rubik 0.3.2 → 0.3.4

data/lib/rubik/repl/commands/workspace.rb

@@ -34,101 +34,109 @@ module Rubik
             scope, clean_args = Base.parse_scope(args)
             sub = clean_args.first&.downcase || "list"
 
-            handle_add = lambda do |tokens_to_add|
-              entry_tokens = tokens_to_add.reject { |a| a == "--force" }
-              entry = entry_tokens.join(" ").strip
-              if entry.empty?
-                ctx.out.puts 'Usage: !allow-cmd add "<command prefix>" [--project|--global] [--force]'
-                return
-              end
-
-              tokens = entry.split(/\s+/)
-              # Fail closed (G3 triage, Priority-1 site): a classifier crash
-              # must not silently skip the broad-token RCE check — treat the
-              # token as broad and let the operator pass a narrow prefix.
-              broad = begin
-                base = Rubik::Security::Classifier.classify(tokens.first)
-                base.classification == :dangerous && tokens.size == 1
-              rescue StandardError => e
-                Rubik::Log.warn(:security, "classifier failed for '#{tokens.first}' (#{e.class}: #{e.message}); treating as broad")
-                true
-              end
-
-              # Fail-closed against unbounded execution: a broad, single-token
-              # dangerous entry (e.g. "node", "python", "bash") grants
-              # command execution for EVERY invocation of that binary, so
-              # `node` → `node -e 'malicious()'` RCE. Such broad tokens are
-              # blocked with or without --force — the operator should use a
-              # narrow prefix (e.g. "node .gitnexus/run.cjs").
-              if broad
-                ctx.out.puts "Blocked: '#{entry}' is a broad, single-token dangerous command. Even with --force it grants " \
-                             "unbounded command execution (e.g. `#{tokens.first} -e 'malicious(...)'` RCE). " \
-                             "Use a narrow prefix instead (e.g. \"#{tokens.first} <script>\")."
-                return
-              end
-
-              # The catastrophic destructive-pattern fallback always runs:
-              # a dangerous multi-token entry may never add `rm -rf /`-style
-              # chains to the allowlist, with or without --force.
-              catastrophic = false
-              begin
-                ctx.guard.verify_command_fallback_regex!(entry)
-              rescue Rubik::Security::BlockedWriteError => e
-                ctx.out.puts "Blocked: '#{entry}' matches a catastrophic destructive pattern and cannot be allowlisted: #{e.message}"
-                catastrophic = true
-              end
-              return if catastrophic
-
-              current = Array(ctx.config.fetch("security.command_allowlist", [])).dup
-              if current.include?(entry)
-                ctx.out.puts "[Rubik::AllowCmd] '#{entry}' is already allowlisted."
-                return
-              end
-              current << entry
-              res = ctx.config.set("security.command_allowlist", current, persist: scope)
-              ctx.guard&.log_audit("allowlist_add", command: entry, scope: scope)
-              next if Base.report_persist_failure(ctx, res, scope)
-
-              ctx.out.puts "[Rubik::AllowCmd] Added command prefix: #{entry} [#{Base.scope_label(scope)}]."
-            end
-
             case sub
             when "list", "status"
-              entries = Array(ctx.config.fetch("security.command_allowlist", []))
-              ctx.out.puts "=== Allowed Command Prefixes (operator allowlist) ==="
-              if entries.empty?
-                ctx.out.puts "  (No command prefixes allowlisted — unknown/dangerous commands stay blocked)"
-              else
-                entries.each_with_index { |e, idx| ctx.out.puts "  • [#{idx + 1}] #{e}" }
-              end
+              handle_allow_cmd_list(ctx)
             when "add"
-              handle_add.call(clean_args[1..])
+              handle_allow_cmd_add(ctx, clean_args[1..], scope)
             when "remove", "rm", "delete"
-              entry = clean_args[1..].join(" ").strip
-              if entry.empty?
-                ctx.out.puts "Usage: !allow-cmd remove \"<command prefix>\" [--project|--global]"
-                next
-              end
-
-              current = Array(ctx.config.fetch("security.command_allowlist", [])).dup
-              unless current.include?(entry)
-                ctx.out.puts "[Rubik::AllowCmd] '#{entry}' is not in the allowlist."
-                next
-              end
-              current.delete(entry)
-              res = ctx.config.set("security.command_allowlist", current, persist: scope)
-              ctx.guard&.log_audit("allowlist_remove", command: entry, scope: scope)
-              next if Base.report_persist_failure(ctx, res, scope)
-
-              ctx.out.puts "[Rubik::AllowCmd] Removed command prefix: #{entry} [#{Base.scope_label(scope)}]."
+              handle_allow_cmd_remove(ctx, clean_args, scope)
             when "help", "-h", "--help"
               ctx.out.puts USAGE_ALLOW_CMD
             else
-              handle_add.call(clean_args)
+              handle_allow_cmd_add(ctx, clean_args, scope)
             end
           end
         end
 
