@@ -62,6 +62,20 @@ Initial open-source release of FrontierAgent.
 
 ### Fixed
 
+- **A write the path gate refused no longer reaches the host.** `write_file` and
+  `file_editor_create` fall back to the sandbox when local authorization fails,
+  and for the in-process `CurrentSandbox` that fallback is an `open()` in the
+  harness (as root, in container mode), so a refused path was written anyway.
+  That branch now authorizes the path itself; remote backends are unaffected.
+- **Paths are quoted before reaching a sandbox shell.** `file_editor`'s view /
+  create / str_replace commands, `write_file`'s `mkdir -p`, and the Docker
+  `mkdir -p` interpolated the path unquoted, so a path containing `;` ran
+  commands that never passed the bash policy.
+- **A system directory named as the workspace root grants nothing.** The root
+  arrives through `ExecutionScope` metadata (workload input), and
+  `{"workspace_root": "/etc"}` made `/etc` readable and writable. System roots
+  and direct children of `/usr` and `/etc` are refused; a run directory deep
+  under `/var` or `/opt` (a container volume, macOS `$TMPDIR`) still works.
 - Bash policy: privilege escalation (`sudo`/`su`/…), remote/exfil clients
   (`ssh`/`nc`/`rsync`/…) and signal senders (`kill`/`pkill`/`killall`) are now
   refused in every allowlist mode, including the default `off`. The local CLI
 
@@ -41,8 +41,49 @@
 _WORD_SPLIT = re.compile(r"[^a-z0-9]+")
 
 
+#: Roots that can never BECOME a workspace: naming one as the workspace root
+#: would authorize the whole system tree for reads, and — outside the service
+#: checkout, which is the only thing ``_is_isolated_workspace_root`` refuses —
+#: for writes too. The workspace root arrives through ExecutionScope metadata,
+#: which carries workload input: a benchmark runner's trial directory is a
+#: legitimate value, ``/etc`` is not, and this module cannot tell which caller
+#: filled the key in. So the VALUE is constrained rather than the caller.
+#:
+#: A path may still live under one of these (a container's ``/var/lib/...``
+#: volume, ``/opt/app/run-17``): only naming the root itself, or a direct
+#: system subdirectory of it, is refused. ``/tmp`` is absent — a scratch
+#: workspace under it is ordinary — and so is ``/home``, whose per-user
+#: subdirectories are where a local CLI run actually lives.
+_NEVER_A_WORKSPACE_ROOT = frozenset({
+    "/", "/etc", "/usr", "/bin", "/sbin", "/lib", "/lib64", "/boot", "/dev",
+    "/proc", "/sys", "/var", "/root", "/opt", "/home",
+})
+
+
+#: Roots whose direct children are no more suitable than the root itself:
+#: ``/usr/local`` and ``/etc/cron.d`` grant exactly the writes that make naming
+#: them an escalation. ``/var`` and ``/opt`` are deliberately absent — a
+#: container volume at ``/var/lib/app/run`` and macOS ``$TMPDIR`` under
+#: ``/var/folders/...`` are real run directories, and refusing them is the
+#: over-denial that loses a run's deliverables.
+_NEVER_A_WORKSPACE_PARENT = frozenset({"/usr", "/etc", "/bin", "/sbin", "/boot", "/proc", "/sys"})
+
+
+def _is_system_root(candidate: Path) -> bool:
+    """Whether ``candidate`` is a system root, or a direct child of a system
+    directory whose children are equally unsuitable."""
+    # Compare canonical paths too: macOS maps /etc and /var into /private,
+    # and other hosts may expose system directories through aliases.
+    roots = {Path(root).resolve() for root in _NEVER_A_WORKSPACE_ROOT}
+    parents = {Path(root).resolve() for root in _NEVER_A_WORKSPACE_PARENT}
+    return candidate in roots or candidate.parent in parents
+
+
 def _configured_workspace_root() -> Path | None:
-    """Return the explicit workspace root, if one was configured for this task."""
+    """Return the explicit workspace root, if one was configured for this task.
+
+    The value is checked, not its source: see ``_NEVER_A_WORKSPACE_ROOT``.
+    """
     scope = get_current_execution_scope()
     metadata = scope.metadata if scope else {}
     raw_root = (
@@ -56,6 +97,12 @@ def _configured_workspace_root() -> Path | None:
     if not workspace_root.is_dir():
         logger.warning("Ignoring invalid CODING_WORKSPACE_ROOT '%s'", raw_root)
         return None
+    if _is_system_root(workspace_root):
+        logger.warning(
+            "Refusing workspace root '%s': a system directory cannot be a "
+            "workspace, so it grants no filesystem access", raw_root,
+        )
+        return None
     return workspace_root
 
