fix CRITICAL: ReadFileTool ReferenceError + WriteFile/EditFile path traversal

ReadFileTool.ts line 147: parameter named _ctx but body referenced ctx (undefined) —
causes ReferenceError on every read_file call when workspaceStore is missing.

WriteFileTool.ts + EditFileTool.ts: resolvePath() had no path traversal check
(no '..' sanitization), allowing writes/edits outside workspace root. Added
validatePath() with '..' detection + workspace root boundary check, matching
the pattern already used in ReadFileTool.ts.

Author: patil-shubham-dev

apps/desktop/src/renderer/runtime/tools/implementations/EditFileTool.ts

@@ -103,6 +103,12 @@ function resolvePath(rootPath: string | null, inputPath: string): string {
   return `${rootPath}\\${inputPath.replace(/\//g, '\\')}`
 }
 
+function validatePath(normalized: string, rootPath: string | null): string | null {
+  if (normalized.includes('..')) return 'Path traversal denied'
+  if (rootPath && !normalized.startsWith(rootPath)) return 'Path escapes workspace root'
+  return null
+}
+
 function toDiffEdits(input: Record<string, unknown>): DiffEdit[] {
   const edits = input.edits as Array<Record<string, unknown>> | undefined
   if (Array.isArray(edits) && edits.length > 0) {
@@ -282,6 +288,9 @@ export const EditFileTool: AgentTool = buildTool({
     const rootPath = ctx.workspaceStore?.rootPath ?? null
     const fullPath = resolvePath(rootPath, filePath)
 
+    const validationError = validatePath(fullPath, rootPath)
+    if (validationError) return { data: null, error: validationError, isError: true }
+
     if (isPathDenied(fullPath)) {
       return { data: null, error: `File not found: "${filePath}". The file may not exist at this location.`, isError: true }
     }

apps/desktop/src/renderer/runtime/tools/implementations/ReadFileTool.ts

@@ -144,7 +144,7 @@ export const ReadFileTool: AgentTool = buildTool({
     const path = String(input.path ?? '')
     if (!path) return { data: null, error: 'path is required', isError: true }
 
-    const rootPath = ctx.workspaceStore?.rootPath ?? null
+    const rootPath = _ctx.workspaceStore?.rootPath ?? null
     const fullPath = resolvePath(rootPath, path)
 
     const validationError = validatePath(fullPath, rootPath)

apps/desktop/src/renderer/runtime/tools/implementations/WriteFileTool.ts

@@ -82,6 +82,12 @@ function resolvePath(rootPath: string | null, inputPath: string): string {
   return `${rootPath}\\${inputPath.replace(/\//g, '\\')}`
 }
 
+function validatePath(normalized: string, rootPath: string | null): string | null {
+  if (normalized.includes('..')) return 'Path traversal denied'
+  if (rootPath && !normalized.startsWith(rootPath)) return 'Path escapes workspace root'
+  return null
+}
+
 export const WriteFileTool: AgentTool = buildTool({
   name: 'write_file',
   description: 'Write content to a file (creates directories if needed), updating the file on disk immediately',
@@ -109,6 +115,9 @@ export const WriteFileTool: AgentTool = buildTool({
     const rootPath = ctx.workspaceStore?.rootPath ?? null
     const fullPath = resolvePath(rootPath, path)
 
+    const validationError = validatePath(fullPath, rootPath)
+    if (validationError) return { data: null, error: validationError, isError: true }
+
     if (isPathDenied(fullPath)) {
       return { data: null, error: `Cannot write to "${path}". The path is not accessible.`, isError: true }
     }