feat: file system access, behind a path policy and an approval (#25)

src/lib/agent.ts

@@ -249,6 +249,10 @@ export async function runAgent(options: AgentOptions): Promise<AgentResult> {
         now: options.toolContext.now,
         signal: options.signal,
         sources,
+        // The policy and the ledger travel with the turn, so a second write to a path
+        // the user already approved does not ask again, and a new question starts
+        // asking from the beginning.
+        files: options.toolContext.files,
       });
 
       const record: ToolCallRecord = {