runWriteOutput();
+        break;
       default:
         stderr.write(`fake-claude: unknown scenario "${scenario}"\n`);
         exit(2);

test/runner.smoke.ts

@@ -47,7 +47,9 @@ async function withSandbox(
     outputsDir: string;
     initialConfig: RunConfig;
   }) => Promise<void>,
+  options: { mode?: 'read-only' | 'write' } = {},
 ): Promise<void> {
+  const mode = options.mode ?? 'read-only';
   const cwd = await mkdtemp(join(tmpdir(), 'mdredd-smoke-cwd-'));
   const storageRoot = join(cwd, 'agents', 'mdredd');
   const runFolder = `run-${Date.now()}`;
@@ -58,7 +60,7 @@ async function withSandbox(
     variantType: 'CLAUDE.md',
     skillOrAgentName: null,
     variantContent: `# ${scenarioName}\nBe concise.\n`,
-    mode: 'read-only',
+    mode,
   });
   const initialConfig: RunConfig = {
     runFolder,
@@ -71,7 +73,7 @@ async function withSandbox(
     prompt: 'test prompt',
     model: 'haiku',
     effort: null,
-    mode: 'read-only',
+    mode,
     status: 'preparing',
     startedAt: new Date().toISOString(),
     endedAt: null,
@@ -1126,4 +1128,123 @@ await scenario('effort flag: dropped when model rejects the value (sonnet + xhig
   );
 });
 
+await scenario('write mode: --tools and --allowedTools include Write and Edit', async () => {
+  await withSandbox(
+    'write-tools',
+    async ({ runDir, projectDir, outputsDir, initialConfig }) => {
+      const dumpPath = join(runDir, 'argv.txt');
+      const runner = new Runner({
+        claudeBin: fakeBin,
+        projectDir,
+        runDir,
+        outputsDir,
+        prompt: 'go',
+        model: 'haiku',
+        mode: 'write',
+        initialConfig,
+        env: {
+          ...process.env,
+          FAKE_CLAUDE_SCENARIO: 'happy',
+          FAKE_CLAUDE_DUMP_ARGS: dumpPath,
+        },
+      });
+      await runner.start();
+      const final = await runner.wait();
+      if (final.status !== 'completed') throw new Error(`expected completed, got ${final.status}`);
+      const argv = (await readFile(dumpPath, 'utf8')).split('\n');
+      // --tools and --allowedTools both carry the same comma-joined list.
+      // Inspect both: a regression where one is set correctly but the other
+      // isn't would leave write mode silently neutered.
+      for (const flag of ['--tools', '--allowedTools']) {
+        const idx = argv.indexOf(flag);
+        if (idx < 0) throw new Error(`expected ${flag} in argv, got: ${argv.join(' ')}`);
+        const value = argv[idx + 1] ?? '';
+        const tools = value.split(',');
+        if (!tools.includes('Write') || !tools.includes('Edit')) {
+          throw new Error(`${flag} missing Write/Edit, got '${value}'`);
+        }
+        if (!tools.includes('Read') || !tools.includes('Glob')) {
+          throw new Error(`${flag} dropped read-only tools, got '${value}'`);
+        }
+      }
+      // The mirrored toolAllowlist on the persisted config drives the judge
+      // rubric and the topbar harness summary, so it has to track too.
+      if (!final.toolAllowlist.includes('Write') || !final.toolAllowlist.includes('Edit')) {
+        throw new Error(
+          `persisted toolAllowlist missing Write/Edit: ${final.toolAllowlist.join(',')}`,
+        );
+      }
+    },
+    { mode: 'write' },
+  );
+});
+
+await scenario(
+  'write mode: child writes to ../outputs/, file lands in outputsDir and surfaces via outputs event',
+  async () => {
+    await withSandbox(
+      'write-end-to-end',
+      async ({ runDir, projectDir, outputsDir, initialConfig }) => {
+        const outputName = 'result.txt';
+        const outputBody = 'persisted across finalize';
+        let observedOutputs: { path: string; bytes: number }[] | null = null;
+        const runner = new Runner({
+          claudeBin: fakeBin,
+          projectDir,
+          runDir,
+          outputsDir,
+          prompt: 'go',
+          model: 'haiku',
+          mode: 'write',
+          initialConfig,
+          env: {
+            ...process.env,
+            FAKE_CLAUDE_SCENARIO: 'write-output',
+            FAKE_CLAUDE_OUTPUT_NAME: outputName,
+            FAKE_CLAUDE_OUTPUT_BODY: outputBody,
+          },
+        });
+        runner.on('outputs', (files) => {
+          observedOutputs = files.map((f) => ({ path: f.path, bytes: f.bytes }));
+        });
+        await runner.start();
+        const final = await runner.wait();
+        if (final.status !== 'completed') {
+          throw new Error(`expected completed, got ${final.status}`);
+        }
+        // 1. The file the child wrote at '../outputs/result.txt' from its cwd
+        //    must end up at the outputsDir mdredd reported. This is the
+        //    relative-path invariant between projectDir and outputsDir.
+        const written = await readFile(join(outputsDir, outputName), 'utf8');
+        if (written !== outputBody) {
+          throw new Error(`outputs/${outputName} content mismatch: '${written}'`);
+        }
+        // 2. The runner emits an 'outputs' event after finalize listing every
+        //    file under outputsDir. Drives the UI and judge.
+        if (!observedOutputs) throw new Error('runner did not emit outputs event');
+        const match = (observedOutputs as { path: string; bytes: number }[]).find(
+          (f) => f.path === outputName,
+        );
+        if (!match) {
+          throw new Error(
+            `outputs event missing ${outputName}: ${JSON.stringify(observedOutputs)}`,
+          );
+        }
+        if (match.bytes !== Buffer.byteLength(outputBody, 'utf8')) {
+          throw new Error(`outputs event bytes mismatch: got ${match.bytes}`);
+        }
+        // 3. The transcript records the Write tool_use so the judge has
+        //    visibility into what the child did. A finalize bug that wiped
+        //    the run dir or skipped the toolUse event would surface here.
+        const transcript = JSON.parse(await readFile(join(runDir, 'transcript.json'), 'utf8')) as {
+          events: Array<{ t: string; tool?: string }>;
+        };
+        const writeUse = transcript.events.find((e) => e.t === 'toolUse' && e.tool === 'Write');
+        if (!writeUse) throw new Error('transcript missing Write toolUse event');
+      },
+      { mode: 'write' },
+    );
+  },
+);
+
 console.log('\nAll runner smoke scenarios passed.');

