[Bug]: STT always reports “WARN: Path outside workspace, rejecting”.

[hightman]

OpenACP Version

2026.402.5

Messaging Platform

Telegram

AI Agent

opencode

Bug Description

Because Telegram voice attachments are saved by default in ~/.openacp/files, that path is outside the session workspace directory, so access is always denied.

Steps to Reproduce

1. Enable TTS feature
2. Send a voice message in a Telegram chat.

Expected Behavior

Invoke the message conversion tool to convert the voice attachment into text and send it to the agent.

Logs / Error Output

[10:50:17] INFO: Bypass mode: auto-approving permission {"module":"session-bridge","sessionId":"wAmobthop7go","requestId":"call_L68EdwhfUcuPrCoKRTZ5zo9j","optionId":"once","agentBypass":false,"clientBypass":true}
[10:50:17] INFO (read): enrichWithViewerLinks: extracted file info {"module":"message-transformer","kind":"read","filePath":"/home/codex/.openacp/files/wAmobthop7go/1775184611644-voice.wav","hasOldContent":false}
[10:50:17] WARN: Path outside workspace, rejecting {"module":"viewer-store","filePath":"/home/codex/.openacp/files/wAmobthop7go/1775184611644-voice.wav","workingDirectory":"/home/codex/flutter_web_test"}

Configuration

Operating System

Ubuntu 22.04

Node.js Version

v24

Additional Context

No response

[0xmrpeter]

Fixed in f9bcb34

Root cause: Two issues compounding each other:

1. message-transformer.ts was calling storeFile/storeDiff on every file the agent reads, including binary files like .wav/.ogg voice attachments saved to ~/.openacp/files/. Binary files cannot be displayed in the code viewer, so this was always pointless.

2. viewer-store.ts was logging a WARN when it rejected out-of-workspace paths. This is a normal skip condition, not an error — the rejection only affected viewer link generation, not actual file access. The misleading WARN made the feature appear broken.

Fix:

• Added a BINARY_VIEWER_EXTENSIONS set in message-transformer.ts — audio, image, video, archive, and other binary extensions are now skipped before reaching the store.
• Downgraded the path-outside-workspace log from WARN to DEBUG in viewer-store.ts.

Tests added to prevent regression:

• Parametrized test covering all binary extensions (.wav, .ogg, .mp3, .mp4, .jpg, .png, .pdf, .zip, etc.)
• Exact-path regression test using the file path from the issue logs (/home/codex/.openacp/files/wAmobthop7go/1775184611644-voice.wav)
• Verified text/code files (.ts) are still processed normally