vrr/ouroboros
2
0
Fork 0
mirror of https://github.com/razzant/ouroboros.git synced 2026-08-16 22:23:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

fix(workspace-tools): cover windows workspace guard paths

Browse source
This commit is contained in:
Ouroboros 2026-06-06 00:44:16 +03:00
parent a403e1a634
commit cd981fbe20
2 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
ouroboros/tools/registry.py
View file

@ -964,8 +964,7 @@ class ToolRegistry:
resolved = pathlib.Path(candidate).resolve(strict=False)
except Exception:
continue
if any(resolved.is_relative_to(allowed_root) for allowed_root in allowed_data_roots):
continue
if any(resolved.is_relative_to(allowed_root) for allowed_root in allowed_data_roots): continue
for protected_path in protected_paths:
try:
resolved.relative_to(protected_path)
@ -979,6 +978,7 @@ class ToolRegistry:
if not pro_workspace_passthrough:
return "⚠️ WORKSPACE_SHELL_BLOCKED: write-like shell commands may not target absolute paths outside the active workspace."
continue
if any(path_text_is_inside(candidate, root) for root in allowed_data_roots): continue
for protected_path in protected_paths:
if path_text_is_inside(candidate, protected_path):
return "⚠️ WORKSPACE_SHELL_BLOCKED: write-like shell command mentions Ouroboros system/data paths."

2
tests/test_headless_cli.py
View file

@ -769,7 +769,7 @@ def test_workspace_shell_keeps_symlinked_workspace_absolute_paths_allowed(tmp_pa
registry.set_context(ctx)
target = workspace_link / "inside.txt"
result = registry.execute("run_command", {"cmd": f"touch {target}"})
result = registry.execute("run_command", {"cmd": [sys.executable, "-c", f"open({str(target)!r}, 'w').write('ok')"]})
assert "WORKSPACE_SHELL_BLOCKED" not in result, result
assert (real_workspace / "inside.txt").exists()