AIKIDO-2026-357199

TL;DR

The LocalBackend permission ruleset only consulted deny rules on the read, write, and edit operations and the execute command-pattern check, while content-returning paths ignored the ruleset. read_bytes, grep_raw, and ls_info/glob_info returned file bytes, search matches, and directory listings for paths a configured deny rule was meant to block, so a rule such as **/restricted/** or **/.env* could be bypassed to read, search, or list restricted files. The fix applies the same read/grep/ls/glob deny checks on every content-returning path and adds a best-effort path guard on the execute paths. Denied reads now return empty bytes, denied grep matches are hidden, and denied listing entries are omitted.