fix(path_utils): anchor is_safe_path containment on a separator boundary

[Osamaali313]

Problem

PathUtils.is_safe_path (fastcode/path_utils.py) — the repository-containment security check delegated to by AgentTools._is_safe_path and used as the first gate in every agent read tool (list_directory, search_codebase, get_file_info, get_file_structure_summary, read_file_content) — tests containment with a bare startswith:

resolved = self.resolve_path(path)
if resolved is None:
    abs_path = os.path.abspath(os.path.join(self.repo_root, path))
    return abs_path.startswith(self.repo_root)
return resolved.startswith(self.repo_root)

self.repo_root has no trailing separator, so any path whose absolute form merely begins with the repo-root string passes — including a sibling directory that shares the name prefix and ../ escapes onto it.

Reproduction

Repo root .../myrepo, sibling .../myrepo_secrets outside it (verified against the real PathUtils):

call	before	after
is_safe_path("../myrepo_secrets/passwords.txt")	True ❌	False
is_safe_path("../myrepo_secrets")	True ❌	False
is_safe_path("../myrepo2")	True ❌	False
is_safe_path(".") / is_safe_path("sub/f.py")	True	True

A wrongly-permissive result lets the exploration agent read/list files outside the intended repository boundary.

Fix

Require an exact match or a path-separator boundary:

return (abs_path == self.repo_root
        or abs_path.startswith(self.repo_root + os.sep))

This is the same containment discipline the sibling function file_path_to_module_path in this file already applies (it was deliberately rewritten to use os.path.commonpath, per its comment "prevents path traversal attacks and handles edge cases like root directories") — is_safe_path just wasn't given the same treatment.

Verified RED→GREEN against the real PathUtils (module is stdlib-only); python -m py_compile passes. (No test suite exists in the repo; the reproduction above is the RED→GREEN check.)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.