@principles/pd-cli 1.135.0 → 1.135.1

package/dist/services/pd-config-loader.js

@@ -14,6 +14,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
 import * as yaml from 'js-yaml';
+import { canonicalPath, isPathInside } from '../utils/path-security.js';
 import { validatePdConfig, computeEffectivePdConfig, computeFeatureFlagsFromConfig, redactPdConfig, } from '@principles/core/runtime-v2';
 // ── Constants ────────────────────────────────────────────────────────────────
 export const PD_CONFIG_DIR = '.pd';
@@ -230,6 +231,31 @@ function loadOpenClawPluginConfig() {
     }
     return null;
 }
+/**
+ * Validate a candidate config directory before it is joined into a config
+ * path for filesystem reads. Candidate dirs are operator-supplied
+ * (PD_WORKSPACE_DIR / plugin config / home default), so we normalize with
+ * `path.normalize` (pure string, no filesystem access), then reject empty,
+ * parent-traversal, or root paths. This keeps the subsequent
+ * `path.join(dir, PD_CONFIG_DIR, ...)` inside the intended directory
+ * boundary (CWE-22 mitigation).
+ *
+ * Platform note: no `path.isAbsolute` check — absolute-ness is
+ * platform-dependent (a Windows-style path is not absolute on POSIX
+ * runners) and relative dirs resolve inside cwd without traversal risk.
+ */
+function assertConfigDirBoundary(dir, source) {
+    if (!dir || dir.trim().length === 0) {
+        throw new Error(`Invalid config search dir (${source}): path is empty`);
+    }
+    const normalized = path.normalize(dir);
+    if (normalized.split(/[\\/]/).includes('..')) {
+        throw new Error(`Invalid config search dir (${source}): "${dir}" contains parent traversal`);
+    }
+    if (normalized === path.parse(normalized).root) {
+        throw new Error(`Invalid config search dir (${source}): "${dir}" resolves to filesystem root`);
+    }
+}
 /**
  * Search known locations for a .pd/config.yaml that contains a workspace.default field.
  * This runs BEFORE workspace resolution and does NOT require knowing the workspace dir.
@@ -256,7 +282,14 @@ export function discoverWorkspaceDefault() {
     }
     // Search each candidate for .pd/config.yaml with workspace.default
     for (const { dir, source } of candidates) {
-        const configPath = path.join(dir, PD_CONFIG_DIR, PD_CONFIG_FILENAME);
+        assertConfigDirBoundary(dir, source);
+        // CWE-22: resolve the candidate root once, then verify the joined config
+        // path stays inside that root before any filesystem access.
+        const candidateRoot = canonicalPath(dir);
+        const configPath = path.resolve(candidateRoot, PD_CONFIG_DIR, PD_CONFIG_FILENAME);
+        if (!isPathInside(candidateRoot, configPath)) {
+            throw new Error(`Invalid config search dir (${source}): "${dir}" escapes its boundary`);
+        }
         if (fs.existsSync(configPath)) {
             const workspaceDefault = extractWorkspaceDefault(configPath);
             if (workspaceDefault) {

