reject path traversal in files.read and files.ls (T-78)

Both handlers concatenated the request path onto the workspace root
without validating containment, letting `path: "../../../etc/passwd"`
escape the workspace. resolveUnderRoot normalizes the path and
checks containment under root.absolute.path before any filesystem
access.

Co-Authored-By: Claude <noreply@anthropic.com>

lib/src/daemon/files_commands.dart

@@ -6,6 +6,7 @@ import 'dart:io';
 
 import '../files/ignore.dart';
 import '../files/listing.dart';
+import '../files/path_safety.dart';
 import '../files/watcher.dart';
 import '../ipc/envelope.dart';
 import '../ipc/schema_v1.dart';
@@ -71,7 +72,13 @@ void registerFilesCommands(DaemonDispatcher d, FilesService files) {
     if (path == null || path.isEmpty) {
       return IpcResponse.err(id: req.id, error: IpcError(code: IpcExitCode.toolError, kind: IpcErrorKind.toolError, message: 'files.read requires a path'));
     }
-    final file = File('${files.root.absolute.path}/$path');
+    final String absPath;
+    try {
+      absPath = resolveUnderRoot(files.root, path);
+    } on PathOutsideRoot {
+      return IpcResponse.err(id: req.id, error: IpcError(code: IpcExitCode.toolError, kind: IpcErrorKind.toolError, message: 'path outside workspace: $path'));
+    }
+    final file = File(absPath);
     if (!file.existsSync()) {
       return IpcResponse.err(id: req.id, error: IpcError(code: IpcExitCode.toolError, kind: IpcErrorKind.toolError, message: 'file not found: $path'));
     }
@@ -81,6 +88,13 @@ void registerFilesCommands(DaemonDispatcher d, FilesService files) {
 
   d.register('files.ls', (req) async {
     final dir = (req.args['path'] as String?) ?? '';
+    if (dir.isNotEmpty) {
+      try {
+        resolveUnderRoot(files.root, dir);
+      } on PathOutsideRoot {
+        return IpcResponse.err(id: req.id, error: IpcError(code: IpcExitCode.toolError, kind: IpcErrorKind.toolError, message: 'path outside workspace: $dir'));
+      }
+    }
     final entries = await listDir(
       root: files.root,
       dir: dir,

lib/src/files/path_safety.dart

@@ -0,0 +1,51 @@
+/// Workspace-relative path validation. Rejects paths that resolve
+/// outside the workspace root (path traversal via `..`, absolute
+/// paths, symlink-out attempts).
+library;
+
+import 'dart:io';
+
+class PathOutsideRoot implements Exception {
+  PathOutsideRoot(this.requested, this.resolved, this.root);
+  final String requested;
+  final String resolved;
+  final String root;
+
+  @override
+  String toString() => 'path outside workspace root: $requested → $resolved (root: $root)';
+}
+
+/// Resolve [relative] against [root] and verify the result is
+/// contained within [root]. Returns the absolute, normalized path.
+/// Throws [PathOutsideRoot] on traversal attempts.
+String resolveUnderRoot(Directory root, String relative) {
+  final rootPath = _normalize(root.absolute.path);
+  final joined = _normalize('$rootPath${Platform.pathSeparator}$relative');
+
+  // Containment check: joined must equal rootPath, or start with
+  // rootPath + separator. Equality covers `relative == ''` (the
+  // root itself); the separator check prevents `/repo` matching
+  // `/repository`.
+  if (joined != rootPath && !joined.startsWith('$rootPath${Platform.pathSeparator}')) {
+    throw PathOutsideRoot(relative, joined, rootPath);
+  }
+  return joined;
+}
+
+String _normalize(String path) {
+  // Use Uri to collapse `..` and `.` segments without hitting the
+  // filesystem (Directory(...).resolveSymbolicLinksSync would also
+  // resolve symlinks, which we don't want here — symlink handling
+  // belongs at the filesystem-access layer, not the path layer).
+  final segments = <String>[];
+  for (final raw in path.split(Platform.pathSeparator)) {
+    if (raw.isEmpty || raw == '.') continue;
+    if (raw == '..') {
+      if (segments.isNotEmpty) segments.removeLast();
+      continue;
+    }
+    segments.add(raw);
+  }
+  final prefix = path.startsWith(Platform.pathSeparator) ? Platform.pathSeparator : '';
+  return '$prefix${segments.join(Platform.pathSeparator)}';
+}