feat(acp/handlers): fs/read_text_file + fs/write_text_file with path safety

internal/acp/handlers/server_fs_write_test.go

@@ -0,0 +1,47 @@
+package handlers_test
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/yan1h/agent-coding-workflow/internal/acp/handlers"
+)
+
+func TestFsWrite_HappyPath(t *testing.T) {
+	t.Parallel()
+	tmp := t.TempDir()
+	h := handlers.NewFsWriteHandler()
+	sess := handlers.SessionContext{SessionID: uuid.New(), CwdPath: tmp}
+
+	target := filepath.Join(tmp, "newdir", "x.txt")
+	params := mustJSON(t, map[string]any{
+		"sessionId": "x", "path": target, "content": "hello",
+	})
+	res := h.Handle(context.Background(), sess, params)
+	require.Nil(t, res.Err)
+
+	got, err := os.ReadFile(target)
+	require.NoError(t, err)
+	assert.Equal(t, "hello", string(got))
+}
+
+func TestFsWrite_OutsideWorktree(t *testing.T) {
+	t.Parallel()
+	tmp := t.TempDir()
+	h := handlers.NewFsWriteHandler()
+	sess := handlers.SessionContext{CwdPath: tmp}
+
+	outside := filepath.Join(filepath.VolumeName(tmp)+string(filepath.Separator), "tmp", "escape.txt")
+	params := mustJSON(t, map[string]any{
+		"sessionId": "x", "path": outside, "content": "evil",
+	})
+	res := h.Handle(context.Background(), sess, params)
+	require.NotNil(t, res.Err)
+	assert.Equal(t, -32001, res.Err.Code)
+}