fix(daemon): reject path-traversal ids in readPromptTemplate (nexu-io#5027)

Author: EthanGuo-coder

apps/daemon/src/prompt-templates.ts

@@ -72,7 +72,11 @@ export async function listPromptTemplates(root: string): Promise<PromptTemplate[
 
 export async function readPromptTemplate(root: string, surface: string, id: string): Promise<PromptTemplate | null> {
   if (!isPromptTemplateSurface(surface)) return null;
-  const filePath = path.join(root, surface, `${id}.json`);
+  const dir = path.join(root, surface);
+  const filePath = path.join(dir, `${id}.json`);
+  // `id` comes straight from the request path; a value like `../secret` would
+  // resolve outside the surface directory. Only read a direct child of it.
+  if (path.dirname(filePath) !== dir) return null;
   try {
     const raw = await readFile(filePath, 'utf8');
     const parsed = JSON.parse(raw);

apps/daemon/tests/prompt-templates.test.ts

@@ -175,4 +175,15 @@ describe('readPromptTemplate', () => {
     );
     expect(await readPromptTemplate(root, 'image', 'bad')).toBeNull();
   });
+
+  it('returns null for a path-traversal id instead of reading outside the surface dir', async () => {
+    // `id` arrives straight from the request path (`/api/prompt-templates/:surface/:id`,
+    // where a percent-encoded `..%2f` decodes back to `../`). Plant a valid template one
+    // level above the surface dir and confirm a traversal id can't resolve to it.
+    await writeFile(
+      path.join(root, 'secret.json'),
+      JSON.stringify(makeTemplate({ id: '../secret' })),
+    );
+    expect(await readPromptTemplate(root, 'image', '../secret')).toBeNull();
+  });
 });