fix(parser): remove redundant path confinement security in workers

Repositories are explicitly managed through the UI, making worker-level
path validation unnecessary and overly restrictive. This resolves indexing
issues where valid repository files were being rejected due to path
resolution differences between UI and worker contexts.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 2 people

src/core/parse-pool.ts

@@ -141,7 +141,7 @@ export class ParsePool {
         this.recycleWorkerIfNeeded(poolWorker);
         resolve(response.parsed);
       } else {
-        // Worker reported an error (security or parse)
+        // Worker reported a parse error
         console.warn(`index.file.skipped`, {
           filePath: request.filePath,
           reason: response.kind,

src/core/parse-worker.ts

@@ -1,20 +1,16 @@
 /**
  * Worker thread entry for parsing files in isolation
  *
- * This worker receives file parsing requests via parentPort, validates the file path
- * to ensure it's within workspaceRoot (preventing directory traversal), and delegates
+ * This worker receives file parsing requests via parentPort and delegates
  * to the existing parseFile function. The worker reports success/failure via structured
  * messages that can be serialized across the worker boundary.
  *
- * Security: File paths MUST be validated against workspaceRoot using isSubpath to
- * prevent directory traversal attacks. On violation, reports security error without
- * crashing the worker.
+ * Note: Path validation is not needed here as repositories are explicitly managed
+ * through the UI and only added repositories are indexed.
  */
 
 import { parentPort } from 'node:worker_threads';
-import { resolve } from 'node:path';
 import { parseFile } from './parser.js';
-import { isSubpath } from './path-utils.js';
 import { ParseError } from './errors.js';
 
 interface ParseRequest {
@@ -25,7 +21,6 @@ interface ParseRequest {
 
 type ParseResponse =
   | { ok: true; parsed: any } // ParsedFile from parser.ts
-  | { ok: false; kind: 'security'; message: string }
   | { ok: false; kind: 'parse'; message: string };
 
 if (!parentPort) {
@@ -36,21 +31,8 @@ parentPort.on('message', async (request: ParseRequest) => {
   try {
     const { filePath, repositoryId, workspaceRoot } = request;
 
-    // Canonicalize and validate the file path
-    const resolvedPath = resolve(filePath);
-    const resolvedWorkspace = resolve(workspaceRoot);
-    
-    if (!isSubpath(resolvedWorkspace, resolvedPath)) {
-      const response: ParseResponse = {
-        ok: false,
-        kind: 'security',
-        message: `File path '${filePath}' is outside workspace root '${workspaceRoot}'`
-      };
-      parentPort!.postMessage(response);
-      return;
-    }
-
     // Parse the file using the existing parseFile function
+    // Note: Path validation removed as repositories are explicitly managed through UI
     try {
       const parsed = await parseFile(filePath, repositoryId, workspaceRoot);
       const response: ParseResponse = { ok: true, parsed };