@jackControls/dsh-noBS-CAD-step

sessionRegistryDir() defaults to <tmpdir>/nbcad-sessions and runningDesktopPids() accepts any *.json there whose updated_ms is fresh. discoverEngine() then does `for (const pid of runningDesktopPids(...)) { const path = executableOfPid(pid, platform); if (path) return found(path, 'running desktop') }`, engineArgs() gives that binary ['--headless'], and every CAD tool call (nbcad_run_script/nbcad_inspect_step/nbcad_check) spawns it as the harness user. Any local user who can create/populate that temp directory before the CAD app does, and who has a process of their own, gets their own binary ex

Every tool argument (script_path, step_path, print_path, out_png, and the .holes.json sibling written by holesJsonFor) goes through resolvePath and is handed verbatim to the engine or to the native probe, which reads and writes it with the user's rights; the tool descriptions promise workspace-relative paths but nothing enforces it, although insideDir() exists in the same file. A prompt-injected print (e.g. a PDF carrying instruction text) can therefore make the model render any local PDF/PNG/JPG into a picture it can read, or overwrite any writable file with probe output.

Rendered pages are cached as <filename>-<len>-<mtime>-<dpi>-<page>.pgm under $PRINT_PROBE_CACHE or the shared OS temp dir and read back before rendering, so another local user can pre-place a file with a matching key; calibrate/crop/ring-score/symbols would then analyse wrong pixels and report confident but incorrect hole geometry with no error. A corrupted PGM also reaches the unchecked `data[idx..idx + w * h]` slice in parse_pgm (panic, reported as a JSON error).