caruso 0.6.2 → 0.6.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e38c7a5007af96bb708d286a62909f07f1c1aa3b3aa800baa4a23f36c1a35814
-  data.tar.gz: 18a217953c0ec7c87bc6d9476c89bbca442fde6b45aec4614e4f58c183a3a760
+  metadata.gz: 9f6520caf8c5e8a4946369e9722ca36685a6c79b933b67336bc02b39b0fca359
+  data.tar.gz: d1b2f7b52ae5746909e173b75fc31e601417bca1ef55af889a56f802a8ae1d24
 SHA512:
-  metadata.gz: 427385d4dca6b37150a1bcf487884db8979883d1e7e3d6caa353217b55609ad43dd97dfd1c85860379a6807c62eb37646eabe491540a54a683ec347e17edbc99
-  data.tar.gz: f04abed100aef554d47572af9507c4d7701782b6321e5f48cfdee677f5cbe5ecd82dffab4e719b2328231ea8bee1a1a041c476ee3322fbdc8653c23333d81ed5
+  metadata.gz: 48d8c7c701c7c1a380672ac77f3025dc69c90c4a5ef7d6fd6e72e50358e69440a9c57ff022f52f94c4970faead782ba04c223246bf766045e4508bca427cf4f8
+  data.tar.gz: 293893a825850e919ca8141203f307c300e9fdba931f80aafadad15a766dd5f28ff6bd061eae53891c5a4da41f061e2b4b6bea5f0108d9b79396e63d82f49296

