Security review request: file-access scope — symlinks and path injection (suspicion of out-of-scope reads)

[ainthek]

---

When indexing a repository (e.g. via index_repository), the server resolves and reads files under the requested repo root. I'd like a review of the path-handling logic to confirm it cannot escape the requested scope, for example through:

• Symlinks: files or directories inside the repo that are symlinks pointing outside the repo root — are they followed, and if so, are their contents indexed?
• Directory traversal: relative paths using .. segments, canonicalization (filepath.EvalSymlinks, filepath.Clean), and whether resolved paths are re-checked to still be under the root.
• Path/glob injection: any path matching or ignore-rule logic (gitignore/.cbmignore/skip-lists) that could be tricked into reading outside the root.
• Worktrees/submodules/boundaries: whether sibling worktrees or nested submodules sharing the same parent tree are treated as out-of-scope or not.
• The file watcher: the background watcher (watcher.watch) — does it stay scoped to the repo root?

This is currently just a suspicion / hardening request from a user who noticed the server operates on the repo root plus a cache/log dir under ~/.cache. No out-of-scope access has been confirmed. A review (even just confirming the intended behavior and where the boundary checks live) would be appreciated.

---

Generated/modified by AI Kilo Code 7.5.6-gratex-017, used model deepseek-v4-flash