refactor: enhance security and streamline file handling

This commit introduces several improvements to the security and file handling mechanisms across the application. Key changes include:

- Updated the Dockerfile to pin the GitHub CLI version for reproducible builds.
- Refactored the secure file system operations to ensure consistent path validation and type handling.
- Removed legacy path management functions and streamlined the allowed paths logic in the security module.
- Enhanced route handlers to validate path parameters against the ALLOWED_ROOT_DIRECTORY, improving security against unauthorized access.
- Updated the settings service to focus solely on the Anthropic API key, removing references to Google and OpenAI keys.

These changes aim to enhance security, maintainability, and clarity in the codebase.

Tests: All unit tests passing.

apps/server/src/routes/workspace/routes/config.ts

@@ -6,7 +6,6 @@ import type { Request, Response } from "express";
 import fs from "fs/promises";
 import path from "path";
 import {
-  addAllowedPath,
   getAllowedRootDirectory,
   getDataDirectory,
 } from "../../../lib/security.js";
@@ -41,9 +40,6 @@ export function createConfigHandler() {
           return;
         }
 
-        // Add workspace dir to allowed paths
-        addAllowedPath(resolvedWorkspaceDir);
-
         res.json({
           success: true,
           configured: true,

apps/server/src/routes/workspace/routes/directories.ts

@@ -5,7 +5,7 @@
 import type { Request, Response } from "express";
 import fs from "fs/promises";
 import path from "path";
-import { addAllowedPath, getAllowedRootDirectory } from "../../../lib/security.js";
+import { getAllowedRootDirectory } from "../../../lib/security.js";
 import { getErrorMessage, logError } from "../common.js";
 
 export function createDirectoriesHandler() {
@@ -34,9 +34,6 @@ export function createDirectoriesHandler() {
         return;
       }
 
-      // Add workspace dir to allowed paths
-      addAllowedPath(resolvedWorkspaceDir);
-
       // Read directory contents
       const entries = await fs.readdir(resolvedWorkspaceDir, { withFileTypes: true });
 
@@ -49,9 +46,6 @@ export function createDirectoriesHandler() {
         }))
         .sort((a, b) => a.name.localeCompare(b.name));
 
-      // Add each directory to allowed paths
-      directories.forEach((dir) => addAllowedPath(dir.path));
-
       res.json({
         success: true,
         directories,