fix: constrain custom workspace paths

[LIghtJUNction]

Motivation

• Close a security regression that allowed absolute custom workspace paths outside the AstrBot workspaces root and thereby expanded allowed read/write roots for non-admin local file tools.
• Ensure project-level custom workspace configuration cannot be used by low-privileged chat-scoped clients to escape the intended filesystem containment.

Description

• Enforce containment in workspace_path_to_root (astrbot/core/workspace.py) by resolving both absolute and relative inputs and rejecting paths that equal or fall outside the AstrBot workspaces root.
• Update unit tests in tests/unit/test_chatui_project_service.py to accept absolute custom workspaces only when they are inside the configured workspaces root and to add a test that rejects absolute paths outside the root.
• Update the validation error message to clearly indicate custom workspace paths must stay under the AstrBot workspaces tree.

Testing

• Ran formatter and linter with uv run --no-sync ruff format ... and uv run --no-sync ruff check ..., and these checks passed.
• Attempted to run uv run --no-sync pytest tests/unit/test_chatui_project_service.py, but test execution was blocked because the environment is missing the pytest_asyncio test dependency; therefore the updated unit tests could not be executed end-to-end in this environment.
• Static/local checks (format/lint) succeeded and the modified test suite includes a new case that asserts absolute paths outside the workspaces root are rejected.

---

Codex Task

Summary by Sourcery

Constrain custom workspace paths so they cannot escape the configured AstrBot workspaces root, tightening filesystem containment for custom workspace configurations.

Bug Fixes:

• Prevent absolute custom workspace paths from targeting directories outside the AstrBot workspaces root.

Enhancements:

• Unify workspace path containment checks to apply to both absolute and relative custom paths and clarify the resulting validation error message.

Tests:

• Adjust existing workspace path tests to require absolute custom paths to reside under the workspaces root and add coverage rejecting absolute paths outside that root.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[gemini-code-assist]

Code Review

This pull request restricts absolute custom workspace paths to stay within the AstrBot workspaces directory, aligning their validation with relative paths. It updates workspace_path_to_root to enforce this boundary check and modifies the test suite to verify that absolute paths outside the workspaces root are rejected while absolute paths inside are accepted. There are no review comments, so no additional feedback is provided.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	astrbot-docs	81b28af	Commit Preview URL Branch Preview URL	Jul 20 2026, 08:28 AM