ace-prompt-prep 0.25.6 → 0.25.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 12b7b66b436a6d0f01c9201277b63ca7fd84fa2ed741022d64f4c3df6cdbdb73
-  data.tar.gz: eb2fd80970e06094f6ffecf128469ae69dadcb6e175e6a361cd45310cb295046
+  metadata.gz: 9bee1d36cf1dc194defba79f0106cd45b9914cebcd8ff7df548966a3cc60c048
+  data.tar.gz: dfa6b8109ccdf9690ebdae87d155190be2c239c73dc299cb68d4937399b66341
 SHA512:
-  metadata.gz: a4c8c27edd364f41c432f09fe92a1ad6cdb75845af9d3e617c986ba1e0e03b98cdc54dfb1528b19957e53e84b0ca35e7653f99759ffe9f20a5ff547924877b40
-  data.tar.gz: b7a5871d5ffd66296a608102622f7ae3e3bc3924b93ddccc1dde7ba2feb964033d87d13d59c2b8e39c50e6f3ccd54a89a415dde2027e137cc99cae789297f6a6
+  metadata.gz: 89b54e6d74589f0e2131e812cea28375fd6c54a09f0189239a207c01bf506c113a9fba88f1de50a7bbf73a94937bf2e7e437292a4c837310c95bb22ba416a7dc
+  data.tar.gz: f40d948adbf19b1efbfc4726287469233f233774ce6db6c18ac3e59e30a455466618f2819e3d0ecd3e919492a02f51e25fe579476385fc116edecde85807c715

data/CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.25.7] - 2026-06-30
+
+### Fixed
+- Hardened prompt-file root-boundary checks by canonicalizing symlinked paths and missing descendants before rejecting files outside the project.
+
 ## [0.25.6] - 2026-04-19
 
 ### Technical

data/lib/ace/prompt_prep/molecules/bundle_loader.rb

@@ -44,15 +44,10 @@ module Ace
             end
 
             # Resolve symlinks and validate project boundaries
-            real_path = begin
-              File.realpath(prompt_path)
-            rescue
-              prompt_path
-            end
             project_root = Ace::Support::Fs::Molecules::ProjectRootFinder.find_or_current
 
-            unless real_path.start_with?(project_root)
-              warn "Error: File path resolves outside project: #{real_path}"
+            unless path_within_root?(prompt_path, project_root)
+              warn "Error: File path resolves outside project: #{canonical_path(prompt_path)}"
               return ""
             end
 
@@ -172,6 +167,33 @@ module Ace
 
           true
         end
+
+        def self.path_within_root?(path, root)
+          canonical = canonical_path(path)
+          canonical_root = canonical_path(root)
+          canonical == canonical_root || canonical.start_with?("#{canonical_root}#{File::SEPARATOR}")
+        end
+
+        def self.canonical_path(path)
+          expanded = File.expand_path(path)
+          return File.realpath(expanded) if File.exist?(expanded)
+
+          canonical_missing_path(expanded)
+        rescue
+          File.expand_path(path)
+        end
+
+        def self.canonical_missing_path(path)
+          parent = path
+          suffix = []
+          until File.exist?(parent) || parent == File.dirname(parent)
+            suffix.unshift(File.basename(parent))
+            parent = File.dirname(parent)
+          end
+          return path unless File.exist?(parent)
+
+          File.join(File.realpath(parent), *suffix)
+        end
       end
     end
   end

data/lib/ace/prompt_prep/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module PromptPrep
-    VERSION = '0.25.6'
+    VERSION = '0.25.7'
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-prompt-prep
 version: !ruby/object:Gem::Version
-  version: 0.25.6
+  version: 0.25.7
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-04-20 00:00:00.000000000 Z
+date: 2026-06-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-support-config