Validate and resolve path. Ensures path is within workspace. CODE_DIR access requires explicit self-modification opt-in. Args: path: Path to validate Returns: Resolved Path object Raises: FilesystemAccessError:
(self, path: Union[str, Path])
| 81 | raise FilesystemAccessError(f"Failed to create checkpoint: {e}") |
| 82 | |
| 83 | def _validate_path(self, path: Union[str, Path]) -> Path: |
| 84 | """ |
| 85 | Validate and resolve path. |
| 86 | |
| 87 | Ensures path is within workspace. CODE_DIR access requires |
| 88 | explicit self-modification opt-in. |
| 89 | |
| 90 | Args: |
| 91 | path: Path to validate |
| 92 | |
| 93 | Returns: |
| 94 | Resolved Path object |
| 95 | |
| 96 | Raises: |
| 97 | FilesystemAccessError: If path is invalid or outside workspace |
| 98 | """ |
| 99 | if isinstance(path, str): |
| 100 | path = Path(path) |
| 101 | |
| 102 | # Resolve to absolute path |
| 103 | if not path.is_absolute(): |
| 104 | path = self.workspace / path |
| 105 | |
| 106 | path = path.resolve() |
| 107 | |
| 108 | # Check if path is within workspace |
| 109 | try: |
| 110 | path.relative_to(self.workspace) |
| 111 | return path |
| 112 | except ValueError: |
| 113 | pass |
| 114 | |
| 115 | # Path is outside workspace - check if it's CODE_DIR (self-modification) |
| 116 | try: |
| 117 | path.relative_to(CODE_DIR) |
| 118 | # This is a CODE_DIR file - check if self-modification is enabled |
| 119 | if not self.allow_self_modification: |
| 120 | raise FilesystemAccessError( |
| 121 | f"Access denied: {path} is outside workspace. " |
| 122 | f"Enable self-modification with --allow-self-mod flag or ALLOW_SELF_MOD=1" |
| 123 | ) |
| 124 | return path |
| 125 | except ValueError: |
| 126 | pass |
| 127 | |
| 128 | # Path is outside both workspace and CODE_DIR |
| 129 | raise FilesystemAccessError( |
| 130 | f"Access denied: {path} is outside workspace ({self.workspace})" |
| 131 | ) |
| 132 | |
| 133 | def read(self, path: Union[str, Path]) -> str: |
| 134 | """ |