feat(header_injector): détection de licence robuste; pas d'injection si absente; i18n via API_SDK (sctx.tr)

Author: PyCompiler ARK++ Team

API_SDK/__init__.py

@@ -188,18 +188,50 @@ def wrap_post_context(post_ctx: PostCompileContext, *, log_fn: Optional[Any] = N
     """Wrap an ACASL PostCompileContext into SDKContext for reuse of the same helpers.
     - Copies workspace root and artifacts
     - Loads workspace config
+    - Enforces ACASL scope: restrict file operations to engine output directory when provided
     """
     try:
         ws = Path(getattr(post_ctx, "workspace_root", "."))
     except Exception:
         ws = Path(".")
     root = ws.resolve()
     cfg = load_workspace_config(root)
+    # Resolve allowed output directory (ACASL scope)
+    allowed_dir = None
     try:
-        arts = list(getattr(post_ctx, "artifacts", []) or [])
+        od = getattr(post_ctx, "output_dir", None)
+        if od:
+            try:
+                allowed_dir = Path(str(od)).resolve()
+            except Exception:
+                allowed_dir = None
+    except Exception:
+        allowed_dir = None
+    # Artifacts: best-effort ensure they are within allowed_dir when set
+    try:
+        arts_in = list(getattr(post_ctx, "artifacts", []) or [])
     except Exception:
-        arts = []
-    return SDKContext(workspace_root=root, config_view=ConfigView(cfg), log_fn=log_fn, engine_id=None, artifacts=arts)
+        arts_in = []
+    arts: list[str] = []
+    if allowed_dir is not None:
+        for a in arts_in:
+            try:
+                rp = Path(a).resolve()
+                _ = rp.relative_to(allowed_dir)
+                arts.append(str(rp))
+            except Exception:
+                # skip artifacts outside of allowed scope
+                continue
+    else:
+        arts = list(arts_in)
+    return SDKContext(
+        workspace_root=root,
+        config_view=ConfigView(cfg),
+        log_fn=log_fn,
+        engine_id=None,
+        artifacts=arts,
+        allowed_dir=allowed_dir,
+    )
 
 
 # -----------------------------

API_SDK/context.py

@@ -42,6 +42,8 @@ class SDKContext:
     engine_id: Optional[str] = None
     plugin_id: Optional[str] = None
     artifacts: list[str] = field(default_factory=list)
+    # ACASL-only scope: when set, all file operations are restricted to this directory
+    allowed_dir: Optional[Path] = None
     redact_logs: bool = True
     debug_enabled: bool = False
     _iter_cache: dict[tuple[tuple[str, ...], tuple[str, ...]], list[Path]] = field(
@@ -181,10 +183,27 @@ def is_within_workspace(self, p: Path) -> bool:
         except Exception:
             return False
 
+    def is_within_allowed(self, p: Path) -> bool:
+        """Return True if path is within the allowed_dir (ACASL scope) when set; otherwise True."""
+        try:
+            if self.allowed_dir is None:
+                return True
+            _ = p.resolve().relative_to(self.allowed_dir.resolve())
+            return True
+        except Exception:
+            return False
+
+    def is_within_scope(self, p: Path) -> bool:
+        """Scope check used by file helpers: within workspace and, when set, within allowed_dir."""
+        try:
+            return self.is_within_workspace(p) and self.is_within_allowed(p)
+        except Exception:
+            return False
+
     def safe_path(self, *parts: Pathish) -> Path:
         p = self.path(*parts).resolve()
-        if not self.is_within_workspace(p):
-            raise ValueError(f"Path escapes workspace: {p}")
+        if not self.is_within_scope(p):
+            raise ValueError(f"Path not allowed (outside output_dir/workspace): {p}")
         return p
 
     def require_files(self, paths: Sequence[Pathish]) -> list[Path]:
@@ -220,14 +239,14 @@ def iter_files(
         enforce_workspace: bool = True,
         max_files: Optional[int] = None,
     ) -> Iterable[Path]:
-        root = self.workspace_root
+        root = self.allowed_dir or self.workspace_root
         ex_patterns = list(exclude or [])
         count = 0
         for p in root.rglob("*"):
             try:
                 if not p.is_file():
                     continue
-                if enforce_workspace and not self.is_within_workspace(p):
+                if enforce_workspace and not self.is_within_scope(p):
                     continue
                 rel = p.relative_to(root).as_posix()
                 if ex_patterns and any(fnmatch.fnmatch(rel, ex) for ex in ex_patterns):
@@ -263,14 +282,14 @@ def iter_project_files(
                     return
             except Exception:
                 key = None
-        root = self.workspace_root
+        root = self.allowed_dir or self.workspace_root
         matches: list[Path] = []
         count = 0
         for p in root.rglob("*"):
             try:
                 if not p.is_file():
                     continue
-                if not self.is_within_workspace(p):
+                if not self.is_within_scope(p):
                     continue
                 rel = p.relative_to(root).as_posix()
                 if exc and any(fnmatch.fnmatch(rel, ex) for ex in exc):