From c248da031794bc74f430c68071f8382392d2e4c0 Mon Sep 17 00:00:00 2001
From: Benjamin Jesuiter <bjesuiter@gmail.com>
Date: Mon, 2 Feb 2026 20:47:20 +0100
Subject: [PATCH] Memory: harden QMD memory_get path checks

---
 src/memory/qmd-manager.ts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/memory/qmd-manager.ts b/src/memory/qmd-manager.ts
index 8cd40e2231a..bf547614670 100644
--- a/src/memory/qmd-manager.ts
+++ b/src/memory/qmd-manager.ts
@@ -280,6 +280,13 @@ export class QmdMemoryManager implements MemorySearchManager {
     const relPath = params.relPath?.trim();
     if (!relPath) throw new Error("path required");
     const absPath = this.resolveReadPath(relPath);
+    if (!absPath.endsWith(".md")) {
+      throw new Error("path required");
+    }
+    const stat = await fs.lstat(absPath);
+    if (stat.isSymbolicLink() || !stat.isFile()) {
+      throw new Error("path required");
+    }
     const content = await fs.readFile(absPath, "utf-8");
     if (!params.from && !params.lines) {
       return { text: content, path: relPath };