feat: enhance OAuth flow validation and improve security checks; add credential read blocking and git operation safeguards

src/tool/mod.rs

@@ -203,7 +203,34 @@ pub fn resolve_path(workspaces: &[PathBuf], rel: &str) -> Result<PathBuf> {
     } else {
         base.join(path)
     };
-    let canon = abs.canonicalize().unwrap_or(abs);
+    // Resolve the path with canonicalisation. For non-existent files
+    // (e.g. the write tool creating a new file), canonicalise the base
+    // workspace root first and then resolve parent-dir (`../`) traversal
+    // component-by-component so that `Path::starts_with` cannot be
+    // bypassed by unnormalised intermediate segments.
+    let canon = match abs.canonicalize() {
+        Ok(c) => c,
+        Err(_) => {
+            let base_canon = workspaces
+                .iter()
+                .filter_map(|w| w.canonicalize().ok())
+                .next()
+                .unwrap_or_else(|| base.clone());
+            let mut resolved = base_canon.clone();
+            if let Ok(rel_components) = abs.strip_prefix(&base_canon) {
+                for comp in rel_components.components() {
+                    match comp {
+                        std::path::Component::ParentDir => {
+                            resolved.pop();
+                        }
+                        std::path::Component::CurDir => {}
+                        c => resolved.push(c),
+                    }
+                }
+            }
+            resolved
+        }
+    };
     if workspaces.iter().any(|w| canon.starts_with(w)) {
         Ok(canon)
     } else {