Add external file read with tilde expansion and user approval flow #40
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Problem: The fs_read tool could only read files inside the workspace directory.
Users working with external configuration files, documentation, or system files
had no way to read them through the tool interface, forcing manual workarounds.
Changes implemented:
1. External path detection and tilde expansion (src/workspace/index.js)
- Added expandTilde() to resolve ~/... paths to the user's home directory
- Added isExternalPath() to detect when a path resolves outside the workspace
- Added readExternalFile() to safely read files at absolute/external paths
- Only regular files are readable (directories, symlinks rejected)
2. Two-phase approval flow (src/tools/workspace.js)
- When fs_read receives an external path, it returns a 403 with a structured
error asking the LLM to get explicit user confirmation first
- On a second call with user_approved=true, the file is read and returned
- Normal workspace reads are completely unchanged
3. Tool schema update (src/clients/standard-tools.js)
- Updated Read tool description to document external file support
- Added user_approved boolean parameter to the input schema
- Updated file_path description to explain path formats (relative, absolute, ~)
Testing:
- Workspace-relative reads continue to work unchanged
- ~/Documents/file.txt correctly resolves and reads after user approval
- Absolute paths like /etc/hosts work with approval flow
- Paths inside workspace still use the fast path (no approval needed)
- Write and edit operations remain workspace-only (no external writes)
- npm run test:unit passes with no regressions
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Problem
The fs_read tool could only read files inside the workspace directory. Users working with external configuration files, documentation, or system files had no way to read them through the tool interface.
Changes
expandTilde(),isExternalPath(), andreadExternalFile()utility functionsuser_approvedparameter and expandedfile_pathdescriptionTesting
~/Documents/file.txtcorrectly resolves and reads after user approval/etc/hostswork with approval flownpm run test:unitpasses with no regressions