@principles/pd-cli 1.134.0 → 1.135.1

package/dist/services/console-launcher.js

@@ -161,18 +161,60 @@ export async function findAvailablePort(host, preferred, limit = PORT_FALLBACK_L
     return null;
 }
 // ─── Browser opener (best-effort, no throw) ──────────────────────────────────
+/**
+ * Validate a browser URL before it is handed to a system opener.
+ * Only http/https targets are allowed — other schemes (file:, javascript:,
+ * custom protocols) could be abused. This is the primary defense for the
+ * win32 opener path, which no longer routes through a shell.
+ */
+function assertSafeBrowserUrl(rawUrl) {
+    if (!rawUrl || rawUrl.trim().length === 0) {
+        throw new Error('browser URL is empty');
+    }
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        throw new Error(`invalid browser URL: "${rawUrl}"`);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new Error(`invalid browser URL: protocol must be http(s), got "${url.protocol}"`);
+    }
+    return url.toString();
+}
 /**
  * Open the system browser. Best-effort — failures are reported but do not
  * crash the launcher.
+ *
+ * Security: the URL is validated (http/https only) and every opener is
+ * invoked with a parameterized `spawn` (no shell). In particular the win32
+ * path uses `explorer.exe` with an argument array instead of the previous
+ * `cmd.exe /c start "" <url>` form, which ran the URL through the cmd shell
+ * and allowed shell metacharacters in the URL to be interpreted as commands
+ * (command injection).
  */
-export async function openBrowser(url) {
+export async function openBrowser(rawUrl) {
     const { spawn } = await import('child_process');
     const { platform } = process;
+    let url;
+    try {
+        url = assertSafeBrowserUrl(rawUrl);
+    }
+    catch (err) {
+        return {
+            opened: false,
+            reason: err instanceof Error ? err.message : String(err),
+            nextAction: 'Use an http:// or https:// URL.',
+        };
+    }
     let cmd;
     let args;
     if (platform === 'win32') {
-        cmd = process.env.ComSpec || 'cmd.exe';
-        args = ['/c', 'start', '""', url];
+        // Parameterized spawn (no shell): explorer.exe receives the validated
+        // URL as a plain argument and opens it in the default browser.
+        cmd = 'explorer.exe';
+        args = [url];
     }
     else if (platform === 'darwin') {
         cmd = 'open';

