From c9ca78d9f136d5a3cd30605ee45ee71d5b817b03 Mon Sep 17 00:00:00 2001
From: Sidney Marvin Fricke <sidney.fricke@faktorzehn.de>
Date: Wed, 24 Jun 2026 12:37:36 +0200
Subject: [PATCH] remove path traversal restriction from file tools
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Container isolation is sufficient — agents can access the full
filesystem. Absolute paths are passed through as-is.
---
 server/main.py | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/server/main.py b/server/main.py
index 314088e..3ce6e1e 100644
--- a/server/main.py
+++ b/server/main.py
@@ -483,11 +483,8 @@ def _get_pty(session_id: str) -> PtySession:
 
 
 def _workspace_path(rel: str) -> pathlib.Path:
-    """Resolve a relative path inside WORKSPACE, reject path traversal."""
-    p = (pathlib.Path(WORKSPACE) / rel).resolve()
-    if not str(p).startswith(str(pathlib.Path(WORKSPACE).resolve())):
-        raise ValueError(f"Path escapes workspace: {rel}")
-    return p
+    p = pathlib.Path(rel)
+    return p if p.is_absolute() else pathlib.Path(WORKSPACE) / rel
 
 
 def _get_job(job_id: str) -> BackgroundJob: