{"path":"LIMITATIONS.md","size":1281,"locked":false,"binary":false,"truncated":false,"content":"# LIMITATIONS & COMPATIBILITY — AgentSafeWorkspace SDK\n\n### Documented Limitations & Out-of-Scope Boundaries\n\n1. **In-Process Boundary vs Hypervisor:**\n   - AgentSafeWorkspace is an application-level filesystem and command execution policy shield. It is designed for local tool-calling safety within a trusted Node.js runtime.\n   - It is **not** a hardware-virtualized hypervisor (like Firecracker or Xen) and does not prevent kernel-level zero-day exploits in the host operating system.\n\n2. **Windows Platform Symlink Constraints:**\n   - On Windows, creating and evaluating symbolic links requires the developer account to have SeCreateSymbolicLinkPrivilege or Windows Developer Mode enabled.\n\n3. **Subprocess Escape Considerations:**\n   - The command engine evaluates the *command line string* prior to execution. If an allowed command itself spawns an interactive shell (e.g. `vim` or `less`), the subagent could theoretically execute commands within that editor. Restricting allowlists strictly to non-interactive binaries (like `git status`, `npm test`) is recommended.\n\n4. **Prohibited Files Customization:**\n   - Custom sensitive configuration filenames should be registered via `customProhibitedFiles` during initialization if non-standard credential filenames are used.\n"}