fix: register missing endpoints in LocalApiHost and tighten manifest path containment

Endpoint registration gap (production WPF host was missing 5 routes):
- Add MapProfiles, MapInstall, MapCleanup, MapDiagnostics, MapSafeMode to LocalApiHost
- Sync Program.cs to match: add MapInstall, MapCleanup, MapDiagnostics, MapSafeMode
  (MapProfiles was already present in Program.cs)

BatchReinstallService #4 containment check:
- After resolving relative paths, reject archives whose normalized absolute path
  does not start with the manifest's directory; set SourceArchivePath to empty so
  the existing extension + File.Exists guards skip them with a clear log entry

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: tbirrell0-cell

LSPDFRManager.LocalApi/LocalApiHost.cs

@@ -76,11 +76,16 @@ public static async Task StartAsync(CancellationToken cancellationToken = defaul
         app.MapLogs();
         app.MapCompatibility();
         app.MapConfig();
+        app.MapProfiles();
         app.MapPatrolReadiness();
         app.MapBackups();
         app.MapJobs();
         app.MapBrowse();
         app.MapLibrary();
+        app.MapInstall();
+        app.MapCleanup();
+        app.MapDiagnostics();
+        app.MapSafeMode();
         app.MapFallbackToFile("index.html");
 
         await app.StartAsync(cancellationToken);

LSPDFRManager.LocalApi/Program.cs

@@ -21,12 +21,16 @@
 app.MapLogs();
 app.MapCompatibility();
 app.MapConfig();
-app.MapLibrary();
 app.MapProfiles();
 app.MapPatrolReadiness();
 app.MapBackups();
 app.MapJobs();
 app.MapBrowse();
+app.MapLibrary();
+app.MapInstall();
+app.MapCleanup();
+app.MapDiagnostics();
+app.MapSafeMode();
 app.MapFallbackToFile("index.html");
 
 app.Run("http://127.0.0.1:5284");

Services/BatchReinstallService.cs

@@ -120,12 +120,24 @@ private void RestoreConfigSnapshots(ModManifest manifest, IProgress<string>? pro
 
         // Resolve relative SourceArchivePaths against the manifest's directory so that
         // bare manifest + sibling archives work without absolute paths in the JSON.
-        // Path.GetFullPath also collapses any ../ traversal segments.
+        // Path.GetFullPath collapses any ../ traversal segments.
+        // After normalization, reject paths that escape the manifest directory —
+        // an absolute path in the JSON that points outside the manifest's folder
+        // has no legitimate use case and could reference arbitrary system files.
         var manifestDir = Path.GetDirectoryName(Path.GetFullPath(manifestPath)) ?? string.Empty;
+        var sep = Path.DirectorySeparatorChar;
         foreach (var mod in bare.Mods)
         {
-            if (!string.IsNullOrWhiteSpace(mod.SourceArchivePath) && !Path.IsPathRooted(mod.SourceArchivePath))
+            if (string.IsNullOrWhiteSpace(mod.SourceArchivePath))
+                continue;
+
+            if (!Path.IsPathRooted(mod.SourceArchivePath))
                 mod.SourceArchivePath = Path.GetFullPath(Path.Combine(manifestDir, mod.SourceArchivePath));
+
+            // Reject paths that escape the manifest directory (after normalization).
+            var normalizedDir = manifestDir.TrimEnd(sep) + sep;
+            if (!mod.SourceArchivePath.StartsWith(normalizedDir, StringComparison.OrdinalIgnoreCase))
+                mod.SourceArchivePath = string.Empty; // extension + existence checks will skip it
         }
 
         return (bare, null);