def list_dir(path="."):
    """List files and directories."""
    p = safe_path(path)  # Verify path is in workspace
    if not p.is_dir():
        raise NotADirectoryError(str(p))
    return sorted(x.name + ("/" if x.is_dir() else "") for x in p.iterdir())

list_dir(".")             # ✓ OK
list_dir("src")           # ✓ OK
list_dir("../etc")        # ✗ BLOCKED by safe_path()

def read_file(path, max_chars=4000):
    """Read file with size limit."""
    p = safe_path(path)
    content = p.read_text(encoding="utf-8", errors="replace")
    # Enforce framework-level limit
    return clip(content, min(max_chars, MAX_CHARS))  # MAX_CHARS=8000

read_file("README.md")             # ✓ Up to 4000 chars
read_file("data.txt", max_chars=500)  # ✓ Up to 500 chars
read_file("huge.db")               # ✓ Clipped to 8000 chars (not unlimited)
read_file("/etc/passwd")           # ✗ BLOCKED by safe_path()

ALLOW_WRITE = False  # Disabled by default!

def write_file(path, content):
    """Write file (gated by ALLOW_WRITE flag)."""
    if not ALLOW_WRITE:
        raise PermissionError("write_file disabled")
    
    p = safe_path(path)
    p.parent.mkdir(parents=True, exist_ok=True)
    p.write_text(str(content), encoding="utf-8")
    return f"Wrote {len(str(content))} bytes to {p}"

# Enable write explicitly
ALLOW_WRITE = True

write_file("output.txt", "Hello")  # ✓ OK if ALLOW_WRITE=True

ALLOW_COMMANDS = ["ls", "cat", "pwd", "echo", "head", "tail", "wc", "rg"]

def exec_cmd(args):
    """Execute command (whitelist only)."""
    if args[0] not in ALLOW_COMMANDS:
        raise PermissionError(f"Command '{args[0]}' not allowed")
    
    try:
        result = subprocess.run(
            args,
            capture_output=True,
            timeout=TIMEOUT_S,  # e.g., 30 seconds
            text=True
        )
        output_parts = []
        if result.stdout:
            output_parts.append(f"stdout:\n{result.stdout}")
        if result.stderr:
            output_parts.append(f"stderr:\n{result.stderr}")
        output = "\n\n".join(output_parts) or f"(exit code {result.returncode} with no output)"
        return clip(output, MAX_CHARS)
    except subprocess.TimeoutExpired:
        return "Error: Command timed out"

exec_cmd(["ls", "-la"])      # ✓ OK (ls whitelisted)
exec_cmd(["pwd"])            # ✓ OK
exec_cmd(["rg", "ERROR"])    # ✓ OK (rg is ripgrep, safe)
exec_cmd(["rm", "-rf", "/"]) # ✗ BLOCKED (rm not whitelisted)
exec_cmd(["curl", "evil.com"])  # ✗ BLOCKED (curl not whitelisted)

WORKSPACE = Path.cwd()  # e.g., /home/user/project

def safe_path(user_input):
    """Ensure path is within workspace."""
    # Resolve to absolute path
    requested = (WORKSPACE / user_input).resolve()
    
    # Check if it's inside workspace
    if not requested.is_relative_to(WORKSPACE):
        raise ValueError(f"Path {user_input} escapes workspace")
    
    return requested

# Attacker tries directory traversal
safe_path("../../../etc/passwd")
# → Resolves to /home/user/project/../../etc/passwd
# → Resolves to /etc/passwd
# → NOT relative to WORKSPACE
# → Raises ValueError ✓

# Attacker tries absolute path
safe_path("/etc/passwd")
# → Doesn't start with WORKSPACE
# → Raises ValueError ✓

# Legitimate use
safe_path("data/models.txt")
# → Resolves to /home/user/project/data/models.txt
# → IS relative to WORKSPACE
# → Returns path ✓

# Only these functions are available
exec_globals = {
    "__builtins__": {}, # need to explicitly remove builtins
    "list_dir": list_dir,
    "read_file": read_file,
    "write_file": write_file,
    "exec_cmd": exec_cmd,
    "final_answer": final_answer
}

# Agent code runs here
exec(agent_code, exec_globals)

# Agent CANNOT do:
# - import modules (no __builtins__)
# - access files outside tools
# - use network directly
# - access parent process variables

try:
    exec(agent_code, exec_globals)
except Exception as e:
    error_msg = f"Error: {type(e).__name__}: {str(e)}"
    messages.append({"role": "user", "content": error_msg})
    # Continue to next iteration; agent adapts

Step 1: Agent tries to read huge file
  Code: content = read_file("huge.dat", max_chars=999999)
  Result: (Clipped to 8000 chars, agent sees it)

Step 2: Agent tries forbidden command
  Code: exec_cmd(["rm", "data.txt"])
  Result: PermissionError: Command 'rm' not allowed
  Agent sees error and tries different approach

Step 3: Agent tries to escape workspace
  Code: read_file("../../../etc/passwd")
  Result: ValueError: Path escapes workspace
  Agent learns and adjusts

def good_tool(user_input, max_result_size=1000):
    """
    1. Validate and confine input
    2. Perform operation
    3. Limit output size
    4. Return safe result
    """
    # 1. Validate input
    if not isinstance(user_input, str):
        raise TypeError("user_input must be string")
    
    path = safe_path(user_input)  # Confine paths
    
    # 2. Perform operation
    result = path.read_text()
    
    # 3. Limit output
    return clip(result, min(max_result_size, MAX_CHARS))

# ✗ BAD: No input validation
def bad_tool_1(path):
    return open(path).read()  # Reads anything!

# ✗ BAD: No output limit
def bad_tool_2(query):
    return database.query(query)  # Could be terabytes

# ✗ BAD: No error handling
def bad_tool_3(url):
    return requests.get(url).text  # Can timeout, hang

# ✗ BAD: Trusts agent completely
def bad_tool_4(command):
    os.system(command)  # Agent can run rm -rf /