[Security]: File tools have no workspace boundary — can read/write anywhere on disk

[shauryagangrade]

Problem

read_file, write_file, edit_file, and list_dir operate on arbitrary
paths (os.path, open(...)) with no check that they stay inside the
project/working directory. A model with a bad prompt — or a malicious
session — can read or overwrite anything the user can on the machine, with
only write_file's force flag as a mild guard.

Proposed approach

• Define a "workspace root" (the --cwd / session cwd).
• For paths resolving outside it, require explicit confirmation (reuse the
  permission gate pattern in _run_tool) or reject by default.
• Handle symlinks/.. resolution properly (Path.resolve()).

Where to look

• gcode/tools.py:74-168 (read_file, write_file, edit_file)
• gcode/agent.py:82-98 (_run_tool) for the existing permission-gate pattern.

Acceptance criteria

• Out-of-workspace writes are rejected by default, or confirmed first.
• Existing in-workspace behavior is unchanged.
• Unit tests for path boundary cases (symlink, .., absolute path).

Difficulty

Medium.