feat(workspace): WorkspaceResolver trust pipeline + allowed_workspace_roots

Resolve a client-supplied workspace dir safely: canonicalize via toRealPath, reject privileged locations, clamp to [tools] allowed_workspace_roots (permissive when unset, logged), fall back to the boot default on any rejection. PathJail made non-internal so the server can reuse its symlink-safe containment. (Axis 2 Phase A, task 4.)
2026-06-02 19:57:03 +04:00
parent d405f9d2c1
commit 7d7e524756
6 changed files with 226 additions and 1 deletions
@@ -10,7 +10,7 @@ import java.nio.file.Path
 * cannot smuggle access to a target outside it. Fails CLOSED: an empty
 * allow-list contains nothing.
 */
-internal object PathJail {
+object PathJail {

    /**
     * Resolve [path] to a symlink-resolved absolute path. If the target does not