Clarify artifact root symlink behavior

internal/artifact/reader.go

@@ -158,14 +158,15 @@ func (r *restrictedFileReader) Read(ctx context.Context, ref domain.ArtifactRef)
 		return nil, ErrMissingFilePath
 	}
 
-	path, err := r.resolve(ref.URI)
+	path, err := r.resolveLexicalPath(ref.URI)
 	if err != nil {
 		return nil, err
 	}
 	return readFileArtifactWithLimit(path, r.maxBytes)
 }
 
-func (r *restrictedFileReader) resolve(rawPath string) (string, error) {
+// resolveLexicalPath checks cleaned path containment without resolving symlinks.
+func (r *restrictedFileReader) resolveLexicalPath(rawPath string) (string, error) {
 	cleanPath := filepath.Clean(strings.TrimSpace(rawPath))
 	var candidate string
 	if filepath.IsAbs(cleanPath) {

internal/artifact/reader_test.go

@@ -112,6 +112,34 @@ func TestRestrictedCompositeReader(t *testing.T) {
 	})
 }
 
+func TestRestrictedCompositeReaderFollowsSymlinkInsideRoot(t *testing.T) {
+	ctx := context.Background()
+	root := t.TempDir()
+	outside := t.TempDir()
+
+	target := filepath.Join(outside, "linked.txt")
+	if err := os.WriteFile(target, []byte("linked outside root"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	link := filepath.Join(root, "linked.txt")
+	if err := os.Symlink(target, link); err != nil {
+		t.Skipf("symlink creation unavailable: %v", err)
+	}
+
+	reader, err := NewRestrictedCompositeReader(root)
+	if err != nil {
+		t.Fatalf("expected restricted reader construction, got %v", err)
+	}
+
+	art, err := reader.Read(ctx, domain.ArtifactRef{Type: domain.ArtifactRefFile, URI: "linked.txt"})
+	if err != nil {
+		t.Fatalf("expected symlink inside root to be followed, got %v", err)
+	}
+	if string(art.Body) != "linked outside root" {
+		t.Fatalf("unexpected artifact body: %q", string(art.Body))
+	}
+}
+
 func TestRestrictedCompositeReaderWithoutRootDeniesFileRefs(t *testing.T) {
 	reader, err := NewRestrictedCompositeReader("")
 	if err != nil {