Filesystem Restrictions

All filesystem operations in Novamira (Read File, Write File, Edit File, Delete File, List Directory) are restricted to a configurable base directory. This page explains how these restrictions work.

Important: These restrictions apply to the filesystem abilities (Read File, Write File, Edit File, Delete File, List Directory, Disable File, Enable File). The Execute PHP ability runs arbitrary code and is not subject to any of these restrictions.

ABSPATH restriction

By default, every filesystem operation must target a path within ABSPATH (the WordPress root directory). If an AI agent tries to read, write, or delete a file outside of ABSPATH, the operation fails with a “path outside the allowed base directory” error.

Relative paths (e.g., wp-content/themes/mytheme/style.css) are automatically resolved from ABSPATH. Absolute paths are checked against the ABSPATH boundary.

Protected directories

The Delete File ability has additional protection for critical WordPress directories. The following paths cannot be deleted, even with the recursive flag:

• ABSPATH (the WordPress root itself)
• wp-admin/
• wp-includes/
• wp-content/mu-plugins/

Individual files within these directories can still be read and listed, but the directories themselves cannot be deleted. This prevents accidental destruction of the WordPress core installation.

Customizing the base directory

The base directory restriction can be customized using the novamira_filesystem_base_dir filter. This is a WordPress filter that receives the current base directory (ABSPATH) and can return a different path or false to disable the restriction entirely.

Example: restrict filesystem operations to wp-content/ only:

add_filter('novamira_filesystem_base_dir', function() {
    return WP_CONTENT_DIR;
});

Example: disable the base directory restriction (not recommended):

add_filter('novamira_filesystem_base_dir', '__return_false');

Place these filters in your theme’s functions.php or a must-use plugin. Do not place them in a sandbox file, as the sandbox loads after the filter might be needed.