@aixle/insights 0.2.1-staging → 0.2.3-staging

package/README.md

@@ -274,7 +274,8 @@ After the script reports success: **quit and reopen Claude Code / Cursor** so ea
 
 ## Requirements
 
-- Node.js ≥ 20.
+- Node.js >= 20.19.0 — matches `engines.node` in `package.json`, and
+  `src/test/supply-chain-contract.test.ts` fails if the two drift apart.
 - macOS / Linux / Windows. On Windows, the package writes a `cmd /c npx …` wrapper in `~/.claude.json` so Claude Code can spawn the MCP server reliably.
 - `better-sqlite3` is a native module. After a Node upgrade, if SQLite reads start failing, rebuild it from the tools workspace:
 

package/dist/hooks/cursor-hooks-reader.js

@@ -6,9 +6,16 @@ import { markSessionSent } from "../state.js";
 import { postEvent } from "../client.js";
 import { mcpLog } from "../log.js";
 import { shouldIngestHookEvent, mapHookEventToPayload, hookDedupeKey, warnOnCursorVersion, CURSOR_HOOK_STATE_PREFIX, } from "./cursor-hooks-mapper.js";
+import { isRepoPathWithinRoot, normalizeRepoPathCandidate } from "../lib/repo-path-safety.js";
 export { CURSOR_HOOK_STATE_PREFIX };
+/**
+ * `workspace` is `workspace_roots[0]` from the on-disk hooks queue — an
+ * arbitrary JSON string. A plain prefix match would accept
+ * `<scopeDir>/../../elsewhere` (DB90DV-547).
+ */
 function isUnderScopeDir(workspace, scopeDir) {
-    return workspace === scopeDir || workspace.startsWith(scopeDir + "/");
+    const normalized = normalizeRepoPathCandidate(workspace);
+    return normalized !== null && isRepoPathWithinRoot(normalized, scopeDir);
 }
 /**
  * The forwarder redacts the home directory to "~" in workspace_roots for

package/dist/lib/project-resolver.js

@@ -1,5 +1,7 @@
 import { execFileSync } from "node:child_process";
 import { evaluateTransportSecurity } from "./transport-security.js";
+import { isSafeSshHost } from "./spawn-arg-safety.js";
+import { safeGitRepoPath } from "./repo-path-safety.js";
 /** Coerce empty string to undefined so "" is treated as "not set" */
 function coerce(val) {
     return val === "" ? undefined : val;
@@ -48,8 +50,19 @@ export function getGitRemote(verbose) {
     }
 }
 export function getGitRemoteForPath(repoPath, verbose) {
+    // The spawn boundary. `repoPath` is untrusted (Cursor workspace.json, a
+    // composer uri.fsPath, a hook workspace_root, or a Claude transcript cwd), so
+    // it must resolve to a real directory before git reads its .git/config.
+    // Supersedes the isSafeSpawnPathArg check from DB90DV-546, which this
+    // subsumes. See DB90DV-547.
+    const safePath = safeGitRepoPath(repoPath);
+    if (safePath === null) {
+        if (verbose)
+            console.log(`[verbose] Refusing git for unsafe repo path: ${repoPath}`);
+        return null;
+    }
     try {
-        const out = execFileSync("git", ["-C", repoPath, "remote", "get-url", "origin"], {
+        const out = execFileSync("git", ["-C", safePath, "remote", "get-url", "origin"], {
             encoding: "utf-8",
             stdio: ["ignore", "pipe", "pipe"],
             timeout: 5000,
@@ -75,12 +88,21 @@ export function canonicalizeGitRemote(remote, verbose) {
     if (!trimmed)
         return remote;
     const scp = trimmed.match(/^([\w.-]+)@([^:/]+):(.+)$/);
+    /* eslint-disable-next-line security/detect-unsafe-regex -- Flagged only
+       because safe-regex counts `?` as a repetition. Every group is separated by
+       a literal delimiter (`@`, `:`, `/`) that its neighbours exclude, so there
+       is no backtracking ambiguity. Input is a git remote URL, bounded length. */
     const sshUrl = trimmed.match(/^ssh:\/\/(?:([\w.-]+)@)?([^:/]+)(?::\d+)?\/(.+)$/i);
     const host = scp?.[2] ?? sshUrl?.[2];
-    if (!host)
+    // An unvalidated host would be parsed by ssh as an option (DB90DV-546); an
+    // unvalidated `resolved` would be spliced back into the remote and sent to
+    // the lookup endpoint. Both fail open — the remote is returned unchanged.
+    if (!host || !isSafeSshHost(host))
         return trimmed;
     const resolved = resolveSshHostName(host, verbose);
-    if (!resolved || resolved.toLowerCase() === host.toLowerCase())
+    if (!resolved || !isSafeSshHost(resolved))
+        return trimmed;
+    if (resolved.toLowerCase() === host.toLowerCase())
         return trimmed;
     if (verbose)
         console.log(`[verbose] Resolved SSH host alias ${host} -> ${resolved}`);
@@ -90,6 +112,13 @@ export function canonicalizeGitRemote(remote, verbose) {
     return `ssh://${user}${resolved}/${sshUrl[3]}`;
 }
 function resolveSshHostName(host, verbose) {
+    // Defense in depth: the only caller already checks, but this function is the
+    // spawn boundary and must not depend on callers getting it right.
+    if (!isSafeSshHost(host)) {
+        if (verbose)
+            console.log(`[verbose] Refusing ssh -G for option-shaped host: ${host}`);
+        return null;
+    }
     try {
         const out = execFileSync("ssh", ["-G", host], {
             encoding: "utf-8",
@@ -129,6 +158,11 @@ export function repoNameToGitRemoteCandidates(repoName) {
     if (trimmed.includes("://") || trimmed.includes("@")) {
         return [trimmed];
     }
+    /* eslint-disable-next-line security/detect-unsafe-regex -- Star height 2
+       (`+` inside `(…)*`), but the inner group is prefixed by `/`, which is not
+       in [\w.-]. There is no ambiguous overlap, so matching stays linear. The
+       input is a short `owner/repo` slug that already failed the "://" and "@"
+       checks above. */
     if (/^[\w.-]+\/[\w.-]+(\/[\w.-]+)*$/.test(trimmed)) {
         return [`https://github.com/${trimmed}`, `git@github.com:${trimmed}.git`];
     }

