fix(tools): prevent filesystem tools from escaping workDir

[danielebarbaro]

All filesystem tools (list_files, read_file, write_file, update_file) use a shared helper called resolvePath.

Before this change, it returned absolute paths as-is and joined relative paths without checking that they stayed within the intended directory.

As a result, the agent could access or write files outside the allowed scope (e.g., /etc/hosts or /tmp/pwn.txt), despite the README claiming it was “safe by design.”

Change

• resolvePath now returns (string, error).
• It canonicalizes both workDir and the target via filepath.EvalSymlinks, then verifies containment via filepath.Rel.
• Write destinations to files that do not yet exist are handled by a new helper, canonicalPath, which walks up to the nearest existing ancestor, resolves its symlinks, and re-appends the non-existent tail. This keeps write_file working for new files and new parent directories.
• The four tool entrypoints propagate the error back to the tool response, so the LLM sees a clear message like path "/etc/passwd" escapes working directory.

Rejected

• absolute paths outside workDir (e.g. /etc/hosts)
• relative paths escaping via .. (e.g. ../../etc/hosts)
• symlinks rooted inside workDir that point outside

Still allowed

• absolute paths inside workDir
• relative paths inside workDir
• writes to new files under a non-existent parent directory that would be created by write_file