pi          read                         {"path":"sub/../../x"}                   deny: read path is outside the workspace: sub/../../x
pi          read                         {"path":"@/etc/passwd"}                  deny: read path is outside the workspace: @/etc/passwd
pi          read                         {"path":"~/x"}                           deny: read path is outside the workspace: ~/x
pi          read                         {"path":"file:///etc/passwd"}            deny: read path is outside the workspace: file:///etc/passwd
pi          read                         {"path":" /etc/passwd"}                  ALLOW
pi          read                         {"path":"etc-link/passwd"}               deny: read path is outside the workspace: etc-link/passwd
pi          write                        {"path":"dangling/x"}                    ALLOW
pi          read                         {"path":"sub/./x"}                       ALLOW
pi          grep                         {"path":"..","pattern":"x"}              deny: grep path is outside the workspace: ..
pi          find                         {"pattern":"{..,x}/*"}                   ALLOW
pi          find                         {"pattern":"*","path":"/"}               deny: find path is outside the workspace: /
pi          ls                           {}                                       ALLOW
pi          bash                         {"command":"cat /etc/passwd"}            deny: bash isn't in this session's policy
pi          message.send                 {}                                       ALLOW
claude-code Read                         {"file_path":"/etc/passwd"}              deny: Read path is outside the workspace: /etc/passwd
claude-code Read                         {"file_path":"/home/jwoltje/darkwing-scratch/tmp/r41-gate-1f41z7/ws/sub/x"} ALLOW
claude-code Glob                         {"pattern":"/etc/*"}                     deny: Glob pattern must stay inside the workspace: /etc/*
claude-code Glob                         {"pattern":"**/x","path":"/"}            deny: Glob path is outside the workspace: /
claude-code Grep                         {"pattern":"x","path":"/etc"}            deny: Grep path is outside the workspace: /etc
claude-code Grep                         {"pattern":"x","glob":"../*"}            ALLOW
claude-code Bash                         {"command":"id"}                         deny: Bash isn't in this session's policy
claude-code WebFetch                     {"url":"http://x"}                       deny: WebFetch isn't in this session's policy
claude-code mcp__mosaic__message.send    {}                                       ALLOW
claude-code mcp__other__message.send     {}                                       deny: mcp__other__message.send isn't in this session's policy
claude-code message.send                 {}                                       deny: message.send isn't in this session's policy
claude-code Read                         {"file_path":7}                          deny: Read.file_path isn't a string
