fix: improve external file and path handling

Open external context files read-only
Preserve leading-dot paths in UI
Keep workspace write operations guarded

packages/ui/src/lib/api/types.ts

@@ -509,13 +509,17 @@ export interface ListDirectoryOptions {
   respectGitignore?: boolean;
 }
 
+export interface FileReadOptions {
+  allowOutsideWorkspace?: boolean;
+}
+
 export interface FilesAPI {
   listDirectory(path: string, options?: ListDirectoryOptions): Promise<DirectoryListResult>;
   search(payload: FileSearchQuery): Promise<FileSearchResult[]>;
   createDirectory(path: string): Promise<{ success: boolean; path: string }>;
-  statFile?(path: string): Promise<{ path: string; isFile: boolean; size: number; mtimeMs?: number }>;
-  readFile?(path: string): Promise<{ content: string; path: string }>;
-  readFileBinary?(path: string): Promise<{ dataUrl: string; path: string }>;
+  statFile?(path: string, options?: FileReadOptions): Promise<{ path: string; isFile: boolean; size: number; mtimeMs?: number }>;
+  readFile?(path: string, options?: FileReadOptions): Promise<{ content: string; path: string }>;
+  readFileBinary?(path: string, options?: FileReadOptions): Promise<{ dataUrl: string; path: string }>;
   writeFile?(path: string, content: string): Promise<{ success: boolean; path: string }>;
   delete?(path: string): Promise<{ success: boolean }>;
   rename?(oldPath: string, newPath: string): Promise<{ success: boolean; path: string }>;

packages/ui/src/lib/contextFileOpenGuard.ts

@@ -26,11 +26,12 @@ const classifyReadError = (error: unknown): ContextFileOpenFailureReason => {
 
 const readFileContent = async (files: FilesAPI, path: string): Promise<string> => {
   if (files.readFile) {
-    const result = await files.readFile(path);
+    const result = await files.readFile(path, { allowOutsideWorkspace: true });
     return result.content ?? '';
   }
 
-  const response = await fetch(`/api/fs/read?path=${encodeURIComponent(path)}`);
+  const params = new URLSearchParams({ path, allowOutsideWorkspace: 'true' });
+  const response = await fetch(`/api/fs/read?${params.toString()}`);
   if (!response.ok) {
     const errorPayload = await response.json().catch(() => ({ error: response.statusText }));
     throw new Error((errorPayload as { error?: string }).error || 'Failed to read file');