Reject paths outside the repo root in repo drivers and AI file tools

[nishantmonu51]

The AI file tools (read_file, write_file, develop_file) and the runtime's file APIs passed caller-supplied paths straight to repo.Get/Put/Delete, where both the file and admin drivers joined them onto the repo root with no containment check. A path with .. segments (e.g. /models/../../../../etc/passwd) could therefore read, write, or delete files outside the project root.

• Adds drivers.ResolveRepoPath, which resolves a repo-relative path against the root and errors if the result escapes it. Both repo drivers now use it everywhere they previously did filepath.Join(root, path) (Get, Hash, Stat, Put, MkdirAll, Rename, Delete).
• The AI file tools additionally reject paths containing .. segments up front, so the model gets a clear error instead of a filesystem error.
• Adds unit tests for ResolveRepoPath, traversal assertions in the shared repo driver test suite, and traversal cases for the read_file and write_file tools.

Checklist:

• Covered by tests
• Ran it and it works as intended
• Reviewed the diff before requesting a review
• Checked for unhandled edge cases
• Linked the issues it closes
• Checked if the docs need to be updated. If so, create a separate Linear DOCS issue
• Intend to cherry-pick into the release branch
• I'm proud of this work!

[nishantmonu51]

@codex: review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fc3a9b7d0a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject traversal globs before walking repo roots

This containment helper is only applied to single file paths, but ListGlob remains on the old path: both repo drivers still pass caller-controlled globs to doublestar.GlobWalk(os.DirFS(root), ...), and the public ListFiles RPC forwards req.Glob unchanged. For inputs such as ../* or ../../**, os.DirFS is not a chroot and the glob walk can enumerate parent-directory entries, so the security fix still leaves a repo API that can escape the root; reject .. in globs or resolve the glob base with the same containment check before walking.

Useful? React with 👍 / 👎.