feat: remove CWD path containment from file tools

read_file, write_file, and edit_file no longer restrict access to
paths outside the working directory. The isPathWithinWorkdir prefix
check and symlink hardening have been removed from all three tools.

This allows agents to read and write files anywhere on the filesystem,
not just within the per-turn cwd. The shell tool already had no such
restriction.

2 files changed, 3 insertions, 112 deletions

diff --git a/packages/tool-edit-file/src/edit-file.test.ts b/packages/tool-edit-file/src/edit-file.test.ts
index dba3d9e..5ef8376 100644
--- a/packages/tool-edit-file/src/edit-file.test.ts
+++ b/packages/tool-edit-file/src/edit-file.test.ts
@@ -3,12 +3,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { createLogger, type ToolExecuteContext } from "@dispatch/kernel";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import {
-	computeReplacement,
-	createEditFileTool,
-	isPathWithinWorkdir,
-	validateArgs,
-} from "./edit-file.js";
+import { computeReplacement, createEditFileTool, validateArgs } from "./edit-file.js";
 
 function stubCtx(overrides?: Partial<ToolExecuteContext>): ToolExecuteContext {
 	return {
@@ -145,24 +140,6 @@ describe("computeReplacement", () => {
 	});
 });
 
-describe("isPathWithinWorkdir", () => {
-	it("accepts a path within workdir", () => {
-		expect(isPathWithinWorkdir("/tmp/workdir/file.txt", "/tmp/workdir")).toBe(true);
-	});
-
-	it("accepts the workdir itself", () => {
-		expect(isPathWithinWorkdir("/tmp/workdir", "/tmp/workdir")).toBe(true);
-	});
-
-	it("rejects a path outside workdir", () => {
-		expect(isPathWithinWorkdir("/tmp/other/file.txt", "/tmp/workdir")).toBe(false);
-	});
-
-	it("rejects a prefix attack (workdir prefix but different dir)", () => {
-		expect(isPathWithinWorkdir("/tmp/workdir-evil/file.txt", "/tmp/workdir")).toBe(false);
-	});
-});
-
 describe("createEditFileTool", () => {
 	it("replaces a single occurrence", async () => {
 		const filePath = join(workdir, "test.txt");
@@ -251,49 +228,6 @@ describe("createEditFileTool", () => {
 		expect(result.content).toContain("not found");
 	});
 
-	it("rejects a path outside the working directory", async () => {
-		const tool = createEditFileTool(workdir);
-		const result = await tool.execute(
-			{ path: "../escape.txt", oldString: "a", newString: "b" },
-			stubCtx(),
-		);
-
-		expect(result.isError).toBe(true);
-		expect(result.content).toContain("outside the working directory");
-	});
-
-	it("rejects an absolute path outside workdir", async () => {
-		const tool = createEditFileTool(workdir);
-		const result = await tool.execute(
-			{ path: "/etc/passwd", oldString: "a", newString: "b" },
-			stubCtx(),
-		);
-
-		expect(result.isError).toBe(true);
-		expect(result.content).toContain("outside the working directory");
-	});
-
-	it("handles symlink escape attempt", async () => {
-		const outsideDir = await mkdtemp(join(tmpdir(), "outside-"));
-		const outsideFile = join(outsideDir, "secret.txt");
-		await writeFile(outsideFile, "secret data", "utf8");
-
-		const symlinkPath = join(workdir, "link.txt");
-		const { symlink } = await import("node:fs/promises");
-		await symlink(outsideFile, symlinkPath);
-
-		const tool = createEditFileTool(workdir);
-		const result = await tool.execute(
-			{ path: "link.txt", oldString: "secret", newString: "leaked" },
-			stubCtx(),
-		);
-
-		expect(result.isError).toBe(true);
-		expect(result.content).toContain("outside the working directory");
-
-		await rm(outsideDir, { recursive: true, force: true });
-	});
-
 	it("reads file under ctx.cwd when set", async () => {
 		const ctxDir = await mkdtemp(join(tmpdir(), "ctx-cwd-test-"));
 		try {
diff --git a/packages/tool-edit-file/src/edit-file.ts b/packages/tool-edit-file/src/edit-file.ts
index af630aa..36f99e0 100644
--- a/packages/tool-edit-file/src/edit-file.ts
+++ b/packages/tool-edit-file/src/edit-file.ts
@@ -1,5 +1,5 @@
-import { readFile, realpath, writeFile } from "node:fs/promises";
-import { resolve, sep } from "node:path";
+import { readFile, writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
 import type { ToolContract, ToolResult } from "@dispatch/kernel";
 
 // --- Pure types ---
@@ -103,12 +103,6 @@ export function computeReplacement(
 	};
 }
 
-/** Pure: check that a resolved absolute path is within the workdir (prefix check). */
-export function isPathWithinWorkdir(resolvedPath: string, workdir: string): boolean {
-	const normalizedWorkdir = workdir.endsWith(sep) ? workdir : workdir + sep;
-	return resolvedPath === workdir || resolvedPath.startsWith(normalizedWorkdir);
-}
-
 // --- Shell / edge ---
 
 /**
@@ -156,46 +150,9 @@ export function createEditFileTool(workingDirectory: string): ToolContract {
 
 			const { path: relPath, oldString, newString, replaceAll } = validated;
 
-			// Effective base: per-turn ctx.cwd overrides the baked workdir.
 			const effectiveBase = ctx.cwd ? resolve(ctx.cwd) : workdir;
-
-			// Resolve the requested path against the effective base.
 			const resolvedPath = resolve(effectiveBase, relPath);
 
-			// Basic prefix check.
-			if (!isPathWithinWorkdir(resolvedPath, effectiveBase)) {
-				return {
-					content: `Error: Path "${relPath}" is outside the working directory.`,
-					isError: true,
-				};
-			}
-
-			// Symlink hardening: realpath both and re-check containment.
-			let realResolved: string;
-			let realBase: string;
-			try {
-				[realResolved, realBase] = await Promise.all([
-					realpath(resolvedPath),
-					realpath(effectiveBase),
-				]);
-			} catch (err: unknown) {
-				const code = (err as NodeJS.ErrnoException).code;
-				if (code === "ENOENT") {
-					return { content: `Error: File "${relPath}" not found.`, isError: true };
-				}
-				return {
-					content: `Error accessing file: ${err instanceof Error ? err.message : String(err)}`,
-					isError: true,
-				};
-			}
-
-			if (!isPathWithinWorkdir(realResolved, realBase)) {
-				return {
-					content: `Error: Path "${relPath}" is outside the working directory.`,
-					isError: true,
-				};
-			}
-
 			// Read the file.
 			let content: string;
 			try {