Hardening audit

Key hardening changes:

  - Config validation now rejects paths.source: . and paths.assets: ., so source/asset roots cannot
    resolve to the repository root.
  - apply-hak-manifest now refuses to run when paths.source is unset or unsafe, instead of potentially
    writing under a root-level module/.
  - Inline flags across utility parsers now reject empty values consistently, e.g. --dataset=, --hak=,
    --endpoint=, --output=.
  - build-changelog now supports --flag=value inline syntax like the other utilities.

internal/pipeline/apply_manifest.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 
 	"gitea.westgate.pw/ShadowsOverWestgate/sow-tools/internal/gff"
 	"gitea.westgate.pw/ShadowsOverWestgate/sow-tools/internal/project"
@@ -20,6 +21,13 @@ func ApplyHAKManifest(p *project.Project, manifestPath string) (ApplyManifestRes
 	if manifestPath == "" {
 		manifestPath = p.HAKManifestPath()
 	}
+	if strings.TrimSpace(p.EffectiveConfig().Paths.Source) == "" {
+		return ApplyManifestResult{}, fmt.Errorf("cannot apply hak manifest: paths.source is not configured")
+	}
+	sourceRoot := filepath.Clean(p.SourceDir())
+	if sourceRoot == "." || sourceRoot == string(filepath.Separator) || sourceRoot == filepath.Clean(p.Root) {
+		return ApplyManifestResult{}, fmt.Errorf("cannot apply hak manifest: paths.source resolves to unsafe source root %s", sourceRoot)
+	}
 
 	raw, err := os.ReadFile(manifestPath)
 	if err != nil {
@@ -31,7 +39,7 @@ func ApplyHAKManifest(p *project.Project, manifestPath string) (ApplyManifestRes
 		return ApplyManifestResult{}, fmt.Errorf("parse hak manifest: %w", err)
 	}
 
-	moduleSource := filepath.Join(p.SourceDir(), "module", "module.ifo.json")
+	moduleSource := filepath.Join(sourceRoot, "module", "module.ifo.json")
 	sourceRaw, err := os.ReadFile(moduleSource)
 	if err != nil {
 		return ApplyManifestResult{}, fmt.Errorf("read module ifo source: %w", err)

internal/pipeline/pipeline_test.go

@@ -548,6 +548,43 @@ func TestExtractKeepsConsumedModuleArchiveWhenExtractionFails(t *testing.T) {
 	}
 }
 
+func TestApplyHAKManifestRefusesUnsetSourcePath(t *testing.T) {
+	root := t.TempDir()
+	mustMkdir(t, filepath.Join(root, "assets"))
+	mustMkdir(t, filepath.Join(root, "build"))
+	mustMkdir(t, filepath.Join(root, "module"))
+	mustWriteFile(t, filepath.Join(root, "nwn-tool.yaml"), `
+module:
+  name: Test Module
+  resref: testmod
+paths:
+  assets: assets
+  build: build
+`)
+	mustWriteFile(t, filepath.Join(root, "build", "haks.json"), `{"module_haks":["core"],"haks":[]}`)
+	mustWriteFile(t, filepath.Join(root, "module", "module.ifo.json"), "{}\n")
+
+	p, err := project.Load(root)
+	if err != nil {
+		t.Fatalf("load project: %v", err)
+	}
+
+	_, err = ApplyHAKManifest(p, filepath.Join(root, "build", "haks.json"))
+	if err == nil {
+		t.Fatal("expected apply manifest to fail")
+	}
+	if !strings.Contains(err.Error(), "paths.source is not configured") {
+		t.Fatalf("expected missing source path error, got %v", err)
+	}
+	raw, readErr := os.ReadFile(filepath.Join(root, "module", "module.ifo.json"))
+	if readErr != nil {
+		t.Fatalf("read root module file: %v", readErr)
+	}
+	if string(raw) != "{}\n" {
+		t.Fatalf("expected root module file to remain unchanged, got %q", string(raw))
+	}
+}
+
 func TestBuildSplitsConfiguredHAKs(t *testing.T) {
 	root := t.TempDir()
 	mustMkdir(t, filepath.Join(root, "src"))