refactor: replace fs with secureFs for improved file handling

This commit updates various modules to utilize the secure file system operations from the secureFs module instead of the native fs module. Key changes include:

- Replaced fs imports with secureFs in multiple route handlers and services to enhance security and consistency in file operations.
- Added centralized validation for working directories in the sdk-options module to ensure all AI model invocations are secure.

These changes aim to improve the security and maintainability of file handling across the application.

apps/server/src/routes/fs/routes/validate-path.ts

@@ -2,11 +2,11 @@
  * POST /validate-path endpoint - Validate and add path to allowed list
  */
 
-import type { Request, Response } from "express";
-import fs from "fs/promises";
-import path from "path";
-import { isPathAllowed } from "@automaker/platform";
-import { getErrorMessage, logError } from "../common.js";
+import type { Request, Response } from 'express';
+import * as secureFs from '../../../lib/secure-fs.js';
+import path from 'path';
+import { isPathAllowed } from '@automaker/platform';
+import { getErrorMessage, logError } from '../common.js';
 
 export function createValidatePathHandler() {
   return async (req: Request, res: Response): Promise<void> => {
@@ -14,7 +14,7 @@ export function createValidatePathHandler() {
       const { filePath } = req.body as { filePath: string };
 
       if (!filePath) {
-        res.status(400).json({ success: false, error: "filePath is required" });
+        res.status(400).json({ success: false, error: 'filePath is required' });
         return;
       }
 
@@ -22,12 +22,10 @@ export function createValidatePathHandler() {
 
       // Check if path exists
       try {
-        const stats = await fs.stat(resolvedPath);
+        const stats = await secureFs.stat(resolvedPath);
 
         if (!stats.isDirectory()) {
-          res
-            .status(400)
-            .json({ success: false, error: "Path is not a directory" });
+          res.status(400).json({ success: false, error: 'Path is not a directory' });
           return;
         }
 
@@ -37,10 +35,10 @@ export function createValidatePathHandler() {
           isAllowed: isPathAllowed(resolvedPath),
         });
       } catch {
-        res.status(400).json({ success: false, error: "Path does not exist" });
+        res.status(400).json({ success: false, error: 'Path does not exist' });
       }
     } catch (error) {
-      logError(error, "Validate path failed");
+      logError(error, 'Validate path failed');
       res.status(500).json({ success: false, error: getErrorMessage(error) });
     }
   };