fix(workbench): keep repository inventory and snapshots within the target

sdk/typescript/_bundled_plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-security",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "description": "Codex Security workflows for security scans, analysis, and investigation.",
   "author": {
     "name": "OpenAI"

sdk/typescript/_bundled_plugin/scripts/generate_in_scope_files.py

@@ -154,7 +154,7 @@ def generate_diff_in_scope_files(
         is_binary_sample,
         preview_for,
     )
-    from workbench_target import git_blob_bytes
+    from workbench_target import directory_is_within_target, git_blob_bytes
 
     rows: list[bytes] = []
     try:
@@ -195,12 +195,26 @@ def generate_diff_in_scope_files(
                         )
                     if is_binary_sample(contents):
                         continue
-                elif (
-                    path.is_symlink()
-                    or not path.is_file()
-                    or preview_for(path, DEFAULT_PREVIEW_BYTES)[1]
-                ):
-                    continue
+                else:
+                    try:
+                        parent = path.parent.resolve(strict=True)
+                        if not directory_is_within_target(parent, repository):
+                            path.lstat()
+                            raise InventoryError(
+                                "changed Git working-tree paths must stay inside the selected target"
+                            )
+                    except (FileNotFoundError, NotADirectoryError):
+                        continue
+                    except (OSError, RuntimeError) as error:
+                        raise InventoryError(
+                            "could not inspect a changed Git working-tree path"
+                        ) from error
+                    if (
+                        path.is_symlink()
+                        or not path.is_file()
+                        or preview_for(path, DEFAULT_PREVIEW_BYTES)[1]
+                    ):
+                        continue
             relative_path = relative.as_posix()
             if "\n" in relative_path or "\r" in relative_path:
                 raise InventoryError(

sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py

@@ -43,7 +43,11 @@
     preview_for,
     preview_for_bytes,
 )
-from workbench_target import git_blob_bytes, git_directory_snapshot_paths
+from workbench_target import (
+    directory_is_within_target,
+    git_blob_bytes,
+    git_directory_snapshot_paths,
+)
 
 EXCLUDED_DIRS = {
     ".cache",
@@ -693,7 +697,16 @@ def make_diff_rank_input(args: argparse.Namespace) -> None:
     for path, status in changed:
         rel = path.relative_to(repo)
 
-        if status == "D":
+        unsafe_parent = False
+        if status != "D" and args.mode != "revisions":
+            try:
+                unsafe_parent = not directory_is_within_target(
+                    path.parent.resolve(strict=True), repo
+                )
+            except (OSError, RuntimeError):
+                unsafe_parent = True
+
+        if status == "D" or unsafe_parent:
             preview = ""
         elif args.mode == "revisions":
             content = revision_blobs[rel]
@@ -708,13 +721,17 @@ def make_diff_rank_input(args: argparse.Namespace) -> None:
             preview = ""
         elif path.is_file():
             try:
-                path.resolve(strict=True).relative_to(repo)
-            except (OSError, ValueError):
-                preview = ""
-            else:
+                safe_leaf = directory_is_within_target(
+                    path.resolve(strict=True).parent, repo
+                )
+            except (OSError, RuntimeError):
+                safe_leaf = False
+            if safe_leaf:
                 preview, is_binary = preview_for(path, args.preview_bytes)
                 if is_binary:
                     continue
+            else:
+                preview = ""
         else:
             preview = ""
         rows.append({"path": rel.as_posix(), "area": args.area, "preview": preview})

sdk/typescript/_bundled_plugin/scripts/workbench_target.py

@@ -230,7 +230,10 @@ def worktree_content_digest_for_context(
             update_digest_field(
                 digest,
                 b"untracked-content",
-                directory_content_digest(path.resolve()).encode(),
+                directory_content_digest(
+                    path.resolve(),
+                    _selected_target=((work_tree or repository) / pathspec).resolve(),
+                ).encode(),
             )
         elif stat.S_ISREG(metadata.st_mode):
             content_digest = hashlib.sha256()
@@ -341,7 +344,9 @@ def clean_worktree_content_digest() -> str:
     return f"codex-security-snapshot/v1:sha256:{digest.hexdigest()}"
 
