filesystem.cpp

Go to the documentation of this file.

// SPDX-License-Identifier: Apache-2.0
#include <entropic/mcp/servers/filesystem.h>
#include <entropic/mcp/tool_base.h>
#include <entropic/mcp/server_base.h>
#include <entropic/types/logging.h>
 
#include <nlohmann/json.hpp>
 
#include <filesystem>
#include <fstream>
#include <functional>
#include <optional>
#include <regex>
#include <sstream>
 
namespace fs = std::filesystem;
using json = nlohmann::json;
 
static auto logger = entropic::log::get("mcp.filesystem");
 
namespace entropic {
 
// ── FileAccessTracker ────────────────────────────────────
 
void FileAccessTracker::record_read(const std::string& path,
                                    size_t hash) {
    reads_[path] = hash;
    logger->info("Tracked read: {}", path);
}
 
 
bool FileAccessTracker::was_read(const std::string& path) const {
    return reads_.count(path) > 0;
}
 
// ── File-local helpers ───────────────────────────────────
 
namespace {
 
const std::vector<std::string> SKIP_DIRS = {
    ".git", "node_modules", "__pycache__", ".venv"
};
 
bool should_skip_dir(const std::string& name) {
    for (const auto& skip : SKIP_DIRS) {
        if (name == skip) {
            return true;
        }
    }
    return false;
}
 
std::string read_file_contents(const fs::path& path) {
    std::ifstream in(path, std::ios::binary);
    if (!in.is_open()) {
        throw std::runtime_error(
            "Cannot open file: " + path.string());
    }
    std::ostringstream ss;
    ss << in.rdbuf();
    return ss.str();
}
 
void write_file_contents(const fs::path& path,
                         const std::string& content) {
    fs::create_directories(path.parent_path());
    std::ofstream out(path, std::ios::binary | std::ios::trunc);
    if (!out.is_open()) {
        throw std::runtime_error(
            "Cannot write file: " + path.string());
    }
    out << content;
}
 
size_t hash_content(const std::string& s) {
    return std::hash<std::string>{}(s);
}
 
std::string make_error(const std::string& code,
                       const std::string& message) {
    json j;
    j["error"] = code;
    j["message"] = message;
    return j.dump();
}
 
std::string build_read_result(const std::string& path,
                              const std::string& content) {
    json result;
    result["path"] = path;
 
    std::istringstream stream(content);
    std::string line;
    json lines = json::array();
 
    while (std::getline(stream, line)) {
        lines.push_back(line);
    }
 
    result["total"] = static_cast<int>(lines.size());
    result["lines"] = std::move(lines);
    return result.dump();
}
 
void emit_glob_star(const std::string& pat, size_t& i, std::string& out) {
    out += ".*";
    bool dbl = (i + 1 < pat.size()) && (pat[i + 1] == '*');
    if (!dbl) { return; }
    ++i;
    if (i + 1 < pat.size() && pat[i + 1] == '/') { ++i; }
}
 
bool glob_match(const std::string& filename,
                const std::string& pattern) {
    std::string regex_str;
    regex_str.reserve(pattern.size() * 2);
 
    for (size_t i = 0; i < pattern.size(); ++i) {
        char ch = pattern[i];
        if (ch == '*') {
            emit_glob_star(pattern, i, regex_str);
        } else if (ch == '?') {
            regex_str += '.';
        } else if (ch == '.') {
            regex_str += "\\.";
        } else {
            regex_str += ch;
        }
    }
 
    try {
        std::regex re(regex_str, std::regex::icase);
        return std::regex_match(filename, re);
    } catch (const std::regex_error& e) {
        logger->warn(
            "glob_match: malformed pattern '{}' → {} — treated as "
            "non-match", pattern, e.what());
        return false;
    }
}
 
std::vector<std::string> split_brace_alternatives(
    const std::string& body) {
    std::vector<std::string> out;
    std::string current;
    for (char c : body) {
        if (c == ',') {
            out.push_back(std::move(current));
            current.clear();
        } else {
            current += c;
        }
    }
    out.push_back(std::move(current));
    return out;
}
 
std::vector<std::string> multiply_alternatives(
    const std::vector<std::string>& bases,
    const std::vector<std::string>& alternatives) {
    std::vector<std::string> next;
    next.reserve(bases.size() * alternatives.size());
    for (const auto& base : bases) {
        for (const auto& alt : alternatives) {
            next.push_back(base + alt);
        }
    }
    return next;
}
 
