Capability security

Declare where change is allowed.

Primary root

Relative DSL paths resolve against --root, or the invocation working directory if omitted. They never resolve against the script’s directory.

undo plan ./scripts/migrate.undo --root /opt/acme
undo run ./scripts/migrate.undo --root /opt/acme --yes

Additional roots

An absolute path outside the primary root is denied unless it maps beneath a repeatable allowed directory. The most-specific capability wins.

undo run migrate.undo --root /opt/acme \
  --allow-path /etc/acme --allow-path /var/lib/acme --yes

Traversal boundary

Go os.Root handles enforce actual access. UndoLang also rejects lexical .. escapes, symlink mutation parents, undeclared absolute paths, capability-root deletion, and the primary root’s reserved .undo tree.

Symlinks

Deleting or moving a symlink acts on the link entry. Copying a symlink is rejected. Directory traversal never follows symlink directories implicitly.