fix(dashboard): prevent symlink-following file disclosure when indexing untrusted repos

understand-anything-plugin/packages/dashboard/vite.config.ts

@@ -148,6 +148,30 @@ function readSourceFile(url: URL) {
     return rejectFileRequest("File is not in the knowledge graph", 404);
   }
 
+  // Resolve symlinks and re-confirm the real path stays inside the project.
+  // The textual checks above only see the requested (in-root) path; a symlink
+  // committed in an indexed repo (e.g. src/config.txt -> ~/.ssh/id_rsa) is
+  // textually in-root and present in the graph, so without this guard the
+  // statSync/readFileSync below would follow it and disclose a file outside
+  // the project root.
+  let realFile: string;
+  let realRoot: string;
+  try {
+    realFile = fs.realpathSync(absoluteFile);
+    realRoot = fs.realpathSync(projectRoot);
+  } catch {
+    return rejectFileRequest("File not found", 404);
+  }
+  const realRelative = path.relative(realRoot, realFile);
+  if (
+    !realRelative ||
+    realRelative === ".." ||
+    realRelative.startsWith(`..${path.sep}`) ||
+    path.isAbsolute(realRelative)
+  ) {
+    return rejectFileRequest("Path must stay inside the project");
+  }
+
   let stat: fs.Stats;
   try {
     stat = fs.statSync(absoluteFile);

understand-anything-plugin/skills/understand/scan-project.mjs

@@ -53,6 +53,7 @@ import { dirname, resolve, join, basename, extname, relative, sep } from 'node:p
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import {
   existsSync,
+  lstatSync,
   readFileSync,
   readdirSync,
   realpathSync,
@@ -699,10 +700,13 @@ async function main() {
     // Stat first — git ls-files could include paths that vanished between
     // listing and processing; the walker shouldn't but defensive anyway.
     try {
-      const st = statSync(absPath);
-      if (!st.isFile()) {
-        // Symlinks-to-dir, special files, etc. — skip silently. Not a
-        // warning condition because git wouldn't have tracked it as a file.
+      // lstat (not stat) so symlinks are NOT followed: a symlink committed in
+      // an indexed repo could point outside the project root (e.g.
+      // src/config.txt -> ~/.ssh/id_rsa) and would otherwise be emitted as a
+      // normal file node and later served by the dashboard. Skip it (the
+      // recursive-walk fallback already skips symlinks).
+      const st = lstatSync(absPath);
+      if (st.isSymbolicLink() || !st.isFile()) {
         continue;
       }
     } catch (err) {