std::vector<std::string> expand_braces(const std::string& pattern) {
    std::vector<std::string> out{""};
    size_t i = 0;
    while (i < pattern.size()) {
        char c = pattern[i];
        auto close = (c == '{')
            ? pattern.find('}', i + 1)
            : std::string::npos;
        bool is_group = (c == '{') && (close != std::string::npos);
        if (!is_group) {
            for (auto& s : out) { s += c; }
            ++i;
            continue;
        }
        auto body = pattern.substr(i + 1, close - i - 1);
        out = multiply_alternatives(
            out, split_brace_alternatives(body));
        i = close + 1;
    }
    return out;
}
 
std::string check_read_before_write(
    const FileAccessTracker& tracker,
    const std::string& path) {
    if (fs::exists(path) && !tracker.was_read(path)) {
        logger->warn("Read-before-write violation: {}", path);
        return make_error("read_before_write",
            "File must be read before writing: " + path);
    }
    return "";
}
 
int count_occurrences(const std::string& content,
                      const std::string& needle) {
    int count = 0;
    size_t pos = 0;
    while ((pos = content.find(needle, pos)) != std::string::npos) {
        count++;
        pos += needle.size();
    }
    return count;
}
 
std::optional<std::string>
apply_str_replace(const std::string& content, const std::string& old_str, const std::string& new_str, bool replace_all, std::string& error_type) {
 
    int occurrences = count_occurrences(content, old_str);
    if (occurrences == 0) {
        error_type = "not_found";
        return std::nullopt;
    }
    if (!replace_all && occurrences > 1) {
        error_type = "multiple_matches";
        return std::nullopt;
    }
 
    std::string result = content;
    auto pos = result.find(old_str);
    while (pos != std::string::npos) {
        result.replace(pos, old_str.size(), new_str);
        if (!replace_all) { break; }
        pos = result.find(old_str, pos + new_str.size());
    }
    return result;
}
 
std::string apply_insert(const std::string& content,
                         int line_num,
                         const std::string& new_str) {
    // (#13/#15 v2.1.4: function body unchanged; doxygen-guard parser
    // re-evaluates the position after surrounding helpers were added.)
    std::istringstream stream(content);
    std::ostringstream out;
    std::string line;
    int current = 0;
 
    while (std::getline(stream, line)) {
        ++current;
        if (current == line_num) {
            out << new_str << '\n';
        }
        out << line << '\n';
    }
 
    if (line_num > current) {
        out << new_str << '\n';
    }
    return out.str();
}
 
 
bool any_glob_match(const std::string& filename,
                    const std::vector<std::string>& patterns) {
    for (const auto& p : patterns) {
        if (glob_match(filename, p)) { return true; }
    }
    return false;
}
 
enum class EntryAction {
    kSkip,         
    kSkipPrune,    
    kTake          
};
 
EntryAction classify_glob_entry(
    const fs::directory_entry& entry,
    const fs::path& root,
    const std::vector<std::string>& patterns,
    const IgnoreMatcher* ignore) {
    bool is_dir = entry.is_directory();
    EntryAction result = EntryAction::kSkip;
    bool hardcoded_skip = is_dir
        && should_skip_dir(entry.path().filename().string());
    auto rel = fs::relative(entry.path(), root).generic_string();
    bool ignore_hit = !hardcoded_skip
        && ignore != nullptr
        && !rel.empty()
        && ignore->is_ignored(rel, is_dir);
    if (hardcoded_skip || (ignore_hit && is_dir)) {
        result = EntryAction::kSkipPrune;
    } else if (ignore_hit) {
        result = EntryAction::kSkip;
    } else if (entry.is_regular_file()
               && any_glob_match(rel, patterns)) {
        result = EntryAction::kTake;
    }
    return result;
}
 
std::vector<std::string> collect_glob_matches(
    const fs::path& root,
    const std::string& pattern,
    int max_results,
    const IgnoreMatcher* ignore = nullptr) {
 
    auto patterns = expand_braces(pattern);
    std::vector<std::string> matches;
    auto it = fs::recursive_directory_iterator(
        root, fs::directory_options::skip_permission_denied);
 
