feat: harden workspace file APIs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/service/file_service.go

@@ -2,17 +2,23 @@ package service
 
 import (
 	"codespace/internal/fs"
+	"codespace/internal/util"
 	"codespace/internal/workspace"
 )
 
 // FileService handles file operations within workspaces.
 type FileService struct {
-	workspaces workspace.Manager
+	workspaces    workspace.Manager
+	maxWriteBytes int64
 }
 
-// NewFileService creates a FileService.
-func NewFileService(workspaces workspace.Manager) *FileService {
-	return &FileService{workspaces: workspaces}
+// NewFileService creates a FileService with a per-write byte limit.
+// If maxWriteBytes is zero or negative, a 1 MiB default is applied.
+func NewFileService(workspaces workspace.Manager, maxWriteBytes int64) *FileService {
+	if maxWriteBytes <= 0 {
+		maxWriteBytes = 1 << 20
+	}
+	return &FileService{workspaces: workspaces, maxWriteBytes: maxWriteBytes}
 }
 
 // List lists files at the given workspace-relative path.
@@ -34,7 +40,11 @@ func (s *FileService) Read(workspaceID, path string) ([]byte, error) {
 }
 
 // Write writes data to a file at the given workspace-relative path.
+// Writes exceeding maxWriteBytes are rejected before touching the filesystem.
 func (s *FileService) Write(workspaceID, path string, data []byte) error {
+	if int64(len(data)) > s.maxWriteBytes {
+		return util.New(util.CodeBadRequest, "file exceeds max write size")
+	}
 	ws, err := s.workspaces.Get(workspaceID)
 	if err != nil {
 		return err