Music Pipeline Configuration Hardening

internal/project/project.go

@@ -602,10 +602,46 @@ func (p *Project) Scan() error {
 	assetDir := p.AssetsDir()
 	var assetFiles []string
 	if assetDir != "" && filepath.Clean(assetDir) != filepath.Clean(p.Root) {
+		musicSourceExts := make(map[string]struct{})
+		for _, ext := range effective.Music.ConvertExtensions {
+			musicSourceExts[ext] = struct{}{}
+		}
+		musicSourceRoots := make(map[string]map[string]struct{})
+		for _, ds := range effective.Music.Datasets {
+			if strings.TrimSpace(ds.Source) == "" {
+				continue
+			}
+			exts := musicSourceRoots[ds.Source]
+			if exts == nil {
+				exts = make(map[string]struct{})
+				musicSourceRoots[ds.Source] = exts
+			}
+			for _, ext := range ds.ConvertExtensions {
+				exts[ext] = struct{}{}
+			}
+			for ext := range musicSourceExts {
+				exts[ext] = struct{}{}
+			}
+		}
 		var err error
 		assetFiles, _, err = scanDir(assetDir, func(path string) bool {
-			ext := strings.ToLower(filepath.Ext(path))
-			return slices.Contains(effective.Inventory.AssetExtensions, ext)
+			rel, err := filepath.Rel(assetDir, path)
+			if err != nil {
+				return false
+			}
+			rel = filepath.ToSlash(rel)
+			ext := strings.ToLower(filepath.Ext(rel))
+			if slices.Contains(effective.Inventory.AssetExtensions, ext) {
+				return true
+			}
+			for root, exts := range musicSourceRoots {
+				if !pathIsUnder(root, rel) {
+					continue
+				}
+				_, ok := exts[ext]
+				return ok
+			}
+			return false
 		})
 		if err != nil {
 			if errors.Is(err, os.ErrNotExist) {
@@ -1393,6 +1429,15 @@ func validateOutputFileName(field, name, expectedExt string) error {
 	return nil
 }
 
+func pathIsUnder(root, rel string) bool {
+	root = strings.Trim(strings.TrimSpace(filepath.ToSlash(root)), "/")
+	rel = strings.Trim(strings.TrimSpace(filepath.ToSlash(rel)), "/")
+	if root == "" || rel == "" {
+		return false
+	}
+	return rel == root || strings.HasPrefix(rel, root+"/")
+}
+
 func validateRelativePath(field, path string) []error {
 	var failures []error
 	trimmed := strings.TrimSpace(path)