 
-def git_directory_snapshot_paths(target: Path) -> list[Path] | None:
+def git_directory_snapshot_paths(
+    target: Path, *, skip_unsafe_paths: bool = False, _selected_target: Path | None = None
+) -> list[Path] | None:
     repository_root = git_output(target, "rev-parse", "--show-toplevel")
     if repository_root is None:
         return None
@@ -359,13 +364,34 @@ def git_directory_snapshot_paths(target: Path) -> list[Path] | None:
     if listed is None:
         raise SystemExit("Could not inspect files in the selected Git working tree.")
     paths: list[Path] = []
+    resolved_target = target.resolve()
+    canonical_target = _selected_target.resolve() if _selected_target is not None else resolved_target
+    resolved_parents: dict[Path, Path] = {target: resolved_target}
     for raw_path in (raw_path for raw_path in listed.split(b"\0") if raw_path):
         path = repository / os.fsdecode(raw_path)
         try:
             metadata = path.lstat()
         except FileNotFoundError:
             # The index can retain a path that was staged and then deleted.
             continue
+        parent = path.parent
+        try:
+            if parent not in resolved_parents:
+                resolved_parents[parent] = parent.resolve()
+            directory = path.resolve() if stat.S_ISDIR(metadata.st_mode) else None
+            within_target = directory_is_within_target(
+                resolved_parents[parent], canonical_target
+            )
+            if directory is not None:
+                within_target = (
+                    within_target or directory.samefile(canonical_target)
+                ) and directory_is_within_target(directory, canonical_target)
+        except (OSError, RuntimeError):
+            within_target = False
+        if not within_target:
+            if skip_unsafe_paths:
+                continue
+            raise SystemExit("Git working-tree paths must stay inside the selected target.")
         paths.append(path)
         if not stat.S_ISDIR(metadata.st_mode):
             continue
@@ -374,7 +400,9 @@ def git_directory_snapshot_paths(target: Path) -> list[Path] | None:
             nested_repository_root is not None
             and Path(nested_repository_root).resolve() == path.resolve()
         ):
-            nested_paths = git_directory_snapshot_paths(path)
+            nested_paths = git_directory_snapshot_paths(
+                path, skip_unsafe_paths=skip_unsafe_paths, _selected_target=canonical_target
+            )
             if nested_paths is not None:
                 paths.extend(nested_paths)
                 continue
@@ -386,14 +414,26 @@ def git_directory_snapshot_paths(target: Path) -> list[Path] | None:
     return sorted(set(paths))
 
 
-def directory_content_digest(target: Path, *, excluded: tuple[Path, ...] = ()) -> str:
+def directory_is_within_target(directory: Path, target: Path) -> bool:
+    """Compare resolved directories, including equivalent filesystem spellings."""
+    if directory.is_relative_to(target):
+        return True
+    try:
+        return any(candidate.samefile(target) for candidate in (directory, *directory.parents))
+    except OSError:
+        return False
+
+
+def directory_content_digest(
+    target: Path, *, excluded: tuple[Path, ...] = (), _selected_target: Path | None = None
+) -> str:
     excluded_relative = []
     for path in excluded:
         try:
             excluded_relative.append(path.relative_to(target))
         except ValueError:
             continue
-    paths = git_directory_snapshot_paths(target)
+    paths = git_directory_snapshot_paths(target, _selected_target=_selected_target)
     if paths is None:
         paths = sorted(target.rglob("*"))
     digest = hashlib.sha256()
@@ -436,7 +476,7 @@ def directory_content_digest(target: Path, *, excluded: tuple[Path, ...] = ()) -
 
 
 def directory_snapshot_regular_file_count(target: Path) -> int:
-    paths = git_directory_snapshot_paths(target)
+    paths = git_directory_snapshot_paths(target, skip_unsafe_paths=True)
     if paths is None:
         paths = sorted(target.rglob("*"))
     count = 0

sdk/typescript/src/version.ts

@@ -8,7 +8,7 @@ const PACKAGE_VERSIONS = packageVersions(
 export const VERSION = PACKAGE_VERSIONS.package;
 export const CODEX_SDK_VERSION = PACKAGE_VERSIONS.sdk;
 export const CODEX_EXECUTABLE_VERSION = PACKAGE_VERSIONS.executable;
-export const BUNDLED_PLUGIN_VERSION = "0.1.20" as const;
+export const BUNDLED_PLUGIN_VERSION = "0.1.21" as const;
 
 const PACKAGE_NAME = "@openai/codex-security";
 const VERSION_PATTERN =