package/dist/services/console-launcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"console-launcher.js","sourceRoot":"","sources":["../../src/services/console-launcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAC3B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAgC7B,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,YAAY,GAAG,WAAW,CAAC;AACjC,MAAM,mBAAmB,GAAG,EAAE,CAAC,CAAC,kCAAkC;AAElE,+EAA+E;AAE/E,+DAA+D;AAC/D,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC;IAClK,oDAAoD;IACpD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY;IACxD,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,gBAAgB,IAAI,EAAE,CAAC;IAClD,OAAO,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,gFAAgF;AAEhF,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,SAAS,GAAG,GAAG;IAC3E,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,mBAAmB,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,mBAAmB,CAInC,CAAC;QACtB,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE;YAC9B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,CAAC;gBAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YAChD,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAwC,EAAE,EAAE;YAChE,qEAAqE;YACrE,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC7F,IAAI,CAAC,KAAK,CAAC,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,KAAK,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAUD,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAwB;IAC/D,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAErD,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,0BAA0B,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,0BAA0B,CAEZ,CAAC;QACpD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;QAC5C,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CACtB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAC/E,CAAC,GAAG,EAAE,EAAE;YACN,oEAAoE;YACpE,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC3B,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8EAA8E,EAAE,CAAC,CAAC;gBACpH,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC3B,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,GAAG,CAAC,UAAU,IAAI,WAAW,EAAE,EAAE,CAAC,CAAC;gBAChH,OAAO;YACT,CAAC;YACD,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,KAAK,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;oBACzC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;wBACrC,MAAM,SAAS,GACb,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,IAAI,CAAC;4BACzE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC;wBAC5E,IAAI,SAAS,EAAE,CAAC;4BACd,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;wBAC7B,CAAC;6BAAM,CAAC;4BACN,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yDAAyD,EAAE,CAAC,CAAC;wBACjG,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC,CAAC;oBAC1F,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClI,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YAC7B,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,SAAiB,EACjB,KAAK,GAAG,mBAAmB;IAE3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC;QAChC,IAAI,SAAS,GAAG,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM;QACR,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAChD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAE7B,IAAI,GAAW,CAAC;IAChB,IAAI,IAAc,CAAC;IAEnB,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;QACvC,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;SAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,GAAG,GAAG,MAAM,CAAC;QACb,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;SAAM,CAAC;QACN,GAAG,GAAG,UAAU,CAAC;QACjB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YAEpE,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,KAAgD,CAAC;YACrD,MAAM,IAAI,GAAG,CAAC,MAAiE,EAAE,EAAE;gBACjF,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,KAAK;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC/B,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC;YAEF,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACzB,CAAC,EAAE,IAAI,CAAC,CAAC;YAET,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,IAAI,CAAC;oBACH,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,oCAAoC,GAAG,CAAC,OAAO,EAAE;oBACzD,UAAU,EAAE,2BAA2B,GAAG,+CAA+C;iBAC1F,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACf,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC;wBACH,MAAM,EAAE,KAAK;wBACb,MAAM,EAAE,oCAAoC,IAAI,EAAE;wBAClD,UAAU,EAAE,0BAA0B,GAAG,EAAE;qBAC5C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC;gBACN,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACxD,UAAU,EAAE,6DAA6D;aAC1E,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAiCD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAwB;IAC9D,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,yBAAyB,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,yBAAyB,CAE9B,CAAC;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACxB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,YAAY,CAAC;IAC3C,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,YAAY,CAAC;IAE1D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,GAAG,EAAE,EAAE;YACP,IAAI,EAAE,aAAa;YACnB,IAAI;YACJ,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,+BAA+B,IAAI,sDAAsD;YACjG,UAAU,EAAE,gFAAgF;SAC7F,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC;YACzC,IAAI,EAAE,aAAa;YACnB,IAAI;YACJ,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,MAAM,cAAc,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAE9D,IAAI,cAAc,EAAE,CAAC;QACnB,iDAAiD;QACjD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,CAAC,EAAE,mBAAmB,GAAG,CAAC,CAAC,CAAC;QAC3F,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,GAAG,EAAE,EAAE;gBACP,IAAI,EAAE,aAAa;gBACnB,IAAI;gBACJ,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,wBAAwB,aAAa,GAAG,CAAC,KAAK,aAAa,GAAG,mBAAmB,EAAE;gBAC3F,UAAU,EAAE,iCAAiC,aAAa,0EAA0E;aACrI,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,GAAG,EAAE,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC;YACpC,IAAI,EAAE,QAAQ;YACd,IAAI;YACJ,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,kBAAkB,aAAa,oBAAoB,QAAQ,UAAU;SAC9E,CAAC;IACJ,CAAC;IAED,uCAAuC;IACvC,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,GAAG,EAAE,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC;QACzC,IAAI,EAAE,aAAa;QACnB,IAAI;QACJ,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC"}
+{"version":3,"file":"console-launcher.js","sourceRoot":"","sources":["../../src/services/console-launcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAC3B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAsC7B,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,YAAY,GAAG,WAAW,CAAC;AACjC,MAAM,mBAAmB,GAAG,EAAE,CAAC,CAAC,kCAAkC;AAElE,+EAA+E;AAE/E,+DAA+D;AAC/D,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC;IAClK,oDAAoD;IACpD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY;IACxD,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,gBAAgB,IAAI,EAAE,CAAC;IAClD,OAAO,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,gFAAgF;AAEhF,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,SAAS,GAAG,GAAG;IAC3E,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,mBAAmB,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,mBAAmB,CAInC,CAAC;QACtB,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE;YAC9B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,CAAC;gBAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YAChD,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAwC,EAAE,EAAE;YAChE,qEAAqE;YACrE,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC7F,IAAI,CAAC,KAAK,CAAC,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,KAAK,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAUD,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAwB;IAC/D,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAErD,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,0BAA0B,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,0BAA0B,CAEZ,CAAC;QACpD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;QAC5C,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CACtB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAC/E,CAAC,GAAG,EAAE,EAAE;YACN,oEAAoE;YACpE,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC3B,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8EAA8E,EAAE,CAAC,CAAC;gBACpH,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC3B,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,GAAG,CAAC,UAAU,IAAI,WAAW,EAAE,EAAE,CAAC,CAAC;gBAChH,OAAO;YACT,CAAC;YACD,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,KAAK,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;oBACzC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;wBACrC,MAAM,SAAS,GACb,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,IAAI,CAAC;4BACzE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC;wBAC5E,IAAI,SAAS,EAAE,CAAC;4BACd,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;wBAC7B,CAAC;6BAAM,CAAC;4BACN,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yDAAyD,EAAE,CAAC,CAAC;wBACjG,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC,CAAC;oBAC1F,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClI,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YAC7B,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,SAAiB,EACjB,KAAK,GAAG,mBAAmB;IAE3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC;QAChC,IAAI,SAAS,GAAG,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM;QACR,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAEhF;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,MAAc;IAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,uDAAuD,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc;IAC9C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAChD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAE7B,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACxD,UAAU,EAAE,iCAAiC;SAC9C,CAAC;IACJ,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,IAAc,CAAC;IAEnB,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,sEAAsE;QACtE,+DAA+D;QAC/D,GAAG,GAAG,cAAc,CAAC;QACrB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;SAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,GAAG,GAAG,MAAM,CAAC;QACb,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;SAAM,CAAC;QACN,GAAG,GAAG,UAAU,CAAC;QACjB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YAEpE,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,KAAgD,CAAC;YACrD,MAAM,IAAI,GAAG,CAAC,MAAiE,EAAE,EAAE;gBACjF,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,KAAK;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC/B,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC;YAEF,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACzB,CAAC,EAAE,IAAI,CAAC,CAAC;YAET,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,IAAI,CAAC;oBACH,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,oCAAoC,GAAG,CAAC,OAAO,EAAE;oBACzD,UAAU,EAAE,2BAA2B,GAAG,+CAA+C;iBAC1F,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACf,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC;wBACH,MAAM,EAAE,KAAK;wBACb,MAAM,EAAE,oCAAoC,IAAI,EAAE;wBAClD,UAAU,EAAE,0BAA0B,GAAG,EAAE;qBAC5C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC;gBACN,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACxD,UAAU,EAAE,6DAA6D;aAC1E,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAiCD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAwB;IAC9D,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,yBAAyB,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,yBAAyB,CAE9B,CAAC;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACxB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,YAAY,CAAC;IAC3C,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,YAAY,CAAC;IAE1D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,GAAG,EAAE,EAAE;YACP,IAAI,EAAE,aAAa;YACnB,IAAI;YACJ,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,+BAA+B,IAAI,sDAAsD;YACjG,UAAU,EAAE,gFAAgF;SAC7F,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC;YACzC,IAAI,EAAE,aAAa;YACnB,IAAI;YACJ,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,MAAM,cAAc,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAE9D,IAAI,cAAc,EAAE,CAAC;QACnB,iDAAiD;QACjD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,CAAC,EAAE,mBAAmB,GAAG,CAAC,CAAC,CAAC;QAC3F,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,GAAG,EAAE,EAAE;gBACP,IAAI,EAAE,aAAa;gBACnB,IAAI;gBACJ,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,wBAAwB,aAAa,GAAG,CAAC,KAAK,aAAa,GAAG,mBAAmB,EAAE;gBAC3F,UAAU,EAAE,iCAAiC,aAAa,0EAA0E;aACrI,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,GAAG,EAAE,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC;YACpC,IAAI,EAAE,QAAQ;YACd,IAAI;YACJ,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,kBAAkB,aAAa,oBAAoB,QAAQ,UAAU;SAC9E,CAAC;IACJ,CAAC;IAED,uCAAuC;IACvC,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,GAAG,EAAE,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC;QACzC,IAAI,EAAE,aAAa;QACnB,IAAI;QACJ,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC"}

