Inline @-mentioned files outside the workspace instead of blocking them

An @-mention is the operator asking the agent to read one path, once,
right now — the same consent that already covers workspace files.
Outside-workspace mentions now resolve and inline like any other
mention, gated only by the sensitive-path and size checks that already
applied. Nothing about the mention persists past that one read: no
grant is minted, nothing is written to settings, and later reads of
the same path still go through the permission gate on its own terms.

Author: TheGreatAxios

src/permission/path-restriction.test.ts

@@ -47,3 +47,15 @@ test("workspace-relative paths are unrestricted", () => {
   expect(r.isRestricted("src/index.ts", false)).toBe(false);
   expect(r.isRestricted("src/index.ts", true)).toBe(false);
 });
+
+test("a directory sharing a string prefix with the workspace root is still restricted", async () => {
+  // "<cwd>baz" shares a string prefix with cwd but is a distinct sibling
+  // directory outside the workspace — the boundary check must not leak into
+  // it via naive string prefixing.
+  const prefixSibling = `${cwd}baz`;
+  await mkdir(prefixSibling, { recursive: true });
+  const r = createPathRestriction(cwd, () => [], home);
+
+  expect(r.isRestricted(prefixSibling, false)).toBe(true);
+  expect(r.isRestricted(join(prefixSibling, "file.txt"), false)).toBe(true);
+});

src/tui/mention-resolution.ts

@@ -1,38 +1,13 @@
 import { readFile, opendir, realpath, stat } from "node:fs/promises";
 import { resolve, isAbsolute } from "node:path";
 import { isSensitivePath } from "../plugins/secret-guard-plugin.js";
-import { createPathRestriction, type PathRestriction } from "../permission/path-restriction.js";
-import { createWorktreeRootsProvider } from "../permission/worktree-roots.js";
 
 const MAX_MENTION_FILE_BYTES = 200_000;
 const MAX_MENTION_TOTAL_BYTES = 400_000;
 const MAX_MENTION_COUNT = 5;
 const MAX_DIRECTORY_SUMMARY_ENTRIES = 200;
 const MAX_DIRECTORY_NAMES = 20;
 
-async function resolveMentionPath(
-  cwd: string,
-  path: string,
-  pathRestriction: PathRestriction,
-): Promise<{ ok: true; abs: string } | { ok: false; reason: string }> {
-  if (path === "~" || path.startsWith("~/")) {
-    return { ok: false, reason: "home-relative paths are not supported" };
-  }
-
-  let abs: string;
-  try {
-    abs = await realpath(isAbsolute(path) ? path : resolve(cwd, path));
-  } catch {
-    return { ok: false, reason: "not found" };
-  }
-
-  if (pathRestriction.isRestricted(abs, false)) {
-    return { ok: false, reason: "outside workspace" };
-  }
-
-  return { ok: true, abs };
-}
-
 async function summarizeDir(abs: string): Promise<string> {
   let scanned = 0;
   let files = 0;
@@ -58,6 +33,13 @@ async function summarizeDir(abs: string): Promise<string> {
   return parts.length > 0 ? parts.join(", ") : "empty directory";
 }
 
+// An @mention is the operator directly asking the agent to read one path, once,
+// right now — the same consent that already lets the agent read any workspace
+// file. There is no workspace-boundary check here: mentioning a path outside
+// the workspace inlines it exactly like a workspace path would, gated only by
+// the sensitive-path and size checks below. Nothing here authorizes a *later*
+// read of the same path — that still goes through the permission gate on its
+// own terms, and an @mention grants it no standing there.
 export async function resolveAtMentions(message: string, cwd: string): Promise<string> {
   const pattern = /@("([^"]+)"|(\S+))/g;
   const mentions: Array<{ full: string; path: string }> = [];
@@ -68,11 +50,6 @@ export async function resolveAtMentions(message: string, cwd: string): Promise<s
   }
   if (mentions.length === 0) return message;
 
-  // Mirrors the permission gate's own containment check (see gate.ts): the
-  // gate resolves paths against cwd plus every registered git worktree of
-  // this session, so an @mention into a sibling worktree must resolve the
-  // same way rather than being wrongly rejected as an escape.
-  const pathRestriction = createPathRestriction(cwd, createWorktreeRootsProvider(cwd));
   const replacements: Array<{ full: string; replacement: string }> = [];
   let totalBytes = 0;
 