package/dist/lib/repo-path-safety.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Normalize an untrusted repo-path candidate. Pure — never touches the
+ * filesystem, so it is safe to call on every payload in a sync.
+ *
+ * Returns an absolute, `..`-collapsed path, or null when the value cannot be a
+ * legitimate workspace path. Rejecting relative values is deliberate: `git -C`
+ * would resolve a relative path against *this* process's cwd, which has nothing
+ * to do with where the value came from. It also rejects Cursor's literal
+ * `"unknown"` placeholder for global hook events.
+ */
+export declare function normalizeRepoPathCandidate(value: string | undefined | null): string | null;
+/**
+ * True when `candidate` is `root` itself or lives beneath it.
+ *
+ * Compares with a trailing `sep` so `/repos/project-evil` is not treated as
+ * inside `/repos/project`, and resolves symlinks so a link inside the root
+ * cannot point out of it.
+ *
+ * When either side does not exist, `realpathSync` throws and the normalized
+ * paths are compared instead. That loses nothing — a path that does not exist
+ * cannot be a symlink, and `resolve()` has already collapsed `..` — and it keeps
+ * containment usable for scope filtering, which legitimately runs against
+ * payload paths naming directories this machine no longer has.
+ */
+export declare function isRepoPathWithinRoot(candidate: string, root: string): boolean;
+/**
+ * The last check before `git -C <path>` runs. Requires the value to resolve to a
+ * real directory: a missing path, a dangling symlink, or a regular file is not a
+ * workspace. (Cursor's `metadata.workspace` is often the `state.vscdb` file
+ * itself, which git would only error on anyway.)
+ *
+ * Returns the canonical real path so `git` runs against exactly what was
+ * checked, narrowing the window between the check and the spawn.
+ */
+export declare function safeGitRepoPath(value: string | undefined | null): string | null;

