fix(twitter): confine uploadMedia paths to cwd

[SashaMIT]

Why

upload_media passes agent-controlled filePath straight to v1.uploadMedia with no cwd/realpath confine. A prompt-injected path (e.g. ../../.env, /etc/passwd) can read arbitrary process-readable files and exfiltrate them via Twitter media upload.

Same local-path class as flaunch #1424 / zora #1425, on the Twitter action provider.

Fix

resolveSafeLocalMediaPath: resolve under process.cwd(), require realpath stays under that root, then upload only the confined path.

Test plan

• npx jest src/action-providers/twitter/utils.test.ts src/action-providers/twitter/twitterActionProvider.test.ts (20/20)
• In-cwd relative path still uploads
• ../ and absolute outsides fail closed before uploadMedia

Made with Cursor

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

[SashaMIT]

Consolidating our open queue to reduce triage load. Closing this for now; the core set we are keeping open is #1392, #1404, #1405, #1409, #1421, #1423. Happy to reopen or refile this specific fix if a maintainer wants it.