@sweny-ai/core 0.1.111 → 0.1.113

package/dist/cli/config.d.ts

@@ -74,6 +74,15 @@ export interface CliConfig {
     context: string[];
     offline: boolean;
     fetchAuth: Record<string, string>;
+    /**
+     * When set, sandbox `file:` Sources to this directory tree: a `file:` source
+     * that escapes it (via `..`, an absolute path, or a symlink pointing out) is
+     * rejected. The sandbox is opt-in: empty string means no root configured, so
+     * `file:` Sources read anywhere on disk (default). Set via `--file-root [dir]`
+     * (the working directory when the flag is given without a value) or a
+     * `.sweny.yml` `file-root: <path>`.
+     */
+    fileRoot: string;
 }
 export declare function registerTriageCommand(program: Command): Command;
 export declare function parseCliInputs(options: Record<string, unknown>, fileConfig?: FileConfig): CliConfig;

package/dist/cli/config.js

@@ -63,7 +63,8 @@ export function registerTriageCommand(program) {
         .option("--no-cache", "Disable step cache")
         .option("--output-dir <path>", "Output directory for file providers (default: .sweny/output)")
         .option("--workspace-tools <tools>", "Comma-separated workspace tool integrations to enable (slack, notion, pagerduty, monday)")
-        .option("--offline", "Skip URL Sources and fail fast if any are referenced", false);
+        .option("--offline", "Skip URL Sources and fail fast if any are referenced", false)
+        .option("--file-root [dir]", "Sandbox file: Sources to this directory tree (defaults to the working directory when the flag is given without a value)");
 }
 export function parseCliInputs(options, fileConfig = {}) {
     const env = process.env;
@@ -183,8 +184,21 @@ export function parseCliInputs(options, fileConfig = {}) {
         context: fa("context"),
         offline: Boolean(options.offline),
         fetchAuth: parseFetchAuth(fileConfig),
+        // Opt-in file: sandbox. `--file-root <dir>` sets the root; `--file-root`
+        // with no value defaults to cwd; otherwise honor a `.sweny.yml`
+        // `file-root: <path>`. Empty string = no root = read-anywhere (default).
+        fileRoot: typeof options.fileRoot === "string"
+            ? options.fileRoot
+            : options.fileRoot === true
+                ? process.cwd()
+                : fileStr(fileConfig, "file-root"),
     };
 }
+/** Read a string key from file config, returning "" when absent or non-string. */
+function fileStr(fileConfig, key) {
+    const v = fileConfig[key];
+    return typeof v === "string" ? v : "";
+}
 function parseFetchAuth(fileConfig) {
     const raw = fileConfig["fetch.auth"];
     if (!raw || typeof raw !== "object" || Array.isArray(raw))
@@ -659,7 +673,8 @@ export function registerImplementCommand(program) {
         .option("--additional-instructions <text>", "Extra instructions for the coding agent")
         .option("--stream", "Stream NDJSON events to stdout (for Studio / automation)", false)
         .option("--verbose", "Print each tool call's input and output inline (human-readable, truncated). Use --stream for full untruncated NDJSON.", false)
-        .option("--offline", "Skip URL Sources and fail fast if any are referenced", false);
+        .option("--offline", "Skip URL Sources and fail fast if any are referenced", false)
+        .option("--file-root [dir]", "Sandbox file: Sources to this directory tree (defaults to the working directory when the flag is given without a value)");
 }
 /**
  * Parse a JSON string into MCP server configs.

