Phi 0.29 makes child agents obey parent permission limits
Phi 0.29 introduces stricter checks on file paths and child-agent working directories. Unresolvable symbolic links are denied, and read-only sessions cannot launch children. Permission rules can tighten existing policy without loosening it. The project’s release document also states an important limit: these checks do not constitute an operating-system sandbox against concurrent changes to the filesystem.
Artificial Intelligence··Midday
Child agents inherit the boundary
Phi 0.29.0 checks child agents’ working directories against the parent workspace, whether those directories are inherited or explicitly supplied. Relative directories are resolved consistently. In headless operation, access outside the workspace is refused; interactive use requires approval for such a directory. Read-only sessions cannot launch child agents. Children also obey the parent’s sensitive-path, read and shell restrictions. The primary release document associates this correction with CVE-2026-108595; the project’s release document is the single source for these changes.[1]
Unresolved links close access
Workspace and sensitive-path checks now resolve symbolic links in existing paths and their ancestors. A dangling link or otherwise unresolvable path is denied, replacing a fallback to textual path comparison. File access remains closed when a sensitive-path prefix contains a broken link, pending its repair. The release associates this change with CVE-2026-108599. It explicitly limits the protection: concurrent filesystem changes remain outside the protection of these permission checks, which lack operating-system isolation.[1]
Rules can tighten existing policy
The permissions.rules setting adds rules for a tool, operation type, command, path or workspace. Denial takes priority over asking, and asking over allowing, so the rules can tighten policy but cannot loosen it. The release also prevents deletion of unmerged local branches. A separate Gemini correction preserves original tool-call arguments, avoiding a decode-and-re-encode conversion that could round large integers. These functions are described by the project, without a claimed independent security evaluation.[1]