data/impl.md

@@ -0,0 +1,111 @@
+# Implementation Plan - Evolve Caruso for Claude Code Support
+
+Refining caruso to provide robust support for Claude Code's Commands, Skills, and Hooks, adapting them specifically for the Cursor environment.
+
+## Goal Description
+
+The goal is to transform caruso from a simple markdown copier into a smart adapter that bridges the gap between Claude Code's plugin architecture and Cursor's steering mechanisms. This involves:
+
+- **Skills**: deeply adapting skills by not just copying the markdown, but also bundling associated scripts/ and making them executable.
+- **Commands**: mapping Claude Code commands to Cursor's new .cursor/commands/ structure.
+- **Hooks**: translating Claude Code's hooks/hooks.json events into Cursor's .cursor/hooks.json format.
+- **Fetcher**: upgrading the fetcher to retrieve auxiliary files (scripts, configs) beyond just `.md` files.
+
+## User Review Required
+
+> [!NOTE]
+> **Script Execution Security:** We will trust the "trusted workspace" model of Cursor. This means we will automatically fetch scripts and make them executable (`chmod +x`). Users relying on Caruso are expected to audit the plugins they install, similar to how they would audit an npm package.
+
+## Proposed Changes
+
+### 1. Fetcher Upgrades (`lib/caruso/fetcher.rb`)
+
+The current fetcher is overly focused on *.md files. We need to broaden it to fetch associated resources using an Additive Strategy.
+
+#### [MODIFY] `fetcher.rb`
+
+- **Additive Discovery**: In `fetch_plugin`:
+  - **Logic**:
+    1. **Check Manifest**: Look for `skills` field in `plugin` object (string or array).
+    2. **If Present**: Recursively fetch all files in those specific paths.
+    3. **If Absent**: Fallback to scanning the default `skills/` directory (recursively).
+    4. **Other Components**: Continue scanning for `commands/`, `agents/`, `hooks/` as before.
+
+- **Support Resource Types**:
+  - `skills`: Fetch `SKILL.md` AND recursively fetch `scripts/` directories if found within the skill path.
+
+  - `hooks`: Fetch the `hooks/hooks.json` file (or inline config).
+  - `commands`: Fetch markdown files.
+  - `agents`: Fetch markdown files.
+
+### 2. Adapter Architecture Refactor (`lib/caruso/`)
+
+Refactor the monolithic Adapter class into a dispatcher with specialized strategies.
+
+#### [MODIFY] `adapter.rb`
+Change `Adapter#adapt` to identify the component type and delegate to the appropriate sub-adapter.
+
+#### [NEW] `adapters/base.rb`
+Shared logic for file writing, frontmatter injection, and path sanitization.
+
+#### [NEW] `adapters/skill_adapter.rb`
+**Input:** `skills/<name>/SKILL.md` + `skills/<name>/scripts/*`
+**Output:**
+- `.cursor/rules/caruso/<marketplace>/<skill>/<skill>.mdc` (The rule)
+- `.cursor/scripts/caruso/<marketplace>/<skill>/*` (The scripts)
+
+**Logic:**
+1. Copy scripts to `.cursor/scripts/caruso/<marketplace>/<skill>/`.
+2. Ensure scripts are executable (`chmod +x`).
+3. **Paths:** Do NOT rewrite paths in the markdown (to avoid messiness).
+4. **Context:** Inject a location hint into the Rule's frontmatter `description` or prepended content:
+   ```yaml
+   description: Imported from <skill>. Scripts located at: .cursor/scripts/caruso/<marketplace>/<skill>/
+   ```
+
+#### [NEW] `adapters/agent_adapter.rb`
+**Input:** `agents/<name>.md`
+**Output:** `.cursor/rules/caruso/<marketplace>/agents/<name>.mdc`
+**Logic:**
+- Copy content.
+- Wrap as a "Persona" rule if needed, or simple markdown rule.
+
+#### [NEW] `adapters/command_adapter.rb`
+**Input:** `commands/<name>.md`
+**Output:** `.cursor/commands/<name>.md`
+**Logic:**
+- Basic markdown copy.
+- Frontmatter cleanup (remove Claude-specific fields if necessary).
+
+#### [NEW] `adapters/hook_adapter.rb`
+**Input:** `hooks/hooks.json`
+**Output:** Merged/Updated `.cursor/hooks.json`
+**Logic:**
+- Parse source JSON.
+- Map events (e.g., `PostToolUse` -> `afterFileEdit`).
+- Write/Merge into project's `hooks.json`.
+
+### 3. CLI Updates (`lib/caruso/cli.rb`)
+
+#### [MODIFY] `cli.rb`
+- Update `install` command to handle multiple file types returned by the upgraded fetcher.
+- Ensure `uninstall` cleans up the directories (scripts, etc) correctly.
+
+## Verification Plan
+
+### Automated Tests
+- **Fetcher Tests**: Mock a plugin structure with `scripts/` and verify they are returned in the file list.
+- **Adapter Tests**:
+  - Feed a `SKILL.md` + script to `SkillAdapter` and verify output structure and chmod.
+  - Feed a `hooks.json` and verify the event translation.
+
+### Manual Verification
+- **Skills**: Install a plugin with a script (e.g., a "linter" skill).
+  - Verify file exists at `.cursor/scripts/.../lint.sh`.
+  - Verify it is executable.
+  - Verify the Rule markdown is present.
+- **Commands**: Install a command plugin.
+  - Verify file exists at `.cursor/commands/...`.
+  - Test running the command in Cursor (Cmd+K `/command`).
+- **Hooks**: Install a hook plugin.
+  - Check `.cursor/hooks.json` contains the mapped event.

data/lib/caruso/adapter.rb

@@ -1,113 +1,26 @@
 # frozen_string_literal: true
 
-require "fileutils"
-require "yaml"
-require_relative "safe_file"
-require_relative "path_sanitizer"
+require_relative "adapters/dispatcher"
 
 module Caruso
   class Adapter
-    attr_reader :files, :target_dir, :agent, :marketplace_name, :plugin_name
-
+    # Preserving the interface for CLI compatibility
     def initialize(files, target_dir:, marketplace_name:, plugin_name:, agent: :cursor)
       @files = files
       @target_dir = target_dir
-      @agent = agent
       @marketplace_name = marketplace_name
       @plugin_name = plugin_name
-      FileUtils.mkdir_p(@target_dir)
+      @agent = agent
     end
 
