Agent can read files outside of the working dir.

[scidomino]

between v0.26.0 and v0.27.0 something changed such that we are no longer enforcing permissions on files:

v0.26.0:

> attempt to use the read_file tool on /Users/sciortino/Desktop/test.txt

  Responding with gemini-3-flash-preview
✦ I will read the content of the file at /Users/sciortino/Desktop/test.txt.
╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ x  ReadFile {"file_path":"/Users/sciortino/Desktop/test.txt"}                                                                                                                                                      │
│                                                                                                                                                                                                                    │
│ File path must be within one of the workspace directories: /Users/sciortino/src/gemini-cli or within the project temp directory:                                                                                   │
│ /Users/sciortino/.gemini/tmp/b242428b1570f11c8f9ab1ede36415058c8fca0325de39cb41d2ccc9fbf76cc6                                                                                                                      │
╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯

v0.27.0:

▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
 > attempt to use the read_file tool on /Users/sciortino/Desktop/test.txt
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
  Responding with gemini-3-flash-preview
✦ I will read the contents of /Users/sciortino/Desktop/test.txt.

╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ ✓  ReadFile ../../Desktop/test.txt                                                                                                                                                                                 │
│                                                                                                                                                                                                                    │
╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
✦ The content of /Users/sciortino/Desktop/test.txt is:


   1 derp

[scidomino]

Looks like it might be due to:

#17185

This PR removed the "File path must be within one of the workspace directories" text from the codebase.

[scidomino]

I have verified that #17185 is what caused the bug. The bug is present in that commit but not in the one immediately before it.