kami
473730060e
buildToolConfig built FileReadConfig without workingDir, unlike the sibling fileWrite/fileEdit configs (and buildToolConfigForWorkspace), so the default tool registry's file_read resolved relative paths against the JVM process cwd instead of the configured workspace. When the server is launched from outside the workspace (e.g. `./gradlew :apps:server:run`, whose cwd is apps/server), a `file_read .` from a curl-started session resolved to the launch dir, which is not in the allowed paths, and was rejected with "Path '.' is not in the allowed list" — while it worked on machines where the launch cwd happens to coincide with an allowed path. Pass workingDir so relative paths anchor to the workspace, matching the other file tools. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>