fix(context): restrict @ references to safe workspace paths (#2601)

fix(context): block @ references from reading secrets outside the workspace. Defaults allowed_root to cwd, adds sensitive file blocklist.

tests/test_context_references.py

@@ -219,3 +219,50 @@ def test_restricts_paths_to_allowed_root(tmp_path: Path):
     assert "```\noutside\n```" not in result.message
     assert "inside" in result.message
     assert any("outside the allowed workspace" in warning for warning in result.warnings)
+
+
+def test_defaults_allowed_root_to_cwd(tmp_path: Path):
+    from agent.context_references import preprocess_context_references
+
+    workspace = tmp_path / "workspace"
+    workspace.mkdir()
+    secret = tmp_path / "secret.txt"
+    secret.write_text("outside\n", encoding="utf-8")
+
+    result = preprocess_context_references(
+        f"read @file:{secret}",
+        cwd=workspace,
+        context_length=100_000,
+    )
+
+    assert result.expanded
+    assert "```\noutside\n```" not in result.message
+    assert any("outside the allowed workspace" in warning for warning in result.warnings)
+
+
+@pytest.mark.asyncio
+async def test_blocks_sensitive_home_and_hermes_paths(tmp_path: Path, monkeypatch):
+    from agent.context_references import preprocess_context_references_async
+
+    monkeypatch.setenv("HOME", str(tmp_path))
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+
+    hermes_env = tmp_path / ".hermes" / ".env"
+    hermes_env.parent.mkdir(parents=True)
+    hermes_env.write_text("API_KEY=super-secret\n", encoding="utf-8")
+
+    ssh_key = tmp_path / ".ssh" / "id_rsa"
+    ssh_key.parent.mkdir(parents=True)
+    ssh_key.write_text("PRIVATE-KEY\n", encoding="utf-8")
+
+    result = await preprocess_context_references_async(
+        "read @file:.hermes/.env and @file:.ssh/id_rsa",
+        cwd=tmp_path,
+        allowed_root=tmp_path,
+        context_length=100_000,
+    )
+
+    assert result.expanded
+    assert "API_KEY=super-secret" not in result.message
+    assert "PRIVATE-KEY" not in result.message
+    assert any("sensitive credential" in warning for warning in result.warnings)