---
url: 'https://adk.nht.io/api/batteries/sandbox/node/type-aliases/FsNode.md'
description: The in-process policy decision procedure.
---

# Type Alias: FsNode

```ts
type FsNode = {
  canRead: boolean;
  canWrite: boolean;
};
```

Defined in: [src/batteries/sandbox/node/fs\_node.ts:43](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/node/fs_node.ts#L43)

The in-process policy decision procedure.

## Remarks

BESPOKE POLICY CODE, not a thin wrapper: SRT exports rule LISTS
(`getFsReadConfig()`/`getFsWriteConfig()`) but **no authorization predicate**, so the decision is
ours to make and ours to get wrong. It backs the tools that run OUR code — `open_file*`,
`stage_file`, `save_media`, `list_directory` — where there is no untrusted binary between the check
and the `open()`, so applying the same derived rules in-process is the same path without a
subprocess rather than a weaker one.

The residuals are real and unmitigated: a TOCTOU race between check and open, and any bug in this
evaluator. There is no OS backstop on this path — SRT restricts spawned children only. The
compensating controls are the mandatory gate and a narrow `writeRoot`.

## Methods

### canRead()

```ts
canRead(path: string): boolean;
```

Defined in: [src/batteries/sandbox/node/fs\_node.ts:45](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/node/fs_node.ts#L45)

Whether a read of `path` is permitted. Reads default to ALLOW; `allowRead` wins inside `denyRead`.

#### Parameters

| Parameter | Type     |
| --------- | -------- |
| `path`    | `string` |

#### Returns

`boolean`

***

### canWrite()

```ts
canWrite(path: string): boolean;
```

Defined in: [src/batteries/sandbox/node/fs\_node.ts:47](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/node/fs_node.ts#L47)

Whether a write to `path` is permitted. Writes default to DENY; `denyWrite` wins inside `allowWrite`, and the mandatory-deny set applies on top.

#### Parameters

| Parameter | Type     |
| --------- | -------- |
| `path`    | `string` |

#### Returns

`boolean`