@@ -105,6 +105,14 @@ ACL 幂等检查不能只按路径缓存。Windows 不隔离网络，Everyone/
 **权限清单与审批扩展(openspec align-codex-sandboxing)**:`SandboxPolicy` 由 read /
 write / deny 三类条目派生(`config.sandbox.filesystem.*` + 默认 deny 名单 + 会话授权),
 判定「最长前缀优先,同深度 deny > write > read」;Windows 受限令牌管不了读,deny 只拦写。
+**比较两侧必须同口径**:策略条目是 canonical 形态(`make_sandbox_policy` 已 weakly_canonical),
+待判路径(`resolve_access`、`is_denied`、授权过滤 `denied_by`、「只放行该目录」建议)一律先
+`canonical_utf8` 再比 —— 曾经授权与建议拿词法形态比,经 junction 别名(本机 `C:\Users\shao` →
+`N:\Users\shao`)申请 `~/.ssh` 下尚不存在的目录就绕过了 deny 名单。单测里手拼 `SandboxPolicy`
+也要用 `canonical_policy_path` 填条目:Windows 上 `/work` 按当前盘解析,当前盘恰好有 `\work`
+(本机 `C:\work`)时未规范化的条目对不上,用例随机器时过时不过。回归:
+`sandbox_policy_test.cpp::DenyListStillWinsWhenGrantUsesDirectoryAlias`、
+`sandbox_denial_test.cpp::SuggestedWriteRootRejectsDeniedDirectoryReachedThroughAlias`。
 bash 参数是 Codex 同款 `sandbox_permissions=use_default|with_additional_permissions|require_escalated`
 + `additional_permissions` + `prefix_rule`(旧 `with_escalated_permissions` 是别名)。
 决策表新增 `unattended`:active goal 下越权 / 额外权限申请一律 Forbidden(`escalation_unattended`),
 
@@ -144,7 +144,8 @@ Seatbelt 策略按 Codex `create_seatbelt_command_args_with_profile` 组装：
 临时加上申请的路径 / 网络）、`require_escalated`（申请沙盒外执行）；旧参数
 `with_escalated_permissions=true` 等价 `require_escalated`。非 `use_default` 必须带非空
 `justification`；`with_additional_permissions` 必须带非空 `additional_permissions`，路径必须是
-绝对路径或 `~` 开头；deny 名单里的路径不能通过申请变可写。`prefix_rule` 是模型建议的可记住
+绝对路径或 `~` 开头；deny 名单里的路径不能通过申请变可写 —— 判定前申请路径与 deny 条目都按真实
+路径规范化，经 junction / 符号链接别名（如 `C:\Users\x` 指向 `N:\Users\x`）写的路径同样被拦。`prefix_rule` 是模型建议的可记住
 前缀，必须覆盖全部命令段且不在禁用名单里才被采用。
 
 请求确认时，`args.permission` 给出原因、批准后的沙盒边界、可记忆前缀、申请的额外权限、
 
@@ -181,13 +181,9 @@ std::string suggested_write_root(const SandboxViolation& violation, const Sandbo
     // 已经可写的目录不是「被拒」的原因;deny 名单里的目录不能通过申请变可写。
     if (policy.can_write(candidate)) return {};
     if (policy.resolve_access(candidate) == FsAccess::Deny && !policy.full_disk_read()) return {};
-    for (const auto& denied : policy.denied_paths) {
-        const auto rel = path_from_utf8(candidate).lexically_relative(path_from_utf8(denied));
-        if (!rel.empty() && *rel.begin() != "..") return {};
-    }
-    for (const auto& glob : policy.denied_globs) {
-        if (glob_matches_path(glob, candidate)) return {};
-    }
+    // 候选目录不存在时只是词法形态;is_denied 与 resolve_access 同口径规范化后再比,
+    // 经别名(junction / 符号链接)写的被拒路径也认得出 deny 名单。
+    if (policy.is_denied(candidate)) return {};
     return candidate;
 }
 
 
@@ -487,7 +487,10 @@ void expand_denied_entries(const SandboxPolicyOptions& options, const EntryConte
 
 bool denied_by(const std::vector<std::string>& denied_paths, const std::vector<std::string>& denied_globs,
                const std::string& path) {
-    const std::string p = comparable(path);
+    // deny 条目是 canonical 形态,待判路径按 resolve_access 的同一口径先规范化。申请路径
+    // 指向尚不存在的目录时 normalize_policy_path 只做词法归一,经 junction / 符号链接的
+    // 别名(C:\Users\x → N:\Users\x)逐字比较就漏判,~/.ssh 下的新目录会被授权成可写根。
+    const std::string p = comparable(canonical_utf8(path));
     for (const auto& d : denied_paths) {
         if (is_same_or_under(comparable(d), p)) return true;
     }
@@ -499,6 +502,10 @@ bool denied_by(const std::vector<std::string>& denied_paths, const std::vector<s
 
