@aexhq/cli 0.21.0 → 0.22.0

package/dist/cli.mjs

@@ -350,6 +350,25 @@ var SKILL_BUNDLE_LIMITS = {
   defaultDirMode: 493
 };
 var ASSET_ID_PATTERN = /^asset_[A-Za-z0-9_-]{8,128}$/;
+var MOUNT_PATH_PATTERN = /^\/(?:[^/\0\\]+\/?)*$/;
+var MOUNT_PATH_MAX_LENGTH = 512;
+function assertValidMountPath(value, field) {
+  if (value.length === 0 || value.length > MOUNT_PATH_MAX_LENGTH) {
+    throw new Error(`${field} must be 1..${MOUNT_PATH_MAX_LENGTH} chars`);
+  }
+  if (!value.startsWith("/")) {
+    throw new Error(`${field} must be an absolute path starting with '/'`);
+  }
+  if (value.includes("\0") || value.includes("\\")) {
+    throw new Error(`${field} must not contain NUL or backslash`);
+  }
+  if (value.split("/").some((seg) => seg === "..")) {
+    throw new Error(`${field} must not contain '..' traversal segments`);
+  }
+  if (!MOUNT_PATH_PATTERN.test(value)) {
+    throw new Error(`${field} must match ${MOUNT_PATH_PATTERN.source}`);
+  }
+}
 function parseSkillRef(input, path) {
   if (input === null || typeof input !== "object" || Array.isArray(input)) {
     throw new Error(`${path} must be a SkillRef object`);
@@ -401,8 +420,11 @@ function parseAssetRefFields(record, path) {
     throw new Error(`${path}.name must be a non-empty string (<= 128 chars)`);
   }
   const mountPath = record.mountPath;
-  if (mountPath !== void 0 && (typeof mountPath !== "string" || mountPath.length === 0)) {
-    throw new Error(`${path}.mountPath, when provided, must be a non-empty string`);
+  if (mountPath !== void 0) {
+    if (typeof mountPath !== "string") {
+      throw new Error(`${path}.mountPath, when provided, must be a string`);
+    }
+    assertValidMountPath(mountPath, `${path}.mountPath`);
   }
   return {
     kind: "asset",

package/dist/cli.mjs.sha256

@@ -1 +1 @@
-d05e5e074b577553d20fa3680f834b7941fe0cb7692c0a743975fcf36c4ec9b5  cli.mjs
+bfd0fb573fa113fe08d69fc50f246c821bfc9e0acd9bddd6e92775d38120e201  cli.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aexhq/cli",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/aexhq/aex.git"
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "fflate": "^0.8.2",
-    "@aexhq/contracts": "0.21.0"
+    "@aexhq/contracts": "0.22.0"
   },
   "devDependencies": {
     "esbuild": "^0.28.0"