package/dist/lib/repo-path-safety.js

@@ -0,0 +1,102 @@
+import { realpathSync, statSync } from "node:fs";
+import { isAbsolute, resolve, sep } from "node:path";
+import { isSafeSpawnPathArg } from "./spawn-arg-safety.js";
+/**
+ * Containment for untrusted filesystem paths that end up in `git -C <path>`.
+ *
+ * Every repo path this package resolves is untrusted text: Cursor's
+ * `workspace.json` `folder`, a composer's `workspaceIdentifier.uri.fsPath`, a
+ * hook's `workspace_roots[0]`, or a Claude transcript's `cwd`. None is validated
+ * by its producer — `fileUriToPath` (`readers/cursor.ts:189`) even passes a
+ * non-`file://` value straight through.
+ *
+ * `execFileSync` stops shell injection, but not `git -C ../../../elsewhere`: git
+ * would read that directory's `.git/config` and this package would ship the
+ * remote it found to the DB90 API. See DB90DV-547.
+ *
+ * Semantics are ported from `validatedRealPathWithinRoot`
+ * (`readers/cursor-sqlite.ts:23`), which already guards the Cursor SQLite
+ * reader the same way.
+ */
+function realPathOrNull(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Normalize an untrusted repo-path candidate. Pure — never touches the
+ * filesystem, so it is safe to call on every payload in a sync.
+ *
+ * Returns an absolute, `..`-collapsed path, or null when the value cannot be a
+ * legitimate workspace path. Rejecting relative values is deliberate: `git -C`
+ * would resolve a relative path against *this* process's cwd, which has nothing
+ * to do with where the value came from. It also rejects Cursor's literal
+ * `"unknown"` placeholder for global hook events.
+ */
+export function normalizeRepoPathCandidate(value) {
+    if (typeof value !== "string")
+        return null;
+    const trimmed = value.trim();
+    // Rejects empty, NUL-containing, and option-shaped values (DB90DV-546).
+    if (!isSafeSpawnPathArg(trimmed))
+        return null;
+    if (!isAbsolute(trimmed))
+        return null;
+    return resolve(trimmed);
+}
+/**
+ * True when `candidate` is `root` itself or lives beneath it.
+ *
+ * Compares with a trailing `sep` so `/repos/project-evil` is not treated as
+ * inside `/repos/project`, and resolves symlinks so a link inside the root
+ * cannot point out of it.
+ *
+ * When either side does not exist, `realpathSync` throws and the normalized
+ * paths are compared instead. That loses nothing — a path that does not exist
+ * cannot be a symlink, and `resolve()` has already collapsed `..` — and it keeps
+ * containment usable for scope filtering, which legitimately runs against
+ * payload paths naming directories this machine no longer has.
+ */
+export function isRepoPathWithinRoot(candidate, root) {
+    const normalizedCandidate = resolve(candidate);
+    const normalizedRoot = resolve(root);
+    const realCandidate = realPathOrNull(normalizedCandidate);
+    const realRoot = realPathOrNull(normalizedRoot);
+    // Compare like with like: mixing a realpath against a normalized path would
+    // false-negative on macOS, where /var is a symlink to /private/var.
+    const bothResolve = realCandidate !== null && realRoot !== null;
+    const left = bothResolve ? realCandidate : normalizedCandidate;
+    const right = bothResolve ? realRoot : normalizedRoot;
+    if (left === right)
+        return true;
+    const rootWithSep = right.endsWith(sep) ? right : `${right}${sep}`;
+    return left.startsWith(rootWithSep);
+}
+/**
+ * The last check before `git -C <path>` runs. Requires the value to resolve to a
+ * real directory: a missing path, a dangling symlink, or a regular file is not a
+ * workspace. (Cursor's `metadata.workspace` is often the `state.vscdb` file
+ * itself, which git would only error on anyway.)
+ *
+ * Returns the canonical real path so `git` runs against exactly what was
+ * checked, narrowing the window between the check and the spawn.
+ */
+export function safeGitRepoPath(value) {
+    const normalized = normalizeRepoPathCandidate(value);
+    if (normalized === null)
+        return null;
+    const real = realPathOrNull(normalized);
+    if (real === null)
+        return null;
+    try {
+        if (!statSync(real).isDirectory())
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return real;
+}