package/dist/services/pd-config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pd-config-loader.d.ts","sourceRoot":"","sources":["../../src/services/pd-config-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH,OAAO,KAAK,EACV,iBAAiB,EAEjB,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,6BAA6B,CAAC;AAIrC,eAAO,MAAM,aAAa,QAAQ,CAAC;AACnC,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAIhD,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,aAAa,GAAG,WAAW,CAAC;AAEpE,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,IAAI,CAAC;IACT,SAAS,EAAE,iBAAiB,CAAC;IAC7B,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,oCAAoC;IACpC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,+EAA+E;IAC/E,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/D,4CAA4C;IAC5C,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,sCAAsC;IACtC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,+EAA+E;IAC/E,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,GAAG,qBAAqB,CAAC;AAI9E,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE5D;AA2BD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,CAoGrE;AAID;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,GAAG,kBAAkB,CAGzF;AAID;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,GAAG,uBAAuB,CAGpF;AAID,+DAA+D;AAC/D,MAAM,WAAW,wBAAwB;IACvC,4CAA4C;IAC5C,gBAAgB,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,MAAM,EAAE,SAAS,GAAG,kBAAkB,GAAG,wBAAwB,CAAC;CACnE;AA4ED;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAAI,wBAAwB,GAAG,IAAI,CAkC1E"}
+{"version":3,"file":"pd-config-loader.d.ts","sourceRoot":"","sources":["../../src/services/pd-config-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAaH,OAAO,KAAK,EACV,iBAAiB,EAEjB,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,6BAA6B,CAAC;AAIrC,eAAO,MAAM,aAAa,QAAQ,CAAC;AACnC,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAIhD,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,aAAa,GAAG,WAAW,CAAC;AAEpE,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,IAAI,CAAC;IACT,SAAS,EAAE,iBAAiB,CAAC;IAC7B,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,oCAAoC;IACpC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,+EAA+E;IAC/E,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/D,4CAA4C;IAC5C,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,sCAAsC;IACtC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,+EAA+E;IAC/E,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,GAAG,qBAAqB,CAAC;AAI9E,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE5D;AA2BD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,CAoGrE;AAID;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,GAAG,kBAAkB,CAGzF;AAID;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,GAAG,uBAAuB,CAGpF;AAID,+DAA+D;AAC/D,MAAM,WAAW,wBAAwB;IACvC,4CAA4C;IAC5C,gBAAgB,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,MAAM,EAAE,SAAS,GAAG,kBAAkB,GAAG,wBAAwB,CAAC;CACnE;AAsGD;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAAI,wBAAwB,GAAG,IAAI,CAyC1E"}

package/dist/services/pd-config-loader.js

@@ -14,6 +14,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
 import * as yaml from 'js-yaml';
+import { canonicalPath, isPathInside } from '../utils/path-security.js';
 import { validatePdConfig, computeEffectivePdConfig, computeFeatureFlagsFromConfig, redactPdConfig, } from '@principles/core/runtime-v2';
 // ── Constants ────────────────────────────────────────────────────────────────
 export const PD_CONFIG_DIR = '.pd';
@@ -230,6 +231,31 @@ function loadOpenClawPluginConfig() {
     }
     return null;
 }
+/**
+ * Validate a candidate config directory before it is joined into a config
+ * path for filesystem reads. Candidate dirs are operator-supplied
+ * (PD_WORKSPACE_DIR / plugin config / home default), so we normalize with
+ * `path.normalize` (pure string, no filesystem access), then reject empty,
+ * parent-traversal, or root paths. This keeps the subsequent
+ * `path.join(dir, PD_CONFIG_DIR, ...)` inside the intended directory
+ * boundary (CWE-22 mitigation).
+ *
+ * Platform note: no `path.isAbsolute` check — absolute-ness is
+ * platform-dependent (a Windows-style path is not absolute on POSIX
+ * runners) and relative dirs resolve inside cwd without traversal risk.
+ */
+function assertConfigDirBoundary(dir, source) {
+    if (!dir || dir.trim().length === 0) {
+        throw new Error(`Invalid config search dir (${source}): path is empty`);
+    }
+    const normalized = path.normalize(dir);
+    if (normalized.split(/[\\/]/).includes('..')) {
+        throw new Error(`Invalid config search dir (${source}): "${dir}" contains parent traversal`);
+    }
+    if (normalized === path.parse(normalized).root) {
+        throw new Error(`Invalid config search dir (${source}): "${dir}" resolves to filesystem root`);
+    }
+}
 /**
  * Search known locations for a .pd/config.yaml that contains a workspace.default field.
  * This runs BEFORE workspace resolution and does NOT require knowing the workspace dir.
@@ -256,7 +282,14 @@ export function discoverWorkspaceDefault() {
     }
     // Search each candidate for .pd/config.yaml with workspace.default
     for (const { dir, source } of candidates) {
-        const configPath = path.join(dir, PD_CONFIG_DIR, PD_CONFIG_FILENAME);
+        assertConfigDirBoundary(dir, source);
+        // CWE-22: resolve the candidate root once, then verify the joined config
+        // path stays inside that root before any filesystem access.
+        const candidateRoot = canonicalPath(dir);
+        const configPath = path.resolve(candidateRoot, PD_CONFIG_DIR, PD_CONFIG_FILENAME);
+        if (!isPathInside(candidateRoot, configPath)) {
+            throw new Error(`Invalid config search dir (${source}): "${dir}" escapes its boundary`);
+        }
         if (fs.existsSync(configPath)) {
             const workspaceDefault = extractWorkspaceDefault(configPath);
             if (workspaceDefault) {

