AI-written journey storage code joined unvalidated journeyId values into filesystem paths, letting ../ traverse out of ~/.ui-probe/journeys to read or delete arbitrary files.

+import { JourneyAnalyzer } from '../journey/JourneyAnalyzer.js';+import { JourneyDiscovery } from '../journey/JourneyDiscovery.js'; import {   MCPToolResult,   NavigateParams,@@ -26,6 +32,12 @@ import {   ExportReportParams,   TestRun } from '../types/index.js';+import {+  Journey,+  JourneyExecutionResult,+  RecordingConfig,+  PlaybackConfig+} from '../types/journey.js'; import { MCPUIError, NavigationError, FormInferenceError } from '../utils/errors.js'; import { verifyPage, VerifyPageParams } from '../tools/verify_page.js'; import logger from '../utils/logger.js';@@ -39,6 +51,14 @@ export class MCPServer {   private adaptiveExecutor: AdaptiveExecutor;   private errorEnhancer: ErrorEnhancer; +  // Journey system components+  private journeyStorage: JourneyStorage;+  private journeyValidator: JourneyValidator;+  private journeyAnalyzer: JourneyAnalyzer;+  private journeyDiscovery: JourneyDiscovery;+  private journeyRecorder: JourneyRecorder;+  private journeyPlayer: JourneyPlayer;+   constructor() {     this.server = new Server(       {@@ -60,6 +80,36 @@ export class MCPServer {     this.adaptiveExecutor = new AdaptiveExecutor();     this.errorEnhancer = new ErrorEnhancer(this.llmStrategy); +    // Initialize journey system components+    this.journeyStorage = new JourneyStorage();+    this.journeyValidator = new JourneyValidator(this.journeyStorage);+    this.journeyAnalyzer = new JourneyAnalyzer();+    this.journeyDiscovery = new JourneyDiscovery(this.journeyStorage, this.journeyAnalyzer, this.journeyValidator);++    // Initialize recorder and player with default configs+    const recordingConfig: RecordingConfig = {+      captureScreenshots: true,+      captureNetworkRequests: false,+      ignoredSelectors: ['.loading', '.spinner', '.ads'],+      minimumActionDelay: 500,+      autoGenerateName: true,+      autoGenerateDescription: true,+      smartSelectorGeneration: true+    };++    const playbackConfig: PlaybackConfig = {+      speed: 1.0,+      pauseOnError: true,+      maxRetries: 3,+      screenshotOnFailure: true,+      continueOnNonCriticalErrors: true,+      validateContext: true,+      timeoutMs: 30000+    };++    this.journeyRecorder = new JourneyRecorder(recordingConfig, this.journeyStorage, this.journeyAnalyzer);+    this.journeyPlayer = new JourneyPlayer(playbackConfig, this.journeyValidator, this.journeyStorage);+     this.setupToolHandlers();   } @@ -268,6 +318,251 @@ export class MCPServer {               required: ['runId', 'format'],             },           },+          // Journey Recording and Replay Tools+          {+            name: 'record_journey',+            description: 'Start recording user interactions as a journey',+            inputSchema: {+              type: 'object',+              properties: {+                name: {

+import yaml from 'js-yaml';+import {+  Journey,+  JourneyCollection,+  JourneyTemplate,+  JourneyStorageConfig,+  JourneySearchCriteria,+  JourneySearchResult,+  JourneySchema+} from '../types/journey.js';+import logger from '../utils/logger.js';++export class JourneyStorage {+  private config: JourneyStorageConfig;+  private indexCache: Map<string, Journey> = new Map();+  private collectionsCache: Map<string, JourneyCollection> = new Map();+  private lastIndexUpdate = 0;++  constructor(customConfig?: Partial<JourneyStorageConfig>) {+    this.config = {+      baseDir: path.join(os.homedir(), '.ui-probe', 'journeys'),+      collectionsDir: 'collections',+      templatesDir: 'templates',+      backupsDir: 'backups',+      indexFile: 'index.json',+      maxBackups: 10,+      compressionEnabled: true,+      ...customConfig+    };+  }++  async initialize(): Promise<void> {+    try {+      // Create directory structure+      await this.ensureDirectoryStructure();++      // Load index cache+      await this.loadIndexCache();++      // Load collections cache+      await this.loadCollectionsCache();++      logger.info('Journey storage initialized', {+        baseDir: this.config.baseDir,+        journeyCount: this.indexCache.size+      });+    } catch (error) {+      logger.error('Failed to initialize journey storage', { error });+      throw error;+    }+  }++  async saveJourney(journey: Journey, format: 'yaml' | 'json' = 'yaml'): Promise<void> {+    try {+      // Validate journey schema+      const validatedJourney = JourneySchema.parse(journey);++      // Ensure directories exist+      await this.ensureDirectoryStructure();++      // Determine file path and format+      const extension = format === 'yaml' ? '.yml' : '.json';+      const filename = `${validatedJourney.id}${extension}`;+      const filePath = path.join(this.config.baseDir, filename);++      // Serialize journey data+      let content: string;+      if (format === 'yaml') {+        content = yaml.dump(validatedJourney, {+          indent: 2,+          lineWidth: 120,+          noRefs: true+        });+      } else {+        content = JSON.stringify(validatedJourney, null, 2);+      }++      // Write to file+      await fs.writeFile(filePath, content, 'utf8');++      // Update index cache+      this.indexCache.set(validatedJourney.id, validatedJourney);++      // Update persistent index+      await this.updateIndex();