@ai-development-environment/control-agent 0.0.90 → 0.0.91

package/dist/control-agent.js

@@ -6172,6 +6172,7 @@ var WORKTREE_OPERATIONS = [
   "PULL",
   "PUSH",
   "RESET",
+  "CLEAR_LOCK",
   "STASH_ALL",
   "STAGE_ALL",
   "UNSTAGE_ALL"
@@ -14355,6 +14356,20 @@ function rootPath(location) {
   }
   return path;
 }
+function isContainedPath(base, candidate) {
+  return candidate === base || candidate.startsWith(`${base}${sep6}`);
+}
+async function resolvedSkillRoot(location) {
+  const root = rootPath(location);
+  const resolvedRoot = await realpath6(root);
+  if (location.scope === "PROJECT") {
+    const resolvedProject = await realpath6(location.folder);
+    if (!isContainedPath(resolvedProject, resolvedRoot)) {
+      throw new Error("Project skill root resolves outside the project folder");
+    }
+  }
+  return { root, resolvedRoot };
+}
 function targetForFolder(targets, folder) {
   return folder ? targets.find((target2) => resolve6(target2.folder) === resolve6(folder)) : void 0;
 }
@@ -14395,14 +14410,15 @@ async function listPackageFiles(skillDirectory) {
   await visit(skillDirectory);
   return files;
 }
-async function readPackage(directory) {
+async function readPackage(directory, resolvedRoot) {
   const metadata = await lstat3(directory);
-  let resolvedDirectory = directory;
-  if (metadata.isSymbolicLink()) {
-    resolvedDirectory = await realpath6(directory);
-  } else if (!metadata.isDirectory()) {
+  if (!metadata.isSymbolicLink() && !metadata.isDirectory()) {
     throw new Error("Skill path is not a directory");
   }
+  const resolvedDirectory = await realpath6(directory);
+  if (!isContainedPath(resolvedRoot, resolvedDirectory)) {
+    throw new Error("Skill package resolves outside its configured root");
+  }
   const files = await listPackageFiles(resolvedDirectory);
   const definition = files.find((file) => file.path === "SKILL.md");
   if (!definition) throw new Error("Skill does not contain SKILL.md");
@@ -14442,6 +14458,15 @@ function consumersForRoot(configured, rootKind, scope) {
 async function scanRoot2(location, configured, targets, warnings) {
   const root = rootPath(location);
   if (!await directoryExists(root)) return [];
+  let resolvedRoot;
+  try {
+    resolvedRoot = (await resolvedSkillRoot(location)).resolvedRoot;
+  } catch (error) {
+    warnings.push(
+      `${root}: ${error instanceof Error ? error.message : String(error)}`
+    );
+    return [];
+  }
   const consumers = consumersForRoot(
     configured,
     location.rootKind,
@@ -14454,7 +14479,7 @@ async function scanRoot2(location, configured, targets, warnings) {
     if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
     const directory = join9(root, entry.name);
     try {
-      const skillPackage = await readPackage(directory);
+      const skillPackage = await readPackage(directory, resolvedRoot);
       const relativeDirectory = location.folder ? relative6(location.folder, directory).split(sep6).join("/") : "";
       installations.push({
         ...location,
@@ -14529,9 +14554,10 @@ var readSkills = async (payload) => {
     if (!allowed.has(`${request.scope}:${root}`)) {
       throw new Error("Requested skill root is not enabled or configured");
     }
+    const { resolvedRoot } = await resolvedSkillRoot(request);
     packages.push({
       ...request,
-      package: await readPackage(join9(root, request.skillName))
+      package: await readPackage(join9(root, request.skillName), resolvedRoot)
     });
   }
   return { ...successfulProcess6, packages };
@@ -18012,6 +18038,9 @@ var operateWorktree = async (payload, timeoutMs, signal) => {
       await runGit(["clean", "-fd"], "Could not remove untracked files");
       break;
     }
+    case "CLEAR_LOCK":
+      await rm10(join14(input.gitDirectory, "index.lock"), { force: true });
+      break;
     case "STASH_ALL":
       await runGit(["stash", "push", "--include-untracked"], "Stash failed");
       break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-development-environment/control-agent",
-  "version": "0.0.90",
+  "version": "0.0.91",
   "description": "Control agent for the AI Development Environment",
   "license": "MIT",
   "repository": {