package/dist/cli/main.js

@@ -145,6 +145,7 @@ async function resolveRulesAndContext(config) {
         offline: config.offline,
         fetchAuth: config.fetchAuth,
         env: process.env,
+        fileRoot: config.fileRoot || undefined,
     };
     const [rulesResult, contextResult] = await Promise.all([
         loadAdditionalContext(config.rules, loadOptions),
@@ -366,6 +367,7 @@ triageCmd.action(async (options) => {
             env: process.env,
             fetchAuth: config.fetchAuth,
             offline: config.offline,
+            fileRoot: config.fileRoot || undefined,
         });
         const durationMs = Date.now() - runStart;
         // Output
@@ -552,6 +554,7 @@ implementCmd.action(async (issueId, options) => {
             env: process.env,
             fetchAuth: config.fetchAuth,
             offline: config.offline,
+            fileRoot: config.fileRoot || undefined,
         });
         const hasFailed = [...results.values()].some((r) => r.status === "failed");
         const implDurationMs = Date.now() - implRunStart;
@@ -833,6 +836,7 @@ export async function workflowRunAction(file, options) {
             env: process.env,
             fetchAuth: config.fetchAuth,
             offline: config.offline,
+            fileRoot: config.fileRoot || undefined,
         });
         const wfDurationMs = Date.now() - runStart;
         const wfHasFailed = [...results.values()].some((r) => r.status === "failed");

package/dist/executor.d.ts

@@ -32,6 +32,15 @@ export interface ExecuteOptions {
     fetchAuth?: Record<string, string>;
     /** When true, URL Sources throw instead of fetching */
     offline?: boolean;
+    /**
+     * When set, `file:` Sources are sandboxed to this directory tree: a `file:`
+     * source that resolves outside it (via `..` traversal, an absolute path, or a
+     * symlink pointing out) is rejected with `SOURCE_FILE_OUTSIDE_ROOT`. The
+     * sandbox is opt-in: when unset, `file:` sources may read anywhere on disk
+     * (default), preserving the read-anywhere behavior workflow authors rely on
+     * for files elsewhere in their own repo / machine.
+     */
+    fileRoot?: string;
     /**
      * Workflow-level hard cap on total node executions (the number of times the
      * main loop visits a node). Guards against unbounded cycles, e.g. a back-edge

package/dist/executor.js

@@ -93,11 +93,15 @@ export async function execute(workflow, input, options) {
         nodeRules.forEach((s, i) => (sourceMap[`nodes.${nodeId}.rules.${i}`] = s));
         nodeContext.forEach((s, i) => (sourceMap[`nodes.${nodeId}.context.${i}`] = s));
     }
+    const resolveCwd = options.cwd ?? process.cwd();
     const resolvedSources = await resolveSources(sourceMap, {
-        cwd: options.cwd ?? process.cwd(),
+        cwd: resolveCwd,
         env: options.env ?? process.env,
         authConfig: options.fetchAuth ?? {},
         offline: options.offline ?? false,
+        // Opt-in `file:` sandbox: only engaged when the caller sets `fileRoot`.
+        // When unset, `file:` sources read anywhere on disk (default).
+        fileRoot: options.fileRoot,
         logger,
     });
     trace.sources = resolvedSources;

package/dist/skills/betterstack.d.ts

@@ -5,4 +5,23 @@
  * CI-native alternative to the BetterStack MCP server.
  */
 import type { Skill } from "../types.js";
+/**
+ * Validate an LLM-chosen table name as a bare ClickHouse identifier.
+ * Anything outside [A-Za-z0-9_] is rejected — table names from
+ * BetterStack are always of the form t<id>_<name>.
+ */
+export declare function assertClickHouseIdentifier(name: string): string;
+/**
+ * Best-effort read-only guard for `betterstack_query`.
+ *
+ * Accepts SELECT / WITH / DESCRIBE statements, rejects everything else,
+ * rejects multi-statement input, and appends a LIMIT cap when the query
+ * has none. Keyword checks ignore string literal contents so a log
+ * message containing "LIMIT" doesn't skip the cap.
+ *
+ * This is UX, not a security boundary: a determined query can still do
+ * anything the ClickHouse connection's role allows. Use a read-only
+ * role for the configured credentials.
+ */
+export declare function prepareReadOnlyQuery(query: string): string;
 export declare const betterstack: Skill;