@@ -81,23 +58,30 @@ export async function resolveAtMentions(message: string, cwd: string): Promise<s
       replacements.push({ full, replacement: `${full} (blocked: too many @mentions; max ${MAX_MENTION_COUNT})` });
       continue;
     }
+    if (path === "~" || path.startsWith("~/")) {
+      replacements.push({ full, replacement: `${full} (blocked: home-relative paths are not supported)` });
+      continue;
+    }
     if (isSensitivePath(path)) {
       replacements.push({ full, replacement: `${full} (blocked: sensitive path)` });
       continue;
     }
-    const resolved = await resolveMentionPath(cwd, path, pathRestriction);
-    if (!resolved.ok) {
-      replacements.push({ full, replacement: `${full} (blocked: ${resolved.reason})` });
+    let abs: string;
+    try {
+      abs = await realpath(isAbsolute(path) ? path : resolve(cwd, path));
+    } catch {
+      replacements.push({ full, replacement: `${full} (not found)` });
       continue;
     }
-    if (isSensitivePath(resolved.abs)) {
+    if (isSensitivePath(abs)) {
       replacements.push({ full, replacement: `${full} (blocked: sensitive path)` });
       continue;
     }
+
     try {
-      const info = await stat(resolved.abs);
+      const info = await stat(abs);
       if (info.isDirectory()) {
-        const summary = await summarizeDir(resolved.abs);
+        const summary = await summarizeDir(abs);
         replacements.push({ full, replacement: `\`${path}\` (directory - ${summary})` });
         continue;
       }
@@ -109,9 +93,9 @@ export async function resolveAtMentions(message: string, cwd: string): Promise<s
         replacements.push({ full, replacement: `${full} (blocked: total @mention content is too large; max ${MAX_MENTION_TOTAL_BYTES} bytes)` });
         continue;
       }
-      const content = await readFile(resolved.abs, "utf-8");
+      const content = await readFile(abs, "utf-8");
       totalBytes += info.size;
-      const ext = resolved.abs.split(".").pop() ?? "";
+      const ext = abs.split(".").pop() ?? "";
       replacements.push({ full, replacement: `\`${path}\`:\n\`\`\`${ext}\n${content}\n\`\`\`` });
     } catch {
       replacements.push({ full, replacement: `${full} (not found)` });

tests/unit/tui/at-mention-resolution.test.ts

@@ -110,54 +110,93 @@ describe("resolveAtMentions", () => {
     }
   });
 
-  test("blocks symlinks that resolve outside the workspace", async () => {
+  test("inlines symlinked outside-workspace files", async () => {
     const dir = await fixture();
     const outside = await mkdtemp(join(tmpdir(), "at-mention-resolution-outside-"));
     try {
       await writeFile(join(outside, "outside.txt"), "outside content\n");
       await symlink(outside, join(dir, "escape"));
 
       const resolved = await resolveAtMentions("read @escape/outside.txt", dir);
-      expect(resolved).toContain("@escape/outside.txt (blocked: outside workspace)");
-      expect(resolved).not.toContain("outside content");
+      expect(resolved).toContain("outside content");
     } finally {
       await rm(dir, { recursive: true, force: true });
       await rm(outside, { recursive: true, force: true });
     }
   });
 
-  test("blocks absolute paths outside the workspace", async () => {
+  test("inlines absolute outside-workspace paths", async () => {
     const dir = await fixture();
     const outside = await mkdtemp(join(tmpdir(), "at-mention-resolution-outside-"));
     try {
       const outsideFile = join(outside, "outside.txt");
       await writeFile(outsideFile, "outside content\n");
 
       const resolved = await resolveAtMentions(`read @${outsideFile}`, dir);
-      expect(resolved).toContain(`@${outsideFile} (blocked: outside workspace)`);
-      expect(resolved).not.toContain("outside content");
+      expect(resolved).toContain(`\`${outsideFile}\`:`);
+      expect(resolved).toContain("outside content");
     } finally {
       await rm(dir, { recursive: true, force: true });
       await rm(outside, { recursive: true, force: true });
     }
   });
 
-  test("blocks parent-traversal paths that escape the workspace", async () => {
+  test("inlines parent-traversal outside-workspace paths", async () => {
     const dir = await fixture();
     const outside = await mkdtemp(join(tmpdir(), "at-mention-resolution-outside-"));
     try {
       await writeFile(join(outside, "outside.txt"), "outside content\n");
       const traversal = `../../${outside.split("/").pop() ?? ""}/outside.txt`;
 
       const resolved = await resolveAtMentions(`read @${traversal}`, join(dir, "src"));
-      expect(resolved).toContain(`@${traversal} (blocked: outside workspace)`);
-      expect(resolved).not.toContain("outside content");
+      expect(resolved).toContain("outside content");
     } finally {
       await rm(dir, { recursive: true, force: true });
       await rm(outside, { recursive: true, force: true });
     }
   });
 
+  test("summarizes outside-workspace directories", async () => {
+    const dir = await fixture();
+    const outside = await mkdtemp(join(tmpdir(), "at-mention-resolution-outside-"));
+    try {
+      await writeFile(join(outside, "a.txt"), "a\n");
+      await mkdir(join(outside, "sub"));
+
+      const resolved = await resolveAtMentions(`read @${outside}`, dir);
+      expect(resolved).toContain("directory - ");
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+      await rm(outside, { recursive: true, force: true });
+    }
+  });
+
+  test("still blocks sensitive outside-workspace paths", async () => {
+    const dir = await fixture();
+    const outside = await mkdtemp(join(tmpdir(), "at-mention-resolution-outside-"));
+    try {
+      const outsideEnv = join(outside, ".env");
+      await writeFile(outsideEnv, "API_KEY=secret\n");
+
+      const resolved = await resolveAtMentions(`read @${outsideEnv}`, dir);
+      expect(resolved).toContain("(blocked: sensitive path)");
+      expect(resolved).not.toContain("API_KEY=secret");
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+      await rm(outside, { recursive: true, force: true });
+    }
+  });
+
+  test("blocks home-relative paths", async () => {
+    const dir = await fixture();
+    try {
+      const resolved = await resolveAtMentions("read @~/some-file.txt", dir);
+      expect(resolved).toContain("(blocked: home-relative paths are not supported)");
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+
   test("inlines mentions into a sibling git worktree of the same session", async () => {
     const repo = await mkdtemp(join(tmpdir(), "at-mention-resolution-repo-"));
     const worktree = await mkdtemp(join(tmpdir(), "at-mention-resolution-worktree-"));