From f1dc0781105e15e69e959fb7b08b9acfb04b0dff Mon Sep 17 00:00:00 2001
From: stevef <stevef@omen.home>
Date: Tue, 21 Apr 2026 06:23:23 +0200
Subject: [PATCH] fix(k3s): move allowed paths to tools section and fix
 subagent workspace persistence

---
 k3s/configmap.yaml    | 18 ++++++++----------
 pkg/agent/instance.go |  2 +-
 2 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/k3s/configmap.yaml b/k3s/configmap.yaml
index fffbd5d74..e392400e1 100644
--- a/k3s/configmap.yaml
+++ b/k3s/configmap.yaml
@@ -14,14 +14,6 @@ data:
         "defaults": {
           "workspace": "/home/picoclaw/.picoclaw",
           "restrict_to_workspace": true,
-          "allow_read_paths": [
-            "/home/picoclaw/.picoclaw",
-            "/tmp"
-          ],
-          "allow_write_paths": [
-            "/home/picoclaw/.picoclaw",
-            "/tmp"
-          ],
           "provider": "nvidia",
           "model_name": "nemotron-120b",
           "model_fallbacks": [
@@ -729,8 +721,14 @@ data:
         }
       },
       "tools": {
-        "allow_read_paths": null,
-        "allow_write_paths": null,
+        "allow_read_paths": [
+          "/home/picoclaw/.picoclaw",
+          "/tmp"
+        ],
+        "allow_write_paths": [
+          "/home/picoclaw/.picoclaw",
+          "/tmp"
+        ],
         "deny_read_paths": [
           "^skills(/.*)?$"
         ],
diff --git a/pkg/agent/instance.go b/pkg/agent/instance.go
index 0ccfbb208..7e874b92e 100644
--- a/pkg/agent/instance.go
+++ b/pkg/agent/instance.go
@@ -307,7 +307,7 @@ func resolveAgentWorkspace(agentCfg *config.AgentConfig, defaults *config.AgentD
 	}
 	// For named agents without explicit workspace, use default workspace with agent ID suffix
 	id := routing.NormalizeAgentID(agentCfg.ID)
-	return filepath.Join(expandHome(defaults.Workspace), "..", "workspace-"+id)
+	return filepath.Join(expandHome(defaults.Workspace), "workspaces", id)
 }
 
 // resolveAgentModel resolves the primary model for an agent.