package/dist/skills/betterstack.js

@@ -37,6 +37,58 @@ async function bsQuery(sql, ctx) {
         .split("\n")
         .map((line) => JSON.parse(line));
 }
+// ─── Input hardening (issue #226) ──────────────────────────────
+//
+// Threat model: tool arguments are LLM-controlled at runtime and can be
+// steered by prompt-injected content (issue bodies, fetched logs). The
+// `table` argument reaches a ClickHouse query string, so it is strictly
+// validated as an identifier. The read-only query guard below is
+// best-effort UX — the real security boundary must be a read-only
+// ClickHouse role on the BETTERSTACK_QUERY_USERNAME connection.
+/**
+ * Validate an LLM-chosen table name as a bare ClickHouse identifier.
+ * Anything outside [A-Za-z0-9_] is rejected — table names from
+ * BetterStack are always of the form t<id>_<name>.
+ */
+export function assertClickHouseIdentifier(name) {
+    if (!/^[A-Za-z0-9_]+$/.test(name)) {
+        throw new Error(`[BetterStack] Invalid table identifier "${name}" — only letters, digits, and _ are allowed`);
+    }
+    return name;
+}
+/** Blank out string literal contents so keyword checks don't match inside them. */
+function stripStringLiterals(sql) {
+    // Handles both '' (SQL) and \' (ClickHouse) quote escaping.
+    return sql.replace(/'(?:[^'\\]|\\.|'')*'/g, "''");
+}
+/**
+ * Best-effort read-only guard for `betterstack_query`.
+ *
+ * Accepts SELECT / WITH / DESCRIBE statements, rejects everything else,
+ * rejects multi-statement input, and appends a LIMIT cap when the query
+ * has none. Keyword checks ignore string literal contents so a log
+ * message containing "LIMIT" doesn't skip the cap.
+ *
+ * This is UX, not a security boundary: a determined query can still do
+ * anything the ClickHouse connection's role allows. Use a read-only
+ * role for the configured credentials.
+ */
+export function prepareReadOnlyQuery(query) {
+    let sql = query.trim().replace(/;\s*$/, "").trim();
+    const stripped = stripStringLiterals(sql);
+    if (stripped.includes(";")) {
+        throw new Error("[BetterStack] Multi-statement queries are not allowed — send a single statement");
+    }
+    if (!/^(SELECT|WITH|DESCRIBE)\b/i.test(stripped)) {
+        throw new Error("[BetterStack] Only read-only queries are allowed (SELECT, WITH, or DESCRIBE)");
+    }
+    // Append LIMIT if none present to prevent unbounded result sets.
+    // DESCRIBE output is already bounded by the column count.
+    if (!/^DESCRIBE\b/i.test(stripped) && !/\bLIMIT\b/i.test(stripped)) {
+        sql = `${sql} LIMIT 500`;
+    }
+    return sql;
+}
 // ─── Skill definition ──────────────────────────────────────────
 export const betterstack = {
     id: "betterstack",
@@ -55,7 +107,8 @@ export const betterstack = {
             env: "BETTERSTACK_QUERY_ENDPOINT",
         },
         BETTERSTACK_QUERY_USERNAME: {
-            description: "ClickHouse connection username",
+            description: "ClickHouse connection username. Use a read-only role — the in-skill query guard is best-effort, " +
+                "not a security boundary",
             required: true,
             env: "BETTERSTACK_QUERY_USERNAME",
         },
@@ -114,7 +167,7 @@ export const betterstack = {
                 required: ["table"],
             },
             handler: async (input, ctx) => {
-                return bsQuery(`DESCRIBE TABLE remote(${input.table}_logs)`, ctx);
+                return bsQuery(`DESCRIBE TABLE remote(${assertClickHouseIdentifier(input.table)}_logs)`, ctx);
             },
         },
         {
@@ -123,28 +176,19 @@ export const betterstack = {
 Tables: remote(TABLE_logs) for recent logs, s3Cluster(primary, TABLE_s3) for historical (add WHERE _row_type = 1).
 Key fields: dt (timestamp), raw (JSON blob with all log fields).
 Extract nested fields: JSONExtract(raw, 'field_name', 'Nullable(String)').
-Use betterstack_get_source_fields to discover available columns.`,
+Use betterstack_get_source_fields to discover available columns.
+Only single SELECT / WITH / DESCRIBE statements are accepted.`,
             input_schema: {
                 type: "object",
                 properties: {
-                    query: { type: "string", description: "ClickHouse SQL query (SELECT only)" },
+                    query: { type: "string", description: "ClickHouse SQL query (single SELECT, WITH, or DESCRIBE statement)" },
                     source_id: { type: "number", description: "Source ID (for context)" },
                     table: { type: "string", description: "Table name (e.g. t273774_offload_ecs_production)" },
                 },
                 required: ["query", "source_id", "table"],
             },
             handler: async (input, ctx) => {
-                const trimmed = input.query.trim();
-                const upper = trimmed.toUpperCase();
-                if (!upper.startsWith("SELECT") && !upper.startsWith("DESCRIBE")) {
-                    throw new Error("[BetterStack] Only SELECT and DESCRIBE queries are allowed");
-                }
-                // Append LIMIT if none present to prevent unbounded result sets
-                let sql = trimmed;
-                if (!upper.includes("LIMIT")) {
-                    sql = `${sql} LIMIT 500`;
-                }
-                return bsQuery(sql, ctx);
+                return bsQuery(prepareReadOnlyQuery(input.query), ctx);
             },
         },
     ],

