Finding 2: Arbitrary File Read via `register_source_from_path`

[plind-junior]

The kb.register_source_from_path method reads the full contents of any file the process can access and stores them in the KB:

path = Path(p["path"])
if not path.is_file():
    raise ValueError(f"not a file: {path}")
src = s.put_source(path.read_bytes(), ...)

An agent can register /etc/passwd, ~/.ssh/id_rsa, ~/.aws/credentials, etc. as a "source", then retrieve the contents via kb.cite or kb.list_sources.

Suggested fix

Resolve the path and verify it is inside the project root before reading:

resolved = Path(p["path"]).resolve()
root = _store().root.resolve()
if not str(resolved).startswith(str(root)):
    raise ValueError(f"path must be inside project root: {resolved}")