… issues

SEC-01/02 — Prompt injection via source files and YAML repair content
  context-builder.ts: source files and manifest JSON are now wrapped in
  <context_manifest> / <context_file> XML tags instead of bare markdown
  fences. Prevents a scanned source file from injecting LLM instructions.
  index.ts (repairYaml): YAML content wrapped in <yaml_content> XML tags;
  truncated to 64 KB. System prompt instructs Claude to treat tagged content
  as data only.
  skills/guidelines.md: security preamble added — Claude must treat all
  <context_*> content as data, never as instructions.

SEC-03 — Path traversal in $file: tool module references
  context-builder.ts extractFileRefs(): resolves each $file: path and checks
  it starts with manifestDir + sep. Paths escaping the directory are silently
  skipped (prevents $file:../../etc/passwd from being read and sent to Claude).

BUG-04 — js-yaml unsafe schema allows !!js/function execution
  sdk/src/loader/index.ts: yaml.load now uses { schema: yaml.JSON_SCHEMA }.
  The default schema supports !!js/regexp and !!js/function which can execute
  code when parsing a malicious agent.yaml.

SEC-08 — SSRF: RFC 1918 private addresses not blocked in service health checks
  service.check.ts classifyHost(): added blocking for 10.0.0.0/8,
  172.16.0.0/12, and 192.168.0.0/16. Previously only loopback and link-local
  were blocked; a manifest could reference redis://10.x.x.x to probe internal
  cluster services.

BUG-05 — Dataset path traversal in evaluate.ts
  Added bounds-check after resolving dataset path. If absPath does not start
  with manifestDir + sep, the command exits 1.

BUG-02 — Biased shuffle in evaluate.ts --sample-size
  Replaced Array.sort(() => Math.random()-0.5) with Fisher-Yates. The sort
  idiom violates transitivity and produces a non-uniform distribution.

QUAL-08 — OPA parseCommaSeparatedHeader discards all but first array value
  opa-client.ts: Array.isArray(value) ? value[0] : value replaced with
  value.join(',') so all HTTP header instances are included.

Tests: updated claude-adapter.test.ts for new XML context format; added
  path-traversal guard test; added RFC 1918 SSRF tests to service-check.test.ts

…tion or class'

Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

…ements

context-builder.ts:
- Add missing security preamble to guidelines.md (was only on
  feat/claude-subscription-auth branch) instructing Claude to treat
  <context_*> XML tags as data only, never as instructions
- Escape XML attribute values (path, lang) with a minimal XML escaper so
  file paths containing ", <, & etc. cannot produce malformed tags or inject
  content outside the attribute
- Sanitize file content to encode </context_file> as <\/context_file> so a
  source file cannot break out of its wrapper and inject instructions
- Add lstatSync check in extractFileRefs() to reject symlinks before reading;
  a symlink inside baseDir pointing outside would have bypassed the realpath
  prefix guard

evaluate.ts:
- Replace the lexical-only dataset path guard with a two-step check: the
  existing resolve()-based prefix test (fast, catches ..) followed by
  realpathSync on both the candidate and the base directory so symlinks
  inside manifestDir that point outside cannot bypass the guard

service.check.ts:
- Use net.isIP() to distinguish IP literals from hostnames before applying
  RFC 1918 / loopback / link-local prefix checks; hostnames like
  '10.example.com' no longer produce a false positive
- Document DNS-rebinding limitation (out of scope for sync health checks)

Tests:
- service-check.test.ts: add two false-positive hostname tests; fix
  node:net mock to use importOriginal so net.isIP is available
- claude-adapter.test.ts: add symlink-escape test, XML attribute escaping
  test, and </context_file> content breakout test
- evaluate.test.ts: add realpathSync to node:fs mock (returns path unchanged)