     def adapt
-      created_files = []
-      files.each do |file_path|
-        content = SafeFile.read(file_path)
-
-        adapted_content = inject_metadata(content, file_path)
-        created_file = save_file(file_path, adapted_content)
-        created_files << created_file
-      end
-      created_files
-    end
-
-    private
-
-    def inject_metadata(content, file_path)
-      # Check if frontmatter exists
-      if content.match?(/\A---\s*\n.*?\n---\s*\n/m)
-        # If it exists, we might need to append to it or modify it
-        # For now, we assume existing frontmatter is "good enough" but might need 'globs' for Cursor
-        ensure_cursor_globs(content) if agent == :cursor
-      else
-        # No frontmatter, prepend it
-        create_frontmatter(file_path) + content
-      end
-    end
-
-    def ensure_cursor_globs(content)
-      # Add required Cursor metadata fields if missing
-      # globs: [] enables semantic search (Apply Intelligently)
-      # alwaysApply: false means it won't apply to every chat session
-
-      unless content.include?("globs:")
-        content.sub!(/\A---\s*\n/, "---\nglobs: []\n")
-      end
-
-      unless content.include?("alwaysApply:")
-        # Add after the first line of frontmatter
-        content.sub!(/\A---\s*\n/, "---\nalwaysApply: false\n")
-      end
-
-      content
-    end
-
-    def create_frontmatter(file_path)
-      filename = File.basename(file_path)
-      <<~YAML
-        ---
-        description: Imported rule from #{filename}
-        globs: []
-        alwaysApply: false
-        ---
-      YAML
-    end
-
-    def save_file(original_path, content)
-      filename = File.basename(original_path, ".*")
-
-      # Rename SKILL.md to the skill name (parent directory) to avoid collisions
-      if filename.casecmp("skill").zero?
-        filename = File.basename(File.dirname(original_path))
-      end
-
-      extension = agent == :cursor ? ".mdc" : ".md"
-      output_filename = "#{filename}#{extension}"
-
-      # Extract component type from original path (commands/agents/skills)
-      component_type = extract_component_type(original_path)
-
-      # Build nested directory structure for Cursor
-      # Build nested directory structure for Cursor
-      # Structure: .cursor/rules/caruso/marketplace/plugin/component-type/file.mdc
-      subdirs = File.join("caruso", marketplace_name, plugin_name, component_type)
-      output_dir = File.join(@target_dir, subdirs)
-      FileUtils.mkdir_p(output_dir)
-      target_path = File.join(output_dir, output_filename)
-
-      File.write(target_path, content)
-      puts "Saved: #{target_path}"
-
-      # Return relative path from target_dir
-      File.join(subdirs, output_filename)
-    end
-
-    def extract_component_type(file_path)
-      # Extract component type (commands/agents/skills) from path
-      return "commands" if file_path.include?("/commands/")
-      return "agents" if file_path.include?("/agents/")
-      return "skills" if file_path.include?("/skills/")
-
-      raise Caruso::Error, "Cannot determine component type from path: #{file_path}"
+      Caruso::Adapters::Dispatcher.adapt(
+        @files,
+        target_dir: @target_dir,
+        marketplace_name: @marketplace_name,
+        plugin_name: @plugin_name,
+        agent: @agent
+      )
     end
   end
 end

data/lib/caruso/adapters/base.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "yaml"
+require_relative "../safe_file"
+require_relative "../path_sanitizer"
+
+module Caruso
+  module Adapters
+    class Base
+      attr_reader :files, :target_dir, :agent, :marketplace_name, :plugin_name
+
+      def initialize(files, target_dir:, marketplace_name:, plugin_name:, agent: :cursor)
+        @files = files
+        @target_dir = target_dir
+        @agent = agent
+        @marketplace_name = marketplace_name
+        @plugin_name = plugin_name
+        FileUtils.mkdir_p(@target_dir)
+      end
+
+      def adapt
+        raise NotImplementedError, "#{self.class.name}#adapt must be implemented"
+      end
+
+      protected
+
+      def save_file(relative_path, content, extension: nil)
+        filename = File.basename(relative_path, ".*")
+        
+        # Preserve original extension if none provided
+        ext = extension || File.extname(relative_path)
+        
+        # Rename SKILL.md to the skill name (parent directory) to avoid collisions
+        # This is specific to Skills, might move to SkillAdapter later, but keeping behavior for now
+        if filename.casecmp("skill").zero?
+          filename = File.basename(File.dirname(relative_path))
+        end
+
+        output_filename = "#{filename}#{ext}"
+
+        # Build nested directory structure: .cursor/rules/caruso/marketplace/plugin/component/file
+        # Component type is derived from the class name or passed in?
+        # For base, we might need a way to determine output path more flexibly.
+        # But sticking to current behavior:
+        
+        component_type = extract_component_type(relative_path)
+        subdirs = File.join("caruso", marketplace_name, plugin_name, component_type)
+        output_dir = File.join(target_dir, subdirs)
+        
+        FileUtils.mkdir_p(output_dir)
+        target_path = File.join(output_dir, output_filename)
+
+        File.write(target_path, content)
+        puts "Saved: #{target_path}"
+
+        File.join(subdirs, output_filename)
+      end
+
+      def extract_component_type(file_path)
+        # Extract component type (commands/agents/skills) from path
+        return "commands" if file_path.include?("/commands/")
+        return "agents" if file_path.include?("/agents/")
+        return "skills" if file_path.include?("/skills/")
+        
+        # Fallback or specific handling for other types
+        "misc"
+      end
+
+      def inject_metadata(content, file_path)
+        if content.match?(/\A---\s*\n.*?\n---\s*\n/m)
+          ensure_cursor_globs(content) if agent == :cursor
+        else
+          create_frontmatter(file_path) + content
+        end
+      end
+
+      def ensure_cursor_globs(content)
+        unless content.include?("globs:")
+          content.sub!(/\A---\s*\n/, "---\nglobs: []\n")
+        end
+
+        unless content.include?("alwaysApply:")
+          content.sub!(/\A---\s*\n/, "---\nalwaysApply: false\n")
+        end
+
+        content
+      end
+
+      def create_frontmatter(file_path)
+        filename = File.basename(file_path)
+        <<~YAML
+          ---
+          description: Imported rule from #{filename}
+          globs: []
+          alwaysApply: false
+          ---
+        YAML
+      end
+    end
+  end
+end

data/lib/caruso/adapters/dispatcher.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require_relative "markdown_adapter"
+require_relative "skill_adapter"
+
+module Caruso
+  module Adapters
+    class Dispatcher
+      def self.adapt(files, target_dir:, marketplace_name:, plugin_name:, agent: :cursor)
+        created_files = []
+        remaining_files = files.dup
+
+        # 1. Identify and Process Skill Clusters
+        # Find all SKILL.md files to serve as anchors
+        skill_anchors = remaining_files.select { |f| File.basename(f).casecmp("skill.md").zero? }
+
+        skill_anchors.each do |anchor|
+          skill_dir = File.dirname(anchor)
+          
+          # Find all files that belong to this skill's directory (recursive)
+          skill_cluster = remaining_files.select { |f| f.start_with?(skill_dir) }
+          
+          # Use SkillAdapter for this cluster
+          adapter = SkillAdapter.new(
+            skill_cluster,
+            target_dir: target_dir,
+            marketplace_name: marketplace_name,
+            plugin_name: plugin_name,
+            agent: agent
+          )
+          created_files.concat(adapter.adapt)
+          
+          # Remove processed files
+          remaining_files -= skill_cluster
+        end
+
+        # 2. Process Remaining Files (Commands, Agents, etc.) via MarkdownAdapter
+        if remaining_files.any?
+          adapter = MarkdownAdapter.new(
+            remaining_files,
+            target_dir: target_dir,
+            marketplace_name: marketplace_name,
+            plugin_name: plugin_name,
+            agent: agent
+          )
+          created_files.concat(adapter.adapt)
+        end
+
+        created_files
+      end
+    end
+  end
+end

data/lib/caruso/adapters/markdown_adapter.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Caruso
+  module Adapters
+    class MarkdownAdapter < Base
+      def adapt
+        created_files = []
+        files.each do |file_path|
+          content = SafeFile.read(file_path)
+          adapted_content = inject_metadata(content, file_path)
+          
+          extension = agent == :cursor ? ".mdc" : ".md"
+          created_file = save_file(file_path, adapted_content, extension: extension)
+          
+          created_files << created_file
+        end
+        created_files
+      end
+    end
+  end
+end

data/lib/caruso/adapters/skill_adapter.rb

@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Caruso
+  module Adapters
+    class SkillAdapter < Base
+      def adapt
+        created_files = []
+        
+        # Separate SKILL.md from other files (scripts, etc.)
+        skill_file = files.find { |f| File.basename(f).casecmp("skill.md").zero? }
+        other_files = files - [skill_file]
+
+        if skill_file
+          skill_root = File.dirname(skill_file)
+          skill_name = File.basename(skill_root)
+          
+          # Inject script location hint
+          # Targeted script location: .cursor/scripts/caruso/<market>/<plugin>/<skill_name>/
+          script_location = ".cursor/scripts/caruso/#{marketplace_name}/#{plugin_name}/#{skill_name}/"
+          
+          content = SafeFile.read(skill_file)
+          adapted_content = inject_skill_metadata(content, skill_file, script_location)
+          
+          # Save as Rule (.mdc)
+          extension = agent == :cursor ? ".mdc" : ".md"
+          created_file = save_file(skill_file, adapted_content, extension: extension)
+          created_files << created_file
+          
+          # Process Scripts/Assets -> .cursor/scripts/...
+          other_files.each do |file_path|
+            # Calculate path relative to the skill root
+            # e.g. source: .../skills/auth/scripts/login.sh
+            #      root:   .../skills/auth
+            #      rel:    scripts/login.sh
+            relative_path_from_root = file_path.sub(skill_root + "/", "")
+            
+            created_script = save_script(file_path, skill_name, relative_path_from_root)
+            created_files << created_script
+          end
+        end
+
+        created_files
+      end
+
+      private
+
+      def inject_skill_metadata(content, file_path, script_location)
+        # Inject script location into description
+        hint = "Scripts located at: #{script_location}"
+        
+        if content.match?(/\A---\s*\n.*?\n---\s*\n/m)
+          # Update existing frontmatter
+          content.sub!(/^description: (.*)$/, "description: \\1. #{hint}")
+          ensure_cursor_globs(content)
+        else
+          # Create new frontmatter with hint
+          create_skill_frontmatter(file_path, hint) + content
+        end
+      end
+
+      def create_skill_frontmatter(file_path, hint)
+        filename = File.basename(file_path)
+        <<~YAML
+          ---
+          description: Imported skill from #{filename}. #{hint}
+          globs: []
+          alwaysApply: false
+          ---
+        YAML
+      end
+
+      def save_script(source_path, skill_name, relative_sub_path)
+        # Construct target path in .cursor/scripts
+        # .cursor/scripts/caruso/<marketplace>/<plugin>/<skill_name>/<relative_sub_path>
+        
+        scripts_root = File.join(target_dir, "..", "scripts", "caruso", marketplace_name, plugin_name, skill_name)
+        # Note: target_dir passed to adapter is usually .cursor/rules.
+        # So .. -> .cursor -> scripts
+        
+        target_path = File.join(scripts_root, relative_sub_path)
+        output_dir = File.dirname(target_path)
+        
+        FileUtils.mkdir_p(output_dir)
+        FileUtils.cp(source_path, target_path)
+        
+        # Make executable
+        File.chmod(0755, target_path)
+        
+        puts "Saved script: #{target_path}"
+        
+        # Return relative path for tracking/reporting
+        # We start from .cursor (parent of target_dir) ideally?
+        # Or just return the absolute path for now?
+        target_path
+      end
+    end
+  end
+end

data/lib/caruso/fetcher.rb

@@ -181,12 +181,7 @@ module Caruso
       return [] unless SafeDir.exist?(plugin_path)
 
       # Start with default directories
-      files = find_steering_files(plugin_path)
-
-      # Add custom paths if specified (they supplement defaults)
-      files += find_custom_component_files(plugin_path, plugin["commands"]) if plugin["commands"]
-      files += find_custom_component_files(plugin_path, plugin["agents"]) if plugin["agents"]
-      files += find_custom_component_files(plugin_path, plugin["skills"]) if plugin["skills"]
+      files = find_steering_files(plugin_path, plugin)
 
       files.uniq
     end
@@ -210,18 +205,44 @@ module Caruso
       end
     end
 
-    def find_steering_files(plugin_path)
-      # Validate plugin_path before using it in glob
-      # This is safe because plugin_path comes from resolve_plugin_path which returns trusted paths
-      # (either from cache_dir which is under ~/.caruso, or validated local paths)
-      glob_pattern = PathSanitizer.safe_join(plugin_path, "{commands,agents,skills}", "**", "*.md")
+    # Find all steering files based on default locations and manifest overrides
+    # RETURNS: unique list of absolute file paths to fetch
+    def find_steering_files(plugin_path, plugin_data = nil)
+      files = []
 
-      SafeDir.glob(glob_pattern, base_dir: plugin_path).reject do |file|
+      # 1. ALWAYS scan default directories (Additive Strategy)
+      files += glob_plugin_files(plugin_path, "commands", "**", "*.md")
+      files += glob_plugin_files(plugin_path, "agents", "**", "*.md")
+      
+      # For skills, we want recursive default scan if 'skills/' exists
+      # But careful: if we scan default 'skills' recursively here, and then scan strict paths from manifest...
+      # Duplicate handling is fine via uniq.
+      default_skills_path = File.join(plugin_path, "skills")
+      if SafeDir.exist?(default_skills_path)
+         files += find_recursive_component_files(plugin_path, "skills") 
+      end
+
+      # 2. Add manifest-defined paths (if present)
+      if plugin_data
+        files += find_custom_component_files(plugin_path, plugin_data["commands"]) if plugin_data["commands"]
+        files += find_custom_component_files(plugin_path, plugin_data["agents"]) if plugin_data["agents"]
+        files += find_recursive_component_files(plugin_path, plugin_data["skills"]) if plugin_data["skills"]
+      end
+
+      # Filter out noise
+      files.uniq.reject do |file|
         basename = File.basename(file).downcase
-        ["readme.md", "license.md"].include?(basename)
+        ["readme.md", "license.md", "plugin.json"].include?(basename) || File.directory?(file)
       end
     end
 
+    # Helper to glob files safely
+    def glob_plugin_files(plugin_path, *parts)
+       pattern = PathSanitizer.safe_join(plugin_path, *parts)
+       SafeDir.glob(pattern, base_dir: plugin_path)
+    end
+
+    # For Commands/Agents: typically just markdown files, flat or shallow
     def find_custom_component_files(plugin_path, paths)
       # Handle both string and array formats
       paths = [paths] if paths.is_a?(String)
@@ -229,30 +250,49 @@ module Caruso
 
       files = []
       paths.each do |path|
-        # Resolve and sanitize the path relative to plugin_path
-        # This ensures the path stays within plugin_path boundaries
-        begin
-          full_path = PathSanitizer.sanitize_path(File.expand_path(path, plugin_path), base_dir: plugin_path)
-        rescue PathSanitizer::PathTraversalError => e
-          warn "Skipping path outside plugin directory '#{path}': #{e.message}"
-          next
-        end
+        full_path = resolve_safe_path(plugin_path, path)
+        next unless full_path
 
-        # Handle both files and directories
         if File.file?(full_path) && full_path.end_with?(".md")
-          basename = File.basename(full_path).downcase
-          files << full_path unless ["readme.md", "license.md"].include?(basename)
+          files << full_path
         elsif SafeDir.exist?(full_path, base_dir: plugin_path)
-          # Find all .md files in this directory using safe_join
+          # Find all .md files in this directory
           glob_pattern = PathSanitizer.safe_join(full_path, "**", "*.md")
-          SafeDir.glob(glob_pattern, base_dir: plugin_path).each do |file|
-            basename = File.basename(file).downcase
-            files << file unless ["readme.md", "license.md"].include?(basename)
-          end
+          files += SafeDir.glob(glob_pattern, base_dir: plugin_path)
         end
       end
       files
     end
+    
+    # For SKILLS: Recursive fetch of EVERYTHING (scripts, assets, md)
+    def find_recursive_component_files(plugin_path, paths)
+       paths = [paths] if paths.is_a?(String)
+       return [] unless paths.is_a?(Array)
+       
+       files = []
+       paths.each do |path|
+         full_path = resolve_safe_path(plugin_path, path)
+         next unless full_path
+         
+         if File.file?(full_path)
+            files << full_path
+         elsif SafeDir.exist?(full_path, base_dir: plugin_path)
+            # Grab EVERYTHING recursively
+            glob_pattern = PathSanitizer.safe_join(full_path, "**", "*")
+            files += SafeDir.glob(glob_pattern, base_dir: plugin_path)
+         end
+       end
+       files
+    end
+    
+    def resolve_safe_path(plugin_path, relative_path)
+        begin
+          PathSanitizer.sanitize_path(File.expand_path(relative_path, plugin_path), base_dir: plugin_path)
+        rescue PathSanitizer::PathTraversalError => e
+          warn "Skipping path outside plugin directory '#{relative_path}': #{e.message}"
+          nil
+        end
+    end
 
     def local_path?
       !@marketplace_uri.match?(/\Ahttps?:/)

data/lib/caruso/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Caruso
-  VERSION = "0.6.2"
+  VERSION = "0.6.3"
 end