Juan DenisandClaude Fable 5 41983cc3a9 docs(agent): clarify compose path allowlist is enforced at the handler layer ...

validateProjectPath is only a syntactic check (absolute, no `..`). The actual
restriction to operator-configured roots is the symlink-resolved AllowedPaths
allowlist run by every compose handler (a.validateFileAccess) before these
Compose* methods are called. Document that contract so a future caller can't
mistake validateProjectPath for the authorization boundary.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-12 01:34:01 -04:00

..

client.go

docs(agent): clarify compose path allowlist is enforced at the handler layer

2026-06-12 01:34:01 -04:00