isSensitivePath (lib/path-guard.mjs)

Deny-list guard for filesystem reads. Mirror of electron/path-guard.ts + src-tauri/src/path_guard.rs so the same well-known credential stores stay blocked across all three hosts. This is harm-reduction, not a sandbox: legitimate uses (~/.bashrc, /etc/hosts, project trees) still r

// Source: https://github.com/tony1223/better-agent-terminal | License: MIT | Copyright 2024 TonyQ
// Provided via justclaw.it.com; keep this notice with the code.
// Deny-list guard for filesystem reads. Mirror of electron/path-guard.ts
// + src-tauri/src/path_guard.rs so the same well-known credential stores
// stay blocked across all three hosts.
//
// This is harm-reduction, not a sandbox: legitimate uses (~/.bashrc,
// /etc/hosts, project trees) still resolve. Stricter scoping lives at
// the IPC layer via ctx.isRemote, which the sidecar doesn't currently
// thread through to here.

import * as os from 'os'
import * as path from 'path'

const home = os.homedir()

const DENIED_SUFFIXES = [
  // SSH keys
  path.join(home, '.ssh'),
  // AWS credentials
  path.join(home, '.aws', 'credenti

... (truncated -- full source via MCP)