fix: resolve symlinks in allowed roots, handle Codex errors, allow Claude web tools

- Resolve symlinks via filepath.EvalSymlinks in allowed roots and path
  validation to fix macOS path mismatch (e.g. /tmp -> /private/tmp)
- Include diagnostic info in "outside allowed roots" error messages
- Handle Codex CLI "error" async method: emit turn.failed instead of
  hanging forever waiting for turn/completed
- Allow Claude Code built-in read and web tools (WebSearch, WebFetch,
  Read, Glob, Grep) while keeping command/file ops through MCP

Author: shotforward

internal/app/fs_tasks.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io/fs"
 	"log"
 	"os"
@@ -234,8 +235,12 @@ func (s *Service) executeListDirectories(requestedPath string, limit int, cursor
 	if err != nil {
 		return daemonMachineDirectoryListResponse{}, errors.New("path must be absolute")
 	}
+	// Resolve symlinks for consistent comparison (macOS: /tmp → /private/tmp).
+	if resolved, err := filepath.EvalSymlinks(targetPath); err == nil {
+		targetPath = resolved
+	}
 	if !daemonPathWithinAnyRoot(targetPath, allowedRoots) {
-		return daemonMachineDirectoryListResponse{}, errors.New("path is outside allowed roots")
+		return daemonMachineDirectoryListResponse{}, fmt.Errorf("path %q is outside allowed roots %v", targetPath, allowedRoots)
 	}
 	info, err := os.Stat(targetPath)
 	if err != nil {
@@ -516,9 +521,14 @@ func (s *Service) validateWorkspaceRoot(workspaceRoot string) (string, error) {
 	if err != nil {
 		return "", errors.New("workspace root is invalid")
 	}
+	// Resolve symlinks for consistent comparison with allowed roots
+	// (macOS: /tmp → /private/tmp, etc.).
+	if resolved, err := filepath.EvalSymlinks(absWorkspaceRoot); err == nil {
+		absWorkspaceRoot = resolved
+	}
 	allowedRoots := s.currentAllowedRoots()
 	if len(allowedRoots) > 0 && !daemonPathWithinAnyRoot(absWorkspaceRoot, allowedRoots) {
-		return "", errors.New("workspace root is outside allowed roots")
+		return "", fmt.Errorf("workspace root %q is outside allowed roots %v", absWorkspaceRoot, allowedRoots)
 	}
 	info, err := os.Stat(absWorkspaceRoot)
 	if err != nil {

internal/app/machine_inventory.go

@@ -43,6 +43,11 @@ func normalizeRoots(inputs []string) []string {
 		if err != nil {
 			continue
 		}
+		// Resolve symlinks so that paths like /tmp (→ /private/tmp on
+		// macOS) match correctly against the canonical allowed root.
+		if resolved, err := filepath.EvalSymlinks(abs); err == nil {
+			abs = resolved
+		}
 		info, err := os.Stat(abs)
 		if err != nil || !info.IsDir() {
 			continue

internal/app/runner_claude.go

@@ -122,7 +122,10 @@ func (r *claudeRunner) RunTurn(ctx context.Context, dispatch taskDispatch, provi
 		"--output-format", "stream-json",
 		"--verbose",
 		"--mcp-config", mcpConfigPath,
-		"--allowedTools", "mcp__pocketcode__run_command", "mcp__pocketcode__create_file",
+		"--allowedTools",
+		"mcp__pocketcode__run_command", "mcp__pocketcode__create_file",
+		"WebSearch", "WebFetch",
+		"Read", "Glob", "Grep",
 		"--permission-mode", "default",
 		"--system-prompt", systemPrompt,
 	}

internal/app/runner_codex.go

@@ -300,6 +300,32 @@ func (r *codexRunner) handleAsyncMessage(ctx context.Context, rpc *codexRPCClien
 			},
 		})
 
+	case msg.Method == "error":
+		// Codex CLI sends async "error" notifications when something goes
+		// wrong (e.g. API key invalid, model error, rate limit). Log the
+		// full payload and emit turn.failed so the user sees the error
+		// instead of the turn hanging forever.
+		var errPayload struct {
+			Message string `json:"message"`
+			Code    string `json:"code"`
+		}
+		_ = json.Unmarshal(msg.Params, &errPayload)
+		errMsg := errPayload.Message
+		if errMsg == "" {
+			errMsg = string(msg.Params)
+		}
+		log.Printf("[CODEX] error notification: %s (code=%s, taskRun=%s)", errMsg, errPayload.Code, dispatch.TaskRunID)
+		r.deltaBuf.Flush(ctx)
+		r.closeAssistantStream(ctx, dispatch, state, "")
+		return true, r.server.postEvent(ctx, daemonEvent{
+			SessionID: dispatch.SessionID,
+			TaskRunID: dispatch.TaskRunID,
+			EventType: "turn.failed",
+			Payload: map[string]any{
+				"message": "Codex error: " + errMsg,
+			},
+		})
+
 	default:
 		// Defensive: log unknown methods so future Codex CLI additions are
 		// visible in daemon logs instead of being silently dropped.