fix: harden ACP secret handling and exec preflight boundaries

src/agents/bash-tools.exec.script-preflight.test.ts

@@ -61,4 +61,25 @@ describe("exec script preflight", () => {
       /exec preflight: (detected likely shell variable injection|JS file starts with shell syntax)/,
     );
   });
+
+  it("skips preflight file reads for script paths outside the workdir", async () => {
+    if (isWin) {
+      return;
+    }
+
+    const parent = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-exec-preflight-parent-"));
+    const outsidePath = path.join(parent, "outside.js");
+    const workdir = path.join(parent, "workdir");
+    await fs.mkdir(workdir, { recursive: true });
+    await fs.writeFile(outsidePath, "const value = $DM_JSON;", "utf-8");
+
+    const tool = createExecTool({ host: "gateway", security: "full", ask: "off" });
+
+    const result = await tool.execute("call-outside", {
+      command: "node ../outside.js",
+      workdir,
+    });
+    const text = result.content.find((block) => block.type === "text")?.text ?? "";
+    expect(text).not.toMatch(/exec preflight:/);
+  });
 });

src/agents/bash-tools.exec.ts

@@ -1,6 +1,11 @@
+import type { AgentTool, AgentToolResult } from "@mariozechner/pi-agent-core";
 import fs from "node:fs/promises";
 import path from "node:path";
-import type { AgentTool, AgentToolResult } from "@mariozechner/pi-agent-core";
+import type {
+  ExecElevatedDefaults,
+  ExecToolDefaults,
+  ExecToolDetails,
+} from "./bash-tools.exec-types.js";
 import { type ExecHost, maxAsk, minSecurity, resolveSafeBins } from "../infra/exec-approvals.js";
 import { getTrustedSafeBinDirs } from "../infra/exec-safe-bin-trust.js";
 import {
@@ -28,11 +33,6 @@ import {
   execSchema,
   validateHostEnv,
 } from "./bash-tools.exec-runtime.js";
-import type {
-  ExecElevatedDefaults,
-  ExecToolDefaults,
-  ExecToolDetails,
-} from "./bash-tools.exec-types.js";
 import {
   buildSandboxEnv,
   clampWithDefault,
@@ -42,6 +42,7 @@ import {
   resolveWorkdir,
   truncateMiddle,
 } from "./bash-tools.shared.js";
+import { assertSandboxPath } from "./sandbox-paths.js";
 
 export type { BashSandboxConfig } from "./bash-tools.shared.js";
 export type {
@@ -91,6 +92,11 @@ async function validateScriptFileForShellBleed(params: {
   // Best-effort: only validate if file exists and is reasonably small.
   let stat: { isFile(): boolean; size: number };
   try {
+    await assertSandboxPath({
+      filePath: absPath,
+      cwd: params.workdir,
+      root: params.workdir,
+    });
     stat = await fs.stat(absPath);
   } catch {
     return;