 
 
@@ -3000,6 +3000,22 @@ def shell_quote(s: str) -> str:
     return "'" + s.replace("'", "'\\''") + "'"
 
 
+def _local_write_refusal(path: str) -> str:
+    """Why the path gate refuses writing ``path`` on this host, or "".
+
+    Only consulted for the in-process write branch below. Imported lazily:
+    ``_path_auth`` imports this module.
+    """
+    try:
+        from plugins.tools._path_auth import _is_path_allowed
+    except Exception as exc:  # pragma: no cover - broken install
+        return f"path authorization unavailable: {exc}"
+    allowed, reason = _is_path_allowed(path, write_access=True)
+    if allowed:
+        return ""
+    return reason or f"write to {path!r} is not authorized"
+
+
 def sandbox_write_file(
     sandbox: Any, path: str, content: str, *, mode: str = "w",
 ) -> tuple[bool, str]:
@@ -3021,9 +3037,19 @@ def sandbox_write_file(
     # (128 KB), so routing deliverables through it fails with E2BIG somewhere
     # around 96 KB of content — and container mode has no /tmp fallback, so the
     # write becomes a hard error. The harness process already has the mount
-    # bound read-write and the path has passed ``_path_auth``; writing it
-    # directly is both unlimited and cheaper (no bwrap + python3 spawn).
+    # bound read-write, so writing it directly is both unlimited and cheaper
+    # (no bwrap + python3 spawn).
+    #
+    # This branch is an ordinary ``open()`` in the harness process — as root, in
+    # container mode — so it is NOT a sandbox boundary, and the path has to be
+    # authorized HERE. Its callers (``write_file``, ``file_editor_create``)
+    # reach the sandbox precisely when ``_path_auth`` refused a local write, and
+    # for a CurrentSandbox that made the refusal a detour rather than a denial:
+    # a path the gate rejected was written to the host anyway.
     if isinstance(sandbox, CurrentSandbox):
+        reason = _local_write_refusal(path)
+        if reason:
+            return False, reason
         try:
             p = Path(path)
             new_parent = not p.parent.exists()
@@ -3051,7 +3077,7 @@ def sandbox_write_file(
     if mode == "w" and isinstance(sandbox, DockerSandbox):
         parent = os.path.dirname(path)
         if parent:
-            sandbox.commands.run(f"mkdir -p {parent}", timeout=10)
+            sandbox.commands.run(f"mkdir -p {shell_quote(parent)}", timeout=10)
         with tempfile.NamedTemporaryFile(
             mode="w", encoding="utf-8", delete=False, suffix=".tmp",
         ) as f:
 
@@ -3,14 +3,17 @@
 from __future__ import annotations
 
 import logging
+import re
 
 from frontier_agent.core.tool import tool
+from plugins.tools import _sandbox
 from plugins.tools._deliverable_policy import output_write_error
 from plugins.tools._path_auth import _authorized_local_path
 from plugins.tools._sandbox import (
     aget_sandbox,
     arun_sandbox_cmd,
     asandbox_write_file,
+    shell_quote,
 )
 
 logger = logging.getLogger(__name__)
@@ -39,6 +42,16 @@ async def file_editor_view(path: str, view_range: str = "") -> str:
     if not path or not path.strip():
         return "Error: path is required."
 
+    line_range: tuple[int, int] | None = None
+    if view_range:
+        match = re.fullmatch(r"\s*([0-9]+)\s*-\s*([0-9]+)\s*", view_range)
+        if match is None:
+            return "Error: view_range must be a positive line range like 1-50."
+        start, end = int(match[1]), int(match[2])
+        if start < 1 or end < start:
+            return "Error: view_range must be a positive line range like 1-50."
+        line_range = start, end
+
     local_path, _reason = _authorized_local_path(path)
     if local_path is not None:
         from plugins.tools.ignore_rules import discover_repo_root, should_ignore_path
@@ -64,12 +77,7 @@ async def file_editor_view(path: str, view_range: str = "") -> str:
             lines = local_path.read_text(encoding="utf-8").splitlines()
         except Exception as e:
             return f"Error viewing {path}: {e}"
-        if view_range and "-" in view_range:
-            start_s, end_s = view_range.split("-", 1)
-            start = max(int(start_s.strip() or "1"), 1)
-            end = max(int(end_s.strip() or str(start)), start)
-        else:
-            start, end = 1, len(lines)
+        start, end = line_range if line_range is not None else (1, len(lines))
         rendered = "\n".join(f"{idx}: {line}" for idx, line in enumerate(lines[start - 1:end], start=start))
         return _truncate(rendered or "(empty file)")
 