package/dist/lib/spawn-arg-safety.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Guards for untrusted values that end up in the argv of a spawned process.
+ *
+ * `execFileSync` prevents *shell* injection but not *argv-option* injection: a
+ * value beginning with `-` is parsed by the child as a command-line option. Git
+ * remotes and workspace paths are untrusted text — they come from a repo the
+ * developer cloned, from Cursor's `workspace.json`, or from a Claude transcript
+ * — so every value derived from them must be checked before it reaches `git`
+ * or `ssh`. See DB90DV-546.
+ */
+/**
+ * True when `host` is safe to pass as an argv element to `ssh`. Accepts real
+ * hostnames, IPv4 literals, and `~/.ssh/config` host aliases.
+ */
+export declare function isSafeSshHost(host: string): boolean;
+/**
+ * True when `value` is safe to pass as a filesystem-path argv element (e.g.
+ * after `git -C`). Deliberately permissive about path *content* — real
+ * workspace paths contain spaces, dashes and drive letters. It only rejects
+ * what makes the child misread the value as an option, plus embedded NUL.
+ *
+ * This is an argv guard, not a containment check: verifying the path points
+ * somewhere legitimate is DB90DV-547.
+ */
+export declare function isSafeSpawnPathArg(value: string): boolean;

package/dist/lib/spawn-arg-safety.js

@@ -0,0 +1,49 @@
+/**
+ * Guards for untrusted values that end up in the argv of a spawned process.
+ *
+ * `execFileSync` prevents *shell* injection but not *argv-option* injection: a
+ * value beginning with `-` is parsed by the child as a command-line option. Git
+ * remotes and workspace paths are untrusted text — they come from a repo the
+ * developer cloned, from Cursor's `workspace.json`, or from a Claude transcript
+ * — so every value derived from them must be checked before it reaches `git`
+ * or `ssh`. See DB90DV-546.
+ */
+/** Longest legal DNS name (253) with headroom for an ssh_config alias. */
+const MAX_HOST_LENGTH = 255;
+/**
+ * Dot-separated labels of alphanumerics, `-` and `_`. A label may not start or
+ * end with `-`, which is what blocks option injection (`-oProxyCommand=…`).
+ * Whitespace, `=`, quotes, backslashes, newlines and NUL are all excluded.
+ * Underscores are allowed because `~/.ssh/config` aliases commonly use them.
+ * IPv6 literals are not covered — the SCP/`ssh://` host capture in
+ * `project-resolver.ts` cannot produce one, since it excludes `:`.
+ */
+const HOST_LABEL = "[A-Za-z0-9_](?:[A-Za-z0-9_-]*[A-Za-z0-9_])?";
+const HOST_PATTERN = new RegExp(`^${HOST_LABEL}(?:\\.${HOST_LABEL})*$`);
+/**
+ * True when `host` is safe to pass as an argv element to `ssh`. Accepts real
+ * hostnames, IPv4 literals, and `~/.ssh/config` host aliases.
+ */
+export function isSafeSshHost(host) {
+    if (host.length === 0 || host.length > MAX_HOST_LENGTH)
+        return false;
+    return HOST_PATTERN.test(host);
+}
+/**
+ * True when `value` is safe to pass as a filesystem-path argv element (e.g.
+ * after `git -C`). Deliberately permissive about path *content* — real
+ * workspace paths contain spaces, dashes and drive letters. It only rejects
+ * what makes the child misread the value as an option, plus embedded NUL.
+ *
+ * This is an argv guard, not a containment check: verifying the path points
+ * somewhere legitimate is DB90DV-547.
+ */
+export function isSafeSpawnPathArg(value) {
+    if (value.length === 0)
+        return false;
+    if (value.startsWith("-"))
+        return false;
+    if (value.includes("\0"))
+        return false;
+    return true;
+}

package/dist/readers/cursor.js

@@ -74,7 +74,10 @@ export function probeCursorGlobalStateDb(verbose = false, baseDir) {
 export function findCursorDbs(baseDir) {
     const dir = join(baseDir ?? cursorUserDir(), "workspaceStorage");
     try {
-        return glob.sync(join(dir, "**", "cursor.db"));
+        // Pattern stays forward-slash and the directory goes through `cwd`. Building
+        // it with `join` emitted `\` on Windows, and glob treats `\` as an escape
+        // character on every platform, so this silently matched nothing there.
+        return glob.sync("**/cursor.db", { cwd: dir, absolute: true });
     }
     catch {
         return [];
@@ -244,7 +247,14 @@ export function findStateVscDbs(baseDir) {
     const results = [];
     results.push(join(userDir, "globalStorage", "state.vscdb"));
     try {
-        results.push(...glob.sync(join(userDir, "workspaceStorage", "**", "state.vscdb")));
+        // Forward-slash pattern + `cwd`, as above. This one mattered most: the
+        // globalStorage path is pushed unconditionally, so on Windows the function
+        // still returned a result while silently dropping every per-workspace
+        // state.vscdb — partial data loss that looked like working software.
+        results.push(...glob.sync("workspaceStorage/**/state.vscdb", {
+            cwd: userDir,
+            absolute: true,
+        }));
     }
     catch {
         /* ignore */

