fix(security): enforce canonical path containment on renderer-supplied meeting paths

[Optic00]

Summary

Closes several path-traversal issues where the untrusted Electron renderer (XSS / compromised renderer / DevTools) could drive the backend or the main process into reading, writing, or deleting arbitrary local files. Enforcement is at the Electron trust boundary; the Python CLI stays intentionally permissive so the documented query transcript.txt debug path keeps working.

Issues fixed

• Arbitrary file read (+ potential exfiltration) — query-transcript / query-transcript-stream passed the renderer's summaryFile straight to the backend query command, which reads any UTF-8 file (no extension gate on the plain-text path). With a cloud/org provider the contents are also sent to the external AI service.
• Arbitrary file write — add-/remove-meeting-to-folder passed summaryFile straight to the folders backend, which rewrites the target file.
• Symlink escape — update-meeting used a lexical-only path check, then read/wrote the original (symlink-followed) path across the whole project/storage root.
• Symlink-followed delete — delete-meeting / reveal / system-audio shared the same lexical check.

Fix

• Route the four meeting-file handlers through validateMeetingFilePath() (output/-only, realpath-canonicalized) and pass the canonical realPath downstream — never the original renderer string.
• Harden validateSafeFilePath() with realpathSync canonicalization of both target and base dirs, covering delete/reveal/system-audio with no call-site change.
• Additional hardening on the stream handler this change makes async: guard a query-cancel or sender-destroy landing during pre-spawn validation (cancel-race / orphaned backend), type-guard non-string input at the validateMeetingFilePath source (avoids an unhandled rejection that could crash main), and make query-done delivery exception-safe. The chat_message_sent analytics from feat: instrument product analytics for activation, engagement and usage #323 is preserved.

Tests

New model-free T2 e2e spec path-validation-security.t2.spec.ts: asserts rejection of out-of-output/ paths, non-string input, and symlink escapes on both validator seams, and that the out-of-bounds file is never read / modified / deleted. meetings-crud / folders-crud / chat-sessions T2 regressions green.

---

Summary by cubic

Enforces symlink-safe, canonical path containment for renderer-supplied meeting files to block arbitrary local file read/write/delete from the Electron renderer. Validation now happens at the Electron trust boundary; the Python CLI remains permissive for documented debug flows.

• Bug Fixes
  • Guard query-transcript, query-transcript-stream, update-meeting, and add/remove-meeting-to-folder with validateMeetingFilePath (output/ only) and pass the canonical realPath downstream.
  • Canonicalize both target and base dirs in validateSafeFilePath using fs.realpathSync, securing delete/reveal/system-audio without call-site changes.
  • Pre-validate in query-transcript-stream, add pending-cancel handling to avoid orphaned backends, and make query-done delivery exception-safe.
  • Reject non-string paths early to prevent unhandled rejections and main-process crashes.
  • Add a T2 e2e spec covering out-of-output/ paths, non-string input, and symlink escapes; asserts no unauthorized disk reads/writes/deletes.

^{Written for commit 541654f. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}