package/dist/skills/github.d.ts

@@ -5,4 +5,19 @@
  * ~800 lines → ~120 lines
  */
 import type { Skill } from "../types.js";
+/**
+ * Encode an LLM-chosen repo file path for safe interpolation into a
+ * GitHub API request path.
+ *
+ * Trust model (issue #226): tool arguments are runtime-controlled by the
+ * model and can be steered by prompt-injected content. Without encoding,
+ * a `path` containing `?` or `#` rewrites the request (injects query
+ * params / truncates via fragment), and `..` segments walk out of the
+ * `/contents/` endpoint entirely.
+ *
+ * Each `/`-separated segment is percent-encoded (so `/` between segments
+ * is preserved); `.` and `..` segments are rejected outright because
+ * URL normalization resolves them server-side even when encoded.
+ */
+export declare function encodeRepoFilePath(path: string): string;
 export declare const github: Skill;

package/dist/skills/github.js

@@ -34,6 +34,32 @@ function isAlreadyExistsError(err) {
         return false;
     return /pull request already exists/i.test(err.body);
 }
+/**
+ * Encode an LLM-chosen repo file path for safe interpolation into a
+ * GitHub API request path.
+ *
+ * Trust model (issue #226): tool arguments are runtime-controlled by the
+ * model and can be steered by prompt-injected content. Without encoding,
+ * a `path` containing `?` or `#` rewrites the request (injects query
+ * params / truncates via fragment), and `..` segments walk out of the
+ * `/contents/` endpoint entirely.
+ *
+ * Each `/`-separated segment is percent-encoded (so `/` between segments
+ * is preserved); `.` and `..` segments are rejected outright because
+ * URL normalization resolves them server-side even when encoded.
+ */
+export function encodeRepoFilePath(path) {
+    return path
+        .split("/")
+        .filter((segment) => segment !== "")
+        .map((segment) => {
+        if (segment === "." || segment === "..") {
+            throw new Error(`[GitHub] Invalid path segment "${segment}" — relative path segments are not allowed`);
+        }
+        return encodeURIComponent(segment);
+    })
+        .join("/");
+}
 export const github = {
     id: "github",
     name: "GitHub",
@@ -224,8 +250,8 @@ export const github = {
                 required: ["repo", "path"],
             },
             handler: async (input, ctx) => {
-                const ref = input.ref ? `?ref=${input.ref}` : "";
-                const data = await gh(`/repos/${input.repo}/contents/${input.path}${ref}`, ctx);
+                const ref = input.ref ? `?ref=${encodeURIComponent(input.ref)}` : "";
+                const data = await gh(`/repos/${input.repo}/contents/${encodeRepoFilePath(input.path)}${ref}`, ctx);
                 if (data.content && data.encoding === "base64") {
                     return { ...data, decoded_content: Buffer.from(data.content, "base64").toString("utf-8") };
                 }