+        private_class_method def self.handle_allow_cmd_list(ctx)
+          entries = Array(ctx.config.fetch("security.command_allowlist", []))
+          ctx.out.puts "=== Allowed Command Prefixes (operator allowlist) ==="
+          if entries.empty?
+            ctx.out.puts "  (No command prefixes allowlisted — unknown/dangerous commands stay blocked)"
+          else
+            entries.each_with_index { |e, idx| ctx.out.puts "  • [#{idx + 1}] #{e}" }
+          end
+        end
+
+        private_class_method def self.handle_allow_cmd_add(ctx, tokens_to_add, scope)
+          entry_tokens = tokens_to_add.reject { |a| a == "--force" }
+          entry = entry_tokens.join(" ").strip
+          if entry.empty?
+            ctx.out.puts 'Usage: !allow-cmd add "<command prefix>" [--project|--global] [--force]'
+            return
+          end
+
+          tokens = entry.split(/\s+/)
+          # Fail closed (G3 triage, Priority-1 site): a classifier crash
+          # must not silently skip the broad-token RCE check — treat the
+          # token as broad and let the operator pass a narrow prefix.
+          broad = begin
+            base = Rubik::Security::Classifier.classify(tokens.first)
+            base.classification == :dangerous && tokens.size == 1
+          rescue StandardError => e
+            Rubik::Log.warn(:security, "classifier failed for '#{tokens.first}' (#{e.class}: #{e.message}); treating as broad")
+            true
+          end
+
+          # Fail-closed against unbounded execution: a broad, single-token
+          # dangerous entry (e.g. "node", "python", "bash") grants
+          # command execution for EVERY invocation of that binary, so
+          # `node` → `node -e 'malicious()'` RCE. Such broad tokens are
+          # blocked with or without --force — the operator should use a
+          # narrow prefix (e.g. "node .gitnexus/run.cjs").
+          if broad
+            ctx.out.puts "Blocked: '#{entry}' is a broad, single-token dangerous command. Even with --force it grants " \
+                         "unbounded command execution (e.g. `#{tokens.first} -e 'malicious(...)'` RCE). " \
+                         "Use a narrow prefix instead (e.g. \"#{tokens.first} <script>\")."
+            return
+          end
+
+          # The catastrophic destructive-pattern fallback always runs:
+          # a dangerous multi-token entry may never add `rm -rf /`-style
+          # chains to the allowlist, with or without --force.
+          catastrophic = false
+          begin
+            ctx.guard.verify_command_fallback_regex!(entry)
+          rescue Rubik::Security::BlockedWriteError => e
+            ctx.out.puts "Blocked: '#{entry}' matches a catastrophic destructive pattern and cannot be allowlisted: #{e.message}"
+            catastrophic = true
+          end
+          return if catastrophic
+
+          current = Array(ctx.config.fetch("security.command_allowlist", [])).dup
+          if current.include?(entry)
+            ctx.out.puts "[Rubik::AllowCmd] '#{entry}' is already allowlisted."
+            return
+          end
+          current << entry
+          res = ctx.config.set("security.command_allowlist", current, persist: scope)
+          ctx.guard&.log_audit("allowlist_add", command: entry, scope: scope)
+          return if Base.report_persist_failure(ctx, res, scope)
+
+          ctx.out.puts "[Rubik::AllowCmd] Added command prefix: #{entry} [#{Base.scope_label(scope)}]."
+        end
+
+        private_class_method def self.handle_allow_cmd_remove(ctx, clean_args, scope)
+          entry = clean_args[1..].join(" ").strip
+          if entry.empty?
+            ctx.out.puts "Usage: !allow-cmd remove \"<command prefix>\" [--project|--global]"
+            return
+          end
+
+          current = Array(ctx.config.fetch("security.command_allowlist", [])).dup
+          unless current.include?(entry)
+            ctx.out.puts "[Rubik::AllowCmd] '#{entry}' is not in the allowlist."
+            return
+          end
+          current.delete(entry)
+          res = ctx.config.set("security.command_allowlist", current, persist: scope)
+          ctx.guard&.log_audit("allowlist_remove", command: entry, scope: scope)
+          return if Base.report_persist_failure(ctx, res, scope)
+
+          ctx.out.puts "[Rubik::AllowCmd] Removed command prefix: #{entry} [#{Base.scope_label(scope)}]."
+        end
+
         private_class_method def self.register_workspace_command(shell)
           workspace_handler = lambda do |args, ctx|
             scope, clean_args = Base.parse_scope(args)
@@ -263,80 +271,16 @@ module Rubik
 