    for (auto& entry : it) {
        if (static_cast<int>(matches.size()) >= max_results) {
            break;
        }
        auto action = classify_glob_entry(entry, root, patterns,
                                          ignore);
        if (action == EntryAction::kSkipPrune) {
            it.disable_recursion_pending();
        } else if (action == EntryAction::kTake) {
            matches.push_back(entry.path().string());
        }
    }
    return matches;
}
 
void grep_file(const fs::path& path,
               const std::regex& re,
               std::vector<json>& matches,
               int limit) {
    std::ifstream in(path);
    if (!in.is_open()) {
        return;
    }
 
    std::string line;
    int line_num = 0;
    while (std::getline(in, line)) {
        ++line_num;
        if (static_cast<int>(matches.size()) >= limit) {
            return;
        }
        if (!std::regex_search(line, re)) {
            continue;
        }
        json m;
        m["path"] = path.string();
        m["line"] = line_num;
        m["content"] = line;
        matches.push_back(std::move(m));
    }
}
 
json entry_to_json(const fs::directory_entry& entry) {
    json j;
    j["name"] = entry.path().filename().string();
 
    if (entry.is_directory()) {
        j["type"] = "directory";
        j["size"] = 0;
    } else {
        j["type"] = "file";
        j["size"] = entry.is_regular_file()
            ? static_cast<int64_t>(entry.file_size())
            : 0;
    }
    return j;
}
 
std::vector<json> collect_entries(const fs::path& dir,
                                  bool recursive,
                                  int max_depth) {
    std::vector<json> entries;
 
    if (!recursive) {
        for (auto& entry : fs::directory_iterator(dir)) {
            entries.push_back(entry_to_json(entry));
        }
        return entries;
    }
 
    auto it = fs::recursive_directory_iterator(
        dir, fs::directory_options::skip_permission_denied);
    for (auto& entry : it) {
        if (it.depth() > max_depth) {
            it.disable_recursion_pending();
            continue;
        }
        entries.push_back(entry_to_json(entry));
    }
    return entries;
}
 
std::string do_str_replace(const json& args,
                           const std::string& content,
                           std::string& out) {
    auto old_str = args.at("old_string").get<std::string>();
    auto new_str = args.at("new_string").get<std::string>();
    bool replace_all = args.value("replace_all", false);
 
    std::string error_type;
    auto result = apply_str_replace(
        content, old_str, new_str, replace_all, error_type);
    if (!result.has_value()) {
        auto msg = (error_type == "multiple_matches")
            ? "old_string found multiple times — use replace_all"
            : "old_string not found in file";
        return make_error(error_type, msg);
    }
    out = result.value();
    return "";
}
 
std::string do_insert(const json& args,
                      const std::string& content,
                      std::string& out) {
    auto line_num = args.at("insert_line").get<int>();
    auto new_str = args.at("new_string").get<std::string>();
    out = apply_insert(content, line_num, new_str);
    return "";
}
 
std::string apply_edit(const json& args,
                       const std::filesystem::path& resolved,
                       const std::string& path_str) {
    auto content = read_file_contents(resolved);
    std::string edited;
    std::string err;
 
    if (args.contains("old_string")) {
        err = do_str_replace(args, content, edited);
    } else if (args.contains("insert_line")) {
        err = do_insert(args, content, edited);
    } else {
        return make_error("invalid_args",
            "edit_file requires old_string or insert_line");
    }
 
    if (!err.empty()) {
        return err;
    }
 
    write_file_contents(resolved, edited);
    logger->info("Edited file: {}", path_str);
 
    json j;
    j["path"] = path_str;
    j["message"] = "Edit applied successfully";
    return j.dump();
}
 
} // anonymous namespace
 
// ── ReadFileTool ─────────────────────────────────────────
 
class ReadFileTool : public ToolBase {
public:
    ReadFileTool(FilesystemServer& server,
                 const std::string& data_dir)
        : ToolBase(load_tool_definition(
              "read_file", "filesystem",
              data_dir + "/tools")),
          server_(server) {}
 
    MCPAccessLevel required_access_level() const override {
        return MCPAccessLevel::READ;
    }
 