package/dist/skills/supabase.d.ts

@@ -6,4 +6,15 @@
  * and the Management API for project-level operations.
  */
 import type { Skill } from "../types.js";
+/** Validate an LLM-chosen table/column name as a bare PostgREST identifier. */
+export declare function assertSupabaseIdentifier(name: string, label?: string): string;
+/** Validate an LLM-chosen RPC / edge function name (hyphens allowed for edge functions). */
+export declare function assertSupabaseFunctionName(name: string): string;
+/**
+ * Append PostgREST filter strings ("column=op.value") to query params.
+ * Each filter is split at its first `=`; the value side is appended as a
+ * single parameter value so `&`/`=` inside it are percent-encoded rather
+ * than interpreted as additional parameters.
+ */
+export declare function appendPostgrestFilters(params: URLSearchParams, filters: string[]): URLSearchParams;
 export declare const supabase: Skill;

package/dist/skills/supabase.js

@@ -5,6 +5,73 @@
  * Uses the Supabase REST API (PostgREST) for data operations
  * and the Management API for project-level operations.
  */
+// ─── Input hardening (issue #226) ──────────────────────────────
+//
+// Threat model: this skill runs with SUPABASE_SERVICE_ROLE_KEY, which
+// bypasses RLS entirely, and `table`, `filters[]`, and function names are
+// LLM-controlled at runtime (steerable by prompt-injected content).
+// Identifiers are validated before they reach the request path, filter
+// values are URL-encoded so one filter string cannot smuggle extra query
+// parameters, and the optional SUPABASE_ALLOWED_TABLES /
+// SUPABASE_ALLOWED_FUNCTIONS allowlists bound what the agent can touch.
+/** Validate an LLM-chosen table/column name as a bare PostgREST identifier. */
+export function assertSupabaseIdentifier(name, label = "table") {
+    if (!/^[A-Za-z0-9_]+$/.test(name)) {
+        throw new Error(`[Supabase] Invalid ${label} identifier "${name}" — only letters, digits, and _ are allowed`);
+    }
+    return name;
+}
+/** Validate an LLM-chosen RPC / edge function name (hyphens allowed for edge functions). */
+export function assertSupabaseFunctionName(name) {
+    if (!/^[A-Za-z0-9_-]+$/.test(name)) {
+        throw new Error(`[Supabase] Invalid function name "${name}" — only letters, digits, _ and - are allowed`);
+    }
+    return name;
+}
+/**
+ * Append PostgREST filter strings ("column=op.value") to query params.
+ * Each filter is split at its first `=`; the value side is appended as a
+ * single parameter value so `&`/`=` inside it are percent-encoded rather
+ * than interpreted as additional parameters.
+ */
+export function appendPostgrestFilters(params, filters) {
+    for (const filter of filters) {
+        const eq = filter.indexOf("=");
+        if (eq <= 0) {
+            throw new Error(`[Supabase] Invalid filter "${filter}" — expected "column=operator.value" (e.g. "id=eq.1")`);
+        }
+        params.append(filter.slice(0, eq), filter.slice(eq + 1));
+    }
+    return params;
+}
+/** Parse an optional comma-separated allowlist config value. Returns null when unset (no restriction). */
+function resolveAllowlist(config, key) {
+    const raw = config[key];
+    if (!raw || !raw.trim())
+        return null;
+    return new Set(raw
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean));
+}
+/** Validate a table name and check it against SUPABASE_ALLOWED_TABLES (when configured). */
+function checkTable(table, ctx) {
+    assertSupabaseIdentifier(table);
+    const allowlist = resolveAllowlist(ctx.config, "SUPABASE_ALLOWED_TABLES");
+    if (allowlist && !allowlist.has(table)) {
+        throw new Error(`[Supabase] Table "${table}" is not on the SUPABASE_ALLOWED_TABLES allowlist (${[...allowlist].join(", ")})`);
+    }
+    return table;
+}
+/** Validate a function name and check it against SUPABASE_ALLOWED_FUNCTIONS (when configured). */
+function checkFunction(name, ctx) {
+    assertSupabaseFunctionName(name);
+    const allowlist = resolveAllowlist(ctx.config, "SUPABASE_ALLOWED_FUNCTIONS");
+    if (allowlist && !allowlist.has(name)) {
+        throw new Error(`[Supabase] Function "${name}" is not on the SUPABASE_ALLOWED_FUNCTIONS allowlist (${[...allowlist].join(", ")})`);
+    }
+    return name;
+}
 async function supabaseRest(path, ctx, init) {
     const url = ctx.config.SUPABASE_URL;
     const key = ctx.config.SUPABASE_SERVICE_ROLE_KEY;
@@ -54,10 +121,24 @@ export const supabase = {
             env: "SUPABASE_URL",
         },
         SUPABASE_SERVICE_ROLE_KEY: {
-            description: "Supabase service role key (full access, server-side only)",
+            description: "Supabase service role key (full access, bypasses RLS — high blast radius). " +
+                "Prefer a scoped key where possible, and bound exposure with SUPABASE_ALLOWED_TABLES / " +
+                "SUPABASE_ALLOWED_FUNCTIONS",
             required: true,
             env: "SUPABASE_SERVICE_ROLE_KEY",
         },
+        SUPABASE_ALLOWED_TABLES: {
+            description: "Optional comma-separated table allowlist. When set, data tools (query/count/insert/update/delete) " +
+                "are restricted to these tables",
+            required: false,
+            env: "SUPABASE_ALLOWED_TABLES",
