From 9c8f4f639dbbb28c9b9a76664d0cdd2f8aea23c9 Mon Sep 17 00:00:00 2001
From: bflatastic <bombayapirat@gmail.com>
Date: Fri, 30 Oct 2026 15:28:49 +0700
Subject: [PATCH] #1743: confine file.checkOutput's path as a read

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/automation/src/confine.rs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/crates/automation/src/confine.rs b/crates/automation/src/confine.rs
index 0e9d79d4b..d3c27dfb8 100644
--- a/crates/automation/src/confine.rs
+++ b/crates/automation/src/confine.rs
@@ -88,6 +88,8 @@ const READS: &[(&str, &[&str])] = &[
     ("mediaBrowser.removeFavorite", &["path"]),
     ("face.model.install", &["path"]),
     ("roto.model.install", &["path"]),
+    // Looks up what the file at `path` is (writable roots are readable too).
+    ("file.checkOutput", &["path"]),
     // Reads the template at `path`; what it writes is in `MIXED_WRITES`.
     ("templates.create", &["path"]),
 ];