security and validation fixes: error handling, path validation, type checking, and package constraints

Author: Agent-Planner

auto_documentation.py

@@ -86,8 +86,19 @@ class DocumentationGenerator:
     """
 
     def __init__(self, project_dir: Path, output_dir: str = "docs"):
-        self.project_dir = Path(project_dir)
-        self.output_dir = self.project_dir / output_dir
+        self.project_dir = Path(project_dir).resolve()
+
+        # Validate that output directory is contained within project_dir
+        resolved_output = (self.project_dir / output_dir).resolve()
+        try:
+            resolved_output.relative_to(self.project_dir)
+        except ValueError:
+            raise ValueError(
+                f"Output directory '{output_dir}' escapes project directory boundary. "
+                f"Resolved to '{resolved_output}' but project_dir is '{self.project_dir}'"
+            )
+
+        self.output_dir = resolved_output
         self.app_spec: Optional[dict] = None
 
     def generate(self) -> ProjectDocs:

design_tokens.py

@@ -524,7 +524,19 @@ def validate_contrast(self, tokens: DesignTokens) -> list[dict]:
         # Check primary colors against white/black backgrounds
         for name, value in tokens.colors.items():
             color_token = ColorToken(name=name, value=value)
-            _hue, _sat, lightness = color_token.to_hsl()
+            try:
+                _hue, _sat, lightness = color_token.to_hsl()
+            except Exception as e:
+                # Log invalid color and continue to next token
+                issues.append(
+                    {
+                        "color": name,
+                        "value": value,
+                        "issue": "Invalid color value",
+                        "error": str(e),
+                    }
+                )
+                continue
 
             # Simple contrast check based on lightness
             if lightness > 50:
@@ -565,18 +577,26 @@ def generate_all(self, output_dir: Optional[Path] = None) -> dict:
         tokens = self.load()
         output = output_dir or self.project_dir / "src" / "styles"
 
+        # Create Path objects for output files
+        css_path = output / "tokens.css"
+        scss_path = output / "_tokens.scss"
+
+        # Generate files and pass Path objects
+        self.generate_css(tokens, css_path)
+        self.generate_scss(tokens, scss_path)
+
         results = {
-            "css": str(self.generate_css(tokens, output / "tokens.css")),
-            "scss": str(self.generate_scss(tokens, output / "_tokens.scss")),
+            "css": str(css_path),
+            "scss": str(scss_path),
         }
 
         # Check for Tailwind
         if (self.project_dir / "tailwind.config.js").exists() or (
             self.project_dir / "tailwind.config.ts"
         ).exists():
-            results["tailwind"] = str(
-                self.generate_tailwind_config(tokens, output / "tailwind.tokens.js")
-            )
+            tailwind_path = output / "tailwind.tokens.js"
+            self.generate_tailwind_config(tokens, tailwind_path)
+            results["tailwind"] = str(tailwind_path)
 
         # Validate and report
         issues = self.validate_contrast(tokens)

quality_gates.py

@@ -132,23 +132,22 @@ def _detect_python_linter(project_dir: Path) -> tuple[str, list[str]] | None:
     if flake8_path:
         return ("flake8", [flake8_path, "."])
 
-    # Check in virtual environment for both Unix and Windows paths
+    # Check in virtual environment for ruff (both Unix and Windows paths)
     venv_ruff_paths = [
         project_dir / "venv/bin/ruff",
         project_dir / "venv/Scripts/ruff.exe"
     ]
 
+    for venv_ruff in venv_ruff_paths:
+        if venv_ruff.exists():
+            return ("ruff", [str(venv_ruff), "check", "."])
+
+    # Check in virtual environment for flake8 (both Unix and Windows paths)
     venv_flake8_paths = [
         project_dir / "venv/bin/flake8",
         project_dir / "venv/Scripts/flake8.exe"
     ]
 
-    # Check for ruff in venv
-    for venv_ruff in venv_ruff_paths:
-        if venv_ruff.exists():
-            return ("ruff", [str(venv_ruff), "check", "."])
-
-    # Check for flake8 in venv
     for venv_flake8 in venv_flake8_paths:
         if venv_flake8.exists():
             return ("flake8", [str(venv_flake8), "."])

