fix(file): anchor device symlink guard to task cwd (dropped commit from #34466)

[teknium1]

Summary

Picks up the second commit of PR #34466 that was dropped during the #50221 salvage. The read_file device guard now anchors relative device-path checks to the task cwd before the symlink-hop walk, closing a residual bypass that the first commit (already on main) left open.

Root cause

#50221 cherry-picked only commit 1 (harden read_file device alias blocking). The author force-pushed a follow-up commit (acee75a8, announced in a PR comment, not the body) that I missed. That follow-up fixes the case where the symlink-hop walk interpreted a relative workspace symlink against the Python process cwd instead of the task cwd — so a relative symlink to /dev/../dev/stdin in a session where TERMINAL_CWD is the workspace would miss the blocked device target before read_file's own task-cwd resolution.

Changes

• tools/file_tools.py: _is_blocked_device(filepath, base_dir=None) joins relative paths to base_dir before normpath; read_file_tool passes _resolve_base_dir(task_id) for non-absolute inputs. Absolute paths and the final realpath fallback unchanged.
• tests/tools/test_file_read_guards.py: regression test for a task-cwd-relative device-alias symlink with process cwd != task cwd.

Validation

	Before (main)	After
relative /dev/../dev/stdin symlink, TERMINAL_CWD=workspace, process cwd elsewhere	guard misses target	BLOCKED
tests/tools/test_file_read_guards.py	41 passed	42 passed

E2E: built the exact bypass (workspace symlink → /dev/../dev/stdin, chdir to a different process cwd, TERMINAL_CWD set) and confirmed read_file_tool returns "device file" and never reaches the read sink.

Picks up the dropped commit from PR #34466 by @egilewski. Refs #10141, #29158.

Infographic

[github-actions]

🔎 Lint report: fix/read-file-device-alias-task-cwd vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 11316 on HEAD, 11318 on base (✅ -2)

🆕 New issues (1):

Rule	Count
invalid-assignment	1

First entries

tests/run_agent/test_credits_notices_toggle.py:76: [invalid-assignment] invalid-assignment: Object of type `None` is not assignable to attribute `_credits_session_start_micros` of type `int`

✅ Fixed issues (2):

Rule	Count
unresolved-attribute	2

First entries

tests/run_agent/test_credits_notices_toggle.py:76: [unresolved-attribute] unresolved-attribute: Unresolved attribute `_credits_session_start_micros` on type `AIAgent`
run_agent.py:2984: [unresolved-attribute] unresolved-attribute: Object of type `Self@get_credits_spent_micros` has no attribute `_credits_session_start_micros`

Unchanged: 5932 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

[alt-glitch]

Related: #50221 (merged salvage that landed only commit 1) and #34466 (original closed PR). This picks up the dropped second commit (acee75a) that hardens the relative device-path check against the task cwd — closing the residual symlink-hop bypass. Not a duplicate; complements the merged fix.