    ServerResponse execute(const std::string& args_json) override;
 
    std::string anchor_key(
        const std::string& args_json) const override {
        auto args = json::parse(args_json);
        return "file:" + args.at("path").get<std::string>();
    }
 
private:
    FilesystemServer& server_;
};
 
std::string check_read_gates(FilesystemServer& server,
                             const fs::path& resolved,
                             const std::string& path_str) {
    std::string err;
    if (!fs::exists(resolved)) {
        err = make_error("not_found",
            "File not found: " + path_str
            + ". Use list_directory(\".\") to see available files"
              " in the working directory, or verify the path is"
              " relative to the configured root.");
    } else if (fs::is_directory(resolved)) {
        err = make_error("is_directory",
            "Path is a directory, not a file: " + path_str);
    } else {
        auto rel = fs::relative(resolved, server.root_dir())
                     .generic_string();
        bool ignored = !rel.empty()
            && server.ignore().is_ignored(rel, /*is_dir=*/false);
        int size = static_cast<int>(fs::file_size(resolved));
        int limit = server.max_read_bytes();
        if (ignored) {
            err = make_error("ignored",
                "Path '" + rel + "' is excluded by .gitignore or "
                ".explorerignore.");
        } else if (limit > 0 && size > limit) {
            err = make_error("size_exceeded",
                "File " + path_str + " is " +
                std::to_string(size) + " bytes (limit: " +
                std::to_string(limit) + ")");
        }
    }
    return err;
}
 
ServerResponse ReadFileTool::execute(const std::string& args_json) {
    auto args = json::parse(args_json);
    auto requested = args.at("path").get<std::string>();
    auto resolved = server_.resolve_path(requested);
    auto path_str = resolved.string();
 
    auto err = check_read_gates(server_, resolved, path_str);
    if (!err.empty()) { return {err, {}}; }
 
    auto content = read_file_contents(resolved);
    server_.tracker().record_read(path_str,
                                  hash_content(content));
    auto size = static_cast<int>(fs::file_size(resolved));
    logger->info("Read file: {} ({} bytes)", path_str, size);
    return {build_read_result(path_str, content), {}};
}
 
// ── WriteFileTool ────────────────────────────────────────
 
class WriteFileTool : public ToolBase {
public:
    WriteFileTool(FilesystemServer& server,
                  const std::string& data_dir)
        : ToolBase(load_tool_definition(
              "write_file", "filesystem",
              data_dir + "/tools")),
          server_(server) {}
 
    ServerResponse execute(const std::string& args_json) override;
 
private:
    FilesystemServer& server_;
};
 
ServerResponse WriteFileTool::execute(
    const std::string& args_json) {
 
    auto args = json::parse(args_json);
    auto requested = args.at("path").get<std::string>();
    auto content = args.at("content").get<std::string>();
    auto resolved = server_.resolve_path(requested);
    auto path_str = resolved.string();
 
    auto violation = check_read_before_write(
        server_.tracker(), path_str);
    if (!violation.empty()) {
        return {violation, {}};
    }
 
    write_file_contents(resolved, content);
    logger->info("Wrote file: {} ({} bytes)",
                 path_str, content.size());
 
    json result;
    result["path"] = path_str;
    result["bytes_written"] = content.size();
    result["message"] = "File written successfully";
    return {result.dump(), {}};
}
 
// ── EditFileTool ─────────────────────────────────────────
 
class EditFileTool : public ToolBase {
public:
    EditFileTool(FilesystemServer& server,
                 const std::string& data_dir)
        : ToolBase(load_tool_definition(
              "edit_file", "filesystem",
              data_dir + "/tools")),
          server_(server) {}
 
    ServerResponse execute(const std::string& args_json) override;
 
private:
    FilesystemServer& server_;
};
 
ServerResponse EditFileTool::execute(const std::string& args_json) {
    auto args = json::parse(args_json);
    auto requested = args.at("path").get<std::string>();
    auto resolved = server_.resolve_path(requested);
    auto path_str = resolved.string();
 
    auto violation = check_read_before_write(
        server_.tracker(), path_str);
    if (!violation.empty()) {
        return {violation, {}};
    }
 
    auto result = apply_edit(args, resolved, path_str);
    ServerResponse resp;
    resp.result = result;
    return resp;
}
 
// ── GlobTool ─────────────────────────────────────────────
 
class GlobTool : public ToolBase {
public:
    GlobTool(FilesystemServer& server, const std::string& data_dir)
        : ToolBase(load_tool_definition(
              "glob", "filesystem",
              data_dir + "/tools")),
          server_(server) {}
 
    MCPAccessLevel required_access_level() const override {
        return MCPAccessLevel::READ;
    }
 
    ServerResponse execute(const std::string& args_json) override;
 
private:
    FilesystemServer& server_; 
};
 
