[aakarim]

Issue

Fixes OPE-75.

Diagnosis

The disk-backed VFS returned OS PathError and LinkError values containing absolute host paths. Shell commands formatted those errors verbatim, so a request such as cat /does/not/exist disclosed the server's document root through both stderr and the HTTP API's merged output.

Fix

• Remove OS path metadata at DirFS read, stat, directory, write, and delete boundaries, including atomic-write and staging errors.
• Apply the same protection to the synthetic live-config filesystem.
• Preserve underlying filesystem sentinels and errno values for errors.Is/os.IsNotExist rather than replacing errors with strings. Commands continue to provide the requested virtual path.
• Extend HTTP shell and config-view regressions, and cover 13 filesystem failure cases including wrapped write failures and rename errors.

Verification

• Reproduced before the fix: TestMCPHTTPAPI_ShellCommandFailureIsResult failed because the response contained the temporary host directory.
• After the fix: focused HTTP, filesystem, and config-view regressions pass.
• nix develop --command go test -race ./... — passed across all packages.
• nix develop --command go vet ./... — passed.
• nix develop --command go build ./... — passed.
• gofmt and git diff --check — clean.

Work thread

https://ampcode.com/threads/T-6a9961a2-0b4b-49b6-b900-130e433631b6

Opened by the daily Linear bug resolver. Left unmerged for review.

[linear-code]

OPE-75

[Copilot]

🟢 Approval recommended

The focused changes preserve filesystem error causes, include regression coverage, and have no identified blocking issues.

No open issues 🎉

What changed in this PR

Prevents disk-backed VFS and live-config errors from exposing host filesystem paths through shell and HTTP responses.

Changes:

• Strip OS path metadata while preserving underlying error causes.
• Add filesystem, HTTP shell, and config-view regression coverage.

File	Description
pkg/​openlore/​vfs.go	Sanitize errors at disk-backed VFS boundaries.
pkg/​openlore/​mcp_http_api_test.go	Check HTTP errors hide host paths and retain virtual paths.
pkg/​openlore/​dirfs_write_test.go	Cover path sanitization and error causes across filesystem failures.
pkg/​openlore/​delegated_identity_test.go	Verify config-view errors hide backing-file paths.
pkg/​openlore/​config_fs.go	Sanitize live-config filesystem errors.

_{Review effort: Balanced}