feat: add allowSymlinksOutsideWorkspace opt-in setting — backend (Zoo-Code-Org#169)

Adds an opt-in `allowSymlinksOutsideWorkspace` setting (default off) so users who deliberately rely on symlinks pointing outside the workspace can bypass the fail-closed boundary check from Zoo-Code-Org#169/Zoo-Code-Org#241. When enabled, isPathOutsideWorkspace compares lexical paths instead of resolving symlinks. Threaded to the read/list/edit tools via a BaseTool helper. UI + i18n follow.

Author: proyectoauraorg

packages/types/src/global-settings.ts

@@ -101,6 +101,7 @@ export const globalSettingsSchema = z.object({
 	alwaysAllowWrite: z.boolean().optional(),
 	alwaysAllowWriteOutsideWorkspace: z.boolean().optional(),
 	alwaysAllowWriteProtected: z.boolean().optional(),
+	allowSymlinksOutsideWorkspace: z.boolean().optional(),
 	writeDelayMs: z.number().min(0).optional(),
 	requestDelaySeconds: z.number().optional(),
 	alwaysAllowMcp: z.boolean().optional(),
@@ -329,6 +330,7 @@ export const EVALS_SETTINGS: RooCodeSettings = {
 	alwaysAllowReadOnlyOutsideWorkspace: false,
 	alwaysAllowWrite: true,
 	alwaysAllowWriteOutsideWorkspace: false,
+	allowSymlinksOutsideWorkspace: false,
 	alwaysAllowWriteProtected: false,
 	writeDelayMs: 1000,
 	requestDelaySeconds: 10,

packages/types/src/vscode-extension-host.ts

@@ -257,6 +257,7 @@ export type ExtensionState = Pick<
 	| "alwaysAllowReadOnlyOutsideWorkspace"
 	| "alwaysAllowWrite"
 	| "alwaysAllowWriteOutsideWorkspace"
+	| "allowSymlinksOutsideWorkspace"
 	| "alwaysAllowWriteProtected"
 	| "alwaysAllowMcp"
 	| "alwaysAllowModeSwitch"

src/core/tools/BaseTool.ts

@@ -2,6 +2,7 @@ import type { ToolName } from "@roo-code/types"
 
 import { Task } from "../task/Task"
 import type { ToolUse, HandleError, PushToolResult, AskApproval, NativeToolArgs } from "../../shared/tools"
+import { isPathOutsideWorkspace } from "../../utils/pathUtils"
 
 /**
  * Callbacks passed to tool execution
@@ -98,6 +99,18 @@ export abstract class BaseTool<TName extends ToolName> {
 		this.lastSeenPartialPath = undefined
 	}
 
+	/**
+	 * Resolve whether an absolute path is outside the workspace, honoring the
+	 * `allowSymlinksOutsideWorkspace` setting (#169 / #241). When that setting is enabled,
+	 * a symlink resolving outside the workspace is treated by its lexical path rather than
+	 * being blocked; otherwise symlink targets are resolved and the check fails closed.
+	 */
+	protected async resolveIsOutsideWorkspace(task: Task, absolutePath: string): Promise<boolean> {
+		const allowSymlinksOutsideWorkspace =
+			(await task.providerRef.deref()?.getState())?.allowSymlinksOutsideWorkspace ?? false
+		return isPathOutsideWorkspace(absolutePath, { allowSymlinksOutsideWorkspace })
+	}
+
 	/**
 	 * Main entry point for tool execution.
 	 *

src/core/tools/EditFileTool.ts

@@ -4,7 +4,6 @@ import path from "path"
 import { type ClineSayTool, DEFAULT_WRITE_DELAY_MS } from "@roo-code/types"
 
 import { getReadablePath } from "../../utils/path"
-import { isPathOutsideWorkspace } from "../../utils/pathUtils"
 import { Task } from "../task/Task"
 import { formatResponse } from "../prompts/responses"
 import { RecordSource } from "../context-tracking/FileContextTrackerTypes"
@@ -157,7 +156,7 @@ export class EditFileTool extends BaseTool<"edit_file"> {
 			}
 
