fix(security): scope managed path opening

src/shared/contracts/desktop-api/companies.ts

@@ -1,13 +1,13 @@
 import type { z } from "zod";
 import type { CompanyMetrics, OnboardingBootstrapResult, ProfileSnapshot, StandupReport } from "../../types";
-import type { bootstrapOnboardingSchema, companyInputSchema, connectorDisabledModelsSchema, connectorInputSchema, settingsSchema } from "../schemas-company";
+import type { bootstrapOnboardingSchema, companyInputSchema, connectorDisabledModelsSchema, connectorInputSchema, managedPathInputSchema, settingsSchema } from "../schemas-company";
 import type { entityGetterSchema, metricsQuerySchema } from "../schemas-badges";
 import type { DesktopResult } from "./common";
 
 export type CompaniesApi = {
   loadSnapshot: () => Promise<DesktopResult<ProfileSnapshot>>;
   pickDirectory: () => Promise<DesktopResult<string | null>>;
-  openPath: (targetPath: string) => Promise<DesktopResult<boolean>>;
+  openPath: (input: z.infer<typeof managedPathInputSchema>) => Promise<DesktopResult<boolean>>;
   openWorkProduct: (input: z.infer<typeof entityGetterSchema>) => Promise<DesktopResult<boolean>>;
   saveCompany: (input: z.infer<typeof companyInputSchema>) => Promise<DesktopResult<string>>;
   setCurrentCompany: (companyId: string) => Promise<DesktopResult<boolean>>;

src/shared/contracts/preload-forwarders.ts

@@ -30,6 +30,7 @@ import {
   companyInputSchema,
   connectorDisabledModelsSchema,
   connectorInputSchema,
+  managedPathInputSchema,
   socialAccountInputSchema,
   settingsSchema,
   workspaceInputSchema,
@@ -213,10 +214,8 @@ export const PRELOAD_FORWARDERS = [
 export type PreloadForwardedMethod = (typeof PRELOAD_FORWARDERS)[number]["api"];
 export type PreloadForwardedApi = Pick<DesktopApi, PreloadForwardedMethod>;
 
-const managedPathSchema = z.string().min(1);
-
 export const PRELOAD_INPUT_SCHEMAS: Partial<Record<PreloadForwardedMethod, z.ZodType<unknown>>> = {
-  openPath: managedPathSchema,
+  openPath: managedPathInputSchema,
   openWorkProduct: entityGetterSchema,
   saveCompany: companyInputSchema,
   setCurrentCompany: companyIdSchema,

src/shared/contracts/schemas-company.ts

@@ -3,6 +3,11 @@ import { optionalId } from "./helpers";
 
 export const companyIdSchema = z.string().uuid();
 
+export const managedPathInputSchema = z.object({
+  companyId: companyIdSchema,
+  path: z.string().min(1),
+});
+
 export const companyInputSchema = z.object({
   id: optionalId,
   name: z.string().min(2).max(80),