Summary

• Problem: memory_get could accept a path that lexically stayed under the workspace or an allowed extra path, but escaped through an intermediate directory symlink.
• Why it matters: an agent using memory_get could be tricked into pulling content from outside the workspace or QMD memory boundary, which means normal memory lookups could unexpectedly surface unrelated local files instead of only the notes the user intended memory tools to access.
• What changed: resolve target files and allowed roots to real paths before reading, then reject reads whose canonical path falls outside the allowed root; applied to both builtin memory reads and QMD-backed reads.
• What did NOT change (scope boundary): no changes to memory search ranking, indexing behavior, prompt logic, or non-memory file access surfaces.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Memory / storage
• API / contracts

Linked Issue/PR

• Closes #
• Related #
• This PR fixes a bug or regression

Root Cause (if applicable)

• Root cause: the read path checks only validated the lexical path prefix and direct symlink files, but did not verify that the resolved real path still stayed inside the allowed workspace / extraPath / QMD collection root.
• Missing detection / guardrail: no regression test covered an intermediate directory symlink that escaped the allowed root.
• Contributing context (if known): builtin and QMD read paths each enforced path rules separately, so both needed the same canonical-path containment check.

Regression Test Plan (if applicable)

• Coverage level that should have caught this:
  • Unit test
  • Seam / integration test
  • End-to-end test
  • Existing coverage already sufficient
• Target test or file:
  • extensions/memory-core/src/memory/manager.read-file.test.ts
  • extensions/memory-core/src/memory/qmd-manager.test.ts
• Scenario the test should lock in: reject memory_get reads when a path under memory/, an allowed extra path, or a QMD collection crosses the boundary through an intermediate directory symlink.
• Why this is the smallest reliable guardrail: the bug lives in path resolution and file-read authorization, so direct read-path tests cover it without requiring full indexing or end-to-end setup.
• Existing test that already covers this (if any): existing tests already covered direct symlink files; this PR extends coverage to directory symlink escapes.
• If no new test is added, why not: N/A

User-visible / Behavior Changes

memory_get now rejects markdown paths that escape the allowed workspace / extra path / QMD collection through intermediate directory symlinks.

Diagram (if applicable)

Before:
memory_get("memory/linked/secret.md")
-> lexical prefix check passes
-> linked/ resolves outside workspace
-> file is read

After:
memory_get("memory/linked/secret.md")
-> lexical prefix check passes
-> realpath resolves outside allowed root
-> request fails with "path required"

Security Impact (required)

• New permissions/capabilities? No
• Secrets/tokens handling changed? No
• New/changed network calls? No
• Command/tool execution surface changed? No
• Data access scope changed? Yes
• If any Yes, explain risk + mitigation:
  • This narrows the readable file scope for memory_get to the canonical allowed roots and blocks previously unintended cross-boundary reads through directory symlinks.

Repro + Verification

Environment

• OS: macOS
• Runtime/container: local Node/Bun repo test runner
• Model/provider: N/A
• Integration/channel (if any): memory core / QMD
• Relevant config (redacted): default local test config

Steps

1. Create a markdown file outside the workspace or outside an allowed extra path / QMD collection root.
2. Add an intermediate directory symlink inside memory/, an allowed extra path, or a QMD collection that points to that outside directory.
3. Run memory_get on the symlinked markdown path.

Expected

• The read is rejected with path required.

Actual

• Before this fix, the read could succeed because only the lexical path prefix was checked.

Evidence

• Failing test/log before + passing after
• Trace/log snippets
• Screenshot/recording
• Perf numbers (if relevant)

Human Verification (required)

• Verified scenarios:
  • builtin memory reads reject directory symlink escapes
  • extra-path memory reads reject nested directory symlink escapes
  • QMD reads reject directory symlink escapes
• Edge cases checked:
  • direct symlink-file rejection still holds
  • transient file disappearance path still returns empty text correctly after switching reads to canonical paths
• What you did not verify:
  • full pnpm test
  • full pnpm check

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

• Backward compatible? Yes
• Config/env changes? No
• Migration needed? No
• If yes, exact upgrade steps: N/A

Risks and Mitigations

• Risk: setups that used a directory symlink inside memory/, an allowed extra path, or a QMD collection as an implicit way to reach files outside the configured memory roots will now fail on memory_get.
  • Mitigation: supported outside-workspace reads should be configured explicitly through memorySearch.extraPaths or QMD collections; this change aligns runtime reads with the documented memory-root contract and adds regression coverage for the escaped-symlink case.