Embedded CLI runs refuse @path file arguments

readArgumentSource did a raw readFileSync on any @path — and the
mothership runs the CLI in-process on the sim server with argv the
model controls, so a prompt-injected --input @/etc/... read the
SERVER's filesystem. Embedded runs (embedStore present) now refuse
file and stdin sources with inline guidance; @@ literals and inline
values are unchanged, and the installed CLI's behavior is untouched.

Claude-Session: https://claude.ai/code/session_01CgaxNAaeD3taGdghbXn17w

Author: Sg312

packages/sim-cli/src/runtime/embedded-file-args.test.ts

@@ -0,0 +1,40 @@
+import { mkdtempSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { embedStore } from '../embed-context'
+import { readArgumentSource } from './request'
+
+describe('file arguments in embedded runs', () => {
+  it('refuses @path reads in-process, with inline guidance', () => {
+    const ctx = {
+      identity: { endpoint: 'http://x', apiKey: 'k' },
+      stdout: [] as string[],
+      stderr: [] as string[],
+    }
+    embedStore.run(ctx, () => {
+      expect(() => readArgumentSource('@/etc/hostname', 'input')).toThrow(
+        /not available in embedded runs.*inline/
+      )
+    })
+  })
+
+  it('keeps @@ literal escape and inline values working embedded', () => {
+    const ctx = {
+      identity: { endpoint: 'http://x', apiKey: 'k' },
+      stdout: [] as string[],
+      stderr: [] as string[],
+    }
+    embedStore.run(ctx, () => {
+      expect(readArgumentSource('@@literal', 'input').text).toBe('@literal')
+      expect(readArgumentSource('{"a":1}', 'input').text).toBe('{"a":1}')
+    })
+  })
+
+  it('still reads files outside embedded runs', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'cli-args-'))
+    const file = join(dir, 'v.json')
+    writeFileSync(file, '{"ok":true}')
+    expect(readArgumentSource(`@${file}`, 'input').text).toBe('{"ok":true}')
+  })
+})

packages/sim-cli/src/runtime/request.ts

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, readSync } from 'node:fs'
 import { CLI_CONTRACT } from '../contract/commands'
 import type { CommandSpec, FlagSpec } from '../contract/types'
+import { embedStore } from '../embed-context'
 import { V2_OPERATIONS, type V2OperationName } from '../generated/v2-api'
 import { type QueryValue, SimApiError } from '../http/client'
 import { camel, kebab } from './derive'
@@ -202,6 +203,17 @@ export function readArgumentSource(raw: string, flagName: string): { text: strin
   if (raw.startsWith('@@')) return { text: raw.slice(1), from: '' }
   if (!raw.startsWith('@')) return { text: raw, from: '' }
 
+  // An embedded run executes in-process on the hosting server, so a file path
+  // here would read the SERVER's filesystem with argv the model controls.
+  // There is no local file a caller could legitimately mean; the value must
+  // arrive inline (or as @@-escaped literal text).
+  if (embedStore.getStore()) {
+    throw new SimApiError(
+      `--${flagName} file arguments (@path) are not available in embedded runs — pass the JSON inline as a single argument`,
+      0
+    )
+  }
+
   const path = raw.slice(1)
   if (path === '-') {
     if (process.stdin.isTTY) {