fix: 限制NapCat自动化产物写入范围

src/selfTest.ts

@@ -182,6 +182,34 @@ export async function runSelfTest(): Promise<void> {
       );
     }
   }
+  const unsafeSkeletonArtifactRootPath = path.resolve("/tmp/not-kt-skeleton");
+  const unsafeSkeletonArtifactRootExisted = existsSync(
+    unsafeSkeletonArtifactRootPath,
+  );
+  let unsafeSkeletonArtifactRootRejected = false;
+  try {
+    buildNapcatRuntimeReleaseReadiness({
+      artifactRoot: "/tmp/not-kt-skeleton",
+    });
+  } catch (error) {
+    unsafeSkeletonArtifactRootRejected = String(error).includes(
+      "Unsafe NapCat Codex artifactRoot",
+    );
+  } finally {
+    if (
+      !unsafeSkeletonArtifactRootExisted &&
+      existsSync(unsafeSkeletonArtifactRootPath)
+    ) {
+      rmSync(unsafeSkeletonArtifactRootPath, { force: true, recursive: true });
+    }
+  }
+  if (
+    !unsafeSkeletonArtifactRootRejected ||
+    (!unsafeSkeletonArtifactRootExisted &&
+      existsSync(unsafeSkeletonArtifactRootPath))
+  ) {
+    throw new Error("NapCat skeleton unsafe artifact root self-check failed");
+  }
   if (
     napcatCandidateDefaults.candidateBranch !==
       napcatAutomationDefaults.candidateBranch ||

src/tools/napcatAutomation.ts

@@ -165,6 +165,7 @@ function buildNapcatPromptSkeleton(config: NapcatPromptSkeletonConfig) {
     config.input,
     config.artifactSlug,
   );
+  assertSafeNapcatCodexArtifactRoot(artifactRoot);
   const requestedExecute = config.input.execute === true;
   const promptText = loadNapcatAutomationPrompt(config.promptName).trim();
   const promptPath = joinNapcatArtifactPath(