fix(tools): enforce repository boundary for hosted-repair file tools

[BunsDev]

Motivation

• Hosted-repair enabled file read/write tools while headless GitHub sessions run with BypassPermissions, allowing the permission layer to always Allow and thereby bypass any workspace containment checks.
• The existing hosted-repair containment was only a tool-name allowlist and did not prevent absolute paths, parent-directory escapes, or symlink escapes from reaching filesystem writes/reads.
• The change closes this critical containment gap by requiring file tools to enforce the repository workspace boundary themselves when hosted-repair file tools are enabled.

Description

• Add ToolContext::check_hosted_repair_path(tool_name, path) which rejects paths outside the working directory when hosted_review.allow_file_write_tools is set, and run it before normal permission checks.
• Add robust path canonicalization helpers (normalize_path and canonicalize_existing_prefix) and a path_is_within_working_dir helper that handles non-existent children and symlink/parent escapes.
• Apply the hosted-repair path check across all file-oriented tools: Read, Write, Edit, ApplyPatch, BatchEdit, NotebookEdit, Grep, and Glob so containment is enforced pre-permission-bypass.
• Add unit tests covering in-workspace acceptance, parent-directory escape rejection, and symlink escape rejection under hosted-repair mode.
• Files changed: src-rust/crates/tools/src/lib.rs, file_read.rs, file_write.rs, file_edit.rs, apply_patch.rs, batch_edit.rs, notebook_edit.rs, grep_tool.rs, glob_tool.rs.

Testing

• Ran cargo fmt --all and formatting passed.
• Ran cargo test -p claurst-tools hosted_repair_path_check -- --nocapture and the three new tests passed (all checks OK).
• Ran cargo check -p claurst-tools and the package-level check completed successfully.
• Ran cargo clippy -p claurst-tools --all-targets -- -D warnings and clippy passed for the claurst-tools crate.
• Ran cargo check --workspace and it failed in this environment due to a missing system dependency required by alsa-sys (pkg-config could not find alsa.pc); this is an environment issue and unrelated to the change.

If you'd like, I can open a PR with this patch and include the small regression tests; next steps would be review of the path helpers for any platform edge cases and optional expanding of permission_allowed_roots semantics.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Jul 27, 2026 1:44pm

[Copilot]

Pull request overview

This PR closes a critical containment gap in hosted-repair mode by enforcing that file-oriented tools can only operate within the repository working directory, even when the permission layer is running under BypassPermissions.

Changes:

• Introduces ToolContext::check_hosted_repair_path() and supporting path helpers to reject paths outside working_dir under hosted-repair file-tool mode.
• Applies the hosted-repair path check across file tools (read/write/edit/patch/batch/notebook) and search tools (grep/glob) before normal permission checks.
• Adds unit tests covering in-workspace acceptance, parent-directory escape rejection, and symlink escape rejection.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src-rust/crates/tools/src/lib.rs	Adds hosted-repair path boundary enforcement and path canonicalization helpers + unit tests.
src-rust/crates/tools/src/file_read.rs	Enforces hosted-repair repository boundary before permission checks for reads.
src-rust/crates/tools/src/file_write.rs	Enforces hosted-repair repository boundary before permission checks for writes.
src-rust/crates/tools/src/file_edit.rs	Enforces hosted-repair repository boundary before permission checks for edits.
src-rust/crates/tools/src/apply_patch.rs	Enforces hosted-repair repository boundary before applying patches to files.
src-rust/crates/tools/src/batch_edit.rs	Enforces hosted-repair repository boundary for each batch edit target path.
src-rust/crates/tools/src/notebook_edit.rs	Enforces hosted-repair repository boundary for notebook edits.
src-rust/crates/tools/src/grep_tool.rs	Enforces hosted-repair repository boundary for grep base path and discovered files.
src-rust/crates/tools/src/glob_tool.rs	Enforces hosted-repair repository boundary for glob base dir and matched paths.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.