@sweny-ai/core 0.1.111 → 0.1.112

package/dist/cli/config.d.ts

@@ -74,6 +74,15 @@ export interface CliConfig {
     context: string[];
     offline: boolean;
     fetchAuth: Record<string, string>;
+    /**
+     * When set, sandbox `file:` Sources to this directory tree: a `file:` source
+     * that escapes it (via `..`, an absolute path, or a symlink pointing out) is
+     * rejected. The sandbox is opt-in: empty string means no root configured, so
+     * `file:` Sources read anywhere on disk (default). Set via `--file-root [dir]`
+     * (the working directory when the flag is given without a value) or a
+     * `.sweny.yml` `file-root: <path>`.
+     */
+    fileRoot: string;
 }
 export declare function registerTriageCommand(program: Command): Command;
 export declare function parseCliInputs(options: Record<string, unknown>, fileConfig?: FileConfig): CliConfig;

package/dist/cli/config.js

@@ -63,7 +63,8 @@ export function registerTriageCommand(program) {
         .option("--no-cache", "Disable step cache")
         .option("--output-dir <path>", "Output directory for file providers (default: .sweny/output)")
         .option("--workspace-tools <tools>", "Comma-separated workspace tool integrations to enable (slack, notion, pagerduty, monday)")
-        .option("--offline", "Skip URL Sources and fail fast if any are referenced", false);
+        .option("--offline", "Skip URL Sources and fail fast if any are referenced", false)
+        .option("--file-root [dir]", "Sandbox file: Sources to this directory tree (defaults to the working directory when the flag is given without a value)");
 }
 export function parseCliInputs(options, fileConfig = {}) {
     const env = process.env;
@@ -183,8 +184,21 @@ export function parseCliInputs(options, fileConfig = {}) {
         context: fa("context"),
         offline: Boolean(options.offline),
         fetchAuth: parseFetchAuth(fileConfig),
+        // Opt-in file: sandbox. `--file-root <dir>` sets the root; `--file-root`
+        // with no value defaults to cwd; otherwise honor a `.sweny.yml`
+        // `file-root: <path>`. Empty string = no root = read-anywhere (default).
+        fileRoot: typeof options.fileRoot === "string"
+            ? options.fileRoot
+            : options.fileRoot === true
+                ? process.cwd()
+                : fileStr(fileConfig, "file-root"),
     };
 }
+/** Read a string key from file config, returning "" when absent or non-string. */
+function fileStr(fileConfig, key) {
+    const v = fileConfig[key];
+    return typeof v === "string" ? v : "";
+}
 function parseFetchAuth(fileConfig) {
     const raw = fileConfig["fetch.auth"];
     if (!raw || typeof raw !== "object" || Array.isArray(raw))
@@ -659,7 +673,8 @@ export function registerImplementCommand(program) {
         .option("--additional-instructions <text>", "Extra instructions for the coding agent")
         .option("--stream", "Stream NDJSON events to stdout (for Studio / automation)", false)
         .option("--verbose", "Print each tool call's input and output inline (human-readable, truncated). Use --stream for full untruncated NDJSON.", false)
-        .option("--offline", "Skip URL Sources and fail fast if any are referenced", false);
+        .option("--offline", "Skip URL Sources and fail fast if any are referenced", false)
+        .option("--file-root [dir]", "Sandbox file: Sources to this directory tree (defaults to the working directory when the flag is given without a value)");
 }
 /**
  * Parse a JSON string into MCP server configs.

package/dist/cli/main.js

@@ -145,6 +145,7 @@ async function resolveRulesAndContext(config) {
         offline: config.offline,
         fetchAuth: config.fetchAuth,
         env: process.env,
+        fileRoot: config.fileRoot || undefined,
     };
     const [rulesResult, contextResult] = await Promise.all([
         loadAdditionalContext(config.rules, loadOptions),
@@ -366,6 +367,7 @@ triageCmd.action(async (options) => {
             env: process.env,
             fetchAuth: config.fetchAuth,
             offline: config.offline,
+            fileRoot: config.fileRoot || undefined,
         });
         const durationMs = Date.now() - runStart;
         // Output
@@ -552,6 +554,7 @@ implementCmd.action(async (issueId, options) => {
             env: process.env,
             fetchAuth: config.fetchAuth,
             offline: config.offline,
+            fileRoot: config.fileRoot || undefined,
         });
         const hasFailed = [...results.values()].some((r) => r.status === "failed");
         const implDurationMs = Date.now() - implRunStart;
@@ -833,6 +836,7 @@ export async function workflowRunAction(file, options) {
             env: process.env,
             fetchAuth: config.fetchAuth,
             offline: config.offline,
+            fileRoot: config.fileRoot || undefined,
         });
         const wfDurationMs = Date.now() - runStart;
         const wfHasFailed = [...results.values()].some((r) => r.status === "failed");