 } // namespace
 
+bool SandboxPolicy::is_denied(const std::string& absolute_path) const {
+    return denied_by(denied_paths, denied_globs, absolute_path);
+}
+
 std::vector<WritableRoot> compute_writable_roots(const std::string& write_root,
                                                  const SandboxPolicyOptions& options) {
     std::vector<WritableRoot> roots;
 
@@ -57,6 +57,8 @@ struct SandboxPolicy {
     FsAccess resolve_access(const std::string& absolute_path) const;
     bool can_write(const std::string& absolute_path) const;
     bool can_read(const std::string& absolute_path) const;
+    // 路径本身或其祖先在 deny 名单 / deny glob 上(不看可写根)。
+    bool is_denied(const std::string& absolute_path) const;
 };
 
 // AgentLoop 注入到 ToolContext 的"这次 bash 怎么跑":策略 + 用哪个后端 +
 
@@ -1,5 +1,8 @@
 #include <gtest/gtest.h>
 #include "sandbox/sandbox_denial.hpp"
+#include "sandbox/sandbox_policy.hpp"
+#include "test_support/sandbox/test_support.hpp"
+#include "utils/utf8_path.hpp"
 #include <csignal>
 
 using namespace acecode::sandbox;
@@ -62,12 +65,15 @@ TEST(SandboxDenial, ExtractsDeniedPathAcrossPlatforms) {
 // 场景:给「只放行该目录」算建议目录。期望:被拒路径是文件 → 父目录;已经可写的
 // 目录不建议(不是被拒原因);deny 名单里的目录 / 命中 deny glob 的目录不建议;
 // 相对路径不建议。
+// 条目按 make_sandbox_policy 的约定先规范化(canonical_policy_path):Windows 上 `/work`
+// 按当前盘解析,当前盘有 \work 目录时(本机 C:\work)候选目录会变成 C:\work。
+// 回归:条目曾直接写 `/work`,在存在 C:\work 的机器上「已可写」判不出来,建议成了 "C:\work"。
 TEST(SandboxDenial, SuggestedWriteRootRespectsPolicyAndDenyList) {
     SandboxPolicy policy;
     policy.mode = SandboxMode::WorkspaceWrite;
-    policy.writable_roots = {{"/work", {}}};
-    policy.denied_paths = {"/home/u/.ssh"};
-    policy.denied_globs = {"/home/u/**/.secrets"};
+    policy.writable_roots = {{canonical_policy_path("/work"), {}}};
+    policy.denied_paths = {canonical_policy_path("/home/u/.ssh")};
+    policy.denied_globs = {canonical_policy_path("/home/u") + "/**/.secrets"};
     SandboxViolation v;
     v.path = "/home/u/.cache/pnpm/store.lock";
     EXPECT_EQ(suggested_write_root(v, policy), "/home/u/.cache/pnpm");
@@ -83,6 +89,37 @@ TEST(SandboxDenial, SuggestedWriteRootRespectsPolicyAndDenyList) {
     EXPECT_EQ(suggested_write_root(v, policy), "");
 }
 
+// 场景:命令报 <别名>/.ssh/newdir/key 被拒,其中别名是指向真实家目录的 junction /
+// 符号链接(本机 C:\Users\shao → N:\Users\shao),newdir 还不存在;deny 名单里的 ~/.ssh
+// 是 canonical 的真实路径。另有一个经别名写、但不在 deny 名单里的普通目录。
+// 期望:.ssh 下的目录不给「只放行该目录」建议;普通目录照常建议(修复不能误伤)。
+// 回归:建议逻辑拿词法形态的候选目录和 canonical 的 deny 条目做 lexically_relative,别名
+// 形态对不上,越权确认框里出现「只放行 <别名>/.ssh/newdir」的选项。
+TEST(SandboxDenial, SuggestedWriteRootRejectsDeniedDirectoryReachedThroughAlias) {
+    acecode::sandbox::test::TempTree tree;
+    const auto real_home = tree.dir("real-home");
+    tree.dir("real-home/.ssh");
+    const auto workspace = tree.dir("work");
+    const auto alias_home = tree.root / "alias-home";
+    if (!acecode::sandbox::test::make_directory_alias(real_home, alias_home)) {
+        GTEST_SKIP() << "cannot create a directory alias here";
+    }
+    SandboxPolicyOptions options;
+    options.include_tmpdir = false;
+    options.home_override = acecode::path_to_utf8(alias_home);
+    options.denied_entries = {"~/.ssh"};
+    const auto policy = make_sandbox_policy(
+        SandboxMode::WorkspaceWrite, acecode::path_to_utf8(workspace), options);
+
+    SandboxViolation v;
+    v.path = acecode::path_to_utf8(alias_home / ".ssh" / "newdir" / "key");
+    EXPECT_EQ(suggested_write_root(v, policy), "");
+    v.path = acecode::path_to_utf8(alias_home / ".ssh" / "key");
+    EXPECT_EQ(suggested_write_root(v, policy), "");
+    v.path = acecode::path_to_utf8(alias_home / "projects" / "out.txt");
+    EXPECT_NE(suggested_write_root(v, policy), "") << "deny 名单之外的普通目录照常建议";
+}
+
 // 场景:升级提示文案。期望:后端不拦网络且不做准断网(旧 Windows 语义)时不提网络;
 // 拦网络时说"blocked";准断网时说"discouraged";带被拒路径时先建议
 // with_additional_permissions 只加该目录,再提 require_escalated;deny 名单存在时
 
