Summary

• enforce workspace-root path bounds for apply_patch even when sandbox mode is not enabled
• reuse sandbox path guard logic for non-sandbox path resolution
• add regression coverage for traversal, absolute-outside, and symlink escape attempts

Security context

• advisory: GHSA-r5fq-947m-xm57
• this closes the server-side file path escape primitive by rejecting paths outside the workspace root

Tests

• OPENCLAW_E2E_WORKERS=1 pnpm exec vitest run --config vitest.e2e.config.ts src/agents/apply-patch.e2e.test.ts

Greptile Overview

Greptile Summary

This PR closes a critical path traversal vulnerability in apply_patch that allowed writes outside the workspace directory. The fix extends sandbox path enforcement to non-sandbox mode by replacing custom path resolution with the shared assertSandboxPath utility, which validates both path boundaries and symlink escapes.

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The security fix properly addresses the vulnerability by reusing battle-tested path validation logic from assertSandboxPath, comprehensive test coverage validates all attack vectors (relative traversal, absolute paths, symlink escapes), and the CHANGELOG documents the security context appropriately
• No files require special attention

_{Last reviewed commit: 43274ac}