package/dist/services/pd-config-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"pd-config-loader.js","sourceRoot":"","sources":["../../src/services/pd-config-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,SAAS,CAAC;AAChC,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,6BAA6B,EAC7B,cAAc,GACf,MAAM,6BAA6B,CAAC;AAQrC,gFAAgF;AAEhF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AACnC,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAmChD,gFAAgF;AAEhF,MAAM,UAAU,eAAe,CAAC,YAAoB;IAClD,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;AACpE,CAAC;AAED,gFAAgF;AAEhF,SAAS,iBAAiB,CAAC,YAAoB;IAC7C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG;QAClB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,oBAAoB,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC;KACpD,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0EAA0E;AAC1E,SAAS,0BAA0B,CAAC,WAAqB;IACvD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACzB,OAAO,WAAW,CAAC,2BAA2B,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,YAAoB;IAC/C,MAAM,UAAU,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC5D,MAAM,qBAAqB,GAAG,0BAA0B,CAAC,mBAAmB,CAAC,CAAC;IAE9E,wCAAwC;IACxC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,SAAS;YACT,MAAM,EAAE,UAAU;YAClB,UAAU;YACV,QAAQ,EAAE;gBACR,GAAG,SAAS,CAAC,QAAQ;gBACrB,GAAG,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC;oBAChC,CAAC,CAAC,CAAC,iCAAiC,mBAAmB,CAAC,MAAM,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC;oBACnI,CAAC,CAAC,EAAE,CAAC;aACR;YACD,mBAAmB;YACnB,qBAAqB;SACtB,CAAC;IACJ,CAAC;IAED,mBAAmB;IACnB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW;YACnB,UAAU;YACV,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,mCAAmC,OAAO,EAAE,EAAE,UAAU,EAAE,4CAA4C,EAAE,CAAC;YACtI,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,SAAS;YACnB,mBAAmB;YACnB,qBAAqB;SACtB,CAAC;IACJ,CAAC;IAED,6CAA6C;IAC7C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW;YACnB,UAAU;YACV,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,wCAAwC,OAAO,EAAE,EAAE,UAAU,EAAE,oCAAoC,EAAE,CAAC;YACnI,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,SAAS;YACnB,mBAAmB;YACnB,qBAAqB;SACtB,CAAC;IACJ,CAAC;IAED,4DAA4D;IAC5D,MAAM,gBAAgB,GAA6B,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAE5E,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW;YACnB,UAAU;YACV,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxC,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC;YACH,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,SAAS;YACnB,mBAAmB;YACnB,qBAAqB;SACtB,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B,MAAM,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAEnE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS;QACT,MAAM,EAAE,aAAa;QACrB,UAAU;QACV,QAAQ,EAAE;YACR,GAAG,SAAS,CAAC,QAAQ;YACrB,GAAG,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC;gBAChC,CAAC,CAAC,CAAC,iCAAiC,mBAAmB,CAAC,MAAM,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC;gBACnI,CAAC,CAAC,EAAE,CAAC;SACR;QACD,mBAAmB;QACnB,qBAAqB;KACtB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAA0B;IACnE,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IACjE,OAAO,6BAA6B,CAAC,SAAS,CAAC,CAAC;AAClD,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA0B;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IACjE,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAcD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACrG,CAAC;AAED,sDAAsD;AACtD,SAAS,cAAc,CAAC,CAAS;IAC/B,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,UAAkB;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,MAAM,GAAY,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACrE,IACE,QAAQ,CAAC,MAAM,CAAC;YAChB,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YAC1B,OAAO,MAAM,CAAC,SAAS,CAAC,OAAO,KAAK,QAAQ;YAC5C,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACnC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EACxC,CAAC;YACD,OAAO,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+DAA+D;QAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4DAA4D,UAAU,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAChI,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB;IAC/B,MAAM,eAAe,GAAG;QACtB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,0BAA0B,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,0BAA0B,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,0BAA0B,CAAC;KACnE,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC7C,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5C,+DAA+D;gBAC/D,IACE,MAAM,KAAK,IAAI;oBACf,OAAO,MAAM,KAAK,QAAQ;oBAC1B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBACtB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC;oBAClC,OAAQ,MAAkC,CAAC,SAAS,KAAK,QAAQ;oBAC/D,MAAkC,CAAC,SAAoB,CAAC,MAAM,GAAG,CAAC,EACpE,CAAC;oBACD,OAAO,EAAE,SAAS,EAAG,MAAkC,CAAC,SAAmB,EAAE,CAAC;gBAChF,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,6EAA6E;gBAC7E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yDAAyD,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACtH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,UAAU,GAAyF,EAAE,CAAC;IAE5G,mDAAmD;IACnD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,YAAY,EAAE,CAAC;QACjB,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,gCAAgC;IAChC,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7B,UAAU,CAAC,IAAI,CAAC;QACd,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC;QACjD,MAAM,EAAE,kBAAkB;KAC3B,CAAC,CAAC;IAEH,gFAAgF;IAChF,MAAM,YAAY,GAAG,wBAAwB,EAAE,CAAC;IAChD,IAAI,YAAY,EAAE,SAAS,EAAE,CAAC;QAC5B,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,mEAAmE;IACnE,KAAK,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;QACrE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;YAC7D,IAAI,gBAAgB,EAAE,CAAC;gBACrB,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"pd-config-loader.js","sourceRoot":"","sources":["../../src/services/pd-config-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,6BAA6B,EAC7B,cAAc,GACf,MAAM,6BAA6B,CAAC;AAQrC,gFAAgF;AAEhF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AACnC,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAmChD,gFAAgF;AAEhF,MAAM,UAAU,eAAe,CAAC,YAAoB;IAClD,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;AACpE,CAAC;AAED,gFAAgF;AAEhF,SAAS,iBAAiB,CAAC,YAAoB;IAC7C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG;QAClB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,oBAAoB,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC;KACpD,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0EAA0E;AAC1E,SAAS,0BAA0B,CAAC,WAAqB;IACvD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACzB,OAAO,WAAW,CAAC,2BAA2B,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,YAAoB;IAC/C,MAAM,UAAU,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC5D,MAAM,qBAAqB,GAAG,0BAA0B,CAAC,mBAAmB,CAAC,CAAC;IAE9E,wCAAwC;IACxC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,SAAS;YACT,MAAM,EAAE,UAAU;YAClB,UAAU;YACV,QAAQ,EAAE;gBACR,GAAG,SAAS,CAAC,QAAQ;gBACrB,GAAG,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC;oBAChC,CAAC,CAAC,CAAC,iCAAiC,mBAAmB,CAAC,MAAM,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC;oBACnI,CAAC,CAAC,EAAE,CAAC;aACR;YACD,mBAAmB;YACnB,qBAAqB;SACtB,CAAC;IACJ,CAAC;IAED,mBAAmB;IACnB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW;YACnB,UAAU;YACV,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,mCAAmC,OAAO,EAAE,EAAE,UAAU,EAAE,4CAA4C,EAAE,CAAC;YACtI,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,SAAS;YACnB,mBAAmB;YACnB,qBAAqB;SACtB,CAAC;IACJ,CAAC;IAED,6CAA6C;IAC7C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW;YACnB,UAAU;YACV,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,wCAAwC,OAAO,EAAE,EAAE,UAAU,EAAE,oCAAoC,EAAE,CAAC;YACnI,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,SAAS;YACnB,mBAAmB;YACnB,qBAAqB;SACtB,CAAC;IACJ,CAAC;IAED,4DAA4D;IAC5D,MAAM,gBAAgB,GAA6B,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAE5E,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW;YACnB,UAAU;YACV,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxC,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC;YACH,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,SAAS;YACnB,mBAAmB;YACnB,qBAAqB;SACtB,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B,MAAM,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAEnE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS;QACT,MAAM,EAAE,aAAa;QACrB,UAAU;QACV,QAAQ,EAAE;YACR,GAAG,SAAS,CAAC,QAAQ;YACrB,GAAG,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC;gBAChC,CAAC,CAAC,CAAC,iCAAiC,mBAAmB,CAAC,MAAM,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC;gBACnI,CAAC,CAAC,EAAE,CAAC;SACR;QACD,mBAAmB;QACnB,qBAAqB;KACtB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAA0B;IACnE,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IACjE,OAAO,6BAA6B,CAAC,SAAS,CAAC,CAAC;AAClD,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA0B;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IACjE,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAcD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACrG,CAAC;AAED,sDAAsD;AACtD,SAAS,cAAc,CAAC,CAAS;IAC/B,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,UAAkB;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,MAAM,GAAY,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACrE,IACE,QAAQ,CAAC,MAAM,CAAC;YAChB,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YAC1B,OAAO,MAAM,CAAC,SAAS,CAAC,OAAO,KAAK,QAAQ;YAC5C,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACnC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EACxC,CAAC;YACD,OAAO,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+DAA+D;QAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4DAA4D,UAAU,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAChI,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB;IAC/B,MAAM,eAAe,GAAG;QACtB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,0BAA0B,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,0BAA0B,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,0BAA0B,CAAC;KACnE,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC7C,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5C,+DAA+D;gBAC/D,IACE,MAAM,KAAK,IAAI;oBACf,OAAO,MAAM,KAAK,QAAQ;oBAC1B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBACtB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC;oBAClC,OAAQ,MAAkC,CAAC,SAAS,KAAK,QAAQ;oBAC/D,MAAkC,CAAC,SAAoB,CAAC,MAAM,GAAG,CAAC,EACpE,CAAC;oBACD,OAAO,EAAE,SAAS,EAAG,MAAkC,CAAC,SAAmB,EAAE,CAAC;gBAChF,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,6EAA6E;gBAC7E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yDAAyD,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACtH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,uBAAuB,CAAC,GAAW,EAAE,MAAc;IAC1D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,kBAAkB,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,OAAO,GAAG,6BAA6B,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,UAAU,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,OAAO,GAAG,+BAA+B,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,UAAU,GAAyF,EAAE,CAAC;IAE5G,mDAAmD;IACnD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,YAAY,EAAE,CAAC;QACjB,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,gCAAgC;IAChC,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7B,UAAU,CAAC,IAAI,CAAC;QACd,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC;QACjD,MAAM,EAAE,kBAAkB;KAC3B,CAAC,CAAC;IAEH,gFAAgF;IAChF,MAAM,YAAY,GAAG,wBAAwB,EAAE,CAAC;IAChD,IAAI,YAAY,EAAE,SAAS,EAAE,CAAC;QAC5B,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,mEAAmE;IACnE,KAAK,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QACzC,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACrC,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,aAAa,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;QAClF,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,UAAU,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,OAAO,GAAG,wBAAwB,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;YAC7D,IAAI,gBAAgB,EAAE,CAAC;gBACrB,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/services/quality-scorecard/strong-model-gate.d.ts

