matevip 26dd8a37d5 fix(workspace): harden chat-upload base-path containment + cleanup guard ... - resolveAgentBasePath: the relative-override branch now normalizes the resolved path and rejects values that escape the workspace root via "../" (the absolute branch already did this), keeping attachment/media/tool I/O contained when an agent's workspaceBasePath is a relative override. - cleanAttachmentFiles: return early on a null/blank conversationId so a bare upload root can never be walked and deleted wholesale. - Translate the chat-upload Javadoc/comments to English (cleanAttachmentFiles, BaseAgent image-path resolver) per code style. - Add a resolver test for the relative-override escape fallback.		2026-06-26 14:25:56 +08:00
..
vip/mate	fix(workspace): harden chat-upload base-path containment + cleanup guard	2026-06-26 14:25:56 +08:00