package/dist/services/pd-config-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"pd-config-loader.js","sourceRoot":"","sources":["../../src/services/pd-config-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,SAAS,CAAC;AAChC,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,6BAA6B,EAC7B,cAAc,GACf,MAAM,6BAA6B,CAAC;AAQrC,gFAAgF;AAEhF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AACnC,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAmChD,gFAAgF;AAEhF,MAAM,UAAU,eAAe,CAAC,YAAoB;IAClD,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;AACpE,CAAC;AAED,gFAAgF;AAEhF,SAAS,iBAAiB,CAAC,YAAoB;IAC7C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG;QAClB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,oBAAoB,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC;KACpD,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0EAA0E;AAC1E,SAAS,0BAA0B,CAAC,WAAqB;IACvD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACzB,OAAO,WAAW,CAAC,2BAA2B,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,YAAoB;IAC/C,MAAM,UAAU,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC5D,MAAM,qBAAqB,GAAG,0BAA0B,CAAC,mBAAmB,CAAC,CAAC;IAE9E,wCAAwC;IACxC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,SAAS;YACT,MAAM,EAAE,UAAU;YAClB,UAAU;YACV,QAAQ,EAAE;gBACR,GAAG,SAAS,CAAC,QAAQ;gBACrB,GAAG,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC;oBAChC,CAAC,CAAC,CAAC,iCAAiC,mBAAmB,CAAC,MAAM,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC;oBACnI,CAAC,CAAC,EAAE,CAAC;aACR;YACD,mBAAmB;YACnB,qBAAqB;SACtB,CAAC;IACJ,CAAC;IAED,mBAAmB;IACnB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW;YACnB,UAAU;YACV,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,mCAAmC,OAAO,EAAE,EAAE,UAAU,EAAE,4CAA4C,EAAE,CAAC;YACtI,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,SAAS;YACnB,mBAAmB;YACnB,qBAAqB;SACtB,CAAC;IACJ,CAAC;IAED,6CAA6C;IAC7C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW;YACnB,UAAU;YACV,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,wCAAwC,OAAO,EAAE,EAAE,UAAU,EAAE,oCAAoC,EAAE,CAAC;YACnI,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,SAAS;YACnB,mBAAmB;YACnB,qBAAqB;SACtB,CAAC;IACJ,CAAC;IAED,4DAA4D;IAC5D,MAAM,gBAAgB,GAA6B,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAE5E,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW;YACnB,UAAU;YACV,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxC,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC;YACH,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,SAAS;YACnB,mBAAmB;YACnB,qBAAqB;SACtB,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B,MAAM,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAEnE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS;QACT,MAAM,EAAE,aAAa;QACrB,UAAU;QACV,QAAQ,EAAE;YACR,GAAG,SAAS,CAAC,QAAQ;YACrB,GAAG,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC;gBAChC,CAAC,CAAC,CAAC,iCAAiC,mBAAmB,CAAC,MAAM,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC;gBACnI,CAAC,CAAC,EAAE,CAAC;SACR;QACD,mBAAmB;QACnB,qBAAqB;KACtB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAA0B;IACnE,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IACjE,OAAO,6BAA6B,CAAC,SAAS,CAAC,CAAC;AAClD,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA0B;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IACjE,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAcD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACrG,CAAC;AAED,sDAAsD;AACtD,SAAS,cAAc,CAAC,CAAS;IAC/B,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,UAAkB;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,MAAM,GAAY,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACrE,IACE,QAAQ,CAAC,MAAM,CAAC;YAChB,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YAC1B,OAAO,MAAM,CAAC,SAAS,CAAC,OAAO,KAAK,QAAQ;YAC5C,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACnC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EACxC,CAAC;YACD,OAAO,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+DAA+D;QAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4DAA4D,UAAU,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAChI,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB;IAC/B,MAAM,eAAe,GAAG;QACtB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,0BAA0B,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,0BAA0B,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,0BAA0B,CAAC;KACnE,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC7C,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5C,+DAA+D;gBAC/D,IACE,MAAM,KAAK,IAAI;oBACf,OAAO,MAAM,KAAK,QAAQ;oBAC1B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBACtB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC;oBAClC,OAAQ,MAAkC,CAAC,SAAS,KAAK,QAAQ;oBAC/D,MAAkC,CAAC,SAAoB,CAAC,MAAM,GAAG,CAAC,EACpE,CAAC;oBACD,OAAO,EAAE,SAAS,EAAG,MAAkC,CAAC,SAAmB,EAAE,CAAC;gBAChF,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,6EAA6E;gBAC7E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yDAAyD,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACtH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,UAAU,GAAyF,EAAE,CAAC;IAE5G,mDAAmD;IACnD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,YAAY,EAAE,CAAC;QACjB,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,gCAAgC;IAChC,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7B,UAAU,CAAC,IAAI,CAAC;QACd,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC;QACjD,MAAM,EAAE,kBAAkB;KAC3B,CAAC,CAAC;IAEH,gFAAgF;IAChF,MAAM,YAAY,GAAG,wBAAwB,EAAE,CAAC;IAChD,IAAI,YAAY,EAAE,SAAS,EAAE,CAAC;QAC5B,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,mEAAmE;IACnE,KAAK,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;QACrE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;YAC7D,IAAI,gBAAgB,EAAE,CAAC;gBACrB,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"pd-config-loader.js","sourceRoot":"","sources":["../../src/services/pd-config-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,6BAA6B,EAC7B,cAAc,GACf,MAAM,6BAA6B,CAAC;AAQrC,gFAAgF;AAEhF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AACnC,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAmChD,gFAAgF;AAEhF,MAAM,UAAU,eAAe,CAAC,YAAoB;IAClD,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;AACpE,CAAC;AAED,gFAAgF;AAEhF,SAAS,iBAAiB,CAAC,YAAoB;IAC7C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG;QAClB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,oBAAoB,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC;KACpD,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0EAA0E;AAC1E,SAAS,0BAA0B,CAAC,WAAqB;IACvD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACzB,OAAO,WAAW,CAAC,2BAA2B,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,YAAoB;IAC/C,MAAM,UAAU,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC5D,MAAM,qBAAqB,GAAG,0BAA0B,CAAC,mBAAmB,CAAC,CAAC;IAE9E,wCAAwC;IACxC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,SAAS;YACT,MAAM,EAAE,UAAU;YAClB,UAAU;YACV,QAAQ,EAAE;gBACR,GAAG,SAAS,CAAC,QAAQ;gBACrB,GAAG,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC;oBAChC,CAAC,CAAC,CAAC,iCAAiC,mBAAmB,CAAC,MAAM,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC;oBACnI,CAAC,CAAC,EAAE,CAAC;aACR;YACD,mBAAmB;YACnB,qBAAqB;SACtB,CAAC;IACJ,CAAC;IAED,mBAAmB;IACnB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW;YACnB,UAAU;YACV,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,mCAAmC,OAAO,EAAE,EAAE,UAAU,EAAE,4CAA4C,EAAE,CAAC;YACtI,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,SAAS;YACnB,mBAAmB;YACnB,qBAAqB;SACtB,CAAC;IACJ,CAAC;IAED,6CAA6C;IAC7C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW;YACnB,UAAU;YACV,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,wCAAwC,OAAO,EAAE,EAAE,UAAU,EAAE,oCAAoC,EAAE,CAAC;YACnI,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,SAAS;YACnB,mBAAmB;YACnB,qBAAqB;SACtB,CAAC;IACJ,CAAC;IAED,4DAA4D;IAC5D,MAAM,gBAAgB,GAA6B,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAE5E,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW;YACnB,UAAU;YACV,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxC,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC;YACH,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,SAAS;YACnB,mBAAmB;YACnB,qBAAqB;SACtB,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B,MAAM,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAEnE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS;QACT,MAAM,EAAE,aAAa;QACrB,UAAU;QACV,QAAQ,EAAE;YACR,GAAG,SAAS,CAAC,QAAQ;YACrB,GAAG,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC;gBAChC,CAAC,CAAC,CAAC,iCAAiC,mBAAmB,CAAC,MAAM,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC;gBACnI,CAAC,CAAC,EAAE,CAAC;SACR;QACD,mBAAmB;QACnB,qBAAqB;KACtB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAA0B;IACnE,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IACjE,OAAO,6BAA6B,CAAC,SAAS,CAAC,CAAC;AAClD,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA0B;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IACjE,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAcD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACrG,CAAC;AAED,sDAAsD;AACtD,SAAS,cAAc,CAAC,CAAS;IAC/B,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,UAAkB;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,MAAM,GAAY,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACrE,IACE,QAAQ,CAAC,MAAM,CAAC;YAChB,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YAC1B,OAAO,MAAM,CAAC,SAAS,CAAC,OAAO,KAAK,QAAQ;YAC5C,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACnC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EACxC,CAAC;YACD,OAAO,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+DAA+D;QAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4DAA4D,UAAU,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAChI,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB;IAC/B,MAAM,eAAe,GAAG;QACtB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,0BAA0B,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,0BAA0B,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,0BAA0B,CAAC;KACnE,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC7C,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5C,+DAA+D;gBAC/D,IACE,MAAM,KAAK,IAAI;oBACf,OAAO,MAAM,KAAK,QAAQ;oBAC1B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBACtB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC;oBAClC,OAAQ,MAAkC,CAAC,SAAS,KAAK,QAAQ;oBAC/D,MAAkC,CAAC,SAAoB,CAAC,MAAM,GAAG,CAAC,EACpE,CAAC;oBACD,OAAO,EAAE,SAAS,EAAG,MAAkC,CAAC,SAAmB,EAAE,CAAC;gBAChF,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,6EAA6E;gBAC7E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yDAAyD,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACtH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,uBAAuB,CAAC,GAAW,EAAE,MAAc;IAC1D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,kBAAkB,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,OAAO,GAAG,6BAA6B,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,UAAU,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,OAAO,GAAG,+BAA+B,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,UAAU,GAAyF,EAAE,CAAC;IAE5G,mDAAmD;IACnD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,YAAY,EAAE,CAAC;QACjB,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,gCAAgC;IAChC,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7B,UAAU,CAAC,IAAI,CAAC;QACd,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC;QACjD,MAAM,EAAE,kBAAkB;KAC3B,CAAC,CAAC;IAEH,gFAAgF;IAChF,MAAM,YAAY,GAAG,wBAAwB,EAAE,CAAC;IAChD,IAAI,YAAY,EAAE,SAAS,EAAE,CAAC;QAC5B,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,mEAAmE;IACnE,KAAK,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QACzC,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACrC,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,aAAa,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;QAClF,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,UAAU,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,OAAO,GAAG,wBAAwB,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;YAC7D,IAAI,gBAAgB,EAAE,CAAC;gBACrB,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/services/quality-scorecard/strong-model-gate.d.ts