 			const absolutePath = path.resolve(task.cwd, relPath)
-			const isOutsideWorkspace = isPathOutsideWorkspace(absolutePath)
+			const isOutsideWorkspace = await this.resolveIsOutsideWorkspace(task, absolutePath)
 
 			const sharedMessageProps: ClineSayTool = {
 				tool: "appliedDiff",
@@ -399,7 +398,7 @@ export class EditFileTool extends BaseTool<"edit_file"> {
 
 			const sanitizedDiff = sanitizeUnifiedDiff(diff || "")
 			const diffStats = computeDiffStats(sanitizedDiff) || undefined
-			const isOutsideWorkspace = isPathOutsideWorkspace(absolutePath)
+			const isOutsideWorkspace = await this.resolveIsOutsideWorkspace(task, absolutePath)
 
 			const sharedMessageProps: ClineSayTool = {
 				tool: isNewFile ? "newFileCreated" : "appliedDiff",
@@ -512,7 +511,7 @@ export class EditFileTool extends BaseTool<"edit_file"> {
 		this.partialToolAskRelPath = relPath
 
 		const absolutePath = path.resolve(task.cwd, relPath)
-		const isOutsideWorkspace = isPathOutsideWorkspace(absolutePath)
+		const isOutsideWorkspace = await this.resolveIsOutsideWorkspace(task, absolutePath)
 
 		const sharedMessageProps: ClineSayTool = {
 			tool: "appliedDiff",

src/core/tools/ListFilesTool.ts

@@ -6,7 +6,6 @@ import { Task } from "../task/Task"
 import { formatResponse } from "../prompts/responses"
 import { listFiles } from "../../services/glob/list-files"
 import { getReadablePath } from "../../utils/path"
-import { isPathOutsideWorkspace } from "../../utils/pathUtils"
 import type { ToolUse } from "../../shared/tools"
 
 import { BaseTool, ToolCallbacks } from "./BaseTool"
@@ -35,7 +34,7 @@ export class ListFilesTool extends BaseTool<"list_files"> {
 			task.consecutiveMistakeCount = 0
 
 			const absolutePath = path.resolve(task.cwd, relDirPath)
-			const isOutsideWorkspace = isPathOutsideWorkspace(absolutePath)
+			const isOutsideWorkspace = await this.resolveIsOutsideWorkspace(task, absolutePath)
 
 			const [files, didHitLimit] = await listFiles(absolutePath, recursive || false, 200)
 			const { showRooIgnoredFiles = false } = (await task.providerRef.deref()?.getState()) ?? {}
@@ -74,7 +73,7 @@ export class ListFilesTool extends BaseTool<"list_files"> {
 		const recursive = recursiveRaw?.toLowerCase() === "true"
 
 		const absolutePath = relDirPath ? path.resolve(task.cwd, relDirPath) : task.cwd
-		const isOutsideWorkspace = isPathOutsideWorkspace(absolutePath)
+		const isOutsideWorkspace = await this.resolveIsOutsideWorkspace(task, absolutePath)
 
 		const sharedMessageProps: ClineSayTool = {
 			tool: !recursive ? "listFilesTopLevel" : "listFilesRecursive",

src/core/tools/SearchReplaceTool.ts

@@ -4,7 +4,6 @@ import path from "path"
 import { type ClineSayTool, DEFAULT_WRITE_DELAY_MS } from "@roo-code/types"
 
 import { getReadablePath } from "../../utils/path"
-import { isPathOutsideWorkspace } from "../../utils/pathUtils"
 import { Task } from "../task/Task"
 import { formatResponse } from "../prompts/responses"
 import { RecordSource } from "../context-tracking/FileContextTrackerTypes"
@@ -170,7 +169,7 @@ export class SearchReplaceTool extends BaseTool<"search_replace"> {
 
 			const sanitizedDiff = sanitizeUnifiedDiff(diff)
 			const diffStats = computeDiffStats(sanitizedDiff) || undefined
-			const isOutsideWorkspace = isPathOutsideWorkspace(absolutePath)
+			const isOutsideWorkspace = await this.resolveIsOutsideWorkspace(task, absolutePath)
 
