Resolve declared file targets in Run

protocol/job.go

@@ -44,6 +44,7 @@ type RunJobProgressReport struct {
 type RunJobExecutionInput struct {
 	WorkspaceScope       string                     `json:"workspaceScope,omitempty"`
 	Content              string                     `json:"content,omitempty"`
+	FileTargetKey        string                     `json:"fileTargetKey,omitempty"`
 	ExpectedVersion      int                        `json:"expectedVersion,omitempty"`
 	ExpectedChecksum     string                     `json:"expectedChecksum,omitempty"`
 	MaxReadBytes         int                        `json:"maxReadBytes,omitempty"`

protocol/job_validation.go

@@ -51,6 +51,9 @@ func ValidateRunJobAssignment(assignment RunJobAssignment) error {
 	if assignment.ExecutionInput.MaxReadBytes < 0 || assignment.ExecutionInput.MaxReadBytes > maxRunExecutionContentBytes {
 		return ValidationError("execution input maxReadBytes is out of bounds")
 	}
+	if assignment.ExecutionInput.FileTargetKey != "" && !ValidLogicalFileKey(assignment.ExecutionInput.FileTargetKey) {
+		return ValidationError("execution input fileTargetKey is not allowed")
+	}
 	if assignment.ExecutionInput.WorkspaceScope != "" && !ValidLogicalFileKey(assignment.ExecutionInput.WorkspaceScope) {
 		return ValidationError("execution input workspaceScope is not allowed")
 	}

protocol/job_validation_test.go

@@ -30,6 +30,15 @@ func TestValidateRunJobAssignmentScopedFilePayloads(t *testing.T) {
 	if err := ValidateRunJobAssignment(assignment); err == nil || !strings.Contains(err.Error(), "inputRef") {
 		t.Fatalf("expected raw credential ref rejection, got %v", err)
 	}
+	assignment.InputRef = "input://server-config/server-1/server.properties/v1"
+	assignment.ExecutionInput.FileTargetKey = "SCUM/Saved/Config/WindowsServer/ServerSettings.ini"
+	if err := ValidateRunJobAssignment(assignment); err != nil {
+		t.Fatalf("expected valid declared relative file target: %v", err)
+	}
+	assignment.ExecutionInput.FileTargetKey = "../outside.ini"
+	if err := ValidateRunJobAssignment(assignment); err == nil || !strings.Contains(err.Error(), "fileTargetKey") {
+		t.Fatalf("expected declared file target escape rejection, got %v", err)
+	}
 }
 
 func TestValidateRunJobAssignmentScopedReadDoesNotRequireInputRef(t *testing.T) {