@tiens.nguyen/gonext-local-worker 1.0.234 → 1.0.235

package/gonext_agent_chat.py

@@ -1926,20 +1926,31 @@ _WS_ACTIVE: str = ""
 
 
 def _rag_read_allowed(path: str) -> str:
-    """Resolve `path` and ensure it stays within a safe root (worker cwd, temp dir,
-    ~/.gonext, or a registered workspace) — so the agent's file tools can't read
-    arbitrary files like ~/.ssh. Relative paths anchor to the terminal workspace (where
-    downloads/unzips land), NOT the worker's process cwd (the home dir), because the
-    model routinely passes bare names like "tools-hook" or "tools-hook/README.md"."""
+    """Resolve `path` and ensure it stays within a safe root (temp dir, ~/.gonext, the
+    active terminal folder, or a registered workspace) — so the agent's file tools can't
+    read arbitrary files like ~/.ssh. Relative paths anchor to the terminal workspace
+    (where downloads/unzips land), because the model routinely passes bare names like
+    "tools-hook" or "tools-hook/README.md".
+
+    NOTE: the worker's PROCESS CWD is deliberately NOT an allowed root (bug #70). The
+    daemon is often launched from ~/Projects (the PARENT of every workspace), so trusting
+    os.getcwd() let `grep_repo(path="/Users/joseph/Projects")` read EVERY project on disk
+    — including other repos' secrets. Reads are confined to the registered/active
+    workspaces + ~/.gonext + the temp dir. Fail-closed: no workspace ⇒ no repo reads."""
     import os
     import tempfile
     expanded = os.path.expanduser((path or "").strip())
     if not os.path.isabs(expanded):
-        base = _WS_ACTIVE or (_WS_ROOTS[0]["path"] if _WS_ROOTS else os.getcwd())
+        # Anchor a relative path to the active workspace (NOT the worker cwd — see above).
+        base = _WS_ACTIVE or (_WS_ROOTS[0]["path"] if _WS_ROOTS else None)
+        if base is None:
+            raise ValueError(
+                "No workspace is active — register a folder with `gonext-local-worker "
+                "workspace add <path>` before reading files."
+            )
         expanded = os.path.join(base, expanded)
     rp = os.path.realpath(expanded)
     roots = [
-        os.path.realpath(os.getcwd()),
         os.path.realpath(tempfile.gettempdir()),
         os.path.realpath(os.path.join(os.path.expanduser("~"), ".gonext")),
     ] + [w["path"] for w in _WS_ROOTS]
@@ -1950,8 +1961,8 @@ def _rag_read_allowed(path: str) -> str:
     if any(rp == r or rp.startswith(r + os.sep) for r in roots):
         return rp
     raise ValueError(
-        "Path is outside the allowed working directories (download/unzip outputs "
-        "or a registered workspace)."
+        f"Path '{path}' is outside your registered workspace(s). The agent can only read "
+        "inside a folder you registered (or download/unzip outputs), not the whole disk."
     )
 
 
@@ -3040,6 +3051,9 @@ def run_agent_chat(cfg):
         f"  CURRENT folder — the terminal is open HERE; default ALL create/edit/run/"
         f"download operations to THIS folder unless the user EXPLICITLY names another "
         f"workspace: {_active_label}\n"
+        "  Ignore any OTHER folder paths that appear only in EARLIER messages (a previous "
+        "task, a cancelled turn) — they are stale. Do NOT grep/list/read across parent "
+        "directories or unrelated projects; work in the CURRENT folder above.\n"
         if _active_label else ""
     )
     # Upfront, ZERO-COST (no tool call, no model round-trip) top-level listing — so the
@@ -5196,8 +5210,17 @@ def run_agent_chat(cfg):
         # even during a total coding-model outage, instead of trusting a plain-chat
         # model's guess that "there's no code or project" (seen live — false: the
         # workspace had real content the whole time, the model just never reached it).
+        # ONLY the current/active folder — never dump the full list of every registered
+        # workspace here. That list (t1..t23) used to get persisted into the answer/history
+        # and then confused the next turn into free-roaming other projects (bug #70).
         if _WS_AVAILABLE:
-            note += f"\n\n(Your registered workspace:\n{_workspace_overview(_WS_ROOTS)})"
+            import os as _os
+            _ov_path = _WS_ACTIVE or (_WS_ROOTS[0]["path"] if _WS_ROOTS else "")
+            _ov = next((w for w in _WS_ROOTS if w["path"] == _ov_path), None)
+            if _ov is None and _ov_path:
+                _ov = {"name": _os.path.basename(_ov_path), "path": _ov_path}
+            if _ov:
+                note += f"\n\n(Current folder {_ov['name']}:\n{_workspace_overview([_ov])})"
         _emit({"type": "final", "text": note})
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gonext-local-worker",
-  "version": "1.0.234",
+  "version": "1.0.235",
   "description": "Polls GoNext cloud API for async local LLM jobs and runs them against Ollama/OpenAI-compatible servers on this Mac",
   "type": "module",
   "license": "MIT",