 			const sharedMessageProps: ClineSayTool = {
 				tool: "appliedDiff",
@@ -262,7 +261,7 @@ export class SearchReplaceTool extends BaseTool<"search_replace"> {
 		}
 
 		const absolutePath = path.resolve(task.cwd, relPath)
-		const isOutsideWorkspace = isPathOutsideWorkspace(absolutePath)
+		const isOutsideWorkspace = await this.resolveIsOutsideWorkspace(task, absolutePath)
 
 		const sharedMessageProps: ClineSayTool = {
 			tool: "appliedDiff",

src/utils/__tests__/pathUtils.spec.ts

@@ -72,6 +72,19 @@ describe("isPathOutsideWorkspace", () => {
 		expect(isPathOutsideWorkspace(path.join(linkDir, "deep.txt"))).toBe(true)
 	})
 
+	it("allows a symlink pointing outside when allowSymlinksOutsideWorkspace is enabled (#246)", () => {
+		const secret = path.join(outsideDir, "secret.txt")
+		fs.writeFileSync(secret, "secret")
+		const link = path.join(workspaceDir, "link-to-secret.txt")
+		fs.symlinkSync(secret, link)
+
+		// Default (secure, #169): the link resolves outside the workspace.
+		expect(isPathOutsideWorkspace(link)).toBe(true)
+		// Opt-in (#246): symlinks are not resolved, so the link's lexical location
+		// (inside the workspace) wins and it is treated as inside.
+		expect(isPathOutsideWorkspace(link, { allowSymlinksOutsideWorkspace: true })).toBe(false)
+	})
+
 	it("fails closed when symlink resolution throws a non-ENOENT error such as EACCES (#169)", () => {
 		const restricted = path.join(workspaceDir, "restricted.txt")
 		fs.writeFileSync(restricted, "x")

src/utils/pathUtils.ts

@@ -54,19 +54,28 @@ function realPathOrNearest(target: string): string {
  * @param filePath The file path to check
  * @returns true if the path is outside all workspace folders, false otherwise
  */
-export function isPathOutsideWorkspace(filePath: string): boolean {
+export function isPathOutsideWorkspace(
+	filePath: string,
+	options: { allowSymlinksOutsideWorkspace?: boolean } = {},
+): boolean {
 	// If there are no workspace folders, consider everything outside workspace for safety
 	if (!vscode.workspace.workspaceFolders || vscode.workspace.workspaceFolders.length === 0) {
 		return true
 	}
 
-	// Resolve symlinks (not just "." / "..") so a symlink that lives inside the
-	// workspace but points outside it is correctly treated as outside. Without
-	// this, the out-of-workspace read protection was trivially bypassed by
-	// symlinking to a file outside the workspace. See issue #169.
+	// By default we resolve symlinks (not just "." / "..") so a symlink that lives
+	// inside the workspace but points outside it is correctly treated as outside.
+	// Without this, the out-of-workspace read protection was trivially bypassed by
+	// symlinking to a file outside the workspace (#169).
+	//
+	// When the user opts in via `allowSymlinksOutsideWorkspace`, we compare lexical
+	// paths instead (path.resolve, no symlink resolution) — restoring the pre-#169
+	// behavior for those who deliberately rely on symlinks pointing outside.
+	const resolvePath = options.allowSymlinksOutsideWorkspace ? (p: string) => path.resolve(p) : realPathOrNearest
+
 	let absolutePath: string
 	try {
-		absolutePath = realPathOrNearest(filePath)
+		absolutePath = resolvePath(filePath)
 	} catch {
 		// Could not safely resolve the target (e.g. EACCES on a symlink). Fail closed:
 		// treat it as outside the workspace rather than risk a false "inside".
@@ -78,7 +87,7 @@ export function isPathOutsideWorkspace(filePath: string): boolean {
 		// Resolve the workspace folder too, in case it is itself reached via a symlink.
 		let folderPath: string
 		try {
-			folderPath = realPathOrNearest(folder.uri.fsPath)
+			folderPath = resolvePath(folder.uri.fsPath)
 		} catch {
 			// Can't resolve this folder safely; it can't be used to prove containment.
 			return false