package/dist/executor.d.ts

@@ -32,6 +32,15 @@ export interface ExecuteOptions {
     fetchAuth?: Record<string, string>;
     /** When true, URL Sources throw instead of fetching */
     offline?: boolean;
+    /**
+     * When set, `file:` Sources are sandboxed to this directory tree: a `file:`
+     * source that resolves outside it (via `..` traversal, an absolute path, or a
+     * symlink pointing out) is rejected with `SOURCE_FILE_OUTSIDE_ROOT`. The
+     * sandbox is opt-in: when unset, `file:` sources may read anywhere on disk
+     * (default), preserving the read-anywhere behavior workflow authors rely on
+     * for files elsewhere in their own repo / machine.
+     */
+    fileRoot?: string;
     /**
      * Workflow-level hard cap on total node executions (the number of times the
      * main loop visits a node). Guards against unbounded cycles, e.g. a back-edge

package/dist/executor.js

@@ -93,11 +93,15 @@ export async function execute(workflow, input, options) {
         nodeRules.forEach((s, i) => (sourceMap[`nodes.${nodeId}.rules.${i}`] = s));
         nodeContext.forEach((s, i) => (sourceMap[`nodes.${nodeId}.context.${i}`] = s));
     }
+    const resolveCwd = options.cwd ?? process.cwd();
     const resolvedSources = await resolveSources(sourceMap, {
-        cwd: options.cwd ?? process.cwd(),
+        cwd: resolveCwd,
         env: options.env ?? process.env,
         authConfig: options.fetchAuth ?? {},
         offline: options.offline ?? false,
+        // Opt-in `file:` sandbox: only engaged when the caller sets `fileRoot`.
+        // When unset, `file:` sources read anywhere on disk (default).
+        fileRoot: options.fileRoot,
         logger,
     });
     trace.sources = resolvedSources;

package/dist/source-resolver.js

@@ -7,6 +7,7 @@
  * or `node:crypto` into bundlers that target the browser.
  */
 import * as dns from "node:dns/promises";
+import { realpathSync } from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { normalizeSource } from "./sources.js";
@@ -385,22 +386,50 @@ function embeddedIpv4(ip) {
 }
 /**
  * Enforce the optional repo-root file sandbox. The sandbox is opt-in: it only
- * applies when `fileRoot` is set (preserving legacy "read anywhere" behavior
- * for callers that don't configure a root). When active, a `file:` source must
- * resolve to a path inside `fileRoot`; `..` traversal and absolute paths that
- * escape the root are rejected. Set `allowFileOutsideRoot` to opt back out even
+ * applies when `fileRoot` is set. When unset, legacy "read anywhere" behavior is
+ * preserved (a `file:` source may resolve to any path on disk). When a root is
+ * configured, a `file:` source must resolve to a path inside it; `..` traversal
+ * and absolute paths that escape the root are rejected with
+ * `SOURCE_FILE_OUTSIDE_ROOT`. Set `allowFileOutsideRoot` to opt back out even
  * when a root is configured.
+ *
+ * Symlinks are resolved with `fs.realpathSync` before the containment check so
+ * a symlink inside the root pointing at an external target cannot smuggle
+ * out-of-root content. `realpath` throws `ENOENT` on a not-yet-existing file; in
+ * that case we resolve the nearest existing ancestor (so a symlinked parent dir
+ * is still caught) and re-append the missing tail, preserving the downstream
+ * `SOURCE_FILE_NOT_FOUND` error for genuinely missing files.
  */
 function assertFileWithinRoot(absolute, ctx, fieldPath) {
     if (ctx.allowFileOutsideRoot)
         return;
     if (!ctx.fileRoot)
-        return; // sandbox not configured — legacy behavior
-    const root = path.resolve(ctx.fileRoot);
-    const normalized = path.resolve(absolute);
+        return; // no root configured — sandbox not engaged
+    const root = realpathOrLexical(path.resolve(ctx.fileRoot));
+    const normalized = realpathOrLexical(path.resolve(absolute));
     const rel = path.relative(root, normalized);
     const escapes = rel === ".." || rel.startsWith(".." + path.sep) || path.isAbsolute(rel);
     if (escapes) {
         throw new Error(`SOURCE_FILE_OUTSIDE_ROOT: ${absolute} is outside the allowed root ${root} (referenced by ${fieldPath}). Set allowFileOutsideRoot to permit reads outside the repo.`);
     }
 }
+/**
+ * Canonicalize `target` via `fs.realpathSync` (resolving symlinks). If the path
+ * does not yet exist, walk up to the nearest existing ancestor, canonicalize
+ * that, and re-append the non-existent tail. This keeps symlink resolution
+ * meaningful for the directory portion (catching a symlinked parent that
+ * escapes the root) while not throwing on a file that simply isn't there — that
+ * case is surfaced later as `SOURCE_FILE_NOT_FOUND` by the read.
+ */
+function realpathOrLexical(target) {
+    try {
+        return realpathSync(target);
+    }
+    catch {
+        const parent = path.dirname(target);
+        if (parent === target)
+            return target; // reached filesystem root
+        const base = path.basename(target);
+        return path.join(realpathOrLexical(parent), base);
+    }
+}