             case sub
             when "list", "status"
-              allowed = ctx.buffer_manager&.allowed_external_dirs || []
-              rw_set = ctx.buffer_manager&.rw_allowed_dirs || Set.new
-              glob_rw = ctx.buffer_manager&.allow_external_writes || false
-
-              ctx.out.puts "=== Allowed External Directories (Zero-AST / Zero-Scanner) ==="
-              if allowed.empty?
-                ctx.out.puts "  (No allowed external directories configured)"
-              else
-                allowed.each_with_index do |d, idx|
-                  mode_str = glob_rw || rw_set.include?(d) ? "Read-Write" : "Read-Only"
-                  ctx.out.puts "  • [ALLOWED #{idx + 1}] #{d} (#{mode_str})"
-                end
-              end
+              handle_allow_list(ctx)
             when "remove", "rm", "delete"
-              target_path = clean_args[1]
-              if target_path.nil? || target_path.empty?
-                ctx.out.puts "Usage: !allow remove <path> [--project|--global]"
-              else
-                expanded = ctx.buffer_manager&.remove_allowed_dir(target_path)
-                ctx.sandbox_runner&.remove_allowed_dir(target_path)
-
-                # Persist to config
-                current_dirs = Array(ctx.config.fetch("workspace.allowed_external_dirs", [])).dup
-                current_dirs.reject! { |d| File.expand_path(d, effective_root) == expanded || d == target_path }
-                res = ctx.config.set("workspace.allowed_external_dirs", current_dirs, persist: scope)
-                next if Base.report_persist_failure(ctx, res, scope)
-
-                ctx.out.puts "[Rubik::Allow] Removed allowed external directory: #{expanded} [#{Base.scope_label(scope)}]."
-              end
+              handle_allow_remove(clean_args[1], ctx, scope, effective_root)
             when "add"
-              target_path = clean_args[1]
-              if target_path.nil? || target_path.empty?
-                ctx.out.puts "Usage: !allow add <path> [--rw|--ro] [--project|--global]"
-              else
-                begin
-                  ctx.guard.verify_root_safety!(target_path)
-                rescue Rubik::Security::BlockedWriteError => e
-                  ctx.out.puts "Security Error: #{e.message}"
-                  next
-                end
-
-                expanded = ctx.buffer_manager.add_allowed_dir(target_path, rw: mode_rw)
-                ctx.sandbox_runner&.add_allowed_dir(target_path)
-
-                # Persist to config (Zero-AST / Zero-Scanner: No IndexService or AST warm)
-                current_dirs = Array(ctx.config.fetch("workspace.allowed_external_dirs", [])).dup
-                current_dirs << target_path unless current_dirs.include?(target_path)
-                res = ctx.config.set("workspace.allowed_external_dirs", current_dirs, persist: scope)
-                next if Base.report_persist_failure(ctx, res, scope)
-
-                mode_str = mode_rw ? "Read-Write" : "Read-Only"
-                ctx.out.puts "[Rubik::Allow] Added allowed external directory: #{expanded} (Mode: #{mode_str}) [#{Base.scope_label(scope)}]."
-              end
+              handle_allow_add(clean_args[1], ctx, scope, mode_rw)
             else
               # First argument is target path directly
               target_path = clean_args.first
               if target_path && !target_path.empty?
-                begin
-                  ctx.guard.verify_root_safety!(target_path)
-                rescue Rubik::Security::BlockedWriteError => e
-                  ctx.out.puts "Security Error: #{e.message}"
-                  next
-                end
-
-                expanded = ctx.buffer_manager.add_allowed_dir(target_path, rw: mode_rw)
-                ctx.sandbox_runner&.add_allowed_dir(target_path)
-
-                current_dirs = Array(ctx.config.fetch("workspace.allowed_external_dirs", [])).dup
-                current_dirs << target_path unless current_dirs.include?(target_path)
-                res = ctx.config.set("workspace.allowed_external_dirs", current_dirs, persist: scope)
-                next if Base.report_persist_failure(ctx, res, scope)
-
-                mode_str = mode_rw ? "Read-Write" : "Read-Only"
-                ctx.out.puts "[Rubik::Allow] Added allowed external directory: #{expanded} (Mode: #{mode_str}) [#{Base.scope_label(scope)}]."
+                handle_allow_add(target_path, ctx, scope, mode_rw)
               else
                 cmd_name = invoked_as == :allow ? "allow" : "allow-dir"
                 ctx.out.puts format(USAGE_ALLOW, cmd: cmd_name)
@@ -359,6 +303,66 @@ module Rubik
                                           usage: format(USAGE_ALLOW, cmd: "allow"), &deprecated_allow_wrapper)
         end
 
+        private_class_method def self.handle_allow_list(ctx)
+          allowed = ctx.buffer_manager&.allowed_external_dirs || []
+          rw_set = ctx.buffer_manager&.rw_allowed_dirs || Set.new
+          glob_rw = ctx.buffer_manager&.allow_external_writes || false
+
+          ctx.out.puts "=== Allowed External Directories (Zero-AST / Zero-Scanner) ==="
+          if allowed.empty?
+            ctx.out.puts "  (No allowed external directories configured)"
+          else
+            allowed.each_with_index do |d, idx|
+              mode_str = glob_rw || rw_set.include?(d) ? "Read-Write" : "Read-Only"
+              ctx.out.puts "  • [ALLOWED #{idx + 1}] #{d} (#{mode_str})"
+            end
+          end
+        end
+
+        private_class_method def self.handle_allow_remove(target_path, ctx, scope, effective_root)
+          if target_path.nil? || target_path.empty?
+            ctx.out.puts "Usage: !allow remove <path> [--project|--global]"
+            return
+          end
+
+          expanded = ctx.buffer_manager&.remove_allowed_dir(target_path)
+          ctx.sandbox_runner&.remove_allowed_dir(target_path)
+
+          # Persist to config
+          current_dirs = Array(ctx.config.fetch("workspace.allowed_external_dirs", [])).dup
+          current_dirs.reject! { |d| File.expand_path(d, effective_root) == expanded || d == target_path }
+          res = ctx.config.set("workspace.allowed_external_dirs", current_dirs, persist: scope)
+          return if Base.report_persist_failure(ctx, res, scope)
+
+          ctx.out.puts "[Rubik::Allow] Removed allowed external directory: #{expanded} [#{Base.scope_label(scope)}]."
+        end
+
+        private_class_method def self.handle_allow_add(target_path, ctx, scope, mode_rw)
+          if target_path.nil? || target_path.empty?
+            ctx.out.puts "Usage: !allow add <path> [--rw|--ro] [--project|--global]"
+            return
+          end
+
+          begin
+            ctx.guard.verify_root_safety!(target_path)
+          rescue Rubik::Security::BlockedWriteError => e
+            ctx.out.puts "Security Error: #{e.message}"
+            return
+          end
+
+          expanded = ctx.buffer_manager.add_allowed_dir(target_path, rw: mode_rw)
+          ctx.sandbox_runner&.add_allowed_dir(target_path)
+
+          # Persist to config (Zero-AST / Zero-Scanner: No IndexService or AST warm)
+          current_dirs = Array(ctx.config.fetch("workspace.allowed_external_dirs", [])).dup
+          current_dirs << target_path unless current_dirs.include?(target_path)
+          res = ctx.config.set("workspace.allowed_external_dirs", current_dirs, persist: scope)
+          return if Base.report_persist_failure(ctx, res, scope)
+
+          mode_str = mode_rw ? "Read-Write" : "Read-Only"
+          ctx.out.puts "[Rubik::Allow] Added allowed external directory: #{expanded} (Mode: #{mode_str}) [#{Base.scope_label(scope)}]."
+        end
+
         private_class_method def self.register_config_command(shell)
           shell.register_command("config", description: "Get, set, or view runtime configuration (set|get|list|path)",
                                            usage: USAGE_CONFIG, audience: :both) do |args, ctx|

data/lib/rubik/repl/interrupt_handler.rb

@@ -89,14 +89,14 @@ module Rubik
               if get_std_handle
                 new_in = begin
                   get_std_handle.call(Reline::Windows::STD_INPUT_HANDLE)
-                rescue
+                rescue StandardError
                   nil
                 end
                 io.instance_variable_set(:@hConsoleInputHandle, new_in) if new_in && new_in != 0
 
                 new_out = begin
                   get_std_handle.call(Reline::Windows::STD_OUTPUT_HANDLE)
-                rescue
+                rescue StandardError
                   nil
                 end
                 io.instance_variable_set(:@hConsoleHandle, new_out) if new_out && new_out != 0
@@ -105,14 +105,14 @@ module Rubik
                   flush_func = io.instance_variable_get(:@FlushConsoleInputBuffer) ||
                                begin
                                  Reline::Windows::Win32API.new("kernel32", "FlushConsoleInputBuffer", ["L"], "I")
-                               rescue
+                               rescue StandardError
                                  nil
                                end
                   if flush_func
                     io.instance_variable_set(:@FlushConsoleInputBuffer, flush_func)
                     begin
                       flush_func.call(new_in)
-                    rescue
+                    rescue StandardError
                       nil
                     end
                   end
@@ -143,7 +143,7 @@ if defined?(Reline::Windows)
         if @hConsoleInputHandle.nil? || @hConsoleInputHandle.zero? || @hConsoleInputHandle == -1
           @hConsoleInputHandle = begin # rubocop:disable Naming/VariableName -- Win32 FFI SDK adlandırması; yalnızca Windows konsol yolu
             @GetStdHandle.call(STD_INPUT_HANDLE)
-          rescue
+          rescue StandardError
             nil
           end
         end
@@ -156,18 +156,18 @@ if defined?(Reline::Windows)
             if [0xFFFFFFFF, 4_294_967_295, -1].include?(wait_res)
               @hConsoleInputHandle = begin # rubocop:disable Naming/VariableName -- Win32 FFI SDK adlandırması; yalnızca Windows konsol yolu
                 @GetStdHandle.call(STD_INPUT_HANDLE)
-              rescue
+              rescue StandardError
                 nil
               end
               @hConsoleHandle = begin # rubocop:disable Naming/VariableName -- Win32 FFI SDK adlandırması; yalnızca Windows konsol yolu
                 @GetStdHandle.call(STD_OUTPUT_HANDLE)
-              rescue
+              rescue StandardError
                 nil
               end
             end
             @legacy_console = begin
               getconsolemode.nobits?(ENABLE_VIRTUAL_TERMINAL_PROCESSING)
-            rescue
+            rescue StandardError
               false
             end
             next
@@ -175,7 +175,7 @@ if defined?(Reline::Windows)
           if @GetNumberOfConsoleInputEvents.call(@hConsoleInputHandle, num_of_events).zero? || num_of_events.unpack1("L").zero?
             @hConsoleInputHandle = begin # rubocop:disable Naming/VariableName -- Win32 FFI SDK adlandırması; yalnızca Windows konsol yolu
               @GetStdHandle.call(STD_INPUT_HANDLE)
-            rescue
+            rescue StandardError
               nil
             end
             next
@@ -185,7 +185,7 @@ if defined?(Reline::Windows)
           if @ReadConsoleInputW.call(@hConsoleInputHandle, input_records, 80, read_event).zero?
             @hConsoleInputHandle = begin # rubocop:disable Naming/VariableName -- Win32 FFI SDK adlandırması; yalnızca Windows konsol yolu
               @GetStdHandle.call(STD_INPUT_HANDLE)
-            rescue
+            rescue StandardError
               nil
             end
           else

data/lib/rubik/runtime/overlay_storage.rb

@@ -48,7 +48,10 @@ module Rubik
       end
 
       def manifest_path(dir)
-        File.join(dir, ".manifest.json")
+        ensure_valid_overlay_dir!(dir)
+        path = File.join(dir, ".manifest.json")
+        ensure_contained_path!(path, dir)
+        path
       end
 
       def load_manifest(dir)
@@ -56,7 +59,7 @@ module Rubik
         return {} unless File.exist?(path)
 
         JSON.parse(File.read(path))
-      rescue JSON::ParserError
+      rescue JSON::ParserError, ArgumentError
         {}
       end
 
@@ -73,6 +76,7 @@ module Rubik
       end
 
       def record_hash(dir, filename, scope)
+        ensure_valid_overlay_dir!(dir)
         if manifest_state(dir) == :corrupt
           # Bozuk manifesti sessizce "heal" etmek (yalnızca yeni kaydı yazmak) diğer
           # kayıtlı overlay'leri tahliye eder; bunun yerine kaydı reddet.
@@ -80,6 +84,7 @@ module Rubik
         end
 
         path = File.join(dir, filename)
+        ensure_contained_path!(path, dir)
         hash = Digest::SHA256.hexdigest(normalize_content(File.binread(path)))
         manifest = load_manifest(dir)
         manifest[filename] = {
@@ -93,6 +98,11 @@ module Rubik
       def verify_integrity(file_path, dir, bootstrap_eligible: false)
         return :trusted if trust_mode?
 
+        unless safe_path_under?(file_path, dir)
+          warn "[SECURITY] Path traversal attempt detected for overlay '#{file_path}'. Skipping."
+          return :rejected
+        end
+
         basename = File.basename(file_path)
         manifest = load_manifest(dir)
         current_content = File.exist?(file_path) ? File.binread(file_path) : ""
@@ -140,6 +150,8 @@ module Rubik
 
         filename = "#{clean_name.gsub(':', '_')}.rb"
         file_path = File.join(target_dir, filename)
+        ensure_contained_path!(file_path, target_dir)
+
         header = <<~RUBY
           # frozen_string_literal: true
           #{COMMAND_SENTINEL} !#{clean_name}
@@ -164,6 +176,7 @@ module Rubik
         target_dir = scope.to_sym == :global ? global_commands_dir : project_commands_dir
         filename = "#{clean_name.gsub(':', '_')}.rb"
         file_path = File.join(target_dir, filename)
+        ensure_contained_path!(file_path, target_dir)
 
         raise "cannot delete '#{filename}': .manifest.json in #{target_dir} is corrupt; delete it and re-record overlays" if manifest_state(target_dir) == :corrupt
 
@@ -190,8 +203,10 @@ module Rubik
 
           file_path = cmd_meta[:path]
           cmd_name = cmd_meta[:name]
+          target_dir = cmd_meta[:scope].to_sym == :global ? global_commands_dir : project_commands_dir
 
           begin
+            ensure_contained_path!(file_path, target_dir)
             code = File.read(file_path)
             eval_command(shell, cmd_name, code, cmd_meta[:scope])
             loaded << cmd_name
@@ -249,6 +264,8 @@ module Rubik
 
         filename = "#{clean_name}.rb"
         file_path = File.join(target_dir, filename)
+        ensure_contained_path!(file_path, target_dir)
+
         schema_json = params_schema ? JSON.dump(params_schema) : "{}"
         header = <<~RUBY
           # frozen_string_literal: true
@@ -278,6 +295,7 @@ module Rubik
         target_dir = scope.to_sym == :global ? global_tools_dir : project_tools_dir
         filename = "#{clean_name}.rb"
         file_path = File.join(target_dir, filename)
+        ensure_contained_path!(file_path, target_dir)
 
         raise "cannot delete '#{filename}': .manifest.json in #{target_dir} is corrupt; delete it and re-record overlays" if manifest_state(target_dir) == :corrupt
 
@@ -301,6 +319,10 @@ module Rubik
         list_tools.each do |t_meta|
           next if t_meta[:integrity] == :rejected
 
+          file_path = t_meta[:path]
+          target_dir = t_meta[:scope].to_sym == :global ? global_tools_dir : project_tools_dir
+          ensure_contained_path!(file_path, target_dir)
+
           code = File.read(t_meta[:path])
           tool_inst = eval_tool(t_meta[:name], code, t_meta[:scope])
           if tool_inst
@@ -357,6 +379,41 @@ module Rubik
 
       private
 
+      def ensure_valid_overlay_dir!(dir)
+        allowed = [
+          [project_commands_dir, @root_dir],
+          [global_commands_dir, @home_dir],
+          [project_tools_dir, @root_dir],
+          [global_tools_dir, @home_dir]
+        ]
+        valid = allowed.any? do |allowed_dir, trusted_root|
+          Platform.path_equal?(dir, allowed_dir) && Platform.resolved_path_under?(dir, trusted_root)
+        end
+        return if valid
+
+        raise ArgumentError, "Invalid overlay directory: #{dir}"
+      end
+
+      def ensure_contained_path!(path, parent_dir)
+        raise ArgumentError, "Path traversal attempt detected: #{path}" unless safe_path_under?(path, parent_dir)
+      end
+
+      def safe_path_under?(path, parent_dir)
+        return false if path.nil? || parent_dir.nil?
+
+        ensure_valid_overlay_dir!(parent_dir)
+
+        # Lexical containment check first
+        return false unless Platform.path_under?(path, parent_dir)
+
+        # If path exists or parent exists, also check resolved path containment
+        return Platform.resolved_path_under?(path, parent_dir) if File.exist?(path) || File.exist?(parent_dir)
+
+        true
+      rescue StandardError
+        false
+      end
+
       # Bootstrap kabul taramasında kullanılacak guard: kwarg'la geçilen örnek
       # (üretimde service catalog'un tek operatör-policy guard'ı) ya da lazy
       # default. Lazy çözüm bilinçli: overlay_storage.rb standalone require

data/lib/rubik/sandbox/driver/docker.rb

@@ -14,7 +14,7 @@ module Rubik
         DEFAULT_IMAGE = "rubik-sandbox:latest"
 
         def available?
-          !Rubik::Platform.which("docker").nil? && system("docker ps > #{Rubik::Platform.dev_null} 2>&1")
+          !Rubik::Platform.which("docker").nil? && system("docker", "ps", out: File::NULL, err: File::NULL)
         end
 
         def run(cmd, timeout: 15, chdir: Dir.pwd, allow_network: false, memory_limit_mb: 512, cpus: "1.0")
@@ -48,7 +48,7 @@ module Rubik
               error_message: "Docker sandbox error"
             )
           ensure
-            system("docker rm -f #{container_name} > #{Rubik::Platform.dev_null} 2>&1")
+            system("docker", "rm", "-f", container_name, out: File::NULL, err: File::NULL)
           end
 
           {

data/lib/rubik/session/replayer.rb

@@ -18,9 +18,8 @@ module Rubik
       def replay_file(session_file_path)
         return false unless File.exist?(session_file_path)
 
-        lines = File.readlines(session_file_path)
         @shell&.instance_variable_set(:@replaying, true)
-        lines.each do |line|
+        File.foreach(session_file_path) do |line|
           next if line.strip.empty?
 
           event = begin

data/lib/rubik/storage/store.rb

@@ -499,10 +499,11 @@ module Rubik
         # (elle düzenleme: "42", ["x"]) tüm tipi zehirlemesin.
         skipped = 0
         records = File.foreach(path, encoding: "UTF-8").filter_map do |line|
-          next if line.strip.empty?
+          line.strip!
+          next if line.empty?
 
           parsed = begin
-            JSON.parse(line.scrub)
+            JSON.parse(line.valid_encoding? ? line : line.scrub)
           rescue JSON::ParserError
             nil
           end

data/lib/rubik/tools/builtins/subagent.rb

@@ -251,10 +251,15 @@ module Rubik
           return ToolOutput.error("Missing required parameter 'conversation_id' for action 'extend_budget'.") if id.empty?
 
           steps = Rubik::Orchestrator::Subagent::Budget.normalize_grant(args["steps"] || args[:steps])
+          inst = sup.get(id)
           if sup.extend_budget(id, steps)
-            "Step budget for subagent '#{id}' successfully extended by #{steps} steps (total budget: #{sup.get(id).max_steps}, state: #{sup.get(id).state.to_s.upcase})."
+            ceiling = inst.respond_to?(:max_total_steps) ? "/#{inst.max_total_steps}" : ""
+            "Step budget for subagent '#{id}' successfully extended by #{steps} steps (total budget: #{inst.max_steps}#{ceiling}, " \
+              "state: #{inst.state.to_s.upcase})."
+          elsif inst.respond_to?(:max_total_steps) && inst.max_steps >= inst.max_total_steps
+            ToolOutput.error("Subagent '#{id}' reached its lifetime step limit (#{inst.max_total_steps}); no more steps can be granted.")
           else
-            ToolOutput.error("Subagent '#{id}' not found or cannot extend budget (current state: #{sup.get(id)&.state || 'not found'}).")
+            ToolOutput.error("Subagent '#{id}' not found or cannot extend budget (current state: #{inst&.state || 'not found'}).")
           end
         when "resume"
           id = resolve_id(args)