fix: auto-resolve three code-review bugs — store path-traversal (#499), atomicWrite loss (#502), workflow 500-on-bad-input (#506)

[TYRMars]

Summary

Auto-resolves three self-contained code-review bugs picked up from newly-opened issues.

#499 — path traversal in partition directories (bug, security)

encodeId treats . as a safe byte, so encodeId("..") === "..". At filename call sites the .json suffix neutralises it, but stores that join a caller-supplied id as a partition directory let a project_id/requirement_id of .. escape the partition — landing requirement rows in the sibling flat conversation dir and permanently 500ing GET /v1/conversations (the leaked file has no messages).

Fix: add encodeIdSegment, which percent-encodes the dots in exactly the two reserved segments . and ... Every other id is unchanged (only an all-dots segment traverses — UUIDs, __memory__.summary: keys, and ids merely containing dots are untouched). Routed all six partition-directory helpers through it (requirement, comment, activity, label, requirement-run, doc-draft stores). Filename call sites keep using encodeId.

#502 — concurrent atomicWrite silently drops a write (bug)

atomicWrite derived its staging file solely from the target path, so all concurrent writers of one row shared a single <path>.tmp; the rename-race loser hit ENOENT and its write vanished (deterministic, 30/30). The REST message routes catch-and-ignore the failure, so a double-submit or two open tabs lost a whole turn silently.

Fix: unique staging name per writer (${filePath}.${pid}.${randomUUID()}.tmp) for honest last-writer-wins, plus rm on failure so a rejected write leaves no litter. New tmp names still end in .tmp (not .json), so every readdir loop keeps excluding them. This helper also backs @jarvis/observability and @jarvis/learning, which inherit the fix.

#506 — malformed workflow step kinds return 500 instead of 400 (bug)

walkAgentSteps/normalizeSteps trusted the TypeScript step-kind union, but POST/PATCH /v1/workflows feed them unvalidated JSON. A typo'd kind.type or a container kind (pipeline/phase/parallel) missing its steps array surfaced as an opaque 500 (steps is not iterable), and deeply-nested trees could blow the stack (RangeError) on an unauthenticated surface.

Fix: add validateStepKinds at the route boundary — unknown kinds, container kinds without an array steps, and nesting past MAX_WORKFLOW_STEP_DEPTH (64) all throw WorkflowError → 400 with an actionable message; runs before normalizeSteps in both create and update handlers. Also hardened walkAgentSteps (array guard + depth cap) so agentStepCount can never 500 regardless of caller.

Tests

• store (node) requirement-store.ts #projectDir: encodeId leaves .. intact and it is joined as a directory component → a project_id of .. writes requirement rows into the conversation dir and permanently 500s GET /v1/conversations #499: encodeIdSegment mapping; project_id: ".." stays in its partition, base conversation dir keeps only its own .json, list() still parses, requirement retrievable from its encoded partition.
• store (node) json-file.ts atomicWrite: fixed <path>.tmp shared by all writers of a target → concurrent writes to one id deterministically ENOENT on rename and the loser's turn is silently dropped #502: 20 rounds of two concurrent same-id atomicWrites — no ENOENT, honest last-writer-wins, no leftover .tmp.
• workflow (node) definition.ts walkAgentSteps: assumes every non-agent step kind carries steps → an unknown/incomplete step kind from POST /v1/workflows throws TypeError as a 500 instead of a 400 #506: three new 400 paths on create + update (unknown kind, missing steps, over-depth); crash-proof agentStepCount on malformed and 5000-deep input.

Verification

@jarvis/store, @jarvis/workflow, @jarvis/server typecheck clean; lint clean on all changed files; new tests pass. The store commit's CI ("Node" workflow) went green (Typecheck + Lint + Test). Locally the only failures were the pre-existing sqlite: suite (native better-sqlite3 binary not built — install scripts skipped; unrelated, and green in CI).

Closes #499
Closes #502
Closes #506

🤖 Generated with Claude Code

https://claude.ai/code/session_01CoRkweyxMkc5cd2P8xHaQw