+        },
+        SUPABASE_ALLOWED_FUNCTIONS: {
+            description: "Optional comma-separated function allowlist. When set, supabase_rpc and supabase_invoke_function " +
+                "are restricted to these RPC / edge function names",
+            required: false,
+            env: "SUPABASE_ALLOWED_FUNCTIONS",
+        },
     },
     tools: [
         // ─── Read ────────────────────────────────────────────────
@@ -89,18 +170,14 @@ export const supabase = {
                 required: ["table"],
             },
             handler: async (input, ctx) => {
+                const table = checkTable(input.table, ctx);
                 const params = new URLSearchParams();
                 params.set("select", input.select || "*");
                 if (input.order)
                     params.set("order", input.order);
                 params.set("limit", String(input.limit || 100));
-                let path = `/${input.table}?${params}`;
-                if (input.filters) {
-                    for (const f of input.filters) {
-                        path += `&${f}`;
-                    }
-                }
-                return supabaseRest(path, ctx);
+                appendPostgrestFilters(params, input.filters ?? []);
+                return supabaseRest(`/${table}?${params}`, ctx);
             },
         },
         {
@@ -121,12 +198,10 @@ export const supabase = {
             handler: async (input, ctx) => {
                 const url = ctx.config.SUPABASE_URL;
                 const key = ctx.config.SUPABASE_SERVICE_ROLE_KEY;
-                let path = `${url}/rest/v1/${input.table}?select=count`;
-                if (input.filters) {
-                    for (const f of input.filters) {
-                        path += `&${f}`;
-                    }
-                }
+                const table = checkTable(input.table, ctx);
+                const params = new URLSearchParams({ select: "count" });
+                appendPostgrestFilters(params, input.filters ?? []);
+                const path = `${url}/rest/v1/${table}?${params}`;
                 const res = await fetch(path, {
                     headers: {
                         apikey: key,
@@ -165,11 +240,12 @@ export const supabase = {
                 required: ["table", "rows"],
             },
             handler: async (input, ctx) => {
+                const table = checkTable(input.table, ctx);
                 const headers = {};
                 if (input.upsert) {
                     headers["Prefer"] = "resolution=merge-duplicates,return=representation";
                 }
-                return supabaseRest(`/${input.table}`, ctx, {
+                return supabaseRest(`/${table}`, ctx, {
                     method: "POST",
                     headers,
                     body: JSON.stringify(input.rows),
@@ -199,10 +275,9 @@ export const supabase = {
                 if (!input.filters || input.filters.length === 0) {
                     throw new Error("Filters are required for update operations to prevent accidental full-table updates");
                 }
-                let path = `/${input.table}`;
-                const filterParts = input.filters.map((f) => f);
-                path += `?${filterParts.join("&")}`;
-                return supabaseRest(path, ctx, {
+                const table = checkTable(input.table, ctx);
+                const params = appendPostgrestFilters(new URLSearchParams(), input.filters);
+                return supabaseRest(`/${table}?${params}`, ctx, {
                     method: "PATCH",
                     body: JSON.stringify(input.data),
                 });
@@ -227,8 +302,9 @@ export const supabase = {
                 if (!input.filters || input.filters.length === 0) {
                     throw new Error("Filters are required for delete operations");
                 }
-                const path = `/${input.table}?${input.filters.join("&")}`;
-                return supabaseRest(path, ctx, { method: "DELETE" });
+                const table = checkTable(input.table, ctx);
+                const params = appendPostgrestFilters(new URLSearchParams(), input.filters);
+                return supabaseRest(`/${table}?${params}`, ctx, { method: "DELETE" });
             },
         },
         // ─── RPC ─────────────────────────────────────────────────
@@ -247,7 +323,7 @@ export const supabase = {
                 required: ["function_name"],
             },
             handler: async (input, ctx) => {
-                return supabaseRest(`/rpc/${input.function_name}`, ctx, {
+                return supabaseRest(`/rpc/${checkFunction(input.function_name, ctx)}`, ctx, {
                     method: "POST",
                     body: JSON.stringify(input.params || {}),
                 });
@@ -272,7 +348,7 @@ export const supabase = {
                 required: ["function_name", "body"],
             },
             handler: async (input, ctx) => {
-                return supabaseEdgeFunction(input.function_name, input.body, ctx);
+                return supabaseEdgeFunction(checkFunction(input.function_name, ctx), input.body, ctx);
             },
         },
         // ─── Auth Admin ──────────────────────────────────────────

