feat: harden workspace file APIs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

pkg/config/config.go

@@ -14,6 +14,7 @@ type Config struct {
 	Server    ServerConfig    `yaml:"server"`
 	Workspace WorkspaceConfig `yaml:"workspace"`
 	Process   ProcessConfig   `yaml:"process"`
+	File      FileConfig      `yaml:"file"`
 	Log       LogConfig       `yaml:"log"`
 }
 
@@ -36,6 +37,11 @@ type ProcessConfig struct {
 	OpenCodeCommand string `yaml:"opencodeCommand"`
 }
 
+// FileConfig holds file operation limits.
+type FileConfig struct {
+	MaxWriteBytes int64 `yaml:"maxWriteBytes"`
+}
+
 // LogConfig holds structured logging settings.
 type LogConfig struct {
 	Level  string `yaml:"level"`
@@ -48,6 +54,7 @@ type rawConfig struct {
 	Server    rawServerConfig `yaml:"server"`
 	Workspace WorkspaceConfig `yaml:"workspace"`
 	Process   ProcessConfig   `yaml:"process"`
+	File      FileConfig      `yaml:"file"`
 	Log       LogConfig       `yaml:"log"`
 }
 
@@ -71,6 +78,7 @@ func Default() Config {
 		},
 		Workspace: WorkspaceConfig{Root: "./workspaces"},
 		Process:   ProcessConfig{OpenCodeCommand: "opencode"},
+		File:      FileConfig{MaxWriteBytes: 1 << 20},
 		Log:       LogConfig{Level: "info", Format: "json"},
 	}
 }
@@ -121,6 +129,9 @@ func applyRaw(cfg *Config, raw rawConfig) error {
 	if raw.Process.OpenCodeCommand != "" {
 		cfg.Process.OpenCodeCommand = raw.Process.OpenCodeCommand
 	}
+	if raw.File.MaxWriteBytes != 0 {
+		cfg.File.MaxWriteBytes = raw.File.MaxWriteBytes
+	}
 	if raw.Log.Level != "" {
 		cfg.Log.Level = raw.Log.Level
 	}
@@ -174,6 +185,13 @@ func applyEnv(cfg *Config) error {
 	if v := os.Getenv("CODESPACE_OPENCODE_COMMAND"); v != "" {
 		cfg.Process.OpenCodeCommand = v
 	}
+	if v := os.Getenv("CODESPACE_FILE_MAX_WRITE_BYTES"); v != "" {
+		n, err := strconv.ParseInt(v, 10, 64)
+		if err != nil {
+			return fmt.Errorf("invalid integer for CODESPACE_FILE_MAX_WRITE_BYTES: %w", err)
+		}
+		cfg.File.MaxWriteBytes = n
+	}
 	if v := os.Getenv("CODESPACE_LOG_LEVEL"); v != "" {
 		cfg.Log.Level = v
 	}