@@ -5,6 +5,25 @@
  * to parse responses — no unsafe casts.
  */
 import type { PainEpisode, LocalEvaluation, StrongModelAdjudication, AdjudicationStatus } from '@principles/core/quality-scorecard';
+/**
+ * CWE-918 (SSRF) mitigation for operator-supplied LLM API base URLs.
+ *
+ * Threat model: OPENAI_BASE_URL is explicitly configured by the Owner /
+ * operator in the environment or Runtime Profile — it is trusted operator
+ * configuration, NOT untrusted remote input. Local and private-network
+ * OpenAI-compatible endpoints (llama.cpp, LM Studio, local gateways,
+ * intranet model servers) are legitimate PD runtime targets and must keep
+ * working.
+ *
+ * What stays blocked:
+ * - non-http(s) schemes (file:, javascript:, data:, ...)
+ * - malformed / unparseable URLs
+ * - credentials embedded in the URL (secrets leak into logs/errors)
+ *
+ * Callers must not allow the host to be rewritten from untrusted input
+ * after this validation; the endpoint is derived from this URL only.
+ */
+export declare function assertSafeLlmBaseUrl(rawBaseUrl: string): URL;
 export declare function adjudicate(episode: PainEpisode, localEval: LocalEvaluation, config: {
     modelId: string;
     log: (msg: string) => void;

package/dist/services/quality-scorecard/strong-model-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"strong-model-gate.d.ts","sourceRoot":"","sources":["../../../src/services/quality-scorecard/strong-model-gate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,oCAAoC,CAAC;AAkD5C,wBAAsB,UAAU,CAC9B,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACtD,OAAO,CAAC,uBAAuB,CAAC,CAsElC;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,uBAAuB,CAS3E;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,eAAe,EAC1B,YAAY,EAAE,uBAAuB,GAAG,IAAI,GAC3C,kBAAkB,CAOpB"}
+{"version":3,"file":"strong-model-gate.d.ts","sourceRoot":"","sources":["../../../src/services/quality-scorecard/strong-model-gate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,oCAAoC,CAAC;AAkD5C;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAc5D;AAED,wBAAsB,UAAU,CAC9B,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACtD,OAAO,CAAC,uBAAuB,CAAC,CA8ElC;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,uBAAuB,CAS3E;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,eAAe,EAC1B,YAAY,EAAE,uBAAuB,GAAG,IAAI,GAC3C,kBAAkB,CAOpB"}

package/dist/services/quality-scorecard/strong-model-gate.js

@@ -39,10 +39,48 @@ Flags: ${localEval.flags.length > 0 ? localEval.flags.join(', ') : 'none'}
 
 Do NOT output anything other than this JSON object.`;
 }
+/**
+ * CWE-918 (SSRF) mitigation for operator-supplied LLM API base URLs.
+ *
+ * Threat model: OPENAI_BASE_URL is explicitly configured by the Owner /
+ * operator in the environment or Runtime Profile — it is trusted operator
+ * configuration, NOT untrusted remote input. Local and private-network
+ * OpenAI-compatible endpoints (llama.cpp, LM Studio, local gateways,
+ * intranet model servers) are legitimate PD runtime targets and must keep
+ * working.
+ *
+ * What stays blocked:
+ * - non-http(s) schemes (file:, javascript:, data:, ...)
+ * - malformed / unparseable URLs
+ * - credentials embedded in the URL (secrets leak into logs/errors)
+ *
+ * Callers must not allow the host to be rewritten from untrusted input
+ * after this validation; the endpoint is derived from this URL only.
+ */
+export function assertSafeLlmBaseUrl(rawBaseUrl) {
+    let url;
+    try {
+        url = new URL(rawBaseUrl);
+    }
+    catch {
+        throw new Error(`Invalid OPENAI_BASE_URL: "${rawBaseUrl}" is not a valid URL`);
+    }
+    if (url.protocol !== 'https:' && url.protocol !== 'http:') {
+        throw new Error(`Invalid OPENAI_BASE_URL: protocol must be http or https, got "${url.protocol}"`);
+    }
+    if (url.username || url.password) {
+        throw new Error(`Invalid OPENAI_BASE_URL: credentials must not be embedded in the URL`);
+    }
+    return url;
+}
 export async function adjudicate(episode, localEval, config) {
     const { modelId: strongModelId, log } = config;
     const prompt = buildAdjudicationPrompt(episode, localEval);
-    const baseUrl = process.env.OPENAI_BASE_URL || 'https://api.openai.com/v1';
+    // CWE-918 (SSRF): validate the operator-supplied base URL before any
+    // network request — http(s) only, no embedded credentials. Local and
+    // private OpenAI-compatible endpoints remain valid (trusted operator
+    // configuration; llama.cpp / LM Studio / local gateways are supported).
+    const baseUrl = assertSafeLlmBaseUrl(process.env.OPENAI_BASE_URL || 'https://api.openai.com/v1');
     const apiKey = process.env.OPENAI_API_KEY;
     if (!apiKey) {
         return {
@@ -55,7 +93,11 @@ export async function adjudicate(episode, localEval, config) {
         };
     }
     try {
-        const resp = await fetch(`${baseUrl}/chat/completions`, {
+        // Build the endpoint on the validated URL: append the chat completions
+        // path to the base URL's (possibly empty) path component.
+        const endpoint = new URL(baseUrl);
+        endpoint.pathname = endpoint.pathname.replace(/\/+$/, '') + '/chat/completions';
+        const resp = await fetch(endpoint.toString(), {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',