@@ -5,6 +5,25 @@
  * to parse responses — no unsafe casts.
  */
 import type { PainEpisode, LocalEvaluation, StrongModelAdjudication, AdjudicationStatus } from '@principles/core/quality-scorecard';
+/**
+ * CWE-918 (SSRF) mitigation for operator-supplied LLM API base URLs.
+ *
+ * Threat model: OPENAI_BASE_URL is explicitly configured by the Owner /
+ * operator in the environment or Runtime Profile — it is trusted operator
+ * configuration, NOT untrusted remote input. Local and private-network
+ * OpenAI-compatible endpoints (llama.cpp, LM Studio, local gateways,
+ * intranet model servers) are legitimate PD runtime targets and must keep
+ * working.
+ *
+ * What stays blocked:
+ * - non-http(s) schemes (file:, javascript:, data:, ...)
+ * - malformed / unparseable URLs
+ * - credentials embedded in the URL (secrets leak into logs/errors)
+ *
+ * Callers must not allow the host to be rewritten from untrusted input
+ * after this validation; the endpoint is derived from this URL only.
+ */
+export declare function assertSafeLlmBaseUrl(rawBaseUrl: string): URL;
 export declare function adjudicate(episode: PainEpisode, localEval: LocalEvaluation, config: {
     modelId: string;
     log: (msg: string) => void;

package/dist/services/quality-scorecard/strong-model-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"strong-model-gate.d.ts","sourceRoot":"","sources":["../../../src/services/quality-scorecard/strong-model-gate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,oCAAoC,CAAC;AAkD5C,wBAAsB,UAAU,CAC9B,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACtD,OAAO,CAAC,uBAAuB,CAAC,CAsElC;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,uBAAuB,CAS3E;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,eAAe,EAC1B,YAAY,EAAE,uBAAuB,GAAG,IAAI,GAC3C,kBAAkB,CAOpB"}
+{"version":3,"file":"strong-model-gate.d.ts","sourceRoot":"","sources":["../../../src/services/quality-scorecard/strong-model-gate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,oCAAoC,CAAC;AAkD5C;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAc5D;AAED,wBAAsB,UAAU,CAC9B,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACtD,OAAO,CAAC,uBAAuB,CAAC,CA8ElC;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,uBAAuB,CAS3E;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,eAAe,EAC1B,YAAY,EAAE,uBAAuB,GAAG,IAAI,GAC3C,kBAAkB,CAOpB"}

package/dist/services/quality-scorecard/strong-model-gate.js

@@ -39,10 +39,48 @@ Flags: ${localEval.flags.length > 0 ? localEval.flags.join(', ') : 'none'}
 