test/sandbox.spec.ts

@@ -1,6 +1,6 @@
-import { mkdir, mkdtemp, readdir, rm, stat, symlink, writeFile } from 'node:fs/promises';
+import { mkdir, mkdtemp, readFile, readdir, rm, stat, symlink, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { join, relative } from 'node:path';
 import { buildSandbox } from '../src/server/sandbox.js';
 import { listDir, readFileCapped, FsBrowserError } from '../src/server/fsBrowser.js';
 import { pathExists } from '../src/server/fsUtil.js';
@@ -27,7 +27,7 @@ async function withCwd(run: (cwd: string) => Promise<void>): Promise<void> {
   }
 }
 
-async function build(cwd: string) {
+async function build(cwd: string, mode: 'read-only' | 'write' = 'read-only') {
   const storageRoot = join(cwd, '.storage');
   return buildSandbox({
     cwd,
@@ -36,7 +36,7 @@ async function build(cwd: string) {
     variantType: 'CLAUDE.md',
     skillOrAgentName: null,
     variantContent: '# test\n',
-    mode: 'read-only',
+    mode,
   });
 }
 
@@ -222,6 +222,55 @@ await scenario('fsBrowser: readFileCapped still works on real files', async () =
   });
 });
 
+await scenario(
+  'sandbox: write mode plants .claude/settings.json with outputs-only permission rules',
+  async () => {
+    await withCwd(async (cwd) => {
+      const sb = await build(cwd, 'write');
+      if (sb.settingsPath === null) {
+        throw new Error('write mode should report a settingsPath');
+      }
+      const expectedPath = join(sb.projectDir, '.claude', 'settings.json');
+      if (sb.settingsPath !== expectedPath) {
+        throw new Error(`settingsPath = ${sb.settingsPath}, expected ${expectedPath}`);
+      }
+      // The allow rule uses `../outputs/**` — that pattern only resolves to the
+      // run's outputs/ if claude's cwd (projectDir) is exactly one level below
+      // outputsDir. Assert the relative-path invariant explicitly so a future
+      // sandbox layout change can't silently desync from the planted rule.
+      const rel = relative(sb.projectDir, sb.outputsDir);
+      if (rel !== '../outputs') {
+        throw new Error(`outputsDir relative to projectDir = '${rel}', expected '../outputs'`);
+      }
+      const settings = JSON.parse(await readFile(sb.settingsPath, 'utf8'));
+      const allow = settings?.permissions?.allow;
+      const deny = settings?.permissions?.deny;
+      if (
+        !Array.isArray(allow) ||
+        !allow.includes('Write(../outputs/**)') ||
+        !allow.includes('Edit(../outputs/**)')
+      ) {
+        throw new Error(`allow rules missing or wrong: ${JSON.stringify(allow)}`);
+      }
+      if (!Array.isArray(deny) || !deny.includes('Write(**)') || !deny.includes('Edit(**)')) {
+        throw new Error(`deny rules missing or wrong: ${JSON.stringify(deny)}`);
+      }
+    });
+  },
+);
+
+await scenario('sandbox: read-only mode plants no .claude/settings.json', async () => {
+  await withCwd(async (cwd) => {
+    const sb = await build(cwd, 'read-only');
+    if (sb.settingsPath !== null) {
+      throw new Error(`read-only mode should not produce a settings file, got ${sb.settingsPath}`);
+    }
+    if (await pathExists(join(sb.projectDir, '.claude', 'settings.json'))) {
+      throw new Error('read-only mode left a .claude/settings.json on disk');
+    }
+  });
+});
+
 if (failures > 0) {
   console.log(`\n${failures} sandbox security scenario(s) FAILED.`);
   process.exit(1);