add file_read/file_write tools, sandbox tests, CI improvements (#239)

* migrate to flags

* init

* iterate on file write lockdown tests

* improve ci

* fix lockfile

* fix typecheck

* fix lint

* improve pushRestricted

* ok

* fix more

* ok

* remove process.env spreading rule

Co-authored-by: Cursor <cursoragent@cursor.com>

* enhanced fs rw tools

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Colin McDonnell <colinmcd94@gmail.com>

agents/cursor.ts

@@ -398,10 +398,12 @@ function configureCursorTools(ctx: AgentRunContext): void {
   if (ctx.payload.search === "disabled") deny.push("WebSearch");
   // both "disabled" and "restricted" block native shell
   if (bash !== "enabled") deny.push("Shell(*)");
+  // always block native file tools (use MCP file_read/file_write instead)
+  deny.push("Read(*)", "Write(*)", "StrReplace(*)", "EditNotebook(*)", "Delete(*)");
 
   const config: CursorCliConfig = {
     permissions: {
-      allow: ["Read(**)", "Write(**)"],
+      allow: [],
       deny,
     },
   };