fix(security): document bounded CLI file selection (#196)

## Cause

Exact-main CodeQL alert #69 traced migration inventory paths into the
shared local CLI file reader.

## Fix and evidence

File inputs now resolve the current working directory and selected path
to canonical locations, then require the selected path to equal that
root or begin with its separator-terminated prefix. Symlinks and ..
segments therefore cannot escape the current working tree. The
descriptor is also opened with O_NOFOLLOW, required to be a regular
file, bounded before and after reading, and always closed.

A new regression test proves that a symlink to an external file is
rejected before any API request. Existing tests cover an in-tree
symlink, directories, missing files, and byte limits. No alert is
dismissed or source-suppressed.

## Validation

- cli-send + Resend migration tests: 19 passed
- TypeScript check: passed
- exact-head CI/CodeQL required before merge

Author: yhay81

src/cli-send-attachments.ts

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { constants } from "node:fs";
 import { open, realpath } from "node:fs/promises";
-import { basename, extname, resolve } from "node:path";
+import { basename, extname, resolve, sep } from "node:path";
 
 const MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024;
 const MAX_ATTACHMENTS = 20;
@@ -64,7 +64,20 @@ export async function readBoundedFile(
   configuredPath: string,
   maximumBytes: number,
 ) {
-  const path = await realpath(resolve(cwd, configuredPath));
+  const requestedRoot = resolve(cwd);
+  const requestedRootPrefix = requestedRoot.endsWith(sep)
+    ? requestedRoot
+    : `${requestedRoot}${sep}`;
+  const candidatePath = resolve(requestedRoot, configuredPath);
+  if (!candidatePath.startsWith(requestedRootPrefix)) {
+    throw new Error("File inputs must resolve inside the current directory.");
+  }
+  const root = await realpath(requestedRoot);
+  const rootPrefix = root.endsWith(sep) ? root : `${root}${sep}`;
+  const path = await realpath(candidatePath);
+  if (!path.startsWith(rootPrefix)) {
+    throw new Error("File inputs must resolve inside the current directory.");
+  }
   const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
   try {
     const metadata = await file.stat();

tests/cli-send.test.ts

@@ -450,6 +450,36 @@ describe("production email send CLI", () => {
     expect(fetchMock).toHaveBeenCalledOnce();
   });
 
+  it("refuses a symlink that resolves outside the current directory", async () => {
+    const cwd = await temporaryDirectory();
+    const outside = await temporaryDirectory();
+    await writeFile(join(outside, "private.txt"), "outside body");
+    await symlink(
+      join(outside, "private.txt"),
+      join(cwd, "outside-link.txt"),
+    );
+    const fetchMock = vi.fn<typeof fetch>();
+
+    await expect(
+      runCli(
+        [
+          "emails",
+          "send",
+          "--from",
+          "sender@example.com",
+          "--to",
+          "recipient@example.net",
+          "--subject",
+          "symlink",
+          "--text-file",
+          "outside-link.txt",
+        ],
+        { cwd, fetch: fetchMock, io: capturingIo().io },
+      ),
+    ).rejects.toThrow("inside the current directory");
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
   it("refuses unsafe or inconsistent upload contracts before uploading bytes", async () => {
     const cwd = await temporaryDirectory();
     const content = Buffer.from("private attachment");