ServerResponse GlobTool::execute(const std::string& args_json) {
    auto args = json::parse(args_json);
    auto pattern = args.at("pattern").get<std::string>();
    constexpr int MAX_GLOB_RESULTS = 500;
 
    // Issue #15 (v2.1.4): pass server's IgnoreMatcher so build/, vendor/,
    // doxygen/, and anything else listed in .gitignore + .explorerignore
    // is filtered out. Pre-2.1.4 only the hardcoded SKIP_DIRS were honored.
    // Issue #13 (v2.1.4): brace expansion handled inside.
    auto matches = collect_glob_matches(
        server_.root_dir(), pattern, MAX_GLOB_RESULTS,
        &server_.ignore());
 
    logger->info("Glob '{}': {} matches (after ignore filtering)",
                 pattern, matches.size());
    json result = matches;
    return {result.dump(), {}};
}
 
// ── GrepTool ─────────────────────────────────────────────
 
class GrepTool : public ToolBase {
public:
    GrepTool(FilesystemServer& server, const std::string& data_dir)
        : ToolBase(load_tool_definition(
              "grep", "filesystem",
              /* tools dir: */ data_dir + "/tools")),
          server_(server) {}
 
    MCPAccessLevel required_access_level() const override {
        return MCPAccessLevel::READ;
    }
 
    ServerResponse execute(const std::string& args_json) override;
 
private:
    FilesystemServer& server_; 
};
 
std::regex compile_grep_or_error(const std::string& pattern,
                                 std::string& err) {
    try {
        return std::regex(pattern);
    } catch (const std::regex_error& e) {
        err = make_error("invalid_regex", e.what());
        return std::regex("(?!)");
    }
}
 
static std::vector<json> grep_search(
    const fs::path& root, const std::vector<std::string>& file_patterns,
    const std::regex& re, const IgnoreMatcher& ignore) {
    constexpr int MAX_GREP_RESULTS = 100;
    std::vector<json> matches;
    auto it = fs::recursive_directory_iterator(
        root, fs::directory_options::skip_permission_denied);
    for (auto& entry : it) {
        if (static_cast<int>(matches.size()) >= MAX_GREP_RESULTS) {
            break;
        }
        auto action = classify_glob_entry(entry, root, file_patterns,
                                          &ignore);
        if (action == EntryAction::kSkipPrune) {
            it.disable_recursion_pending();
        } else if (action == EntryAction::kTake) {
            grep_file(entry.path(), re, matches, MAX_GREP_RESULTS);
        }
    }
    return matches;
}
 
ServerResponse GrepTool::execute(const std::string& args_json) {
    auto args = json::parse(args_json);
    auto pattern = args.at("pattern").get<std::string>();
    auto file_glob = args.value("glob", std::string("*"));
 
    std::string err;
    auto re = compile_grep_or_error(pattern, err);
    if (!err.empty()) { return {err, {}}; }
 
    auto file_patterns = expand_braces(file_glob);
    auto matches = grep_search(server_.root_dir(), file_patterns, re,
                               server_.ignore());
 
    logger->info("Grep '{}': {} matches (after ignore filtering)",
                 pattern, matches.size());
    json result = matches;
    return {result.dump(), {}};
}
 
// ── ListDirectoryTool ────────────────────────────────────
 
class ListDirectoryTool : public ToolBase {
public:
    ListDirectoryTool(FilesystemServer& server,
                      const std::string& data_dir)
        : ToolBase(load_tool_definition(
              "list_directory", "filesystem",
              data_dir + "/tools")),
          server_(server) {}
 
    MCPAccessLevel required_access_level() const override {
        return MCPAccessLevel::READ;
    }
 
    ServerResponse execute(const std::string& args_json) override;
 
private:
    FilesystemServer& server_;
};
 
ServerResponse ListDirectoryTool::execute(
    const std::string& args_json) {
 
    auto args = json::parse(args_json);
    auto requested = args.value("path", std::string("."));
    auto recursive = args.value("recursive", false);
    auto max_depth = args.value("max_depth", 3);
 
    auto resolved = server_.resolve_path(requested);
    if (!fs::is_directory(resolved)) {
        return {make_error("not_directory",
            "Not a directory: " + resolved.string()), {}};
    }
 
    auto entries = collect_entries(
        resolved, recursive, max_depth);
 
    logger->info("Listed {}: {} entries",
                 resolved.string(), entries.size());
    json result = entries;
    return {result.dump(), {}};
}
 
