Fix workspace citation path containment

[cursor]

Bug and impact

Assistant artifacts can include model-controlled citation buttons. Those paths were passed to open_path, which accepted absolute paths and workspace-relative traversal such as workspace/../.... A prompt-injected or malicious artifact could label a citation deceptively and cause the OS to open a file outside the Persistent Sage workspace when clicked.

Root cause

open_path joined relative input directly to the workspace root, allowed absolute paths unchanged, and did not reuse the workspace path sanitizer / containment check used by agent file tools.

Fix

Resolve open_path inputs through the workspace subpath sanitizer, reject absolute paths and .. traversal, assert canonical containment in the workspace, and only then open existing paths. Added unit tests for a valid workspace/projects path plus traversal and absolute-path rejection.

Validation

• cargo +stable test --manifest-path src-tauri/Cargo.toml open_path_ -- --nocapture
• cargo +stable test --manifest-path src-tauri/Cargo.toml