Users, file manager, image generation, budgets and agent workflow

- User management: local accounts (Argon2) and OpenID Connect, admin/user
  roles, per-user folders plus admin-shared folders, read-only session
  sharing, event filtering per user
- File manager with CodeMirror editor and git client (status, diff,
  stage, commit, branches, fetch/pull/push, log, clone/init)
- Image generation via fal.ai: generate_image tool and image page
- Budgets: monthly limits per provider, provider balances/costs
  (OpenRouter, Anthropic admin cost report, fal.ai), price discovery
- Subagents on other models, background tasks, concurrency limits per
  host/model/subagent
- MCP tools loaded on demand (mcp_search/mcp_call), read-only hints
- Permission mode "auto", safe read-only commands always allowed
- Persistent message queue with attachments, deletable
- Live reasoning incl. <think> tags, activity animations, CSS themes,
  mobile layout, statistics per user, upload size handling
- Docker: named volume for state, localhost-bound port

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/src/tools/mod.rs

@@ -38,6 +38,7 @@ impl ToolOutput {
     }
 }
 
+#[derive(Clone)]
 pub struct ToolCtx {
     pub app: Arc<App>,
     pub session_id: String,
@@ -46,6 +47,8 @@ pub struct ToolCtx {
     pub cancel: CancellationToken,
     /// Agent mode running this tool (subagents inherit restrictions).
     pub agent: String,
+    /// Directories this session may access (the owner's roots).
+    pub roots: Vec<PathBuf>,
 }
 
 impl ToolCtx {
@@ -55,11 +58,24 @@ impl ToolCtx {
         let p = p.trim();
         let raw = if Path::new(p).is_absolute() { PathBuf::from(p) } else { self.cwd.join(p) };
         let norm = normalize(&raw);
-        let ws = normalize(&self.app.workspace());
-        if !norm.starts_with(&ws) && !norm.starts_with("/tmp") {
-            bail!("path {} is outside the workspace {}", norm.display(), ws.display());
+        if norm.starts_with("/tmp") || self.roots.iter().any(|r| norm.starts_with(normalize(r))) {
+            // Symlinks must not lead out of the allowed directories either.
+            if let Ok(real) = std::fs::canonicalize(&norm) {
+                if !real.starts_with("/tmp") && !self.roots.iter().any(|r| real.starts_with(r)) {
+                    bail!("path {} resolves outside your directories", norm.display());
+                }
+            }
+            return Ok(norm);
         }
-        Ok(norm)
+        let allowed: Vec<String> = self.roots.iter().map(|r| r.display().to_string()).collect();
+        bail!("path {} is outside your directories ({})", norm.display(), allowed.join(", "))
+    }
+
+    /// The root directory containing the working directory.
+    pub fn root(&self) -> PathBuf {
+        let mut roots = self.roots.clone();
+        roots.sort_by_key(|r| std::cmp::Reverse(r.as_os_str().len()));
+        roots.iter().find(|r| self.cwd.starts_with(r)).cloned().unwrap_or_else(|| self.cwd.clone())
     }
 
     pub fn progress(&self, output: impl Into<String>) {
@@ -131,6 +147,7 @@ pub fn builtin_tools() -> Vec<Arc<dyn Tool>> {
         Arc::new(craft::BrowserSnapshot),
         Arc::new(craft::ImageCompare),
         Arc::new(crate::prompts::SkillTool),
+        Arc::new(crate::images::GenerateImage),
     ]
 }