Symptom
get-memories (main.js, block "2. {projectPath}/ — project root CLAUDE.md, agents.md") reads CLAUDE.md, GEMINI.md and agents.md at each known project root with a plain fs.readFileSync and feeds the content to the memory FTS index. Unlike the sibling listings, which go through scanMdFiles(dir, isAllowedMemoryPath) since #294, this block has no isSensitivePath / isAllowedMemoryPath call: a project whose CLAUDE.md is a symlink to a sensitive file (a cloned third-party repo added as a project, for instance) gets that file's content into the searchable index.
Found while re-reviewing #294; pre-existing on main, not introduced there.
Expected
The three root files pass the same gate as every other memory listing — resolved target checked with isSensitivePath and isAllowedMemoryPath before the read — and a test with a symlinked CLAUDE.md pointing at a sensitive path pins the exclusion. .ai/contexts/ipc-bridge.md guard inventory updated.
Symptom
get-memories(main.js, block "2. {projectPath}/ — project root CLAUDE.md, agents.md") readsCLAUDE.md,GEMINI.mdandagents.mdat each known project root with a plainfs.readFileSyncand feeds the content to the memory FTS index. Unlike the sibling listings, which go throughscanMdFiles(dir, isAllowedMemoryPath)since #294, this block has noisSensitivePath/isAllowedMemoryPathcall: a project whoseCLAUDE.mdis a symlink to a sensitive file (a cloned third-party repo added as a project, for instance) gets that file's content into the searchable index.Found while re-reviewing #294; pre-existing on
main, not introduced there.Expected
The three root files pass the same gate as every other memory listing — resolved target checked with
isSensitivePathandisAllowedMemoryPathbefore the read — and a test with a symlinkedCLAUDE.mdpointing at a sensitive path pins the exclusion..ai/contexts/ipc-bridge.mdguard inventory updated.