fix: 统一 CLI/API 路径安全检查为 is_path_within_workspace

src/cli/main.py

@@ -17,7 +17,7 @@ if sys.stdout.encoding != "utf-8":
 sys.path.insert(0, str(Path(__file__).parent.parent))
 
 from src.core.config import DEFAULT_CONFIG_PATH
-from src.core.security import is_safe_path
+from src.core.security import is_path_within_workspace
 from src.server.deps import get_state, get_default_collection
 
 app = typer.Typer(
@@ -82,7 +82,7 @@ def ingest(
     if file_paths:
         total = 0
         for fp in file_paths:
-            if not is_safe_path(fp):
+            if not is_path_within_workspace(fp):
                 typer.echo(f"[SKIP] 不安全的路径: {fp}", err=True)
                 continue
             # 支持通配符 (shell 展开或 Python glob)
@@ -90,7 +90,7 @@ def ingest(
             if "*" in fp or "?" in fp:
                 matches = _glob.glob(fp, recursive=True)
                 for m in matches:
-                    if not is_safe_path(m):
+                    if not is_path_within_workspace(m):
                         typer.echo(f"[SKIP] 不安全的路径: {m}", err=True)
                         continue
                     c = ingestor.ingest_file(m)
@@ -117,7 +117,7 @@ def ingest_dir(
     collection: CollectionOpt = None,
 ):
     _init_config(config)
-    if not is_safe_path(dir_path):
+    if not is_path_within_workspace(dir_path):
         typer.echo(f"错误: 不安全的路径 — {dir_path}", err=True)
         raise typer.Exit(code=1)
     state = get_state()