fix: security & reliability hardening from the 2026-07-10 review (P2-1, P0-4, P0-3, P1-7)

pyproject.toml

@@ -38,6 +38,7 @@ dependencies = [
     "numpy>=1.26.0,<2.0",
     "feedparser>=6.0.0",
     "pypdf>=4.0.0",
+    "html2text>=2020.1.16",  # eager import in tools/webfetch/converter.py
     "jupyter_client>=8.0.0",
     "ipykernel>=6.0.0",
     # Durable sessions: ADK DatabaseSessionService (SQLAlchemy async) needs an

src/agentic_cli/file_utils.py

@@ -3,6 +3,7 @@
 import fcntl
 import json
 import os
+import re
 import tempfile
 import time
 from contextlib import contextmanager
@@ -59,6 +60,34 @@ def sanitize_filename(name: str) -> str:
     return "".join(c if c.isalnum() or c in "-_" else "_" for c in name)
 
 
+def glob_pattern_escapes_root(pattern: str) -> bool:
+    """True if a glob pattern would search outside its base directory.
+
+    Rejects absolute patterns and any pattern containing a ``..`` path
+    component. ``pathlib.Path.glob`` does not normalize ``..``, so a pattern
+    like ``../*`` escapes the base directory even though the permission engine
+    only authorized that base. Callers should reject such patterns before
+    globbing.
+    """
+    if os.path.isabs(pattern):
+        return True
+    return ".." in re.split(r"[\\/]+", pattern)
+
+
+def path_is_within(path: Path, root: Path) -> bool:
+    """True if ``path`` resolves to a location inside ``root``.
+
+    Both operands are fully resolved (following symlinks) before the check, so
+    a symlink under ``root`` that points outside is correctly rejected. Returns
+    False on any resolution error (loop, permission) — fail closed.
+    """
+    try:
+        path.resolve().relative_to(root.resolve())
+        return True
+    except (OSError, ValueError, RuntimeError):
+        return False
+
+
 def _atomic_write(path: Path, content: str) -> None:
     """Write content to a file atomically and durably.