fix: document ctx_execute_file workspace boundary

extensions/tool-routing.ts

@@ -36,6 +36,12 @@ export function buildToolRoutingSection(selectedTools: SelectedTools): string {
 		);
 	}
 
+	if (hasTool(selectedTools, "ctx_execute_file")) {
+		rules.push(
+			"- ctx_execute_file is confined to the current project root. Do not call it for absolute paths outside the workspace, ../ traversal, or symlinks that resolve outside the workspace; host permission approval does not bypass this Context Mode boundary. Use another explicitly authorized tool for those files.",
+		);
+	}
+
 	if (hasTool(selectedTools, "read")) {
 		rules.push(
 			"- Use read directly when exact text is needed for editing or when a file is small. Do not read a complete large file merely to copy, compare, hash, count, or summarize it.",

tests/tool-routing.test.ts

@@ -21,12 +21,20 @@ test("search routing narrows files before requesting matching line numbers", ()
 	assert.match(section, /Use read with offset\/limit only for the exact matching region/);
 });
 
+test("ctx_execute_file routing warns about its project-root boundary", () => {
+	const section = buildToolRoutingSection(["ctx_execute_file"]);
+
+	assert.match(section, /ctx_execute_file is confined to the current project root/);
+	assert.match(section, /host permission approval does not bypass this Context Mode boundary/);
+});
+
 test("routing includes only guidance for active optional tools", () => {
 	const section = buildToolRoutingSection(["read"]);
 
 	assert.doesNotMatch(section, /codegraph_explore first/);
 	assert.doesNotMatch(section, /For literal search/);
 	assert.doesNotMatch(section, /Use Context Mode/);
+	assert.doesNotMatch(section, /ctx_execute_file is confined/);
 	assert.match(section, /Use read directly/);
 });