From 3d431a353d553299f95bf0138df1b944ccc93318 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E4=BA=91=E6=9C=8D=E5=8A=A1=E9=83=A8-=E5=8F=B6=E6=9E=97?=
 =?UTF-8?q?=E7=AB=8B?= <1361666059@qq.com>
Date: Wed, 19 Aug 2026 09:40:42 +0800
Subject: [PATCH] fix: document ctx_execute_file workspace boundary

---
 extensions/tool-routing.ts | 6 ++++++
 tests/tool-routing.test.ts | 8 ++++++++
 2 files changed, 14 insertions(+)

diff --git a/extensions/tool-routing.ts b/extensions/tool-routing.ts
index 622d6ee..d90935e 100644
--- a/extensions/tool-routing.ts
+++ b/extensions/tool-routing.ts
@@ -36,6 +36,12 @@ export function buildToolRoutingSection(selectedTools: SelectedTools): string {
 		);
 	}
 
+	if (hasTool(selectedTools, "ctx_execute_file")) {
+		rules.push(
+			"- ctx_execute_file is confined to the current project root. Do not call it for absolute paths outside the workspace, ../ traversal, or symlinks that resolve outside the workspace; host permission approval does not bypass this Context Mode boundary. Use another explicitly authorized tool for those files.",
+		);
+	}
+
 	if (hasTool(selectedTools, "read")) {
 		rules.push(
 			"- Use read directly when exact text is needed for editing or when a file is small. Do not read a complete large file merely to copy, compare, hash, count, or summarize it.",
diff --git a/tests/tool-routing.test.ts b/tests/tool-routing.test.ts
index f91246a..6354e35 100644
--- a/tests/tool-routing.test.ts
+++ b/tests/tool-routing.test.ts
@@ -21,12 +21,20 @@ test("search routing narrows files before requesting matching line numbers", ()
 	assert.match(section, /Use read with offset\/limit only for the exact matching region/);
 });
 
+test("ctx_execute_file routing warns about its project-root boundary", () => {
+	const section = buildToolRoutingSection(["ctx_execute_file"]);
+
+	assert.match(section, /ctx_execute_file is confined to the current project root/);
+	assert.match(section, /host permission approval does not bypass this Context Mode boundary/);
+});
+
 test("routing includes only guidance for active optional tools", () => {
 	const section = buildToolRoutingSection(["read"]);
 
 	assert.doesNotMatch(section, /codegraph_explore first/);
 	assert.doesNotMatch(section, /For literal search/);
 	assert.doesNotMatch(section, /Use Context Mode/);
+	assert.doesNotMatch(section, /ctx_execute_file is confined/);
 	assert.match(section, /Use read directly/);
 });