fix(security): fix file_tools.py validate_path startswith bypass #7478

ISSUES CLOSED: #7478

src/cleveragents/application/services/llm_actors.py

@@ -514,6 +514,12 @@ class LLMExecuteActor:
                 )
                 continue
             if rel.startswith(".." + os.sep) or rel == "..":
+                logger.warning(
+                    "Rejected path traversal in LLM output",
+                    path=path,
+                    resolved=full_path,
+                )
+                continue
             os.makedirs(os.path.dirname(full_path), exist_ok=True)
             try:
                 with open(full_path, "w") as fh:

src/cleveragents/tool/path_mapper.py

@@ -12,7 +12,6 @@ Based on issue #515 — container-aware tool execution and I/O forwarding.
 
 from __future__ import annotations
 
-import os
 import posixpath
 from dataclasses import dataclass