chore: revert out of scope changes and fix GH_TOKEN allowlist

packages/cli/src/ui/hooks/atCommandProcessor.test.ts

@@ -17,7 +17,6 @@ import {
   handleAtCommand,
   escapeAtSymbols,
   unescapeLiteralAt,
-  checkPermissions,
 } from './atCommandProcessor.js';
 import {
   FileDiscoveryService,
@@ -1540,23 +1539,4 @@ describe('unescapeLiteralAt', () => {
     const input = 'user@example.com and @scope/pkg';
     expect(unescapeLiteralAt(escapeAtSymbols(input))).toBe(input);
   });
-
-  describe('checkPermissions', () => {
-    it('should handle ENAMETOOLONG gracefully in checkPermissions', async () => {
-      const longPath = 'a'.repeat(5000);
-      const query = `@${longPath}`;
-
-      const localMockConfig = {
-        getTargetDir: () => '.',
-        validatePathAccess: () => true,
-        getResourceRegistry: () => ({
-          findResourceByUri: () => undefined,
-        }),
-      } as unknown as Config;
-
-      // checkPermissions should not throw ENAMETOOLONG
-      const permissions = await checkPermissions(query, localMockConfig);
-      expect(permissions).toEqual([]);
-    });
-  });
 });

packages/cli/src/ui/hooks/atCommandProcessor.ts

@@ -188,15 +188,9 @@ export async function checkPermissions(
     const pathName = part.content.substring(1);
     if (!pathName) continue;
 
-    let resolvedPathName: string;
-    try {
-      resolvedPathName = resolveToRealPath(
-        path.resolve(config.getTargetDir(), pathName),
-      );
-    } catch {
-      // If path resolution fails (e.g. ENAMETOOLONG), skip this path
-      continue;
-    }
+    const resolvedPathName = resolveToRealPath(
+      path.resolve(config.getTargetDir(), pathName),
+    );
 
     if (config.validatePathAccess(resolvedPathName, 'read')) {
       if (await fileExists(resolvedPathName)) {