From 473730060e235709ccdb0c5e11685cb85b009908 Mon Sep 17 00:00:00 2001 From: kami Date: Mon, 29 Jun 2026 16:40:57 +0000 Subject: [PATCH] fix(server): anchor static-registry file_read to the workspace working dir MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit buildToolConfig built FileReadConfig without workingDir, unlike the sibling fileWrite/fileEdit configs (and buildToolConfigForWorkspace), so the default tool registry's file_read resolved relative paths against the JVM process cwd instead of the configured workspace. When the server is launched from outside the workspace (e.g. `./gradlew :apps:server:run`, whose cwd is apps/server), a `file_read .` from a curl-started session resolved to the launch dir, which is not in the allowed paths, and was rejected with "Path '.' is not in the allowed list" — while it worked on machines where the launch cwd happens to coincide with an allowed path. Pass workingDir so relative paths anchor to the workspace, matching the other file tools. Co-Authored-By: Claude Opus 4.8 --- apps/server/src/main/kotlin/com/correx/apps/server/Main.kt | 1 + 1 file changed, 1 insertion(+) diff --git a/apps/server/src/main/kotlin/com/correx/apps/server/Main.kt b/apps/server/src/main/kotlin/com/correx/apps/server/Main.kt index 924e4b96..4c914095 100644 --- a/apps/server/src/main/kotlin/com/correx/apps/server/Main.kt +++ b/apps/server/src/main/kotlin/com/correx/apps/server/Main.kt @@ -753,6 +753,7 @@ private fun buildToolConfig( fileRead = FileReadConfig( enabled = toolsConfig.fileReadEnabled, allowedPaths = allowed, + workingDir = workingDir, ), fileWrite = FileWriteConfig( allowedPaths = allowed,