Confine agent file tools to explicit roots #49

Merged

lost-rob0t merged 1 commit from fix/zara-013-file-tool-sandbox into master

2026-07-19 04:20:10 +00:00

lost-rob0t commented

2026-07-19 04:18:06 +00:00

(Migrated from github.com)

What changed

disable the complete file-tool group by default behind tools.file_tools = false
add explicit readable and writable root configuration, defaulting to the repository root when enabled
enforce lexical and resolved containment while rejecting direct, nested, and broken symlinks
reject directories for file operations, special files, oversized content, invalid UTF-8, and unauthorized overwrites
use same-directory temporary files with atomic replacement or no-clobber linking
keep file tools on the existing LangChain built-in tool path and correct repository-root discovery
document configuration and add a deterministic temporary-sandbox test gate

Why

The previous tools accepted arbitrary absolute and relative paths without containment checks, allowing traversal and symlink aliases to read, overwrite, diff, or list files outside the repository.

Impact

File tools are absent from the agent unless explicitly enabled. When enabled, legitimate in-root operations continue to work while outside sentinels, traversal aliases, symlinks, and special files are rejected without exposing outside paths.

Validation

nix develop -c scripts/test-file-tools.sh — 24 passed
nix develop -c bash -c 'pytest && for test_script in scripts/test-*.sh; do bash "$test_script"; done' — 87 Python tests plus every integration script passed
nix build

Closes #14

## What changed - disable the complete file-tool group by default behind `tools.file_tools = false` - add explicit readable and writable root configuration, defaulting to the repository root when enabled - enforce lexical and resolved containment while rejecting direct, nested, and broken symlinks - reject directories for file operations, special files, oversized content, invalid UTF-8, and unauthorized overwrites - use same-directory temporary files with atomic replacement or no-clobber linking - keep file tools on the existing LangChain built-in tool path and correct repository-root discovery - document configuration and add a deterministic temporary-sandbox test gate ## Why The previous tools accepted arbitrary absolute and relative paths without containment checks, allowing traversal and symlink aliases to read, overwrite, diff, or list files outside the repository. ## Impact File tools are absent from the agent unless explicitly enabled. When enabled, legitimate in-root operations continue to work while outside sentinels, traversal aliases, symlinks, and special files are rejected without exposing outside paths. ## Validation - `nix develop -c scripts/test-file-tools.sh` — 24 passed - `nix develop -c bash -c 'pytest && for test_script in scripts/test-*.sh; do bash "$test_script"; done'` — 87 Python tests plus every integration script passed - `nix build` Closes #14