requirements.txt

@@ -2,7 +2,7 @@
 claude-agent-sdk>=0.1.0,<0.2.0
 python-dotenv~=1.0.0
 sqlalchemy~=2.0
-fastapi>=0.128.0
+fastapi~=0.128.0
 uvicorn[standard]~=0.32
 websockets~=13.0
 # CVE-2026-24486: >=0.0.22 strips directory components from uploaded filenames
@@ -15,7 +15,7 @@ pywinpty~=2.0; sys_platform == "win32"
 pyyaml~=6.0
 slowapi~=0.1.9
 pydantic-settings~=2.0
-openai>=1.52.0
+openai~=2.15.0
 
 # Dev dependencies
 ruff~=0.8.0

security.py

@@ -109,7 +109,7 @@ def redact_string(s: str, max_preview: int = 20) -> str:
             {
                 "timestamp": cmd.timestamp,
                 "command": redact_string(cmd.command),
-                "reason": cmd.reason,
+                "reason": redact_string(cmd.reason),
                 "project_dir": cmd.project_dir,
             }
             for cmd in commands

server/routers/design_tokens.py

@@ -205,18 +205,18 @@ async def update_design_tokens(project_name: str, request: DesignTokensRequest):
         manager = DesignTokensManager(project_dir)
         current = manager.load()
 
-        # Update only provided fields
-        if request.colors:
+        # Update only provided fields (explicit None checks allow empty dicts/lists for clearing)
+        if request.colors is not None:
             current.colors.update(request.colors)
-        if request.spacing:
+        if request.spacing is not None:
             current.spacing = request.spacing
-        if request.typography:
+        if request.typography is not None:
             current.typography.update(request.typography)
-        if request.borders:
+        if request.borders is not None:
             current.borders.update(request.borders)
-        if request.shadows:
+        if request.shadows is not None:
             current.shadows.update(request.shadows)
-        if request.animations:
+        if request.animations is not None:
             current.animations.update(request.animations)
 
         manager.save(current)
@@ -339,7 +339,16 @@ async def validate_tokens(project_name: str):
 
         hex_pattern = re.compile(r"^#([0-9a-fA-F]{3}|[0-9a-fA-F]{6})$")
         for name, value in tokens.colors.items():
-            if not hex_pattern.match(value):
+            if not isinstance(value, str):
+                issues.append(
+                    {
+                        "type": "color_format",
+                        "field": f"colors.{name}",
+                        "value": value,
+                        "message": "Non-string color value",
+                    }
+                )
+            elif not hex_pattern.match(value):
                 issues.append(
                     {
                         "type": "color_format",

server/routers/documentation.py

@@ -19,7 +19,7 @@
 from pydantic import BaseModel, Field
 
 from auto_documentation import DocumentationGenerator
-from registry import get_project_path
+from registry import get_project_path, list_registered_projects
 
 logger = logging.getLogger(__name__)
 
@@ -121,18 +121,30 @@ def _validate_project_path(path: Path) -> None:
     allowed_root = Path.cwd().resolve()
 
     try:
-        # Check if the path is within the allowed root directory
-        if not path.is_relative_to(allowed_root):
-            raise HTTPException(
-                status_code=403,
-                detail=f"Access denied: Project path '{path}' is outside allowed directory boundary"
-            )
+        # First check if the path is within the allowed root directory (cwd)
+        if path.is_relative_to(allowed_root):
+            return
     except ValueError:
-        # Handle case where path comparison fails
-        raise HTTPException(
-            status_code=403,
-            detail=f"Access denied: Project path '{path}' is outside allowed directory boundary"
-        )
+        pass
+
+    # Check if the path matches or is within any registered project path
+    try:
+        registered_projects = list_registered_projects()
+        for proj_name, proj_info in registered_projects.items():
+            registered_path = Path(proj_info["path"]).resolve()
+            try:
+                if path == registered_path or path.is_relative_to(registered_path):
+                    return
+            except ValueError:
+                continue
+    except Exception as e:
+        logger.warning(f"Failed to check registry: {e}")
+
+    # Path is not within allowed boundaries
+    raise HTTPException(
+        status_code=403,
+        detail=f"Access denied: Project path '{path}' is outside allowed directory boundary"
+    )
 
