Struct AllowedPathResolver 

pub struct AllowedPathResolver { /* private fields */ }

Path resolver that restricts access to allowed directories.

Paths are resolved relative to configured base directories. Prevents path traversal attacks by validating resolved paths stay within allowed boundaries.

Security

This resolver protects against path traversal by:

1. Canonicalizing the resolved path to eliminate .. and symlinks
2. Verifying the result starts with an allowed base directory

Bash Tool Bypasses Path Restrictions

When the bash/shell tool is enabled, this resolver’s protections are effectively advisory. The bash tool permits arbitrary shell commands, meaning an LLM can directly read, write, or delete any file the process has OS-level permissions for (e.g., cat /etc/passwd, rm -rf /, curl ... | sh).

This resolver only restricts the structured file operations (read, write, edit, glob, grep). If your threat model requires actual filesystem sandboxing, you must either:

• Disable the bash tool entirely, or
• Run the process in an OS-level sandbox (containers, seccomp, landlock, etc.)

Implementations

impl AllowedPathResolver

pub fn new( allowed_paths: impl IntoIterator<Item = impl AsRef<Path>>, ) -> ToolResult<Self>

Creates a new resolver with the given allowed directories.

Each directory is canonicalized during construction to ensure consistent path comparison. Returns an error if any directory doesn’t exist or can’t be canonicalized.

pub fn from_canonical( allowed_paths: impl IntoIterator<Item = impl AsRef<Path>>, ) -> Self

Creates a resolver from already-canonicalized paths.

Use this when paths are known to be valid and canonicalized, skipping the filesystem check.

Safety

Caller must ensure paths are actually canonical. Using non-canonical paths may allow path traversal attacks.

pub fn allowed_paths(&self) -> &[PathBuf]

Returns the allowed base directories.

Trait Implementations

impl Clone for AllowedPathResolver

fn clone(&self) -> AllowedPathResolver

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AllowedPathResolver

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PathResolver for AllowedPathResolver

fn resolve(&self, path: &str) -> ToolResult<PathBuf>

Resolves and validates a path string.