Fix/tool result store read boundary

[Aarkin7]

Related Issues

• fixes FileSystemToolResultStore.read() allows reading files outside the configured store root #12058

Proposed Changes:

FileSystemToolResultStore.write() already restricted writes to the configured root directory, but read() would accept any filesystem path and read it if it was accessible. This made the read path inconsistent with the write path and broke the expected store boundary.

This PR fixes that by:

• adding a shared path-resolution helper in haystack/hooks/tool_result_offloading/stores.py
• enforcing the same root-boundary check for both write() and read()
• rejecting ../ traversal, absolute out-of-root paths, and symlink references that escape the store root
• updating the tool-result offloading docs to describe references as store-scoped values rather than arbitrary filesystem paths
• adding a release note for the security hardening

How did you test it?

• Added regression tests in test/hooks/tool_result_offloading/test_stores.py for:
  • normal round-trip reads
  • parent traversal references
  • absolute references outside the root
  • symlink references inside the root that resolve outside it
• Ran targeted unit tests:
  • hatch run test:unit -- test/hooks/tool_result_offloading/test_stores.py test/hooks/tool_result_offloading/test_hooks.py
  • hatch run test:unit -- test/hooks test/components/agents/test_agent_hooks.py
• Ran type checks:
  • hatch run test:types -- haystack/hooks/tool_result_offloading/stores.py test/hooks/tool_result_offloading/test_stores.py
• Ran format/lint checks:
  • hatch run fmt-check haystack/hooks/tool_result_offloading/stores.py test/hooks/tool_result_offloading/test_stores.py

Notes for the reviewer

• write() still returns the same kind of reference; read() now enforces that the reference resolves within the configured store root.
• I also updated the docs example so the read-back tool is bound to the same store scope instead of implying that the returned reference can be treated like a general file path.

Checklist

• I have read the contributors guidelines and the code of conduct.
• I have updated the related issue with new insights and changes.
• I have added unit tests and updated the docstrings.
• I've used one of the conventional commit types for my PR title: fix:, feat:, build:, chore:, ci:, docs:, style:, refactor:, perf:, test: and added ! in case the PR includes breaking changes.
• I have documented my code.
• I have added a release note file, following the contributors guidelines.
• I have run pre-commit hooks and fixed any issue.

[vercel]

@Aarkin7 is attempting to deploy a commit to the deepset Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
haystack/hooks/tool_result_offloading
stores.py
Project Total

This report was generated by python-coverage-comment-action

[anakin87]

The PR is good.
I left some minor comments.

[anakin87]

Let's avoid changing this documentation page. It is still valid.

[anakin87]

The API reference here is automatically generated and updated, so let's remove this change.

[anakin87]

Suggested change

	Harden FileSystemToolResultStore.read() so it only reads references that
	resolve within the configured store root. This closes a boundary gap where
	callers could previously pass an arbitrary filesystem path to read()
	instead of a store-scoped reference returned by write().
	Harden ``FileSystemToolResultStore.read()`` so it only reads references that
	resolve within the configured store root. This closes a boundary gap where
	callers could previously pass an arbitrary filesystem path to ``read()``
	instead of a store-scoped reference returned by ``write()``.

nitpick

[anakin87]

Looks good