feat(security): introduce WorkspaceFileAccess — central workspace boundary authorization (#390)

[proyectoauraorg]

Part of #169. Sub-issue 2 of 4. Depends on #428 (#389 WorkspacePathResolver).

Note

Stacked on #428. This branch is built on top of feat/389-workspace-path-resolver, so the diff currently includes the WorkspacePathResolver commit. Once #428 merges to main, I'll rebase and that commit drops out, leaving only the WorkspaceFileAccess change. Draft until #428 lands.

What

Adds src/core/workspace/WorkspaceFileAccess.ts — the policy layer #390 calls for. Tools request an authorized operation instead of doing a raw isPathOutsideWorkspace() boolean check followed by their own fs access. The decoupled check-then-act pattern is structurally easy to get wrong; the missed ApplyDiffTool check in #241 is exactly the failure mode this prevents.

type AuthorizeResult =
  | { ok: true; resolvedPath: string }
  | { ok: false; reason: "outside_workspace" | "symlink_escapes_workspace" | "realpath_failed" | "permission_denied"; message: string }

authorizeRead(options): Promise<AuthorizeResult>
authorizeWrite(options): Promise<AuthorizeResult>

• Default (fail-closed): canonicalizes the requested path and every workspace folder via resolveRealPath (feat(security): introduce WorkspacePathResolver — safe async symlink-aware path canonicalization #389); grants access only when the real path lands inside a real folder. A folder that can't be resolved is skipped (can't prove containment), never treated as a match.
• Opt-in: allowSymlinksOutsideWorkspace restores the pre-[BUG] vscode out-of-workspace read protection trivially circumvented by symlinks #169 lexical behavior (symlinks not followed for the boundary decision).
• allowSymlinksOutsideWorkspace is read from task.providerRef.deref()?.getState() with a try/catch — provider may be torn down — defaulting to false.
• symlink_escapes_workspace is distinguished from outside_workspace so callers/telemetry can tell a deliberate out-of-tree path apart from one that looks inside but escapes via a symlink.

The allowSymlinksOutsideWorkspace setting is introduced here (its home per the issue) in GlobalSettings + ExtensionState.

Scope

Per the issue: does not change any tool behavior. No UI, no i18n, no tool migrations — those are #391/#392.

Tests

src/core/workspace/__tests__/WorkspaceFileAccess.spec.ts — real temp dirs + real symlinks (no fs mocking), covering all six scenarios from the issue plus plainly-outside, provider-throws, and no-workspace-open. Skips symlink/EACCES cases cleanly on Windows/root.

• ✅ tsc --noEmit clean
• ✅ eslint --max-warnings=0 clean (src + types)
• ✅ 9/9 tests pass

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6c233276-e05c-4f10-ac4c-f960e0886216

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

❌ Patch coverage is 83.33333% with 21 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/core/workspace/WorkspaceFileAccess.ts	79.78%	19 Missing ⚠️
src/utils/WorkspacePathResolver.ts	93.33%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!