 Do NOT output anything other than this JSON object.`;
 }
+/**
+ * CWE-918 (SSRF) mitigation for operator-supplied LLM API base URLs.
+ *
+ * Threat model: OPENAI_BASE_URL is explicitly configured by the Owner /
+ * operator in the environment or Runtime Profile — it is trusted operator
+ * configuration, NOT untrusted remote input. Local and private-network
+ * OpenAI-compatible endpoints (llama.cpp, LM Studio, local gateways,
+ * intranet model servers) are legitimate PD runtime targets and must keep
+ * working.
+ *
+ * What stays blocked:
+ * - non-http(s) schemes (file:, javascript:, data:, ...)
+ * - malformed / unparseable URLs
+ * - credentials embedded in the URL (secrets leak into logs/errors)
+ *
+ * Callers must not allow the host to be rewritten from untrusted input
+ * after this validation; the endpoint is derived from this URL only.
+ */
+export function assertSafeLlmBaseUrl(rawBaseUrl) {
+    let url;
+    try {
+        url = new URL(rawBaseUrl);
+    }
+    catch {
+        throw new Error(`Invalid OPENAI_BASE_URL: "${rawBaseUrl}" is not a valid URL`);
+    }
+    if (url.protocol !== 'https:' && url.protocol !== 'http:') {
+        throw new Error(`Invalid OPENAI_BASE_URL: protocol must be http or https, got "${url.protocol}"`);
+    }
+    if (url.username || url.password) {
+        throw new Error(`Invalid OPENAI_BASE_URL: credentials must not be embedded in the URL`);
+    }
+    return url;
+}
 export async function adjudicate(episode, localEval, config) {
     const { modelId: strongModelId, log } = config;
     const prompt = buildAdjudicationPrompt(episode, localEval);
-    const baseUrl = process.env.OPENAI_BASE_URL || 'https://api.openai.com/v1';
+    // CWE-918 (SSRF): validate the operator-supplied base URL before any
+    // network request — http(s) only, no embedded credentials. Local and
+    // private OpenAI-compatible endpoints remain valid (trusted operator
+    // configuration; llama.cpp / LM Studio / local gateways are supported).
+    const baseUrl = assertSafeLlmBaseUrl(process.env.OPENAI_BASE_URL || 'https://api.openai.com/v1');
     const apiKey = process.env.OPENAI_API_KEY;
     if (!apiKey) {
         return {
@@ -55,7 +93,11 @@ export async function adjudicate(episode, localEval, config) {
         };
     }
     try {
-        const resp = await fetch(`${baseUrl}/chat/completions`, {
+        // Build the endpoint on the validated URL: append the chat completions
+        // path to the base URL's (possibly empty) path component.
+        const endpoint = new URL(baseUrl);
+        endpoint.pathname = endpoint.pathname.replace(/\/+$/, '') + '/chat/completions';
+        const resp = await fetch(endpoint.toString(), {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',

