fix(app-server): sandbox fs/* RPCs to authorized workspace roots

[andrei-hasna]

Risk

app-server fs/* RPCs (fs/readFile, fs/writeFile, fs/createDirectory, fs/getMetadata, fs/readDirectory, fs/remove, fs/copy, fs/watch) accepted arbitrary absolute host paths and forwarded them to the filesystem with sandbox = None. Any generic initialized app-server client (compromised desktop/UI/plugin/remote-control client or another transport peer) could read, write, copy, watch, or recursively delete arbitrary host files from the app-server process context, bypassing session permission profiles, workspace roots, approval flow, and platform sandboxing. fs/remove additionally defaulted to recursive+force=true. Classifications: CWE-862 (Missing Authorization), CWE-22 (Path Traversal), CWE-284 (Improper Access Control). Severity P1.

Fingerprint: open-codewith/security/app-server/fs-host-filesystem-unsandboxed-rpc/19dc867ccbd61d8f79b94eeea7b94245587a7e2eb8cedd8051dc688f0442e613

Fix

• New server-side scope guard app-server/src/fs_scope.rs (FsScope) derived from server-held session state — the active cwd plus effective workspace roots — never from a client-supplied root. Default-deny when no root is established.
• Every fs/* target is authorized before any filesystem access. Targets are fully canonicalized (all symlinks resolved) and checked component-wise against the authorized roots, so symlink escapes, absolute-path traversal, and prefix confusion (/root vs /root-evil) are rejected. Not-yet-existing write/mkdir/copy-destination targets resolve their deepest existing ancestor, so a symlinked ancestor cannot escape either. fs/copy checks both source and destination; fs/watch checks the watch path (emitted changedPaths are always in-scope descendants).
• fs/remove no longer defaults to recursive/force; both must be requested explicitly, so a client cannot recursively delete even inside scope without opting in, and never outside an authorized root.
• README + fs protocol doc comments now state the trust/authorization/scope semantics; schema fixtures regenerated.

Validation

Run in codex-rs/:

• just test-fast -p codex-app-server --test all fs → 20 passed (incl. new denial, authorized-scope, symlink-escape, and non-destructive-remove-default tests)
• cargo test -p codex-app-server --lib fs_scope → 6 passed (containment, missing-target, sibling-prefix, symlink-escape, empty-deny)
• just test-fast -p codex-app-server-protocol → 256 passed (incl. schema fixture drift checks)
• just check-fast -p codex-app-server → clean (clippy)
• just fmt → clean

Independent adversarial review found no exploitable bypass; the guard is fail-closed.

Residual risks

• Static scope: built once from startup Config (cwd + workspace roots), not rebuilt per active thread/session. Still within the authorized roots, but if the startup cwd is broad (repo root/home) fs/* stays authorized across that tree. Follow-up hardening could pin scope per active thread.
• TOCTOU: the check canonicalizes then the op runs on the logical path; a local same-user actor swapping a component for a symlink between check and syscall could redirect. Low exploitability; full elimination needs openat/O_NOFOLLOW in the fs layer.
• Fail-closed over-restriction: remove/getMetadata on an in-scope symlink whose target is out-of-scope are denied (the link is resolved). Edge case, deny-safe.

Commit: 0c716ba66f94c4957d75fb386fc20019ce3b74c1

🤖 Generated with Claude Code