package/dist/sources.d.ts

@@ -86,15 +86,18 @@ export type SourceResolutionContext = {
      */
     fetchTokenHosts?: string[];
     /**
-     * Restrict `file:` source resolution to this directory tree (the repo root,
-     * typically `cwd`). Relative and absolute paths that escape it via `..` or
-     * symlinks are rejected. Defaults to `cwd`. Set
-     * {@link allowFileOutsideRoot} to opt out.
+     * Restrict `file:` source resolution to this directory tree. Relative and
+     * absolute paths that escape it via `..` or via a symlink pointing outside the
+     * root are rejected (the resolver canonicalizes with `realpath` before the
+     * containment check). The sandbox is opt-in: when unset, it is not engaged
+     * (default) and `file:` sources may read anywhere on disk. Set
+     * {@link allowFileOutsideRoot} to opt back out even when a root is configured.
      */
     fileRoot?: string;
     /**
-     * Opt out of the {@link fileRoot} sandbox, permitting `file:` sources to read
-     * anywhere on disk (legacy behavior). Defaults to `false`.
+     * When a {@link fileRoot} IS configured, opt out of the sandbox to permit
+     * `file:` sources to read anywhere on disk (legacy read-anywhere behavior).
+     * No effect when `fileRoot` is unset. Defaults to `false`.
      */
     allowFileOutsideRoot?: boolean;
     /**

package/dist/templates.d.ts

@@ -31,6 +31,13 @@ export interface SourceLoadOptions {
     fetchAuth?: Record<string, string>;
     /** Environment used to resolve `fetchAuth` env-var names. Defaults to process.env. */
     env?: NodeJS.ProcessEnv;
+    /**
+     * When set, `file:` template/context Sources are sandboxed to this directory
+     * tree: a path that escapes it via `..`, an absolute path, or a symlink
+     * pointing out is rejected. The sandbox is opt-in: when unset, `file:` sources
+     * may read anywhere on disk (default).
+     */
+    fileRoot?: string;
 }
 /**
  * Load a template from a file path or URL.

package/dist/templates.js

@@ -53,11 +53,14 @@ export const DEFAULT_PR_TEMPLATE = `## Summary
 Fixes #
 `;
 function buildCtx(options) {
+    const cwd = options.cwd ?? process.cwd();
     return {
-        cwd: options.cwd ?? process.cwd(),
+        cwd,
         env: options.env ?? process.env,
         authConfig: options.fetchAuth ?? {},
         offline: options.offline ?? false,
+        // Opt-in `file:` sandbox: only engaged when the caller sets `fileRoot`.
+        fileRoot: options.fileRoot,
         logger: consoleLogger,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.111",
+  "version": "0.1.112",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"