Enforce workspace directory boundaries for system tools#26
Conversation
|
Hi, this is a feature worth supporting. However, it also needs to allow |
|
picoclaw should support restrict_to_workspace / restrict option in If true, only works in workspace; otherwise can use tools in anywhere. Could you please support this option ? @RinZ27 |
Implemented a unified path validation helper to ensure filesystem operations stay within the designated workspace. This now supports a 'restrict_to_workspace' option in config.json (enabled by default) to allow flexibility for specific environments while maintaining a secure default posture. I've updated read_file, write_file, list_dir, append_file, edit_file, and exec tools to respect this setting and included tests for both restricted and unrestricted modes.
15c2e57 to
792639d
Compare
|
Thank you for this PR, I've tested it and it works well. However, I noticed the |
|
@lxowalle I included the tests to verify the workspace restriction logic during development, but I understand if they don't fit the project's current scope. Glad the core feature is working as expected! |
|
Thanks for your contribution! We are forming the PicoClaw Dev Group to accelerate the evolution of the project. Any developer with more than one merged PR is invited to join. Would you like to join the PicoClaw Dev Group? If so, please send an email to |
…tricted-exec Enforce workspace directory boundaries for system tools
Integrated a
restrict_to_workspaceoption into the configuration to allow tools to access external files when necessary, particularly in containerized environments. While the default remainstruefor security, flipping this toggle lets tools reach any system path. Updated thevalidatePathhelper and all filesystem/shell tools to respect this new setting. Both modes are now fully covered by the expanded test suite.Technical highlights:
restrict_to_workspacetoggle inconfig.jsonandAgentDefaults.validatePathto skip prefix checks when restriction is disabled.read_file,write_file,list_dir,append_file,edit_file, andexecto support the toggle.