fix: block group folder path escapes

setup/register.ts

@@ -10,6 +10,7 @@ import path from 'path';
 import Database from 'better-sqlite3';
 
 import { STORE_DIR } from '../src/config.js';
+import { isValidGroupFolder } from '../src/group-folder.js';
 import { logger } from '../src/logger.js';
 import { emitStatus } from './status.js';
 
@@ -59,6 +60,15 @@ export async function run(args: string[]): Promise<void> {
     process.exit(4);
   }
 
+  if (!isValidGroupFolder(parsed.folder)) {
+    emitStatus('REGISTER_CHANNEL', {
+      STATUS: 'failed',
+      ERROR: 'invalid_folder',
+      LOG: 'logs/setup.log',
+    });
+    process.exit(4);
+  }
+
   logger.info(parsed, 'Registering channel');
 
   // Ensure data directory exists