fix: warn when write globs match no existing files

[miyaontherelay]

Summary

@relayflows/core delegates permission compilation to @agent-relay/cloud: see packages/core/src/provisioner.ts:412. The installed cloud compiler retains readwritePatterns, but builds token write scopes and mount ACLs from the project walk's concrete readwritePaths. Consequently, files.write: ["impl.txt"] collapses to zero effective write access when impl.txt does not exist.

This PR adds the correct local safety behavior in packages/core/src/runner.ts:3081-3090: dry-run now warns when write patterns are present but resolve to zero existing writable paths. Regression coverage is in packages/core/src/__tests__/permissions-integration.test.ts:665-696.

Dry-run reproduction

Using the reported restricted configuration with one readable fixture file and gate.sh present but impl.txt absent:

permissions:
  access: restricted
  files:
    read: ["**"]
    write: ["impl.txt"]
    deny: ["gate.sh"]

Before, with the production change stashed:

writer: restricted (read: 1, write: 0, deny: 1, scopes: 1) [yaml]
Validation: PASS (0 errors, 0 warnings)

After:

writer: restricted (read: 1, write: 0, deny: 1, scopes: 1) [yaml]
Validation: PASS (0 errors, 1 warnings)
WARNING: Agent "writer" write pattern(s) "impl.txt" resolved to no existing writable paths. The installed @agent-relay/cloud resolver only grants writes to existing paths; files created under these patterns may be denied.

The count remains zero because the runtime authorization defect is in @agent-relay/cloud; this core change makes that unsafe outcome visible instead of silent.

Required @agent-relay/cloud change

The actual fix belongs in the cloud permission compiler (compileAgentPermissions / resolveAgentPermissions):

1. Keep normalized write globs in the enforcement decision, including globs with no current project match. readwritePaths should remain an existing-file summary, not the sole authorization input.
2. Mint write scopes from readwritePatterns (for example relayfile:fs:write:/impl.txt) rather than only from readwritePaths; enforce the same globs for create operations.
3. Preserve deny precedence for both existing writes and creates. Do not widen a file glob such as impl.txt into a writable parent-directory ACL, because that would grant sibling files.
4. Pass the pattern-aware decision to the Relayfile mount/server, or have it evaluate the JWT write-pattern scopes for each requested path. The current directory-only ACL derived from concrete paths cannot safely express a not-yet-existing file grant.

Verification

$ cd packages/core && bunx tsc --noEmit
# exit 0; no output

$ cd packages/core && bunx vitest run src/__tests__/permissions-integration.test.ts -t 'warns when a write pattern resolves to no existing paths during dry-run'
Test Files  1 passed (1)
Tests       1 passed | 15 skipped (16)

$ cd packages/core && bunx vitest run --exclude src/__tests__/run-script.test.ts --reporter=dot
Test Files  43 passed (43)
Tests       783 passed (783)
Duration    16.82s

The regression was also proved against the source change: after stashing only src/runner.ts, the new test failed on the missing warning; after restoring it, the test passed.

I attempted the requested unfiltered cd packages/core && bunx vitest run, but it did not complete: run-script.test.ts reached falling back to npx tsx and hung. The task baseline notes 9 pre-existing failures in that file on main; I did not modify or attempt to fix them. No green full-suite claim is made here.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1e684a6b-dd25-4c84-be6b-7b61785b584a

📥 Commits

Reviewing files that changed from the base of the PR and between b086a87 and 81a6e8f.

📒 Files selected for processing (2)

• packages/core/src/__tests__/permissions-integration.test.ts
• packages/core/src/runner.ts

---

📝 Walkthrough

Walkthrough

WorkflowRunner.dryRun now warns when writable patterns resolve to no existing writable paths, and an integration test verifies the warning and zero-path summary.

Changes

Dry-run permissions warning

Layer / File(s)	Summary
Warn on empty writable resolution packages/core/src/runner.ts, packages/core/src/__tests__/permissions-integration.test.ts	dryRun reports unresolved writable patterns, and the integration test validates the warning and writePaths value of 0.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: willwashburn, khaliqgant

Poem

I’m a rabbit with a warning to share,
Empty write paths now get extra care.
Patterns may point where no files grow,
So dry-run tells what agents should know.
Hop, hop—permissions now show!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: a dry-run warning for write globs that resolve to no existing files.
Description check	✅ Passed	The description is directly related to the change and correctly explains the warning, test coverage, and underlying permission issue.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/write-globs-nonexistent-files

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[miyaontherelay]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.