package/dist/services/quality-scorecard/strong-model-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"strong-model-gate.js","sourceRoot":"","sources":["../../../src/services/quality-scorecard/strong-model-gate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,EACL,aAAa,EACb,iBAAiB,IAAI,IAAI,EACzB,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,oCAAoC,CAAC;AAE5C,SAAS,uBAAuB,CAC9B,OAAoB,EACpB,SAA0B;IAE1B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC/B,KAAK,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CACxG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO;;;;;QAKD,OAAO,CAAC,SAAS;YACb,OAAO,CAAC,MAAM;gBACV,OAAO,CAAC,KAAK;cACf,OAAO,CAAC,QAAQ;aACjB,OAAO,CAAC,OAAO;+BACG,OAAO,CAAC,uBAAuB,IAAI,MAAM;uBACjD,OAAO,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM;;yBAEhF,SAAS,CAAC,KAAK;EACtC,WAAW;SACJ,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM;;;;;;;;;;;;;;;oDAerB,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAoB,EACpB,SAA0B,EAC1B,MAAuD;IAEvD,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC/C,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,2BAA2B,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAE1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,kBAAkB,EAAE,cAAc;YAClC,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;YACrB,SAAS,EAAE,+DAA+D;YAC1E,UAAU,EAAE,mDAAmD;SAChE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,mBAAmB,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,aAAa;gBACpB,QAAQ,EAAE;oBACR,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,4EAA4E,EAAE;oBACzG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE;iBAClC;gBACD,WAAW,EAAE,GAAG;gBAChB,UAAU,EAAE,IAAI;aACjB,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAoD,CAAC;QACpF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,SAAS,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;QAEtC,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,kBAAkB,EAAE,OAAO;YAC3B,eAAe,EAAE,MAAM;YACvB,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC;YAC1C,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,GAAG,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;QAClC,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,kBAAkB,EAAE,cAAc;YAClC,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;YACrB,SAAS,EAAE,wBAAwB,GAAG,EAAE;YACxC,UAAU,EAAE,4CAA4C;SACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO;QACL,KAAK,EAAE,MAAM;QACb,kBAAkB,EAAE,SAAS;QAC7B,eAAe,EAAE,IAAI;QACrB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,MAAM;QACjB,UAAU,EAAE,uEAAuE;KACpF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,SAA0B,EAC1B,YAA4C;IAE5C,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACnE,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,UAAU,IAAI,EAAE;YAAE,OAAO,YAAY,CAAC;QACxE,IAAI,SAAS,CAAC,UAAU,IAAI,CAAC;YAAE,OAAO,YAAY,CAAC;QACnD,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,OAAO,YAAY,CAAC,kBAAkB,CAAC;AACzC,CAAC"}
+{"version":3,"file":"strong-model-gate.js","sourceRoot":"","sources":["../../../src/services/quality-scorecard/strong-model-gate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,EACL,aAAa,EACb,iBAAiB,IAAI,IAAI,EACzB,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,oCAAoC,CAAC;AAE5C,SAAS,uBAAuB,CAC9B,OAAoB,EACpB,SAA0B;IAE1B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC/B,KAAK,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CACxG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO;;;;;QAKD,OAAO,CAAC,SAAS;YACb,OAAO,CAAC,MAAM;gBACV,OAAO,CAAC,KAAK;cACf,OAAO,CAAC,QAAQ;aACjB,OAAO,CAAC,OAAO;+BACG,OAAO,CAAC,uBAAuB,IAAI,MAAM;uBACjD,OAAO,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM;;yBAEhF,SAAS,CAAC,KAAK;EACtC,WAAW;SACJ,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM;;;;;;;;;;;;;;;oDAerB,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6BAA6B,UAAU,sBAAsB,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,iEAAiE,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAoB,EACpB,SAA0B,EAC1B,MAAuD;IAEvD,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC/C,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3D,qEAAqE;IACrE,qEAAqE;IACrE,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,2BAA2B,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAE1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,kBAAkB,EAAE,cAAc;YAClC,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;YACrB,SAAS,EAAE,+DAA+D;YAC1E,UAAU,EAAE,mDAAmD;SAChE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,uEAAuE;QACvE,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,mBAAmB,CAAC;QAChF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,aAAa;gBACpB,QAAQ,EAAE;oBACR,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,4EAA4E,EAAE;oBACzG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE;iBAClC;gBACD,WAAW,EAAE,GAAG;gBAChB,UAAU,EAAE,IAAI;aACjB,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAoD,CAAC;QACpF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,SAAS,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;QAEtC,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,kBAAkB,EAAE,OAAO;YAC3B,eAAe,EAAE,MAAM;YACvB,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC;YAC1C,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,GAAG,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;QAClC,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,kBAAkB,EAAE,cAAc;YAClC,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;YACrB,SAAS,EAAE,wBAAwB,GAAG,EAAE;YACxC,UAAU,EAAE,4CAA4C;SACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO;QACL,KAAK,EAAE,MAAM;QACb,kBAAkB,EAAE,SAAS;QAC7B,eAAe,EAAE,IAAI;QACrB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,MAAM;QACjB,UAAU,EAAE,uEAAuE;KACpF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,SAA0B,EAC1B,YAA4C;IAE5C,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACnE,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,UAAU,IAAI,EAAE;YAAE,OAAO,YAAY,CAAC;QACxE,IAAI,SAAS,CAAC,UAAU,IAAI,CAAC;YAAE,OAAO,YAAY,CAAC;QACnD,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,OAAO,YAAY,CAAC,kBAAkB,CAAC;AACzC,CAAC"}

package/dist/utils/path-security.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Path containment primitives (CWE-22 boundary guards).
+ *
+ * Single source of truth for "is this filesystem target inside that root?"
+ * across pd-cli security boundaries. All containment decisions compare
+ * CANONICAL (fully resolved) paths via `path.relative`, never by string
+ * prefix — a string `startsWith` on a possibly-relative root is wrong on
+ * two counts: (1) a relative root never prefixes an absolute target, and
+ * (2) `/work/foo` is a prefix of `/work/foobar` without being a boundary.
+ *
+ * ── Symlink policy ────────────────────────────────────────────────────────
+ * The guarantee provided here is LEXICAL containment: `path.resolve` +
+ * `path.relative`, without resolving symlinks. We deliberately do NOT
+ * `realpath` the target before containment because:
+ *   1. PD's IO roots are operator-supplied workspace directories; symlinks
+ *      inside the workspace are created by the owner and treated as trusted
+ *      content.
+ *   2. On Windows, junction points (worktree junctions, `node_modules`
+ *      junctions) resolve to a *different physical location* via `realpath`;
+ *      realpath-based containment would reject legitimate local workflows
+ *      (e.g. a worktree whose `node_modules` is junctioned to the main
+ *      checkout).
+ * If a future caller must constrain the physical read target (e.g. reading a
+ * file whose path could be a symlink to an untrusted location), that caller
+ * must realpath the target FIRST and then run containment on the resolved
+ * path — do not weaken this module's contract.
+ */
+/**
+ * Canonicalize a user/operator-supplied path once. Every derived filesystem
+ * target must be compared against this canonical root.
+ */
+export declare function canonicalPath(p: string): string;
+/**
+ * True when `candidate` is strictly inside `parent` (canonical comparison).
+ *
+ * - Both arguments are resolved against cwd first, so relative inputs work.
+ * - `candidate === parent` returns false (strict containment). Callers that
+ *   want to allow the root itself should check equality separately.
+ * - Sibling-prefix attacks (`/work/foobar` vs parent `/work/foo`) cannot
+ *   pass because `path.relative` yields a non-`..`-prefixed path only for
+ *   real descendants.
+ */
+export declare function isPathInside(parent: string, candidate: string): boolean;
+/**
+ * Throw unless `candidate` is strictly inside `parent`. `label` names the
+ * candidate in the error message (e.g. "--workspace").
+ */
+export declare function assertPathInside(parent: string, candidate: string, label: string): void;
+/**
+ * Validate an operator-supplied directory root before it is used as an IO
+ * root: rejects empty values, residual parent-traversal segments, and
+ * filesystem-root results. Returns the canonical root.
+ *
+ * No `path.isAbsolute` requirement: absolute-ness is platform-dependent (a
+ * Windows-style path like `Z:\work` is not absolute on POSIX runners) and
+ * relative paths resolve inside cwd, so they carry no traversal risk. The
+ * guards that matter are: empty, parent traversal, and filesystem root.
+ */
+export declare function assertSafeDirectoryRoot(input: string, label: string): string;
+//# sourceMappingURL=path-security.d.ts.map

