Merge commit from fork

* fix(security): keep agent file tools out of the app state directory

The agent's read tools (read_file, grep, glob, ls) resolved model-supplied
paths against a root list whose first entry was the whole data directory.
That directory holds the session store, the auth database, the app
encryption key and the settings file, so prompt-injected content could ask
for any of them. No approval prompt stood in the way: reads are classified
read_workspace and pass the untrusted-context gate untouched, which is
correct for reading a workspace and wrong for reading the app's own state.

The agent gets data/agent_workspace/ instead, and the subprocess cwd and
HOME move with it so bash and read_file agree on where scratch files live.

The deny itself is a property of the path, not of the root it arrived
through, because three routes reach the same bytes and closing only the
first leaves the other two working:

  - the default root list
  - a workspace bound at or above the data directory, which vet_workspace
    accepted and chat_routes auto-binds from a path named in the message
  - a tool_path_extra_roots setting covering the data directory

_resolve_search_root also returned the workspace root unchecked when the
path was empty, so a bare ls enumerated the directory whatever the deny
list said. It now resolves that case through the same guards.

A containment rule rather than a filename deny list, so state files added
later are covered without anyone remembering to list them, and so a user's
own settings.json or app.db inside a real workspace is not caught.

Four directories of user content stay readable, because the application
hands their paths to the model and tells it to open them: the chat upload
manifest, downloaded mail attachments, personal docs (which covers the
runbook) and personal uploads.

* fix: enforce state deny during recursive file search

* fix: bound protected filesystem searches

* fix(security): reject inode aliases and workspace redirects

* fix(security): harden partitioned agent searches

* fix(security): report fallback worker exits promptly

* fix(security): clean up search readers and retain relative data roots

---------

Co-authored-by: RaresKeY <158580472+RaresKeY@users.noreply.github.com>

src/app_initializer.py

@@ -2,10 +2,11 @@
 """Initialize all application components and dependencies."""
 import os
 import logging
+import stat
 from typing import Dict, Any
 
 from src.constants import (
-    DATA_DIR, PERSONAL_DIR, RUNBOOK_DIR, UPLOAD_DIR,
+    DATA_DIR, PERSONAL_DIR, RUNBOOK_DIR, UPLOAD_DIR, AGENT_WORKSPACE_DIR,
     SESSIONS_FILE, DEFAULT_HOST, OPENAI_API_KEY
 )
 from src.memory import MemoryManager
@@ -30,7 +31,35 @@ def create_directories():
     """Create necessary directories if they don't exist."""
     for directory in (DATA_DIR, PERSONAL_DIR, RUNBOOK_DIR, UPLOAD_DIR):
         os.makedirs(directory, exist_ok=True)
-        
+
+    # The model-controlled workspace must be a real child of DATA_DIR.  Never
+    # follow a pre-existing symlink here: it would silently move the default
+    # native-file root outside the application volume before any resolver runs.
+    data_root = os.path.realpath(os.path.abspath(os.path.expanduser(DATA_DIR)))
+    workspace = os.path.abspath(os.path.expanduser(AGENT_WORKSPACE_DIR))
+    expected_workspace = os.path.join(data_root, "agent_workspace")
+    # Validate the real parent so a supported DATA_DIR bind/symlink works, but
+    # require the fixed internal carve-out name and reject a link at the model-
+    # controlled workspace entry itself.
+    if (
+        os.path.basename(workspace) != "agent_workspace"
+        or os.path.realpath(os.path.dirname(workspace)) != data_root
+    ):
+        raise RuntimeError("agent workspace must be the canonical child of DATA_DIR")
+    if os.path.lexists(workspace):
+        mode = os.lstat(workspace).st_mode
+        if stat.S_ISLNK(mode) or not stat.S_ISDIR(mode):
+            raise RuntimeError("agent workspace must be a real directory")
+    else:
+        os.mkdir(workspace, 0o700)
+    resolved_workspace = os.path.realpath(workspace)
+    if resolved_workspace != expected_workspace:
+        raise RuntimeError("agent workspace must be the canonical child of DATA_DIR")
+    try:
+        os.chmod(workspace, 0o700)
+    except OSError:
+        pass
+
 def initialize_managers(base_dir: str, rag_manager=None) -> Dict[str, Any]:
     """
     Initialize all manager and handler instances.