@@ -83,15 +83,29 @@ TEST(SandboxPolicy, GlobMatchingFollowsGitStyleSemantics) {
     EXPECT_FALSE(glob_matches_path("/home/u/[!a]*.key", "/home/u/a1.key"));
 }
 
+namespace {
+
+// 手工拼的策略也要守 make_sandbox_policy 的约定:条目是 canonical 形态
+// (WritableRoot::root 等「已 weakly_canonical」),查询路径由 resolve_access 自己规范化。
+// Windows 上 `/work` 这类无盘符路径按当前盘解析:当前盘恰好有 \work 目录时(本机
+// 2026-09-22 起就有 C:\work)查询变成 C:\work\...,未规范化的条目还是 /work,两侧对不上 ——
+// 旧写法让用例随机器上有没有这个目录时过时不过。
+std::string canon(const std::string& path) { return canonical_policy_path(path); }
+
+} // namespace
+
 // 场景:deny 名单、可写根、只读子路径、可读根共存时的访问判定。期望:最长前缀
 // 命中优先(写根下的 deny 子目录仍 Deny;deny 目录下配置的写根反而可写),同深度
 // deny > write > read;全盘可读时未命中的路径 Read,受限读时 Deny;FullAccess 恒 Write。
+// 回归:条目曾直接写 `/work` 而不经规范化,在存在 C:\work 的 Windows 机器上
+// `/work/src/main.cpp` 判成 Read、`/work/secrets/key` 判成 Read(期望 Write / Deny)。
 TEST(SandboxPolicy, ResolveAccessPrefersDeepestEntryThenDenyWriteRead) {
     SandboxPolicy policy;
     policy.mode = SandboxMode::WorkspaceWrite;
-    policy.writable_roots = {{"/work", {"/work/.acecode/rules"}}, {"/home/u/.cache/allowed", {}}};
-    policy.denied_paths = {"/work/secrets", "/home/u/.cache"};
-    policy.denied_globs = {"/work/**/.env"};
+    policy.writable_roots = {{canon("/work"), {canon("/work/.acecode/rules")}},
+                             {canon("/home/u/.cache/allowed"), {}}};
+    policy.denied_paths = {canon("/work/secrets"), canon("/home/u/.cache")};
+    policy.denied_globs = {canon("/work") + "/**/.env"};
     EXPECT_EQ(policy.resolve_access("/work/src/main.cpp"), FsAccess::Write);
     EXPECT_EQ(policy.resolve_access("/work/.acecode/rules/x.rules"), FsAccess::Read);
     EXPECT_EQ(policy.resolve_access("/work/secrets/key"), FsAccess::Deny);
@@ -101,19 +115,58 @@ TEST(SandboxPolicy, ResolveAccessPrefersDeepestEntryThenDenyWriteRead) {
     EXPECT_EQ(policy.resolve_access("/etc/hosts"), FsAccess::Read) << "全盘可读";
     EXPECT_TRUE(policy.can_read("/etc/hosts"));
     EXPECT_FALSE(policy.can_write("/etc/hosts"));
-    policy.readable_roots = {"/work", "/usr"};
+    policy.readable_roots = {canon("/work"), canon("/usr")};
     EXPECT_EQ(policy.resolve_access("/etc/hosts"), FsAccess::Deny) << "受限读未命中";
     EXPECT_EQ(policy.resolve_access("/usr/lib/libc.so"), FsAccess::Read);
     SandboxPolicy full;
     EXPECT_EQ(full.resolve_access("/anything"), FsAccess::Write);
     // 同深度:同一路径既是写根又在 deny 里 → Deny。
     SandboxPolicy tie;
     tie.mode = SandboxMode::WorkspaceWrite;
-    tie.writable_roots = {{"/both", {}}};
-    tie.denied_paths = {"/both"};
+    tie.writable_roots = {{canon("/both"), {}}};
+    tie.denied_paths = {canon("/both")};
     EXPECT_EQ(tie.resolve_access("/both/x"), FsAccess::Deny);
 }
 