package/dist/utils/path-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-security.d.ts","sourceRoot":"","sources":["../../src/utils/path-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAUvE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIvF;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAe5E"}

package/dist/utils/path-security.js

@@ -0,0 +1,90 @@
+/**
+ * Path containment primitives (CWE-22 boundary guards).
+ *
+ * Single source of truth for "is this filesystem target inside that root?"
+ * across pd-cli security boundaries. All containment decisions compare
+ * CANONICAL (fully resolved) paths via `path.relative`, never by string
+ * prefix — a string `startsWith` on a possibly-relative root is wrong on
+ * two counts: (1) a relative root never prefixes an absolute target, and
+ * (2) `/work/foo` is a prefix of `/work/foobar` without being a boundary.
+ *
+ * ── Symlink policy ────────────────────────────────────────────────────────
+ * The guarantee provided here is LEXICAL containment: `path.resolve` +
+ * `path.relative`, without resolving symlinks. We deliberately do NOT
+ * `realpath` the target before containment because:
+ *   1. PD's IO roots are operator-supplied workspace directories; symlinks
+ *      inside the workspace are created by the owner and treated as trusted
+ *      content.
+ *   2. On Windows, junction points (worktree junctions, `node_modules`
+ *      junctions) resolve to a *different physical location* via `realpath`;
+ *      realpath-based containment would reject legitimate local workflows
+ *      (e.g. a worktree whose `node_modules` is junctioned to the main
+ *      checkout).
+ * If a future caller must constrain the physical read target (e.g. reading a
+ * file whose path could be a symlink to an untrusted location), that caller
+ * must realpath the target FIRST and then run containment on the resolved
+ * path — do not weaken this module's contract.
+ */
+import * as path from 'node:path';
+/**
+ * Canonicalize a user/operator-supplied path once. Every derived filesystem
+ * target must be compared against this canonical root.
+ */
+export function canonicalPath(p) {
+    return path.resolve(p);
+}
+/**
+ * True when `candidate` is strictly inside `parent` (canonical comparison).
+ *
+ * - Both arguments are resolved against cwd first, so relative inputs work.
+ * - `candidate === parent` returns false (strict containment). Callers that
+ *   want to allow the root itself should check equality separately.
+ * - Sibling-prefix attacks (`/work/foobar` vs parent `/work/foo`) cannot
+ *   pass because `path.relative` yields a non-`..`-prefixed path only for
+ *   real descendants.
+ */
+export function isPathInside(parent, candidate) {
+    const root = path.resolve(parent);
+    const target = path.resolve(candidate);
+    const rel = path.relative(root, target);
+    return (rel !== '' &&
+        rel !== '..' &&
+        !rel.startsWith(`..${path.sep}`) &&
+        !path.isAbsolute(rel));
+}
+/**
+ * Throw unless `candidate` is strictly inside `parent`. `label` names the
+ * candidate in the error message (e.g. "--workspace").
+ */
+export function assertPathInside(parent, candidate, label) {
+    if (!isPathInside(parent, candidate)) {
+        throw new Error(`Invalid ${label}: "${candidate}" is outside "${parent}"`);
+    }
+}
+/**
+ * Validate an operator-supplied directory root before it is used as an IO
+ * root: rejects empty values, residual parent-traversal segments, and
+ * filesystem-root results. Returns the canonical root.
+ *
+ * No `path.isAbsolute` requirement: absolute-ness is platform-dependent (a
+ * Windows-style path like `Z:\work` is not absolute on POSIX runners) and
+ * relative paths resolve inside cwd, so they carry no traversal risk. The
+ * guards that matter are: empty, parent traversal, and filesystem root.
+ */
+export function assertSafeDirectoryRoot(input, label) {
+    if (!input || input.trim().length === 0) {
+        throw new Error(`Invalid ${label}: path is empty`);
+    }
+    // Un-normalized `..` segments that survive normalize() mean the input
+    // escaped a parent boundary (e.g. "..\\..\\evil") — reject rather than
+    // trust them. Foldable segments ("a/../b") canonicalize safely.
+    if (path.normalize(input).split(/[\\/]/).includes('..')) {
+        throw new Error(`Invalid ${label}: "${input}" contains parent traversal`);
+    }
+    const root = canonicalPath(input);
+    if (root === path.parse(root).root) {
+        throw new Error(`Invalid ${label}: "${input}" resolves to filesystem root`);
+    }
+    return root;
+}
+//# sourceMappingURL=path-security.js.map