package/dist/services/quality-scorecard/strong-model-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"strong-model-gate.js","sourceRoot":"","sources":["../../../src/services/quality-scorecard/strong-model-gate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,EACL,aAAa,EACb,iBAAiB,IAAI,IAAI,EACzB,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,oCAAoC,CAAC;AAE5C,SAAS,uBAAuB,CAC9B,OAAoB,EACpB,SAA0B;IAE1B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC/B,KAAK,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CACxG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO;;;;;QAKD,OAAO,CAAC,SAAS;YACb,OAAO,CAAC,MAAM;gBACV,OAAO,CAAC,KAAK;cACf,OAAO,CAAC,QAAQ;aACjB,OAAO,CAAC,OAAO;+BACG,OAAO,CAAC,uBAAuB,IAAI,MAAM;uBACjD,OAAO,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM;;yBAEhF,SAAS,CAAC,KAAK;EACtC,WAAW;SACJ,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM;;;;;;;;;;;;;;;oDAerB,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAoB,EACpB,SAA0B,EAC1B,MAAuD;IAEvD,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC/C,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,2BAA2B,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAE1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,kBAAkB,EAAE,cAAc;YAClC,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;YACrB,SAAS,EAAE,+DAA+D;YAC1E,UAAU,EAAE,mDAAmD;SAChE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,mBAAmB,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,aAAa;gBACpB,QAAQ,EAAE;oBACR,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,4EAA4E,EAAE;oBACzG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE;iBAClC;gBACD,WAAW,EAAE,GAAG;gBAChB,UAAU,EAAE,IAAI;aACjB,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAoD,CAAC;QACpF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,SAAS,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;QAEtC,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,kBAAkB,EAAE,OAAO;YAC3B,eAAe,EAAE,MAAM;YACvB,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC;YAC1C,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,GAAG,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;QAClC,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,kBAAkB,EAAE,cAAc;YAClC,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;YACrB,SAAS,EAAE,wBAAwB,GAAG,EAAE;YACxC,UAAU,EAAE,4CAA4C;SACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO;QACL,KAAK,EAAE,MAAM;QACb,kBAAkB,EAAE,SAAS;QAC7B,eAAe,EAAE,IAAI;QACrB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,MAAM;QACjB,UAAU,EAAE,uEAAuE;KACpF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,SAA0B,EAC1B,YAA4C;IAE5C,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACnE,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,UAAU,IAAI,EAAE;YAAE,OAAO,YAAY,CAAC;QACxE,IAAI,SAAS,CAAC,UAAU,IAAI,CAAC;YAAE,OAAO,YAAY,CAAC;QACnD,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,OAAO,YAAY,CAAC,kBAAkB,CAAC;AACzC,CAAC"}
+{"version":3,"file":"strong-model-gate.js","sourceRoot":"","sources":["../../../src/services/quality-scorecard/strong-model-gate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,EACL,aAAa,EACb,iBAAiB,IAAI,IAAI,EACzB,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,oCAAoC,CAAC;AAE5C,SAAS,uBAAuB,CAC9B,OAAoB,EACpB,SAA0B;IAE1B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC/B,KAAK,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CACxG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO;;;;;QAKD,OAAO,CAAC,SAAS;YACb,OAAO,CAAC,MAAM;gBACV,OAAO,CAAC,KAAK;cACf,OAAO,CAAC,QAAQ;aACjB,OAAO,CAAC,OAAO;+BACG,OAAO,CAAC,uBAAuB,IAAI,MAAM;uBACjD,OAAO,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM;;yBAEhF,SAAS,CAAC,KAAK;EACtC,WAAW;SACJ,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM;;;;;;;;;;;;;;;oDAerB,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6BAA6B,UAAU,sBAAsB,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,iEAAiE,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAoB,EACpB,SAA0B,EAC1B,MAAuD;IAEvD,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC/C,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3D,qEAAqE;IACrE,qEAAqE;IACrE,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,2BAA2B,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAE1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,kBAAkB,EAAE,cAAc;YAClC,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;YACrB,SAAS,EAAE,+DAA+D;YAC1E,UAAU,EAAE,mDAAmD;SAChE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,uEAAuE;QACvE,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,mBAAmB,CAAC;QAChF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,aAAa;gBACpB,QAAQ,EAAE;oBACR,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,4EAA4E,EAAE;oBACzG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE;iBAClC;gBACD,WAAW,EAAE,GAAG;gBAChB,UAAU,EAAE,IAAI;aACjB,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAoD,CAAC;QACpF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,SAAS,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;QAEtC,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,kBAAkB,EAAE,OAAO;YAC3B,eAAe,EAAE,MAAM;YACvB,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC;YAC1C,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,GAAG,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;QAClC,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,kBAAkB,EAAE,cAAc;YAClC,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;YACrB,SAAS,EAAE,wBAAwB,GAAG,EAAE;YACxC,UAAU,EAAE,4CAA4C;SACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO;QACL,KAAK,EAAE,MAAM;QACb,kBAAkB,EAAE,SAAS;QAC7B,eAAe,EAAE,IAAI;QACrB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,MAAM;QACjB,UAAU,EAAE,uEAAuE;KACpF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,SAA0B,EAC1B,YAA4C;IAE5C,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACnE,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,UAAU,IAAI,EAAE;YAAE,OAAO,YAAY,CAAC;QACxE,IAAI,SAAS,CAAC,UAAU,IAAI,CAAC;YAAE,OAAO,YAAY,CAAC;QACnD,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,OAAO,YAAY,CAAC,kBAAkB,CAAC;AACzC,CAAC"}