package/dist/risk-scanner.js

@@ -12,6 +12,10 @@ const CATEGORIES = {
         weight: 3,
         patterns: [
             /\b\d{3}-\d{2}-\d{4}\b/g, // SSN
+            /* eslint-disable-next-line security/detect-unsafe-regex -- Flagged for
+               `{3}` inside `(?:…)?`. Every branch is a fixed-length digit run
+               anchored by \b, so the match is bounded and cannot backtrack
+               super-linearly. */
             /\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|6(?:011|5[0-9]{2})[0-9]{12}|(?:2131|1800|35\d{3})\d{11})\b/g, // Credit card
         ],
     },
@@ -19,6 +23,9 @@ const CATEGORIES = {
         weight: 1,
         patterns: [
             /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/gi, // Email
+            /* eslint-disable-next-line security/detect-unsafe-regex -- Flagged for
+               `?` nested in `?`. All quantified groups are fixed-length digit or
+               separator classes anchored by \b; matching is bounded. */
             /\b(?:\+?1[-.\s]?)?(?:\([0-9]{3}\)|[0-9]{3})[-.\s]?[0-9]{3}[-.\s]?[0-9]{4}\b/g, // Phone
         ],
     },

package/dist/sync.d.ts

@@ -67,6 +67,15 @@ export declare function getSyncTelemetry(): {
     lastResult: SyncResult | null;
     recentErrors: string[];
 };
+/**
+ * The repo path for a Cursor payload, normalized and safe to hand to project
+ * resolution. Returns an absolute, `..`-collapsed path or undefined.
+ *
+ * `workspace_folder` comes from the workspace's own `workspace.json` and
+ * `workspace` from a composer `uri.fsPath` or the `state.vscdb` path — all
+ * untrusted. When the preferred field is unusable we fall through to the other
+ * rather than giving up. See DB90DV-547.
+ */
 export declare function cursorRepoPathFromPayload(payload: CursorPayload): string | undefined;
 /**
  * Parallel multi-tool cycle under the global advisory ingest lock (`state.lock`).