package/dist/utils/path-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-security.js","sourceRoot":"","sources":["../../src/utils/path-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,SAAiB;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,CACL,GAAG,KAAK,EAAE;QACV,GAAG,KAAK,IAAI;QACZ,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CACtB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,SAAiB,EAAE,KAAa;IAC/E,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,SAAS,iBAAiB,MAAM,GAAG,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,KAAa;IAClE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,iBAAiB,CAAC,CAAC;IACrD,CAAC;IACD,sEAAsE;IACtE,uEAAuE;IACvE,gEAAgE;IAChE,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,KAAK,6BAA6B,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,KAAK,+BAA+B,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/pd-cli",
-  "version": "1.135.0",
+  "version": "1.135.1",
   "description": "PD CLI — Pain recording, sample management, and evolution tasks",
   "type": "module",
   "bin": {

package/src/commands/legacy-cleanup.ts

@@ -27,6 +27,7 @@ import * as path from 'path';
 import * as os from 'os';
 import type { Database } from 'better-sqlite3';
 import { RuntimeStateManager } from '@principles/core/runtime-v2';
+import { assertSafeDirectoryRoot, isPathInside } from '../utils/path-security.js';
 
 // ── Types ────────────────────────────────────────────────────────────────────
 
@@ -257,9 +258,21 @@ function glob(pattern: string): string[] {
   return results;
 }
 
+/**
+ * Validate a workspace root before cleanup scans derive paths from it.
+ * Returns the canonical root so all derived targets are absolute and
+ * containment checks are canonical-vs-canonical (relative workspaces work).
+ */
+function assertCleanupWorkspaceRoot(workspacePath: string): string {
+  return assertSafeDirectoryRoot(workspacePath, 'workspace path');
+}
+
 function findLegacyTargets(workspacePath: string): CleanupTarget[] {
   const targets: CleanupTarget[] = [];
-  const stateDir = path.join(workspacePath, '.state');
+  // CWE-22: resolve the workspace root once and verify it is a valid,
+  // non-root directory so every derived path stays inside the boundary.
+  const workspaceRoot = assertCleanupWorkspaceRoot(workspacePath);
+  const stateDir = path.join(workspaceRoot, '.state');
   const archiveTimestamp = new Date().toISOString().replace(/[:.]/g, '-');
   const archiveDir = path.join(stateDir, 'legacy-archive', archiveTimestamp);
 
@@ -288,7 +301,11 @@ function findLegacyTargets(workspacePath: string): CleanupTarget[] {
   if (fs.existsSync(sessionsDir)) {
     for (const file of fs.readdirSync(sessionsDir)) {
       if (!file.endsWith('.json')) continue;
-      const filePath = path.join(sessionsDir, file);
+      const filePath = path.resolve(sessionsDir, file);
+      // CWE-22: verify the canonical path stays inside the canonical
+      // sessions dir before any filesystem access (readdir results are
+      // trusted, but defense-in-depth).
+      if (!isPathInside(sessionsDir, filePath)) continue;
       try {
         const content = fs.readFileSync(filePath, 'utf-8');
         const session = JSON.parse(content);

package/src/commands/pain-evidence.ts

@@ -19,6 +19,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { resolveWorkspaceDir } from '../resolve-workspace.js';
+import { assertSafeDirectoryRoot, isPathInside } from '../utils/path-security.js';
 
 interface EvidenceOptions {
   workspace?: string;
@@ -40,11 +41,14 @@ interface TriggerDecisionEntry {
 }
 
 /**
- * Get the memory/logs directory for a workspace.
+ * Get the memory/logs directory for a workspace (canonical root).
  * SystemLogger writes to <workspace>/memory/logs/SYSTEM_YYYY-MM-DD.log.
+ * The workspace root is canonicalized once here so downstream containment
+ * checks compare canonical paths (relative --workspace inputs work).
  */
 function getLogDir(workspaceDir: string): string {
-  return path.join(workspaceDir, 'memory', 'logs');
+  const root = assertSafeDirectoryRoot(workspaceDir, 'workspace path');
+  return path.join(root, 'memory', 'logs');
 }
 
 /**
@@ -108,7 +112,11 @@ function readRecentDecisions(logDir: string, limit: number): TriggerDecisionEntr
   for (const logFile of logFiles) {
     if (allEntries.length >= limit) break;
 
-    const filePath = path.join(logDir, logFile);
+    // CWE-22: verify the canonical log path stays inside the canonical
+    // logDir before reading (canonical-vs-canonical containment, so relative
+    // workspace roots work).
+    const filePath = path.resolve(logDir, logFile);
+    if (!isPathInside(logDir, filePath)) continue;
     try {
       const content = fs.readFileSync(filePath, 'utf8');
       const entries = parseTriggerDecisions(content);

