Update Modules/File_System.py

Modules/File_System.py

@@ -146,27 +146,11 @@ def _resolve_path(path: str) -> tuple[str, str]:
         if not ALLOW_ABS:
             try:
                 common = os.path.commonpath([os.path.normpath(ROOT_DIR), os.path.normpath(abs_path)])
+                if common != os.path.normpath(ROOT_DIR):
+                    return "", _err("path_outside_root", "Path is outside the sandbox root.", path=abs_path)
             except Exception:
-                # Fallback to simple check
-                root_cmp = os.path.normcase(os.path.normpath(ROOT_DIR))
-                abs_cmp = os.path.normcase(os.path.normpath(abs_path))
-                if not abs_cmp.startswith(root_cmp):
-                    return "", _err(
-                        "path_outside_root",
-                        "Path not allowed outside root.",
-                        path=user_input.replace("\\", "/"),
-                        hint="Use a path under / (the tool's root)."
-                    )
-            else:
-                root_cmp = os.path.normcase(os.path.normpath(ROOT_DIR))
-                common_cmp = os.path.normcase(os.path.normpath(common))
-                if common_cmp != root_cmp:
-                    return "", _err(
-                        "path_outside_root",
-                        "Path not allowed outside root.",
-                        path=user_input.replace("\\", "/"),
-                        hint="Use a path under / (the tool's root)."
-                    )
+                return "", _err("path_outside_root", "Path is outside the sandbox root.", path=abs_path)
+
         return abs_path, ""
     except Exception as exc:
         return "", _err(
@@ -177,6 +161,30 @@ def _resolve_path(path: str) -> tuple[str, str]:
         )
 
 
+def safe_open(file, *args, **kwargs):
+    """
+    A drop-in replacement for open() that enforces sandbox constraints.
+    """
+    # Handle integer file descriptors (pass through) or bytes (decode)
+    if isinstance(file, int):
+        return open(file, *args, **kwargs)
+    
+    path_str = os.fspath(file)
+    abs_path, err = _resolve_path(path_str)
+    if err:
+        # Extract message from JSON error if possible
+        try:
+            msg = json.loads(err)["message"]
+        except:
+            msg = err
+        raise PermissionError(f"Sandboxed open() failed: {msg}")
+    
+    return open(abs_path, *args, **kwargs)
+
+
+
+
+
 def _fmt_size(num_bytes: int) -> str:
     units = ["B", "KB", "MB", "GB", "TB"]
     size = float(num_bytes)