package/dist/source-resolver.js

@@ -7,6 +7,7 @@
  * or `node:crypto` into bundlers that target the browser.
  */
 import * as dns from "node:dns/promises";
+import { realpathSync } from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { normalizeSource } from "./sources.js";
@@ -385,22 +386,50 @@ function embeddedIpv4(ip) {
 }
 /**
  * Enforce the optional repo-root file sandbox. The sandbox is opt-in: it only
- * applies when `fileRoot` is set (preserving legacy "read anywhere" behavior
- * for callers that don't configure a root). When active, a `file:` source must
- * resolve to a path inside `fileRoot`; `..` traversal and absolute paths that
- * escape the root are rejected. Set `allowFileOutsideRoot` to opt back out even
+ * applies when `fileRoot` is set. When unset, legacy "read anywhere" behavior is
+ * preserved (a `file:` source may resolve to any path on disk). When a root is
+ * configured, a `file:` source must resolve to a path inside it; `..` traversal
+ * and absolute paths that escape the root are rejected with
+ * `SOURCE_FILE_OUTSIDE_ROOT`. Set `allowFileOutsideRoot` to opt back out even
  * when a root is configured.
+ *
+ * Symlinks are resolved with `fs.realpathSync` before the containment check so
+ * a symlink inside the root pointing at an external target cannot smuggle
+ * out-of-root content. `realpath` throws `ENOENT` on a not-yet-existing file; in
+ * that case we resolve the nearest existing ancestor (so a symlinked parent dir
+ * is still caught) and re-append the missing tail, preserving the downstream
+ * `SOURCE_FILE_NOT_FOUND` error for genuinely missing files.
  */
 function assertFileWithinRoot(absolute, ctx, fieldPath) {
     if (ctx.allowFileOutsideRoot)
         return;
     if (!ctx.fileRoot)
-        return; // sandbox not configured — legacy behavior
-    const root = path.resolve(ctx.fileRoot);
-    const normalized = path.resolve(absolute);
+        return; // no root configured — sandbox not engaged
+    const root = realpathOrLexical(path.resolve(ctx.fileRoot));
+    const normalized = realpathOrLexical(path.resolve(absolute));
     const rel = path.relative(root, normalized);
     const escapes = rel === ".." || rel.startsWith(".." + path.sep) || path.isAbsolute(rel);
     if (escapes) {
         throw new Error(`SOURCE_FILE_OUTSIDE_ROOT: ${absolute} is outside the allowed root ${root} (referenced by ${fieldPath}). Set allowFileOutsideRoot to permit reads outside the repo.`);
     }
 }
+/**
+ * Canonicalize `target` via `fs.realpathSync` (resolving symlinks). If the path
+ * does not yet exist, walk up to the nearest existing ancestor, canonicalize
+ * that, and re-append the non-existent tail. This keeps symlink resolution
+ * meaningful for the directory portion (catching a symlinked parent that
+ * escapes the root) while not throwing on a file that simply isn't there — that
+ * case is surfaced later as `SOURCE_FILE_NOT_FOUND` by the read.
+ */
+function realpathOrLexical(target) {
+    try {
+        return realpathSync(target);
+    }
+    catch {
+        const parent = path.dirname(target);
+        if (parent === target)
+            return target; // reached filesystem root
+        const base = path.basename(target);
+        return path.join(realpathOrLexical(parent), base);
+    }
+}