package/src/commands/rulecode.ts

@@ -31,6 +31,7 @@
 import * as path from 'node:path';
 import * as fs from 'node:fs';
 import type { Command } from 'commander';
+import { isPathInside } from '../utils/path-security.js';
 import {
   RULECODE_SPEC_TEXT,
   checkForbiddenPatterns,
@@ -113,11 +114,33 @@ function isGoldenTraceCaseInput(value: unknown): value is GoldenTraceCaseInput {
 /**
  * Load and validate golden trace cases from a JSON file.
  * Returns either the validated cases or a structured error.
+ * Exported for boundary regression tests (internal test surface).
  */
-function loadGoldenTraceCases(filePath: string): { cases?: GoldenTraceCaseInput[]; error?: { reason: string; nextAction: string } } {
+export function loadGoldenTraceCases(
+  filePath: string,
+  workspaceDir?: string,
+): { cases?: GoldenTraceCaseInput[]; error?: { reason: string; nextAction: string } } {
   let raw: string;
   try {
+    if (!filePath || filePath.trim().length === 0) {
+      throw new Error('golden trace path is empty');
+    }
     const resolved = path.resolve(filePath);
+    // CWE-22 boundary: canonical containment against the workspace root
+    // (rejects sibling-prefix and traversal escapes; relative workspaces
+    // canonicalize consistently). Filesystem-root targets are rejected by
+    // containment when a workspace root is supplied.
+    const normalized = path.normalize(resolved);
+    if (normalized.split(/[\\/]/).includes('..')) {
+      throw new Error('golden trace path contains parent traversal');
+    }
+    if (workspaceDir) {
+      if (!isPathInside(workspaceDir, resolved)) {
+        throw new Error('golden trace path must be inside the workspace directory');
+      }
+    } else if (normalized === path.parse(normalized).root) {
+      throw new Error('golden trace path resolves to filesystem root');
+    }
     raw = fs.readFileSync(resolved, 'utf8');
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
@@ -286,7 +309,7 @@ export async function handleRulecodeReplay(opts: ReplayOptions): Promise<void> {
     return;
   }
 
-  const traceResult = loadGoldenTraceCases(opts.goldenTrace);
+  const traceResult = loadGoldenTraceCases(opts.goldenTrace, opts.workspace);
   if (traceResult.error || traceResult.cases === undefined) {
     const { error } = traceResult;
     const output: RulecodeReplayOutput = {

package/src/resolve-workspace.ts

@@ -15,15 +15,24 @@
 
 import * as path from 'path';
 import { discoverWorkspaceDefault } from './services/pd-config-loader.js';
+import { assertSafeDirectoryRoot } from './utils/path-security.js';
 
 /** Environment variable name for workspace directory. */
 export const WORKSPACE_ENV = 'PD_WORKSPACE_DIR';
 
 // ── Internal helpers ────────────────────────────────────────────────────────
 
-/** Normalize path to forward slashes for cross-platform comparison. */
+/**
+ * Normalize a path to forward slashes for cross-platform string comparison.
+ *
+ * Comparison-only helper: it never resolves against the filesystem and never
+ * feeds a filesystem operation, so it intentionally uses `path.normalize`
+ * (pure string normalization) instead of `path.resolve`. Callers compare two
+ * paths for equality after normalization; the workspace root itself is
+ * validated by `assertWorkspaceDirInside` before any IO uses it.
+ */
 function normalizePath(p: string): string {
-  return path.resolve(p).replace(/\\/g, '/');
+  return path.normalize(p).replace(/\\/g, '/');
 }
 
 /** Emit workspace warnings to stderr. */
@@ -31,6 +40,31 @@ function emitWarning(msg: string): void {
   process.stderr.write(`[PD:workspace] WARNING: ${msg}\n`);
 }
 
+/**
+ * Validate an operator-supplied workspace root before it is used as an IO
+ * root. Delegates to the shared canonical-root validator (empty, parent
+ * traversal, filesystem root). Returns nothing; callers keep the original
+ * value so downstream resolution semantics are unchanged.
+ */
+function assertWorkspaceDirInside(p: string, source: string): void {
+  assertSafeDirectoryRoot(p, source);
+}
+
+/** Emit a warning when an explicit override differs from config default. */
+function emitWarningIfDiffers(
+  override: string,
+  configDefault: string | undefined,
+  discovered: { configPath?: string } | null,
+): void {
+  if (configDefault && normalizePath(override) !== normalizePath(configDefault)) {
+    emitWarning(
+      `"${override}" differs from config default "${configDefault}" ` +
+        `(source: ${discovered?.configPath}). Using explicit override. ` +
+        `Consider updating workspace.default in config.`,
+    );
+  }
+}
+
 // ── Public API ──────────────────────────────────────────────────────────────
 
 /**
@@ -46,34 +80,24 @@ export function resolveWorkspaceDir(workspaceDir?: string): string {
 
   // Step 2: Check --workspace flag (highest priority)
   if (workspaceDir) {
-    if (configDefault && normalizePath(workspaceDir) !== normalizePath(configDefault)) {
-      emitWarning(
-        `--workspace "${workspaceDir}" differs from config default "${configDefault}" ` +
-        `(source: ${discovered.configPath}). Using explicit flag. ` +
-        `Consider updating workspace.default in config.`,
-      );
-    }
+    assertWorkspaceDirInside(workspaceDir, '--workspace');
+    emitWarningIfDiffers(workspaceDir, configDefault, discovered);
     return workspaceDir;
   }
 
   // Step 3: Check PD_WORKSPACE_DIR env var
   const envWorkspace = process.env.PD_WORKSPACE_DIR?.trim();
   if (envWorkspace) {
-    if (configDefault && normalizePath(envWorkspace) !== normalizePath(configDefault)) {
-      emitWarning(
-        `PD_WORKSPACE_DIR "${envWorkspace}" differs from config default "${configDefault}" ` +
-        `(source: ${discovered.configPath}). Using env var. ` +
-        `Consider aligning or updating workspace.default.`,
-      );
-    }
+    assertWorkspaceDirInside(envWorkspace, WORKSPACE_ENV);
+    emitWarningIfDiffers(envWorkspace, configDefault, discovered);
     return envWorkspace;
   }
 
   // Step 4: Use discovered config default
   if (configDefault) {
+    assertWorkspaceDirInside(configDefault, 'workspace.default');
     return configDefault;
   }
-
   // Step 5: No resolution possible — throw (preserves current behavior)
   throw new Error(
     'No workspace directory configured. Set --workspace <path>, ' +