fix(security): reject symlink and path-containment escapes

[cursor]

Summary

• Fixes critical workspace containment bypasses where agent builtin read_file/write_file (and desktop workspace editor) used lexical normalize_path only, so an in-workspace symlink to an outside target could be read/written.
• Closes the Tauri-only gap left by open PR fix(evolution): constrain pending skill path operations #89: read_evolution_pending_skill_md now requires a single-segment pending skill name before joining under _pending.
• Constrains stdio/CLI bash --cwd to skill dir / workspace / output dir / process cwd / skills root, and stops rewrite_output_paths from injecting ../ or Windows drive-absolute tokens.

Bug Impact

• Arbitrary host file read/write via workspace symlink follow (agent + desktop).
• Arbitrary SKILL.md read outside _pending via Tauri pending preview (skill_name=/tmp/...).
• Allowlisted relative bash commands retargetable via unconstrained --cwd.
• Output-path rewrite could force escaped absolute destinations.

Task Linkage

• Task ID: TASK-2026-080
• Task folder: tasks/TASK-2026-080-workspace-symlink-path-safety/

Injected Specs

• spec/verification-integrity.md
• spec/task-artifact-language.md
• spec/security-nonnegotiables.md
• spec/rust-conventions.md
• spec/testing-policy.md
• spec/docs-sync.md (N/A: fail-closed validation only)

Validation Evidence

• Commands executed:
  • cargo test -p skilllite-agent path_containment → 4 passed
  • cargo test -p skilllite-agent rewrite_output_paths → 3 passed
  • cargo test -p skilllite-commands bash_cwd → 2 passed
  • cargo test -p skilllite-assistant pending_name --manifest-path crates/skilllite-assistant/src-tauri/Cargo.toml → 2 passed
  • cargo clippy -p skilllite-agent -p skilllite-commands --all-targets -- -D warnings -A dead_code -A clippy::question_mark -A clippy::useless_borrows_in_formatting → clean
  • cargo fmt -p skilllite-agent -p skilllite-commands -- --check → clean
  • python3 scripts/validate_tasks.py → passed (71 task folders)
• Concrete PoCs before fix: symlink workspace/leak.txt -> /tmp/secret passed lexical check and opened outside content; Tauri-style Path::join with skill_name=/tmp/outside_pending read /tmp/outside_pending/SKILL.md.

Regression Scope

• Areas likely affected:
  • Agent builtin file tools / preview path resolve
  • Desktop workspace editor path resolve
  • Tauri pending skill markdown preview
  • bash-tool --cwd / stdio bash
  • agent bash-tool output path rewriting
• Explicit non-goals:
  • Open PRs fix(evolution): constrain pending skill path operations #89, Fix desktop evolution workspace split-brain for nested workspaces #109–fix(openclaw): reject path-escaping import skill names #131 (not rediscovered; fix(evolution): constrain pending skill path operations #89 still needed for confirm/reject)
  • Full O_NOFOLLOW redesign

Docs Sync (EN/ZH)

• Not needed
• Updated EN + ZH docs
  Files:
  • N/A

Security Review Notes

• What security policy changed, and why is it needed? Workspace/output path resolution must reject symlink targets outside the root; pending skill names and bash cwd must stay contained.
• Is default behavior more permissive? No — fail-closed.
• Does this affect SKILLLITE_* config semantics? No.
• Were tests and EN/ZH docs updated? Tests yes; docs N/A.

Review Checklist

• Acceptance criteria in tasks/TASK-2026-080-workspace-symlink-path-safety/TASK.md satisfied
• tasks/TASK-2026-080-workspace-symlink-path-safety/STATUS.md updated with latest progress
• tasks/TASK-2026-080-workspace-symlink-path-safety/REVIEW.md includes merge readiness decision
• tasks/board.md status is up to date