[ronleizrowice-ant]

Installed as a dependency, this package lives in <project>/node_modules/, usually inside allowWrite. A sandboxed command can rewrite it there, and the next srt run in that project executes the result unsandboxed.

Earlier commits on this branch write-denied the library's own files. That made every sandboxed npm install fail on Linux and did not cover pnpm layouts, so it is gone: no deny, no mount, no new config field, and both backends are as on main.

What remains is a warning:

• ownInstallWarning() in src/sandbox/own-files.ts finds the package directory this copy is loaded from and tells whether it lies at or under an allowed write path, as spelled or where it really is. Nothing for a checkout (not under a node_modules) or a copy compiled into an application.
• checkDependencies() returns it as a warning on Linux and macOS, unless filesystem.disabled is set. The first wrap with a filesystem policy logs it once under SRT_DEBUG.
• It never throws. It only advises, so whatever goes wrong in it (a malformed entry, a working directory that is gone) counts as no warning, and initialize(), checkDependencies() and the wrap behave as on main.
• main is merged in. The write lists hold entries now, so both call sites read them through writeRootsOf(): a root marked { path, literal: true } is judged too.
• Cost: 3 existsSync and two realpathSync per write root for each evaluation (once in initialize(), once per checkDependencies(), once in the first wrap). From the second wrap on, nothing.
• README, Security Limitations: install the package outside every allowed write path.

Tests: npm and pnpm layouts, a checkout, an install outside the write paths, a write path that does not cover the copy, the source loaded from a project for both call sites, a write path marked literal, a malformed entry, a removed working directory, and a check that is made to throw.

Driven through an installed copy of the built package, beside main's build: one warning with the copy inside a write path, none outside, and the wrapped command is the same in every case.

[antdres]

No blockers from me at 0ecb488. I built main's merge-base and this head, placed each build as an installed copy under a project's node_modules, and ran both. The warning shows up once in checkDependencies() when the project, a parent of it, a symlink to it, "." or a { path, literal: true } entry is in allowWrite, and for a pnpm-style layout; it stays silent for an install outside the write paths, a sibling write path, and an empty allowWrite. The wrapped command is the same as main's apart from the random socket names and proxy tokens, the CLI prints nothing extra without SRT_DEBUG, and the new tests fail when I neuter the function or remove either call site (12 pass as written).

Worth knowing, not blocking: this only advises. A sandboxed command can still append to the installed dist/cli.js when the project is writable, same as on main. On Linux an allowWrite glob gives no warning (it is not bound there either); macOS was not run.

---

Generated by Claude Code

[antdres]

Approving at 0ecb488. No blocking issues; what I ran is in my comment above.

---

Generated by Claude Code