Fix source-store citeKey path traversal

Author: Copilot

src/services/source-store.ts

@@ -37,13 +37,14 @@ const CITE_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
 function buildSourceFilePath(citeKey: string, sourcesDir: string): string {
   if (!CITE_KEY_PATTERN.test(citeKey)) {
     throw new Error(
-      `Invalid citeKey '${citeKey}'. Only letters, numbers, underscores, and hyphens are allowed.`,
+      `Invalid citeKey '${citeKey}'. Must start with a letter or number and then use only letters, numbers, underscores, or hyphens.`,
     );
   }
 
   const baseDir = path.resolve(sourcesDir);
   const filePath = path.resolve(baseDir, `${citeKey}.md`);
-  if (!filePath.startsWith(`${baseDir}${path.sep}`)) {
+  const relative = path.relative(baseDir, filePath);
+  if (relative.startsWith("..") || path.isAbsolute(relative)) {
     throw new Error(`Resolved source path escapes sources directory for citeKey '${citeKey}'.`);
   }
 

src/test/unit/source-store.test.ts

@@ -183,9 +183,11 @@ describe("storeSource", () => {
   });
 
   it("rejects path traversal citeKey values", async () => {
-    await expect(storeSource("../escape", TEST_URL, null, SOURCES_DIR)).rejects.toThrow(
-      /Invalid citeKey/,
-    );
+    for (const key of ["../escape", "..\\escape", "/etc/passwd", "%2e%2e/escape", ""]) {
+      await expect(storeSource(key, TEST_URL, null, SOURCES_DIR)).rejects.toThrow(
+        /Invalid citeKey/,
+      );
+    }
     expect(fetchDocumentText).not.toHaveBeenCalled();
     expect(mockFs.writeFile).not.toHaveBeenCalled();
   });