package/dist/utils/path-security.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Path containment primitives (CWE-22 boundary guards).
+ *
+ * Single source of truth for "is this filesystem target inside that root?"
+ * across pd-cli security boundaries. All containment decisions compare
+ * CANONICAL (fully resolved) paths via `path.relative`, never by string
+ * prefix — a string `startsWith` on a possibly-relative root is wrong on
+ * two counts: (1) a relative root never prefixes an absolute target, and
+ * (2) `/work/foo` is a prefix of `/work/foobar` without being a boundary.
+ *
+ * ── Symlink policy ────────────────────────────────────────────────────────
+ * The guarantee provided here is LEXICAL containment: `path.resolve` +
+ * `path.relative`, without resolving symlinks. We deliberately do NOT
+ * `realpath` the target before containment because:
+ *   1. PD's IO roots are operator-supplied workspace directories; symlinks
+ *      inside the workspace are created by the owner and treated as trusted
+ *      content.
+ *   2. On Windows, junction points (worktree junctions, `node_modules`
+ *      junctions) resolve to a *different physical location* via `realpath`;
+ *      realpath-based containment would reject legitimate local workflows
+ *      (e.g. a worktree whose `node_modules` is junctioned to the main
+ *      checkout).
+ * If a future caller must constrain the physical read target (e.g. reading a
+ * file whose path could be a symlink to an untrusted location), that caller
+ * must realpath the target FIRST and then run containment on the resolved
+ * path — do not weaken this module's contract.
+ */
+/**
+ * Canonicalize a user/operator-supplied path once. Every derived filesystem
+ * target must be compared against this canonical root.
+ */
+export declare function canonicalPath(p: string): string;
+/**
+ * True when `candidate` is strictly inside `parent` (canonical comparison).
+ *
+ * - Both arguments are resolved against cwd first, so relative inputs work.
+ * - `candidate === parent` returns false (strict containment). Callers that
+ *   want to allow the root itself should check equality separately.
+ * - Sibling-prefix attacks (`/work/foobar` vs parent `/work/foo`) cannot
+ *   pass because `path.relative` yields a non-`..`-prefixed path only for
+ *   real descendants.
+ */
+export declare function isPathInside(parent: string, candidate: string): boolean;
+/**
+ * Throw unless `candidate` is strictly inside `parent`. `label` names the
+ * candidate in the error message (e.g. "--workspace").
+ */
+export declare function assertPathInside(parent: string, candidate: string, label: string): void;
+/**
+ * Validate an operator-supplied directory root before it is used as an IO
+ * root: rejects empty values, residual parent-traversal segments, and
+ * filesystem-root results. Returns the canonical root.
+ *
+ * No `path.isAbsolute` requirement: absolute-ness is platform-dependent (a
+ * Windows-style path like `Z:\work` is not absolute on POSIX runners) and
+ * relative paths resolve inside cwd, so they carry no traversal risk. The
+ * guards that matter are: empty, parent traversal, and filesystem root.
+ */
+export declare function assertSafeDirectoryRoot(input: string, label: string): string;
+//# sourceMappingURL=path-security.d.ts.map

package/dist/utils/path-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-security.d.ts","sourceRoot":"","sources":["../../src/utils/path-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAUvE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIvF;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAe5E"}

package/dist/utils/path-security.js

@@ -0,0 +1,90 @@
+/**
+ * Path containment primitives (CWE-22 boundary guards).
+ *
+ * Single source of truth for "is this filesystem target inside that root?"
+ * across pd-cli security boundaries. All containment decisions compare
+ * CANONICAL (fully resolved) paths via `path.relative`, never by string
+ * prefix — a string `startsWith` on a possibly-relative root is wrong on
+ * two counts: (1) a relative root never prefixes an absolute target, and
+ * (2) `/work/foo` is a prefix of `/work/foobar` without being a boundary.
+ *
+ * ── Symlink policy ────────────────────────────────────────────────────────
+ * The guarantee provided here is LEXICAL containment: `path.resolve` +
+ * `path.relative`, without resolving symlinks. We deliberately do NOT
+ * `realpath` the target before containment because:
+ *   1. PD's IO roots are operator-supplied workspace directories; symlinks
+ *      inside the workspace are created by the owner and treated as trusted
+ *      content.
+ *   2. On Windows, junction points (worktree junctions, `node_modules`
+ *      junctions) resolve to a *different physical location* via `realpath`;
+ *      realpath-based containment would reject legitimate local workflows
+ *      (e.g. a worktree whose `node_modules` is junctioned to the main
+ *      checkout).
+ * If a future caller must constrain the physical read target (e.g. reading a
+ * file whose path could be a symlink to an untrusted location), that caller
+ * must realpath the target FIRST and then run containment on the resolved
+ * path — do not weaken this module's contract.
+ */
+import * as path from 'node:path';
+/**
+ * Canonicalize a user/operator-supplied path once. Every derived filesystem
+ * target must be compared against this canonical root.
+ */
+export function canonicalPath(p) {
+    return path.resolve(p);
+}
+/**
+ * True when `candidate` is strictly inside `parent` (canonical comparison).
+ *
+ * - Both arguments are resolved against cwd first, so relative inputs work.
+ * - `candidate === parent` returns false (strict containment). Callers that
+ *   want to allow the root itself should check equality separately.
+ * - Sibling-prefix attacks (`/work/foobar` vs parent `/work/foo`) cannot
+ *   pass because `path.relative` yields a non-`..`-prefixed path only for
+ *   real descendants.
+ */
+export function isPathInside(parent, candidate) {
+    const root = path.resolve(parent);
+    const target = path.resolve(candidate);
+    const rel = path.relative(root, target);
+    return (rel !== '' &&
+        rel !== '..' &&
+        !rel.startsWith(`..${path.sep}`) &&
+        !path.isAbsolute(rel));
+}
+/**
+ * Throw unless `candidate` is strictly inside `parent`. `label` names the
+ * candidate in the error message (e.g. "--workspace").
+ */
+export function assertPathInside(parent, candidate, label) {
+    if (!isPathInside(parent, candidate)) {
+        throw new Error(`Invalid ${label}: "${candidate}" is outside "${parent}"`);
+    }
+}
+/**
+ * Validate an operator-supplied directory root before it is used as an IO
+ * root: rejects empty values, residual parent-traversal segments, and
+ * filesystem-root results. Returns the canonical root.
+ *
+ * No `path.isAbsolute` requirement: absolute-ness is platform-dependent (a
+ * Windows-style path like `Z:\work` is not absolute on POSIX runners) and
+ * relative paths resolve inside cwd, so they carry no traversal risk. The
+ * guards that matter are: empty, parent traversal, and filesystem root.
+ */
+export function assertSafeDirectoryRoot(input, label) {
+    if (!input || input.trim().length === 0) {
+        throw new Error(`Invalid ${label}: path is empty`);
+    }
+    // Un-normalized `..` segments that survive normalize() mean the input
+    // escaped a parent boundary (e.g. "..\\..\\evil") — reject rather than
+    // trust them. Foldable segments ("a/../b") canonicalize safely.
+    if (path.normalize(input).split(/[\\/]/).includes('..')) {
+        throw new Error(`Invalid ${label}: "${input}" contains parent traversal`);
+    }
+    const root = canonicalPath(input);
+    if (root === path.parse(root).root) {
+        throw new Error(`Invalid ${label}: "${input}" resolves to filesystem root`);
+    }
+    return root;
+}
+//# sourceMappingURL=path-security.js.map

