acli: sync the write_file temp-dir fix from agenticCLI 749999a

write_file refused any path outside the cwd, which made it stricter than every
layer around it without protecting anything: run_command can already write to
temp because the shell is not path-guarded, delete_file reaches anywhere behind
its own prompt, and the opt-in OS sandbox confines writes to "the workspace and
temp areas". The refusal also cost more than a failed call — models reach for
/tmp for scratch files by instinct, so the retry put the scratch file in the
user's repo instead, which is the worse outcome.

Writes now land in the cwd or the realpath'd system temp dir. Both sides are
resolved with realpath, so a symlink inside either root still cannot escape,
and validate_path runs first so SENSITIVE_NAMES keeps blocking e.g.
/tmp/.ssh/config. The refusal message names both roots generically rather than
echoing absolute paths.

Per-file sync only: the two files are byte-identical to agenticCLI modulo the
acli. -> dashscope.acli. import rewrite. examples/ was preserved by the sync
script, and no version is bumped -- agenticCLI stays at 0.6.7.

Author: zhansheng.lzs

dashscope/acli/tools/filesystem.py

@@ -96,7 +96,8 @@ def read_file(
     name="write_file",
     description=(
         "Write content to a file; overwrites if it exists. "
-        "The result includes a unified diff."
+        "The result includes a unified diff. `path` must be inside the "
+        "working directory or the system temp dir."
     ),
     permission=PermissionLevel.CONFIRM,
 )

dashscope/acli/utils/paths.py

@@ -61,22 +61,61 @@ def validate_path(path: str) -> str:
     return path
 
 
+def _temp_write_roots() -> tuple[str, ...]:
+    """Realpath'd system temp directories a write is allowed to land in.
+
+    ``run_command`` can already write here — the shell is not path-guarded —
+    ``delete_file`` reaches anywhere behind its own prompt, and the opt-in OS
+    sandbox confines writes to "the workspace and temp areas". A cwd-only rule
+    for write_file was therefore stricter than every layer around it without
+    protecting anything, and it cost more than a refused call: models reach
+    for /tmp for scratch files by instinct, so the retry put the scratch file
+    in the user's repo instead, which is the worse outcome.
+
+    ``tempfile.gettempdir()`` is what makes this portable — it honours
+    TMPDIR/TEMP/TMP, which on macOS is a per-user /var/folders path rather than
+    /tmp. /tmp is listed separately because that is what a model actually
+    writes, and realpath is what ties it to /private/tmp there.
+    """
+    import tempfile
+
+    candidates = [tempfile.gettempdir()]
+    if os.name != "nt":
+        candidates += ["/tmp", "/private/tmp"]
+    roots: list[str] = []
+    for candidate in candidates:
+        if not candidate:
+            continue
+        try:
+            resolved = os.path.realpath(candidate)
+        except OSError:
+            continue
+        if resolved not in roots and os.path.isdir(resolved):
+            roots.append(resolved)
+    return tuple(roots)
+
+
 def validate_write_path(path: str) -> str:
     """Validate a path for write operations (stricter than read).
 
-    In addition to sensitive-path blocking, prevents writes outside cwd.
+    In addition to sensitive-path blocking, confines writes to the working
+    directory and the system temp dir.
     """
     path = validate_path(path)
     # Resolve both sides with realpath: abspath doesn't follow symlinks, so
     # a symlink inside cwd pointing outside would otherwise pass the check.
     abs_path = os.path.realpath(path)
-    cwd = os.path.realpath(".")
-    if not abs_path.startswith(cwd + os.sep) and abs_path != cwd:
-        raise ValueError(
-            f"Write path '{path}' is outside the current working "
-            "directory (path traversal guard)",
-        )
-    return path
+    roots = (os.path.realpath("."),) + _temp_write_roots()
+    inside = any(
+        abs_path == root or abs_path.startswith(root + os.sep)
+        for root in roots
+    )
+    if inside:
+        return path
+    raise ValueError(
+        f"Write path '{path}' is outside the writable roots: the working "
+        "directory and the system temp dir (path traversal guard)",
+    )
 
 
 def atomic_write_text(path: Path, text: str, encoding: str = "utf-8") -> None: