ace-support-core 0.31.0 → 0.32.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 24d4b0dce143ebd6e3a05238ffa19ba782ccebf08c7a9027db568d641f1a07e3
-  data.tar.gz: 2ea4aa3a99418d953d05a4622760d3142fcf2593fce656f9c95da5dc0c3d3227
+  metadata.gz: bbf3729aa95960c4ae5dff473126e61e991c0b036817165602753b6b39e9a67d
+  data.tar.gz: a5152044d579586750e8623a378b01dd1a53d8032be9621eea26343fc9a15b5d
 SHA512:
-  metadata.gz: 16fb57a03877b9e0602606aa6869613a823d09553fd477921d4827ab2d485c1cdb2620a6ce133d55c9aa00fe2931772aa8ded2354ed12b02d2016cc5c8d0e1a9
-  data.tar.gz: c5dc7f819ca8bd17eac6b24b1c802befbcda08b320a317c2f3b7ad1527b8f2cb08f64866964aadda87f5036908bd2dc6d2502c43e0f77b3ce26de29d9b6c4405
+  metadata.gz: 204925a3ee7699019defcf6c038f34ed4d81f056b9ae2ec08acd90788de2d61bcc20d2f833f81db4f9d81ca20afefdce7dca13ed34e477de4ffa2df92eeb24ce
+  data.tar.gz: 6cdf410a04b8078f4b915d789adbb71eb8038b0968351aae7bc9127bd7ed2bcd9aabc9cab5677a4eb4426378e4cfb9d514c9bf861573cca3849a64d2fe0b244c

data/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.32.0] - 2026-09-24
+
+### Added
+
+- Restrict file aggregation to an allowed root and explicit trusted paths for review context.
+
+## [0.31.1] - 2026-09-02
+
+### Technical
+- Included in the coordinated all-package patch release preparation for ACE monorepo review.
 ## [0.31.0] - 2026-08-12
 
 ### Changed

data/lib/ace/core/molecules/file_aggregator.rb

@@ -13,6 +13,8 @@ module Ace
           @max_size = options[:max_size] || Atoms::FileReader::MAX_FILE_SIZE
           @base_dir = options[:base_dir] || Ace::Support::Fs::Molecules::ProjectRootFinder.find_or_current
           @exclude_patterns = options[:exclude] || []
+          @allowed_root = File.realpath(options[:allowed_root]) if options[:allowed_root]
+          @allowed_paths = Array(options[:allowed_paths])
         end
 
         # Aggregate files from patterns
@@ -142,6 +144,10 @@ module Ace
           # Make path relative to base directory for display
           display_path = make_relative_path(resolved_path)
 
+          if @allowed_root && !inside_allowed_root?(resolved_path)
+            raise ArgumentError, "File outside allowed root: #{display_path}"
+          end
+
           # Check if file is readable
           unless Atoms::FileReader.readable?(resolved_path)
             result[:errors] << "File not readable: #{display_path}"
@@ -175,6 +181,14 @@ module Ace
           end
         end
 
+        def inside_allowed_root?(path)
+          real_path = File.realpath(path)
+          real_path == @allowed_root || real_path.start_with?("#{@allowed_root}#{File::SEPARATOR}") ||
+            @allowed_paths.include?(real_path)
+        rescue Errno::ENOENT, Errno::EACCES
+          false
+        end
+
         # Make path relative to base directory
         # @param path [String] Path to make relative
         # @return [String] Relative path if possible

data/lib/ace/core/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Core
-    VERSION = "0.31.0"
+    VERSION = "0.32.0"
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-support-core
 version: !ruby/object:Gem::Version
-  version: 0.31.0
+  version: 0.32.0
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-08-12 00:00:00.000000000 Z
+date: 2026-09-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-support-config
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.17'
+        version: '0.18'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.17'
+        version: '0.18'
 - !ruby/object:Gem::Dependency
   name: ace-support-fs
   requirement: !ruby/object:Gem::Requirement