package/dist/utils/path-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-security.js","sourceRoot":"","sources":["../../src/utils/path-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,SAAiB;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,CACL,GAAG,KAAK,EAAE;QACV,GAAG,KAAK,IAAI;QACZ,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CACtB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,SAAiB,EAAE,KAAa;IAC/E,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,SAAS,iBAAiB,MAAM,GAAG,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,KAAa;IAClE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,iBAAiB,CAAC,CAAC;IACrD,CAAC;IACD,sEAAsE;IACtE,uEAAuE;IACvE,gEAAgE;IAChE,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,KAAK,6BAA6B,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,KAAK,+BAA+B,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/pd-cli",
-  "version": "1.134.0",
+  "version": "1.135.1",
   "description": "PD CLI — Pain recording, sample management, and evolution tasks",
   "type": "module",
   "bin": {

package/src/commands/console.ts

@@ -585,6 +585,7 @@ export async function handleConsoleOpen(opts: ConsoleOpenOptions = {}): Promise<
       ? 'Browser opened to the Console. Press Ctrl+C to stop.'
       : `Open ${plan.url} in your browser. Press Ctrl+C to stop.`,
   };
+  if (typeof child.pid === 'number') out.serverPid = child.pid;
   if (plan.reason) out.reason = plan.reason;
   if (browserWarning) {
     out.reason = out.reason ? `${out.reason}; browser_open_failed: ${browserWarning}` : `browser_open_failed: ${browserWarning}`;

package/src/commands/legacy-cleanup.ts

@@ -27,6 +27,7 @@ import * as path from 'path';
 import * as os from 'os';
 import type { Database } from 'better-sqlite3';
 import { RuntimeStateManager } from '@principles/core/runtime-v2';
+import { assertSafeDirectoryRoot, isPathInside } from '../utils/path-security.js';
 
 // ── Types ────────────────────────────────────────────────────────────────────
 
@@ -257,9 +258,21 @@ function glob(pattern: string): string[] {
   return results;
 }
 
+/**
+ * Validate a workspace root before cleanup scans derive paths from it.
+ * Returns the canonical root so all derived targets are absolute and
+ * containment checks are canonical-vs-canonical (relative workspaces work).
+ */
+function assertCleanupWorkspaceRoot(workspacePath: string): string {
+  return assertSafeDirectoryRoot(workspacePath, 'workspace path');
+}
+
 function findLegacyTargets(workspacePath: string): CleanupTarget[] {
   const targets: CleanupTarget[] = [];
-  const stateDir = path.join(workspacePath, '.state');
+  // CWE-22: resolve the workspace root once and verify it is a valid,
+  // non-root directory so every derived path stays inside the boundary.
+  const workspaceRoot = assertCleanupWorkspaceRoot(workspacePath);
+  const stateDir = path.join(workspaceRoot, '.state');
   const archiveTimestamp = new Date().toISOString().replace(/[:.]/g, '-');
   const archiveDir = path.join(stateDir, 'legacy-archive', archiveTimestamp);
 
@@ -288,7 +301,11 @@ function findLegacyTargets(workspacePath: string): CleanupTarget[] {
   if (fs.existsSync(sessionsDir)) {
     for (const file of fs.readdirSync(sessionsDir)) {
       if (!file.endsWith('.json')) continue;
-      const filePath = path.join(sessionsDir, file);
+      const filePath = path.resolve(sessionsDir, file);
+      // CWE-22: verify the canonical path stays inside the canonical
+      // sessions dir before any filesystem access (readdir results are
+      // trusted, but defense-in-depth).
+      if (!isPathInside(sessionsDir, filePath)) continue;
       try {
         const content = fs.readFileSync(filePath, 'utf-8');
         const session = JSON.parse(content);

package/src/commands/pain-evidence.ts

@@ -19,6 +19,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { resolveWorkspaceDir } from '../resolve-workspace.js';
+import { assertSafeDirectoryRoot, isPathInside } from '../utils/path-security.js';
 
 interface EvidenceOptions {
   workspace?: string;
@@ -40,11 +41,14 @@ interface TriggerDecisionEntry {
 }
 
 /**
- * Get the memory/logs directory for a workspace.
+ * Get the memory/logs directory for a workspace (canonical root).
  * SystemLogger writes to <workspace>/memory/logs/SYSTEM_YYYY-MM-DD.log.
+ * The workspace root is canonicalized once here so downstream containment
+ * checks compare canonical paths (relative --workspace inputs work).
  */
 function getLogDir(workspaceDir: string): string {
-  return path.join(workspaceDir, 'memory', 'logs');
+  const root = assertSafeDirectoryRoot(workspaceDir, 'workspace path');
+  return path.join(root, 'memory', 'logs');
 }
 
 /**
@@ -108,7 +112,11 @@ function readRecentDecisions(logDir: string, limit: number): TriggerDecisionEntr
   for (const logFile of logFiles) {
     if (allEntries.length >= limit) break;
 
-    const filePath = path.join(logDir, logFile);
+    // CWE-22: verify the canonical log path stays inside the canonical
+    // logDir before reading (canonical-vs-canonical containment, so relative
+    // workspace roots work).
+    const filePath = path.resolve(logDir, logFile);
+    if (!isPathInside(logDir, filePath)) continue;
     try {
       const content = fs.readFileSync(filePath, 'utf8');
       const entries = parseTriggerDecisions(content);