Enforce session workspace boundaries

tests/test_data_agent_inputs.py

@@ -30,6 +30,17 @@ class DataAgentInputTests(unittest.TestCase):
         self.assertEqual(table['title'], 'Sheet')
         self.assertEqual(table['rows'][0], ['query', '预期domain', '0106-prev-domain', 'type', '备注'])
 
+    def test_load_input_sources_reads_explicit_external_file(self) -> None:
+        with tempfile.TemporaryDirectory() as root_dir, tempfile.TemporaryDirectory() as external_dir:
+            path = Path(external_dir) / 'cases.xlsx'
+            _write_xlsx(path)
+
+            payload = load_input_sources(root_dir, [str(path)])
+
+        self.assertEqual(payload['source_count'], 1)
+        self.assertEqual(payload['sources'][0]['path'], path.resolve().as_posix())
+        self.assertEqual(payload['sources'][0]['tables'][0]['rows'][1][0], '怎么开启查找设备')
+
     def test_extract_case_evidence_profiles_and_extracts_rows(self) -> None:
         with tempfile.TemporaryDirectory() as tmp_dir:
             path = Path(tmp_dir) / 'cases.xlsx'