[Bug]: A file link with ../ to a file outside the workspace fails to open #16354

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/web

Steps to reproduce

1. Open a thread whose workspace is /home/me/project.
2. Create a file in a sibling folder, for example /home/me/other/notes.md.
3. Have the agent mention it with a parent-folder path, as a markdown link [notes.md](../other/notes.md) or as inline code ../other/notes.md.
4. Click the chip.

Expected behavior

The file opens read-only in the file viewer, the same as it does when the agent writes /home/me/other/notes.md or ~/other/notes.md.

Actual behavior

The file viewer shows:

Failed to read workspace file '../other/notes.md' in '/home/me/project'.

The chip tooltip shows /home/me/project/../other/notes.md. The absolute form and the ~/ form of the same file open correctly in the same message.

Impact

Minor bug or occasional failure

Version or commit

main @ 68e50db

Environment

Windows desktop app with the server in WSL2, Ubuntu 24.04. The cause is in shared web code, so I do not think it is specific to WSL.

Cause

resolvePathLinkTarget in apps/web/src/terminal-links.ts joins the path to the workspace root and keeps the .. segment. The result, /home/me/project/../other/notes.md, still starts with the workspace root. workspaceRelativeFilePath compares by string prefix, so it classifies the file as a workspace file with the relative path ../other/notes.md. The server refuses a relative path that leaves the workspace. An absolute path would have been read as a host file.

Mobile already guards against this. resolveWorkspaceRelativeFilePath in apps/mobile/src/features/files/filePath.ts has the comment "/repo/../x starts with the root but escapes it".

Related issues

• [Bug]: File chips for files created outside the project root fail to open: "Failed to read workspace file 'docs/X.md' in '<root>'" #8251 has the same error text and a different cause. There the path has no .. and the agent worked in a different folder from the project root.
• [Bug]: A chat link to a folder outside the workspace opens a failing file preview #15215 is about a link to a folder outside the workspace. Links to files there open correctly.

Proposed fix

Collapse . and .. segments in resolvePathLinkTarget before the workspace check. A file outside the workspace then opens read-only as a host file. A ../ link that stays inside the workspace, such as a link between two docs folders, still opens as a workspace file.

I have this fix with focused tests in terminal-links.test.ts and markdown-links.test.ts. I can open a PR if the direction is right.

Workaround

Ask the agent to write the absolute path.

Investigated with Claude Code, Opus 5.5.