 
 # ============================================================================
@@ -177,6 +189,9 @@ async def generate_docs(request: GenerateDocsRequest):
             message=f"Generated {len(generated)} documentation files",
         )
 
+    except ValueError as e:
+        logger.error(f"Invalid output directory: {e}")
+        raise HTTPException(status_code=400, detail=str(e))
     except Exception as e:
         logger.error(f"Documentation generation failed: {e}")
         raise HTTPException(status_code=500, detail=str(e))

server/routers/review.py

@@ -119,16 +119,67 @@ def get_project_dir(project_name: str) -> Path:
     # Try to get from registry
     project_path = get_project_path(project_name)
     if project_path:
-        return Path(project_path)
+        # Resolve and validate the registered path
+        resolved_path = project_path.resolve()
+        _validate_project_dir(resolved_path)
+        return resolved_path
 
     # Check if it's a direct path
     path = Path(project_name)
     if path.exists() and path.is_dir():
-        return path
+        # Resolve and validate the provided path
+        resolved_path = path.resolve()
+        _validate_project_dir(resolved_path)
+        return resolved_path
 
     raise HTTPException(status_code=404, detail=f"Project not found: {project_name}")
 
 
+def _validate_project_dir(resolved_path: Path) -> None:
+    """
+    Validate that a project directory is within allowed boundaries.
+
+    Args:
+        resolved_path: The resolved project path to validate
+
+    Raises:
+        HTTPException: If the path is outside allowed boundaries or is dangerous
+    """
+    # Blocklist for dangerous locations
+    dangerous_roots = [
+        Path("/").resolve(),  # Root
+        Path("/etc").resolve(),  # System config
+        Path("/var").resolve(),  # System variables
+        Path.home().resolve(),  # User home (allow subpaths, block direct home)
+    ]
+
+    # Check if path is in dangerous locations
+    for dangerous in dangerous_roots:
+        try:
+            if dangerous in resolved_path.parents or dangerous == resolved_path:
+                raise HTTPException(
+                    status_code=404,
+                    detail=f"Project not found: {resolved_path}"
+                )
+        except (ValueError, OSError):
+            pass
+
+    # Ensure path is contained within an allowed root
+    allowed_root = Path.cwd().resolve()
+
+    try:
+        if resolved_path.is_relative_to(allowed_root):
+            return
+    except ValueError:
+        pass
+
+    # Path is not within allowed boundaries
+    raise HTTPException(
+        status_code=404,
+        detail=f"Project not found: {resolved_path}"
+    )
+
+
 # ============================================================================
 # Endpoints
 # ============================================================================

server/routers/templates.py

@@ -27,6 +27,7 @@
 
 from templates.library import generate_app_spec, generate_features
 from templates.library import get_template as get_template_data
+from templates.library import list_templates as load_templates_list
 
 logger = logging.getLogger(__name__)
 
@@ -140,7 +141,7 @@ async def list_templates():
     Returns basic information about each template.
     """
     try:
-        templates = list_templates()
+        templates = load_templates_list()
 
         return TemplateListResponse(
             templates=[

server/routers/visual_regression.py

@@ -325,6 +325,12 @@ async def update_baseline(request: UpdateBaselineRequest):
     """
     project_dir = get_project_dir(request.project_name)
 
+    # Validate inputs (same checks as delete_baseline)
+    if ".." in request.name or "/" in request.name or "\\" in request.name:
+        raise HTTPException(status_code=400, detail="Invalid name")
+    if ".." in request.viewport or "/" in request.viewport or "\\" in request.viewport:
+        raise HTTPException(status_code=400, detail="Invalid viewport")
+
     try:
         tester = VisualRegressionTester(project_dir)
         success = tester.update_baseline(request.name, request.viewport)