+// 场景:家目录经 junction / 符号链接以「别名」出现(本机实况:C:\Users\shao 是指向
+// N:\Users\shao 的 junction)。deny 名单里的 ~/.ssh 已按 canonical 展开成真实路径;
+// 申请(模型的 additional_permissions、会话授权)写的却是 <别名>/.ssh/newdir —— 目录还
+// 不存在,normalize_policy_path 只做词法归一,别名原样留着。
+// 期望:deny 名单仍压过授权 —— 授权被忽略,真实路径与别名路径下都不可写,is_denied
+// 对两种形态都成立。
+// 回归:deny 判定(denied_by)拿未规范化的授权路径和 canonical 的 deny 条目逐字比较,
+// 别名形态对不上,授权进了可写根;又因为「更深的写根压过浅的 deny」,~/.ssh 下的新
+// 目录变成可写。
+TEST(SandboxPolicy, DenyListStillWinsWhenGrantUsesDirectoryAlias) {
+    test::TempTree tree;
+    const auto real_home = tree.dir("real-home");
+    tree.dir("real-home/.ssh");
+    const auto workspace = tree.dir("work");
+    const auto alias_home = tree.root / "alias-home";
+    if (!test::make_directory_alias(real_home, alias_home)) {
+        GTEST_SKIP() << "cannot create a directory alias here";
+    }
+    const std::string alias_grant = normalize_policy_path(path_to_utf8(alias_home / ".ssh" / "newdir"));
+    ASSERT_NE(alias_grant.find("alias-home"), std::string::npos) << "申请路径保持别名形态";
+    const std::string real_newdir = path_to_utf8(fs::weakly_canonical(real_home / ".ssh" / "newdir"));
+
+    SandboxPolicyOptions options;
+    options.include_tmpdir = false;
+    options.home_override = path_to_utf8(alias_home);
+    options.denied_entries = {"~/.ssh"};
+    options.grants.write = {alias_grant};
+    const auto policy = make_sandbox_policy(SandboxMode::WorkspaceWrite, path_to_utf8(workspace), options);
+
+    for (const auto& root : policy.writable_roots) {
+        EXPECT_EQ(root.root.find(".ssh"), std::string::npos) << "deny 名单下的授权进了可写根: " << root.root;
+    }
+    EXPECT_EQ(policy.resolve_access(real_newdir + "/id_rsa"), FsAccess::Deny);
+    EXPECT_EQ(policy.resolve_access(alias_grant + "/id_rsa"), FsAccess::Deny);
+    EXPECT_TRUE(policy.is_denied(alias_grant));
+    EXPECT_TRUE(policy.is_denied(real_newdir));
+    EXPECT_FALSE(policy.is_denied(path_to_utf8(workspace / "src")));
+}
+
 // 场景:make_sandbox_policy 把配置条目、默认 deny 名单、会话授权揉进策略。期望:
 // deny 展开成绝对路径 / glob;落在可写根下的 deny 路径同时列为只读子路径(三平台
 // 写拒绝一致);授权的写路径进可写根,但在 deny 名单上的授权被忽略;配置了 read
 
@@ -3,6 +3,7 @@
 #include "utils/utf8_path.hpp"
 #include <atomic>
 #include <chrono>
+#include <cstdlib>
 #include <filesystem>
 #include <fstream>
 #include <string>
@@ -31,4 +32,20 @@ struct TempTree {
         std::ofstream(path, std::ios::binary) << text;
     }
 };
+
+// 给 target 目录建一个别名目录:Windows 用 junction(mklink /J,普通用户即可,本机
+// C:\Users\shao → N:\Users\shao 就是这种形态),POSIX 用符号链接。失败返回 false,
+// 调用方 GTEST_SKIP。
+inline bool make_directory_alias(const std::filesystem::path& target,
+                                 const std::filesystem::path& alias) {
+#ifdef _WIN32
+    const std::string cmd = "cmd /d /c mklink /J \"" + acecode::path_to_utf8(alias) + "\" \"" +
+                            acecode::path_to_utf8(target) + "\" >NUL 2>&1";
+    return std::system(cmd.c_str()) == 0 && std::filesystem::exists(alias);
+#else
+    std::error_code ec;
+    std::filesystem::create_directory_symlink(target, alias, ec);
+    return !ec;
+#endif
+}
 }