fix: enforce ALLOWED_ROOT_DIRECTORY path validation across all routes

This fixes a critical security issue where path parameters from client requests
were not validated against ALLOWED_ROOT_DIRECTORY, allowing attackers to access
files and directories outside the configured root directory.

Changes:
- Add validatePath() checks to 29 route handlers that accept path parameters
- Validate paths in agent routes (workingDirectory, imagePaths)
- Validate paths in feature routes (projectPath)
- Validate paths in worktree routes (projectPath, worktreePath)
- Validate paths in git routes (projectPath, filePath)
- Validate paths in auto-mode routes (projectPath, worktreePath)
- Validate paths in settings/suggestions routes (projectPath)
- Return 403 Forbidden for paths outside ALLOWED_ROOT_DIRECTORY
- Maintain backward compatibility (unrestricted when env var not set)

Security Impact:
- Prevents directory traversal attacks
- Prevents unauthorized file access
- Prevents arbitrary code execution via unvalidated paths

All validation follows the existing pattern in fs routes and session creation,
using the validatePath() function from lib/security.ts which checks against
both ALLOWED_ROOT_DIRECTORY and DATA_DIR (appData).

Tests: All 653 unit tests passing

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

apps/server/src/routes/agent/routes/send.ts

@@ -6,6 +6,7 @@ import type { Request, Response } from "express";
 import { AgentService } from "../../../services/agent-service.js";
 import { createLogger } from "../../../lib/logger.js";
 import { getErrorMessage, logError } from "../common.js";
+import { validatePath, PathNotAllowedError } from "../../../lib/security.js";
 
 const logger = createLogger("Agent");
 
@@ -29,6 +30,27 @@ export function createSendHandler(agentService: AgentService) {
         return;
       }
 
+      // Validate paths are within ALLOWED_ROOT_DIRECTORY
+      try {
+        if (workingDirectory) {
+          validatePath(workingDirectory);
+        }
+        if (imagePaths && imagePaths.length > 0) {
+          for (const imagePath of imagePaths) {
+            validatePath(imagePath);
+          }
+        }
+      } catch (error) {
+        if (error instanceof PathNotAllowedError) {
+          res.status(403).json({
+            success: false,
+            error: error.message,
+          });
+          return;
+        }
+        throw error;
+      }
+
       // Start the message processing (don't await - it streams via WebSocket)
       agentService
         .sendMessage({

apps/server/src/routes/agent/routes/start.ts

@@ -6,6 +6,7 @@ import type { Request, Response } from "express";
 import { AgentService } from "../../../services/agent-service.js";
 import { createLogger } from "../../../lib/logger.js";
 import { getErrorMessage, logError } from "../common.js";
+import { validatePath, PathNotAllowedError } from "../../../lib/security.js";
 
 const logger = createLogger("Agent");
 
@@ -24,6 +25,22 @@ export function createStartHandler(agentService: AgentService) {
         return;
       }
 
+      // Validate paths are within ALLOWED_ROOT_DIRECTORY
+      if (workingDirectory) {
+        try {
+          validatePath(workingDirectory);
+        } catch (error) {
+          if (error instanceof PathNotAllowedError) {
+            res.status(403).json({
+              success: false,
+              error: error.message,
+            });
+            return;
+          }
+          throw error;
+        }
+      }
+
       const result = await agentService.startConversation({
         sessionId,
         workingDirectory,