@@ -78,33 +86,33 @@ async def file_editor_view(path: str, view_range: str = "") -> str:
     except RuntimeError as e:
         return f"Error: {e}"
 
+    # Every path below is interpolated into a shell command, so it is quoted
+    # once here: an unquoted path containing ``;`` or ``$(…)`` would run
+    # arbitrary commands in the sandbox without passing the bash policy.
+    q = shell_quote(path)
     try:
         check = await arun_sandbox_cmd(
             sandbox,
-            f"test -d {path} && echo DIR || echo FILE", timeout=10,
+            f"test -d {q} && echo DIR || echo FILE", timeout=10,
         )
         is_dir = "DIR" in check.stdout
 
         if is_dir:
             result = await arun_sandbox_cmd(
                 sandbox,
-                f"find {path} -maxdepth 2 -not -path '*/.git/*' "
+                f"find {q} -maxdepth 2 -not -path '*/.git/*' "
                 f"-not -path '*/node_modules/*' -not -path '*/__pycache__/*' "
                 f"| head -100 | sort",
                 timeout=15,
             )
             return _truncate(result.stdout or f"(empty directory: {path})")
 
         # File view
-        if view_range:
-            parts = view_range.split("-")
-            if len(parts) == 2:
-                start, end = parts[0].strip(), parts[1].strip()
-                cmd = f"sed -n '{start},{end}p' {path} | cat -n"
-            else:
-                cmd = f"cat -n {path}"
+        if line_range is not None:
+            start, end = line_range
+            cmd = f"sed -n {shell_quote(f'{start},{end}p')} -- {q} | cat -n"
         else:
-            cmd = f"cat -n {path}"
+            cmd = f"cat -n -- {q}"
 
         result = await arun_sandbox_cmd(sandbox, cmd, timeout=15)
 
@@ -154,9 +162,9 @@ async def file_editor_create(path: str, content: str) -> str:
     try:
         import os
         parent = os.path.dirname(path)
-        if parent:
+        if parent and not isinstance(sandbox, _sandbox.CurrentSandbox):
             await arun_sandbox_cmd(
-                sandbox, f"mkdir -p {parent}", timeout=10,
+                sandbox, f"mkdir -p {shell_quote(parent)}", timeout=10,
             )
 
         # Write via python in sandbox (avoids files.write permission issues)
@@ -165,7 +173,7 @@ async def file_editor_create(path: str, content: str) -> str:
             return f"Error creating {path}: {err}"
 
         result = await arun_sandbox_cmd(
-            sandbox, f"wc -l < {path}", timeout=5,
+            sandbox, f"wc -l < {shell_quote(path)}", timeout=5,
         )
         lines = result.stdout.strip() if result.stdout else "?"
 
@@ -232,7 +240,9 @@ async def file_editor_str_replace(path: str, old_str: str, new_str: str) -> str:
 
     try:
         # Read current content via cat (more reliable than files.read for all paths)
-        result = await arun_sandbox_cmd(sandbox, f"cat {path}", timeout=10)
+        result = await arun_sandbox_cmd(
+            sandbox, f"cat -- {shell_quote(path)}", timeout=10,
+        )
         if result.exit_code != 0:
             return f"Error: Cannot read {path}: {result.stderr or 'file not found'}"
         content = result.stdout
 
@@ -10,6 +10,7 @@
 import os
 
 from frontier_agent.core.tool import tool
+from plugins.tools import _sandbox
 from plugins.tools._deliverable_policy import output_write_error
 from plugins.tools._path_auth import _authorized_local_path
 from plugins.tools._sandbox import (
@@ -19,6 +20,7 @@
     resolve_runtime_path,
     resolve_sandbox_mode,
     sandbox_available,
+    shell_quote,
 )
 
 logger = logging.getLogger(__name__)
@@ -73,9 +75,9 @@ async def write_file(path: str, content: str, append: bool = False) -> str:
         try:
             sandbox = await aget_sandbox()
             parent = os.path.dirname(path)
-            if parent:
+            if parent and not isinstance(sandbox, _sandbox.CurrentSandbox):
                 await arun_sandbox_cmd(
-                    sandbox, f"mkdir -p {parent}", timeout=10,
+                    sandbox, f"mkdir -p {shell_quote(parent)}", timeout=10,
                 )
 
             mode = "a" if append else "w"