package/dist/sync.js

@@ -11,6 +11,7 @@ import { postEvent, postEvents } from "./client.js";
 import { getCostWarning } from "./pricing.js";
 import { acquireSyncLock } from "./lock.js";
 import { getGitRemoteForPath, lookupProjectByRemote, } from "./lib/index.js";
+import { isRepoPathWithinRoot, normalizeRepoPathCandidate, } from "./lib/repo-path-safety.js";
 import { mcpLog } from "./log.js";
 /** Prefix for Claude Code session keys in shared MCP state. */
 export const CLAUDE_STATE_PREFIX = "claude_code:";
@@ -103,8 +104,8 @@ function explicitProjectId(projectId, projectIdSource) {
         : undefined;
 }
 async function resolveProjectIdForRepoPathCached(repoPath, host, token, verbose, cache, allowInsecureHttp = false) {
-    const normalized = repoPath?.trim();
-    if (!normalized)
+    const normalized = normalizeRepoPathCandidate(repoPath);
+    if (normalized === null)
         return null;
     if (cache.has(normalized))
         return cache.get(normalized) ?? null;
@@ -118,15 +119,25 @@ async function resolveProjectIdForRepoPathCached(repoPath, host, token, verbose,
     cache.set(normalized, projectId);
     return projectId;
 }
+/**
+ * The repo path for a Cursor payload, normalized and safe to hand to project
+ * resolution. Returns an absolute, `..`-collapsed path or undefined.
+ *
+ * `workspace_folder` comes from the workspace's own `workspace.json` and
+ * `workspace` from a composer `uri.fsPath` or the `state.vscdb` path — all
+ * untrusted. When the preferred field is unusable we fall through to the other
+ * rather than giving up. See DB90DV-547.
+ */
 export function cursorRepoPathFromPayload(payload) {
     const metadata = payload.metadata;
     if (!metadata)
         return undefined;
-    if (typeof metadata.workspace_folder === "string" && metadata.workspace_folder.length > 0) {
-        return metadata.workspace_folder;
-    }
-    if (typeof metadata.workspace === "string" && metadata.workspace.length > 0) {
-        return metadata.workspace;
+    for (const candidate of [metadata.workspace_folder, metadata.workspace]) {
+        if (typeof candidate !== "string")
+            continue;
+        const normalized = normalizeRepoPathCandidate(candidate);
+        if (normalized !== null)
+            return normalized;
     }
     return undefined;
 }
@@ -194,14 +205,16 @@ async function runClaudeSlice(options) {
             mcpLog.info("sync_noise_skip", { tool: "claude_code", reason: "local_command_noise" }, false);
             continue;
         }
-        // When scopeDir is set, skip turns from other directories.
+        // When scopeDir is set, skip turns from other directories. `turn.cwd` is an
+        // arbitrary string from a transcript JSONL, so a plain prefix match would
+        // accept `<scopeDir>/../../elsewhere` (DB90DV-547).
         if (scopeDir) {
-            const cwd = turn.cwd?.trim();
-            const inScope = cwd && (cwd === scopeDir || cwd.startsWith(scopeDir + "/"));
+            const cwd = normalizeRepoPathCandidate(turn.cwd);
+            const inScope = cwd !== null && isRepoPathWithinRoot(cwd, scopeDir);
             if (!inScope) {
                 totalSkipped++;
                 if (verbose) {
-                    console.log(`[verbose] Skipping Claude turn ${turn.turnId} — cwd=${cwd ?? "(none)"} not under scopeDir=${scopeDir}`);
+                    console.log(`[verbose] Skipping Claude turn ${turn.turnId} — cwd=${turn.cwd ?? "(none)"} not under scopeDir=${scopeDir}`);
                 }
                 continue;
             }
@@ -353,7 +366,7 @@ async function runCursorSlice(params) {
             const inScope = [];
             for (const payload of group.payloads) {
                 const ws = cursorRepoPathFromPayload(payload);
-                if (ws && (ws === scopeDir || ws.startsWith(scopeDir + "/"))) {
+                if (ws && isRepoPathWithinRoot(ws, scopeDir)) {
                     // Same fallback as Claude: when the pre-resolved projectId is null, do a
                     // per-payload lookup from the payload's workspace. Cache dedupes by path.
                     const resolved = projectId ??

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aixle/insights",
-  "version": "0.2.1-staging",
+  "version": "0.2.3-staging",
   "description": "stdio MCP server for AI coding-assistant telemetry — Claude transcript sync + Cursor SQLite ingest.",
   "type": "module",
   "bin": {
@@ -19,7 +19,7 @@
     "provenance": false
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=20.19.0"
   },
   "license": "MIT",
   "repository": {
@@ -43,6 +43,7 @@
   "scripts": {
     "build": "tsc && node -e \"const{mkdirSync,copyFileSync}=require('fs');mkdirSync('dist/hooks',{recursive:true});copyFileSync('src/hooks/hook-forwarder.mjs','dist/hooks/hook-forwarder.mjs');\"",
     "test": "vitest run",
+    "lint": "eslint . --max-warnings 0",
     "verify:cursor-dry-run": "tsx scripts/verify-cursor-dry-run.ts",
     "audit:local-stores": "tsx scripts/audit-local-stores.ts",
     "dev": "tsx src/cli.ts",
@@ -51,7 +52,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "better-sqlite3": "^12.9.0",
-    "glob": "^10.5.0",
+    "glob": "^13.0.6",
     "zod": "^3.23.0 || ^4.0.0"
   },
   "optionalDependencies": {
@@ -60,6 +61,9 @@
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.8",
     "@types/node": "^24",
+    "@typescript-eslint/parser": "^8.65.0",
+    "eslint": "^10.8.0",
+    "eslint-plugin-security": "^4.0.1",
     "tsx": "^4.7.0",
     "typescript": "^5.3.3",
     "vitest": "^4.1.0"