fix CodeQL alert

Author: RCFans

README.md

@@ -44,9 +44,11 @@ A complete reasoning session typically answers the following questions:
 *   **Strategy Effectiveness?** Under what circumstances is an "open ecosystem" superior to "vertical integration"?
 *   **Endgame Form?** Does it move towards monopoly, oligarchic balance, or fragmented coexistence?
 
+---
+
 ## 🚀 Quick Start
 
-### Installation
+### 🏗️ Installation
 
 Environment requirements: Python 3.12+ with `pip` package manager.
 
@@ -57,7 +59,7 @@ pip install --upgrade pip setuptools wheel
 pip install -e .
 ```
 
-### View Example
+### 🌰 View Example
 
 If you want to quickly see Omen in action, a visualized sample case and its results are available in the `sample` directory. Run:
 
@@ -67,7 +69,7 @@ streamlit run sample/app/scenario_planning.py
 
 Then open `http://localhost:8501` in your browser to explore the full strategic reasoning flow.
 
-### Run Built-in Case
+### 🎵 Run Built-in Case
 
 If you want to run a complete end-to-end workflow, we have prepared a built-in case simulating SAP's acquisition of Reltio in March 2026. The case document is `cases/sap_reltio_acquisition.md`, and it can be run end-to-end with the following commands:
 

README.zh.md

@@ -45,9 +45,11 @@ Omen **不预测**单一未来，它是**为复杂性而生**的推演引擎。
 *   **策略有效性？** 在何种情境下，“开放生态”优于“垂直整合”？
 *   **终局形态？** 走向垄断、寡头平衡还是碎片化共存？
 
+---
+
 ## 🚀 快速开始
 
-### 安装
+### 🏗️ 安装
 
 运行环境要求：Python 3.12+，并使用 `pip` 包管理器。
 
@@ -58,7 +60,7 @@ pip install --upgrade pip setuptools wheel
 pip install -e .
 ```
 
-### 查看示例
+### 🌰 看个例子
 
 如果你希望快速查看 Omen 的运行效果，`sample` 目录中提供了可视化案例及其结果。运行：
 
@@ -68,7 +70,7 @@ streamlit run sample/app/scenario_planning.py
 
 然后在浏览器中打开 `http://localhost:8501`，即可查看完整的战略推演流程。
 
-### 运行示例
+### 🎵 亲自运行
 
 如果你希望亲自运行一遍完整的流程，请使用我们准备的内置案例，用于模拟 2026 年 3 月 SAP 收购 Reltio 的情境。案例文档位于 `cases/sap_reltio_acquisition.md`，可以通过以下步骤端到端运行。
 

app/scenario_planning.py

@@ -29,20 +29,21 @@ def _normalize_pack_id(value: Any) -> str:
 
 
 def _resolve_safe_root(raw_value: str, default_rel: str) -> Path:
-    workspace_real = os.path.realpath(str(WORKSPACE_ROOT))
-    default_path = Path(os.path.realpath(str(WORKSPACE_ROOT / default_rel)))
+    workspace_base = os.path.normpath(str(WORKSPACE_ROOT))
+    default_path = Path(os.path.normpath(os.path.join(workspace_base, default_rel)))
+
     raw = str(raw_value or "").strip()
     if not raw:
         return default_path
 
-    candidate = Path(raw)
-    if not candidate.is_absolute():
-        candidate = WORKSPACE_ROOT / candidate
-    candidate_real = os.path.realpath(str(candidate))
+    if not os.path.isabs(raw):
+        fullpath = os.path.normpath(os.path.join(workspace_base, raw))
+    else:
+        fullpath = os.path.normpath(raw)
 
-    if os.path.commonpath([workspace_real, candidate_real]) != workspace_real:
+    if not fullpath.startswith(workspace_base):
         return default_path
-    return Path(candidate_real)
+    return Path(fullpath)
 
 
 def _render_json(path: str, payload: dict[str, Any] | None) -> None:
@@ -55,33 +56,27 @@ def _render_json(path: str, payload: dict[str, Any] | None) -> None:
 
 def _read_json_file(*, base_dir: Path, pack_id: str, filename: str) -> dict[str, Any] | None:
     try:
-        workspace_real = os.path.realpath(str(WORKSPACE_ROOT))
-        base_real = os.path.realpath(str(base_dir))
-        if os.path.commonpath([workspace_real, base_real]) != workspace_real:
+        workspace_base = os.path.normpath(str(WORKSPACE_ROOT))
+        base_path = os.path.normpath(str(base_dir))
+        if not base_path.startswith(workspace_base):
             return None
 
         safe_pack_id = _normalize_pack_id(pack_id)
         if not safe_pack_id:
             return None
 
-        target_real = os.path.realpath(str(Path(base_real) / safe_pack_id / filename))
-    except Exception:
-        return None
-
-    if os.path.commonpath([workspace_real, target_real]) != workspace_real:
-        return None
-    if os.path.commonpath([base_real, target_real]) != base_real:
-        return None
+        fullpath = os.path.normpath(os.path.join(base_path, safe_pack_id, filename))
+        if not fullpath.startswith(base_path):
+            return None
 
-    resolved_path = Path(target_real)
-    if not resolved_path.exists() or not resolved_path.is_file():
-        return None
+        resolved_path = Path(fullpath)
+        if not resolved_path.exists() or not resolved_path.is_file():
+            return None
 
-    try:
         payload = json.loads(resolved_path.read_text(encoding="utf-8"))
+        return payload if isinstance(payload, dict) else None
     except Exception:
         return None
-    return payload if isinstance(payload, dict) else None
 
 
 def _load_scenario_slot_labels() -> dict[str, str]:

sample/app/scenario_planning.py

@@ -37,33 +37,27 @@ def _render_json(path: str, payload: dict[str, Any] | None) -> None:
 
 def _read_json_file(*, base_dir: Path, pack_id: str, filename: str) -> dict[str, Any] | None:
     try:
-        workspace_real = os.path.realpath(str(WORKSPACE_ROOT))
-        base_real = os.path.realpath(str(base_dir))
-        if os.path.commonpath([workspace_real, base_real]) != workspace_real:
+        workspace_base = os.path.normpath(str(WORKSPACE_ROOT))
+        base_path = os.path.normpath(str(base_dir))
+        if not base_path.startswith(workspace_base):
             return None
 
         safe_pack_id = _normalize_pack_id(pack_id)
         if not safe_pack_id:
             return None
 
-        target_real = os.path.realpath(str(Path(base_real) / safe_pack_id / filename))
-    except Exception:
-        return None
-
-    if os.path.commonpath([workspace_real, target_real]) != workspace_real:
-        return None
-    if os.path.commonpath([base_real, target_real]) != base_real:
-        return None
+        fullpath = os.path.normpath(os.path.join(base_path, safe_pack_id, filename))
+        if not fullpath.startswith(base_path):
+            return None
 
-    resolved_path = Path(target_real)
-    if not resolved_path.exists() or not resolved_path.is_file():
-        return None
+        resolved_path = Path(fullpath)
+        if not resolved_path.exists() or not resolved_path.is_file():
+            return None
 
-    try:
         payload = json.loads(resolved_path.read_text(encoding="utf-8"))
+        return payload if isinstance(payload, dict) else None
     except Exception:
         return None
-    return payload if isinstance(payload, dict) else None
 
 
 def _load_sample_actor_payloads(pack_id: str) -> dict[str, Any]: