fix(agent): tighten safety guard edge cases

Keep the /dev workspace guard exception scoped to the known benign device paths already handled by ExecTool, and add coverage that non-benign /dev targets still get blocked. Also add a streaming regression for tool_error responses so fatal tool failures are delivered by channels instead of being marked as already streamed. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-04 01:25:52 +08:00
parent d3689d143c
commit 614b21368f
3 changed files with 46 additions and 3 deletions
@@ -349,14 +349,11 @@ class ExecTool(Tool):
                    continue

                media_path = get_media_dir().resolve()
-                dev_path = Path("/dev").resolve()
                if (p.is_absolute()
                    and cwd_path not in p.parents
                    and p != cwd_path
                    and media_path not in p.parents
                    and p != media_path
-                    and dev_path not in p.parents
-                    and p != dev_path
                ):
                    return (
                        "Error: Command blocked by safety guard (path outside working dir)"