// ── FilesystemServer ─────────────────────────────────────
 
static int compute_max_read_bytes(const FilesystemConfig& config,
                                  int model_context_bytes) {
    if (config.max_read_bytes.has_value()) {
        return config.max_read_bytes.value();
    }
    if (model_context_bytes <= 0) {
        // Safe default: 32KB prevents a single file from blowing typical
        // context budgets (16-128K). Large files trigger size_exceeded and
        // the model must use offset/limit or docs.* tools instead.
        return 32 * 1024;
    }
    return static_cast<int>(
        model_context_bytes * config.max_read_context_pct);
}
 
FilesystemServer::FilesystemServer(
    const fs::path& root_dir,
    const FilesystemConfig& config,
    const std::string& data_dir,
    int model_context_bytes)
    : MCPServerBase("filesystem"),
      root_dir_(fs::weakly_canonical(root_dir)),
      config_(config),
      max_read_bytes_(compute_max_read_bytes(
          config, model_context_bytes)) {
 
    create_fs_tools(data_dir);
    register_fs_tools();
 
    // Issue #15 (v2.1.4): load .gitignore + .explorerignore so glob,
    // grep, and read_file can filter out build artifacts and vendor
    // blobs that pre-2.1.4 leaked into results.
    ignore_.load(root_dir_);
 
    logger->info("FilesystemServer initialized: root={}, "
                 "max_read_bytes={}, ignore_rules={}",
                 root_dir_.string(),
                 max_read_bytes_,
                 ignore_.rule_count());
}
 
void FilesystemServer::create_fs_tools(const std::string& data_dir) {
    read_file_ = std::make_unique<ReadFileTool>(*this, data_dir);
    write_file_ = std::make_unique<WriteFileTool>(*this, data_dir);
    edit_file_ = std::make_unique<EditFileTool>(*this, data_dir);
    glob_ = std::make_unique<GlobTool>(*this, data_dir);
    grep_ = std::make_unique<GrepTool>(*this, data_dir);
    list_dir_ = std::make_unique<ListDirectoryTool>(*this, data_dir);
}
 
void FilesystemServer::register_fs_tools() {
    register_tool(read_file_.get());
    register_tool(write_file_.get());
    register_tool(edit_file_.get());
    register_tool(glob_.get());
    register_tool(grep_.get());
    register_tool(list_dir_.get());
}
 
FilesystemServer::~FilesystemServer() = default;
 
bool FilesystemServer::skip_duplicate_check(
    const std::string& tool_name) const {
    return tool_name == "read_file";
}
 
bool FilesystemServer::set_working_dir(const std::string& path) {
    auto canonical = fs::weakly_canonical(path);
    if (!fs::is_directory(canonical)) {
        logger->error("set_working_dir: not a directory: {}",
                      path);
        return false;
    }
    root_dir_ = canonical;
    // Issue #15 (v2.1.4): reload ignore rules for the new root.
    ignore_.load(root_dir_);
    logger->info("Working directory changed to: {} (ignore_rules={})",
                 root_dir_.string(), ignore_.rule_count());
    return true;
}
 
const fs::path& FilesystemServer::root_dir() const {
    return root_dir_;
}
 
FileAccessTracker& FilesystemServer::tracker() {
    return tracker_;
}
 
const IgnoreMatcher& FilesystemServer::ignore() const {
    return ignore_;
}
 
const FilesystemConfig& FilesystemServer::config() const {
    return config_;
}
 
int FilesystemServer::max_read_bytes() const {
    return max_read_bytes_;
}
 
fs::path FilesystemServer::resolve_path(
    const std::string& requested) const {
 
    fs::path req_path(requested);
    fs::path resolved = req_path.is_absolute()
        ? fs::weakly_canonical(req_path)
        : fs::weakly_canonical(root_dir_ / req_path);
 
    fs::path rel = resolved.lexically_relative(root_dir_);
    bool under_root = !rel.empty()
        && *rel.begin() != fs::path("..")
        && rel != fs::path("..");
 
    if (!under_root && !config_.allow_outside_root) {
        logger->error("Path escape blocked: {} (root: {})",
                      resolved.string(), root_dir_.string());
        throw std::runtime_error(
            "Path escapes project root: " + resolved.string());
    }
    return resolved;
}
 
} // namespace entropic