fix: path traversal in model endpoints, XSS in plan card, remove dead code

- Validate model file names against safe character regex and resolve path
to prevent directory traversal in all /api/models/ endpoints
- Escape HTML in plan card and wizard review to prevent XSS from agent
responses containing markup
- Remove duplicate _is_plan_trigger check in _run_crew (dead code, already
handled in chat_turn)
- Use Literal type for DesignState.phase field to catch invalid states

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

agents/crew_orchestrator.py

@@ -160,18 +160,6 @@ class CrewOrchestrator(BaseOrchestrator):
 
         state = DesignState(**(design_state_dict or {}))
 
-        # Phase: manual plan trigger
-        if state.phase == "exploring" and _is_plan_trigger(message):
-            score = compute_score(state)
-            plan = DesignPlan.from_state(state, confidence_score=score)
-            state.phase = "planning"
-            state.plan = plan
-            return {
-                "responses": [],
-                "preview": None,
-                "design_state": state.model_dump(),
-            }
-
         # Phase: if in planning and user sends a message, reset to exploring
         if state.phase == "planning":
             state.phase = "exploring"

agents/design_state.py

@@ -3,6 +3,8 @@
 from __future__ import annotations
 
 import re
+from typing import Literal
+
 from pydantic import BaseModel, Field
 
 from config.settings import settings
@@ -100,7 +102,7 @@ class DesignState(BaseModel):
     constraints: list[str] = Field(default_factory=list)
     decisions: list[str] = Field(default_factory=list)
     axis_recommendation: str = ""
-    phase: str = "exploring"
+    phase: Literal["exploring", "planning", "approved"] = "exploring"
     plan: DesignPlan | None = None
 
     def render(self) -> str:

server/web.py

@@ -181,34 +181,49 @@ async def list_models():
     return JSONResponse(result)
 
 
+import re
+
+_SAFE_NAME = re.compile(r'^[a-zA-Z0-9_\-]+$')
+
+
+def _safe_model_path(name: str, ext: str) -> Path | None:
+    """Validate model name and return safe path, or None if invalid."""
+    if not _SAFE_NAME.match(name):
+        return None
+    path = (OUTPUT_DIR / f"{name}.{ext}").resolve()
+    if not str(path).startswith(str(OUTPUT_DIR.resolve())):
+        return None
+    return path
+
+
 @app.get("/api/models/{name}.stl")
 async def get_stl(name: str):
-    path = OUTPUT_DIR / f"{name}.stl"
-    if not path.exists():
+    path = _safe_model_path(name, "stl")
+    if not path or not path.exists():
         return JSONResponse({"error": f"STL not found: {name}"}, status_code=404)
     return FileResponse(path, media_type="model/stl", filename=f"{name}.stl")
 
 
 @app.get("/api/models/{name}.step")
 async def get_step(name: str):
-    path = OUTPUT_DIR / f"{name}.step"
-    if not path.exists():
+    path = _safe_model_path(name, "step")
+    if not path or not path.exists():
         return JSONResponse({"error": f"STEP not found: {name}"}, status_code=404)
     return FileResponse(path, media_type="application/step", filename=f"{name}.step")
 
 
 @app.get("/api/models/{name}.gcode")
 async def get_gcode(name: str):
-    path = OUTPUT_DIR / f"{name}.gcode"
-    if not path.exists():
+    path = _safe_model_path(name, "gcode")
+    if not path or not path.exists():
         return JSONResponse({"error": f"G-code not found: {name}"}, status_code=404)
     return FileResponse(path, media_type="text/plain", filename=f"{name}.gcode")
 
 
 @app.get("/api/models/{name}.3mf")
 async def get_3mf(name: str):
-    path = OUTPUT_DIR / f"{name}.3mf"
-    if not path.exists():
+    path = _safe_model_path(name, "3mf")
+    if not path or not path.exists():
         return JSONResponse({"error": f"3MF not found: {name}"}, status_code=404)
     return FileResponse(path, media_type="model/3mf", filename=f"{name}.3mf")
 

web/index.html

@@ -1723,7 +1723,7 @@ function wizUpdateReview() {
   ];
   let html = '';
   for (const [label, value] of fields) {
-    html += '<div class="wizard-review-field"><span class="wizard-review-label">' + label + '</span><span class="wizard-review-value">' + (value || '\u2014') + '</span></div>';
+    html += '<div class="wizard-review-field"><span class="wizard-review-label">' + escapeHtml(label) + '</span><span class="wizard-review-value">' + escapeHtml(value || '\u2014') + '</span></div>';
   }
   el.innerHTML = html;
   const score = wizComputeScore();
@@ -1800,10 +1800,10 @@ function renderPlanCard(plan) {
   let html = '<div class="plan-card" id="active-plan-card">';
   html += '<div class="plan-card-title">\u25c6 PLAN READY FOR REVIEW</div>';
   for (const [label, value] of fields) {
-    html += '<div class="wizard-review-field"><span class="wizard-review-label">' + label + '</span><span class="wizard-review-value">' + (value || '\u2014') + '</span></div>';
+    html += '<div class="wizard-review-field"><span class="wizard-review-label">' + escapeHtml(label) + '</span><span class="wizard-review-value">' + escapeHtml(value || '\u2014') + '</span></div>';
   }
   if (plan.machining_notes && plan.machining_notes.length) {
-    html += '<div class="wizard-review-field"><span class="wizard-review-label">Notes</span><span class="wizard-review-value">' + plan.machining_notes.join('; ') + '</span></div>';
+    html += '<div class="wizard-review-field"><span class="wizard-review-label">Notes</span><span class="wizard-review-value">' + escapeHtml(plan.machining_notes.join('; ')) + '</span></div>';
   }
   html += '<div class="plan-card-score">Score: ' + (plan.confidence_score || 0).toFixed(0) + '/8</div>';
   html += '<div class="plan-card-actions">';