package/dist/sources.d.ts

@@ -86,15 +86,18 @@ export type SourceResolutionContext = {
      */
     fetchTokenHosts?: string[];
     /**
-     * Restrict `file:` source resolution to this directory tree (the repo root,
-     * typically `cwd`). Relative and absolute paths that escape it via `..` or
-     * symlinks are rejected. Defaults to `cwd`. Set
-     * {@link allowFileOutsideRoot} to opt out.
+     * Restrict `file:` source resolution to this directory tree. Relative and
+     * absolute paths that escape it via `..` or via a symlink pointing outside the
+     * root are rejected (the resolver canonicalizes with `realpath` before the
+     * containment check). The sandbox is opt-in: when unset, it is not engaged
+     * (default) and `file:` sources may read anywhere on disk. Set
+     * {@link allowFileOutsideRoot} to opt back out even when a root is configured.
      */
     fileRoot?: string;
     /**
-     * Opt out of the {@link fileRoot} sandbox, permitting `file:` sources to read
-     * anywhere on disk (legacy behavior). Defaults to `false`.
+     * When a {@link fileRoot} IS configured, opt out of the sandbox to permit
+     * `file:` sources to read anywhere on disk (legacy read-anywhere behavior).
+     * No effect when `fileRoot` is unset. Defaults to `false`.
      */
     allowFileOutsideRoot?: boolean;
     /**

package/dist/templates.d.ts

@@ -31,6 +31,13 @@ export interface SourceLoadOptions {
     fetchAuth?: Record<string, string>;
     /** Environment used to resolve `fetchAuth` env-var names. Defaults to process.env. */
     env?: NodeJS.ProcessEnv;
+    /**
+     * When set, `file:` template/context Sources are sandboxed to this directory
+     * tree: a path that escapes it via `..`, an absolute path, or a symlink
+     * pointing out is rejected. The sandbox is opt-in: when unset, `file:` sources
+     * may read anywhere on disk (default).
+     */
+    fileRoot?: string;
 }
 /**
  * Load a template from a file path or URL.

package/dist/templates.js

@@ -53,11 +53,14 @@ export const DEFAULT_PR_TEMPLATE = `## Summary
 Fixes #
 `;
 function buildCtx(options) {
+    const cwd = options.cwd ?? process.cwd();
     return {
-        cwd: options.cwd ?? process.cwd(),
+        cwd,
         env: options.env ?? process.env,
         authConfig: options.fetchAuth ?? {},
         offline: options.offline ?? false,
+        // Opt-in `file:` sandbox: only engaged when the caller sets `fileRoot`.
+        fileRoot: options.fileRoot,
         logger: consoleLogger,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.111",
+  "version": "0.1.113",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"