From d9441f588b10599ad31cf7385cd10e8b78ed4063 Mon Sep 17 00:00:00 2001
From: xgopilot <noreply@goplus.org>
Date: Wed, 6 May 2026 17:42:06 +0000
Subject: [PATCH] fix(tools): honor relative workdir in effective root

Generated with [codeagent](https://github.com/qbox/codeagent)
Co-authored-by: phantom5099 <245659304+phantom5099@users.noreply.github.com>
---
 internal/tools/codebase/common_test.go | 21 +++++++++++++++++----
 internal/tools/git/common_test.go      | 16 ++++++++++++++--
 internal/tools/workspace_plan.go       |  2 +-
 3 files changed, 32 insertions(+), 7 deletions(-)

diff --git a/internal/tools/codebase/common_test.go b/internal/tools/codebase/common_test.go
index 927a793e..15203a8d 100644
--- a/internal/tools/codebase/common_test.go
+++ b/internal/tools/codebase/common_test.go
@@ -1,17 +1,30 @@
 package codebase
 
 import (
+	"os"
 	"path/filepath"
 	"testing"
+
+	"neo-code/internal/tools"
 )
 
 func TestCodebaseCommonHelpers(t *testing.T) {
 	t.Parallel()
 
-	if got := effectiveRoot("/workspace/root", " "); got != "/workspace/root" {
+	root := t.TempDir()
+	child := filepath.Join(root, "subdir")
+	if err := os.Mkdir(child, 0o755); err != nil {
+		t.Fatalf("Mkdir() error = %v", err)
+	}
+	canonicalRoot, err := filepath.EvalSymlinks(root)
+	if err != nil {
+		t.Fatalf("EvalSymlinks(root) error = %v", err)
+	}
+
+	if got, err := tools.ResolveEffectiveRoot(root, " "); err != nil || got != canonicalRoot {
 		t.Fatalf("effectiveRoot(default) = %q", got)
 	}
-	if got := effectiveRoot("/workspace/root", "/tmp/repo"); got != "/tmp/repo" {
+	if got, err := tools.ResolveEffectiveRoot(root, "subdir"); err != nil || got != child {
 		t.Fatalf("effectiveRoot(custom) = %q", got)
 	}
 	if got := itoa(0); got != "0" {
@@ -26,7 +39,7 @@ func TestCodebaseCommonHelpers(t *testing.T) {
 	if got := boolToString(false); got != "false" {
 		t.Fatalf("boolToString(false) = %q", got)
 	}
-	if got := filepathSlashClean("a/b"); got != filepath.Clean(filepath.FromSlash("a/b")) {
-		t.Fatalf("filepathSlashClean() = %q", got)
+	if _, err := tools.ResolveEffectiveRoot(root, "../escape"); err == nil {
+		t.Fatal("ResolveEffectiveRoot should reject escaping workdir")
 	}
 }
diff --git a/internal/tools/git/common_test.go b/internal/tools/git/common_test.go
index 95414cb9..eaa8d99d 100644
--- a/internal/tools/git/common_test.go
+++ b/internal/tools/git/common_test.go
@@ -1,20 +1,32 @@
 package git
 
 import (
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
+
+	"neo-code/internal/tools"
 )
 
 func TestGitCommonHelpers(t *testing.T) {
 	t.Parallel()
 
-	if got := effectiveRoot("/workspace/root", " "); got != "/workspace/root" {
+	root := t.TempDir()
+	child := filepath.Join(root, "nested", "repo")
+	if err := os.MkdirAll(child, 0o755); err != nil {
+		t.Fatalf("MkdirAll() error = %v", err)
+	}
+
+	if got, err := tools.ResolveEffectiveRoot(root, " "); err != nil || got != root {
 		t.Fatalf("effectiveRoot(default) = %q", got)
 	}
-	if got := effectiveRoot("/workspace/root", "/tmp/repo"); got != "/tmp/repo" {
+	if got, err := tools.ResolveEffectiveRoot(root, "nested/repo"); err != nil || got != child {
 		t.Fatalf("effectiveRoot(custom) = %q", got)
 	}
+	if _, err := tools.ResolveEffectiveRoot(root, "../escape"); err == nil {
+		t.Fatal("ResolveEffectiveRoot should reject escaping workdir")
+	}
 
 	formatted := formatFileList([]fileEntry{
 		{Status: "modified", Path: filepath.Join("pkg", "a.go")},
diff --git a/internal/tools/workspace_plan.go b/internal/tools/workspace_plan.go
index 930c4727..bc34024f 100644
--- a/internal/tools/workspace_plan.go
+++ b/internal/tools/workspace_plan.go
@@ -16,7 +16,7 @@ func ResolveEffectiveRoot(defaultRoot string, workdir string) (string, error) {
 	if base == "" {
 		return defaultRoot, nil
 	}
-	resolved, _, err := security.ResolveWorkspacePath(defaultRoot, base)
+	_, resolved, err := security.ResolveWorkspacePath(defaultRoot, base)
 	return resolved, err
 }