mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-10-26 21:26:39 +00:00
3c08a9f93e
* fix(sandbox): let local file tools read the /mnt/user-data root The local provider maps the aggregate /mnt/user-data root so listing it matches AIO, but the tool layer only accepted paths below it: ls, glob and grep on the root answered "Permission denied" (with a trailing slash, from the resolved-path "path traversal detected" check). validate_local_tool_path now accepts the bare root for reads, and the user-data resolver accepts the shared parent of workspace/uploads/ outputs itself when the caller opts in. Only ls and the shared read path opt in; writes to the root and files placed directly in it stay rejected. * docs(changelog): reference #6991 for the /mnt/user-data root fix * fix(sandbox): list the /mnt/user-data root through its allowed dirs only The first version let glob, grep and ls start at the user-data root after validating only the root itself. The walkers then descended into everything under the host user-data/ directory, so a file or directory stored directly under it was listed and searched although read_file rejects it. ls now lists the root one allowed directory at a time (workspace, uploads and outputs, each one level deep) through the sandbox's own list_dir, so the host root is never walked and list_dir's existing per-directory containment check still filters symlinks. The resolver is back to main's behavior, so glob, grep and read_file keep rejecting the root.