fix(websearch): close review gaps in managed runtime

lib/hooks/websearch-transformer.cjs

@@ -17,6 +17,7 @@
 const { spawnSync } = require('child_process');
 const { createHash } = require('crypto');
 const fs = require('fs');
+const os = require('os');
 const path = require('path');
 
 const isWindows = process.platform === 'win32';
@@ -88,26 +89,35 @@ function isTraceEnabled() {
   return process.env.CCS_WEBSEARCH_TRACE === '1' || process.env.CCS_DEBUG === '1';
 }
 
-function getTraceFilePath() {
-  const fallback = path.join(getCcsDirPath(), 'logs', 'websearch-trace.jsonl');
+function normalizeSafePrefix(inputPath) {
+  return `${path.resolve(inputPath)}${path.sep}`;
+}
+
+function getSafeTracePrefixes() {
+  return [
+    normalizeSafePrefix(path.join(getCcsDirPath(), 'logs')),
+    normalizeSafePrefix(os.tmpdir()),
+    normalizeSafePrefix('/var/log'),
+  ];
+}
+
+function getAllowedTraceFileOverride() {
   const configured = (process.env.CCS_WEBSEARCH_TRACE_FILE || '').trim();
   if (!configured) {
-    return fallback;
+    return null;
   }
 
   const resolved = path.resolve(configured);
-  const safePrefixes = [
-    `${path.resolve(getCcsDirPath())}${path.sep}`,
-    `${path.resolve(process.env.HOME || process.env.USERPROFILE || process.cwd())}${path.sep}`,
-    '/tmp/',
-    '/var/log/',
-  ];
-
-  if (safePrefixes.some((prefix) => resolved.startsWith(prefix))) {
+  if (getSafeTracePrefixes().some((prefix) => resolved.startsWith(prefix))) {
     return resolved;
   }
 
-  return fallback;
+  return null;
+}
+
+function getTraceFilePath() {
+  const fallback = path.join(getCcsDirPath(), 'logs', 'websearch-trace.jsonl');
+  return getAllowedTraceFileOverride() || fallback;
 }
 
 function traceWebSearchEvent(event, payload = {}) {