Function jail_cli_read_path 

pub fn jail_cli_read_path(
    raw: &str,
    project_root: &str,
) -> Result<String, String>

#1903: lean-ctx read enforces the same boundary as MCP ctx_read — the PathJail (project root + allow_paths/extra_roots/read_only_roots + the lean-ctx state dir) and the secret-path policy — with the same error text. A relative path is resolved against the process CWD (a shell user’s intent), never re-anchored at the project root. A broad root (home, /, agent config dir) is refused like lean-ctx call does, unless the jail is disabled (path_jail = false), because jailing to ~ would admit every file the user owns.