@akai-workflow-builder/cli-sdk 0.1.0 → 0.1.1

package/dist/ctx/build-ctx.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-ctx.d.ts","sourceRoot":"","sources":["../../src/ctx/build-ctx.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAc,MAAM,EAAiB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG1F;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6GAA6G;IAC7G,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,sGAAsG;IACtG,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AA4CD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAsDxD"}
+{"version":3,"file":"build-ctx.d.ts","sourceRoot":"","sources":["../../src/ctx/build-ctx.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAc,MAAM,EAAiB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG1F;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6GAA6G;IAC7G,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,sGAAsG;IACtG,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AA4CD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAoDxD"}

package/dist/ctx/build-ctx.js

@@ -71,11 +71,9 @@ export function buildCtx(params) {
         ...(params.extraSafePathRoots ?? []),
     ]);
     const readFile = createReadFile({ safePath, signal: params.signal });
-    // `ctx.writeFile` is wired only when the host provisioned an output channel
-    // (outputDir). Tools declaring `options.producesFiles` get a real writer;
-    // everything else gets a throwing stub so an undeclared write surfaces
-    // clearly instead of leaking files onto a stray path.
-    const writeFile = params.outputDir !== undefined
+    // Real writer only when the tool opted in (producesFiles) AND the host gave
+    // an outputDir — enforces the opt-in at the SDK boundary; else a throwing stub.
+    const writeFile = tool.options.producesFiles === true && params.outputDir !== undefined
         ? createWriteFile({ outputDir: params.outputDir })
         : unavailableWriteFile();
     return Object.freeze({

package/dist/ctx/write-file.d.ts

@@ -9,11 +9,10 @@ export interface CreateWriteFileOptions {
 }
 /**
  * Build a `ctx.writeFile(name, data)` that stages an output file under the
- * invocation's output directory. `name` is a relative path that must stay
- * inside `outputDir`: absolute paths and `..` traversal are rejected with
- * `AkaiPathError`. Parent directories are created as needed. Pairs with
- * `options.producesFiles: true`, which tells the host to provision this
- * channel before invoking the tool.
+ * invocation's output directory. `name` must resolve inside `outputDir`;
+ * absolute paths, `..` escapes, and symlink traversal are rejected with
+ * `AkaiPathError` via the same realpath-stabilised check as `ctx.safePath`.
+ * Parent directories are created as needed. Pairs with `options.producesFiles`.
  */
 export declare function createWriteFile(opts: CreateWriteFileOptions): (name: string, data: Buffer | Uint8Array | string) => Promise<void>;
 /**

package/dist/ctx/write-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write-file.d.ts","sourceRoot":"","sources":["../../src/ctx/write-file.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,sBAAsB,GAC3B,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAkBrE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAQrF"}
+{"version":3,"file":"write-file.d.ts","sourceRoot":"","sources":["../../src/ctx/write-file.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,sBAAsB,GAC3B,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAoBrE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAQrF"}

package/dist/ctx/write-file.js

@@ -1,16 +1,17 @@
 import { mkdir, writeFile as fsWriteFile } from 'node:fs/promises';
-import { dirname, isAbsolute, relative, resolve } from 'node:path';
+import { dirname, isAbsolute, resolve } from 'node:path';
+import { createSafePath } from './safe-path.js';
 import { AkaiPathError } from '../errors.js';
 /**
  * Build a `ctx.writeFile(name, data)` that stages an output file under the
- * invocation's output directory. `name` is a relative path that must stay
- * inside `outputDir`: absolute paths and `..` traversal are rejected with
- * `AkaiPathError`. Parent directories are created as needed. Pairs with
- * `options.producesFiles: true`, which tells the host to provision this
- * channel before invoking the tool.
+ * invocation's output directory. `name` must resolve inside `outputDir`;
+ * absolute paths, `..` escapes, and symlink traversal are rejected with
+ * `AkaiPathError` via the same realpath-stabilised check as `ctx.safePath`.
+ * Parent directories are created as needed. Pairs with `options.producesFiles`.
  */
 export function createWriteFile(opts) {
     const root = resolve(opts.outputDir);
+    const safePath = createSafePath([root]);
     return async function writeFile(name, data) {
         if (typeof name !== 'string' || name.length === 0) {
             throw new Error('ctx.writeFile: name must be a non-empty string');
@@ -18,11 +19,12 @@ export function createWriteFile(opts) {
         if (isAbsolute(name)) {
             throw new AkaiPathError(`ctx.writeFile: name must be relative, got absolute path "${name}"`);
         }
-        const target = resolve(root, name);
-        const rel = relative(root, target);
-        if (rel === '' || rel === '..' || rel.startsWith(`..`) || isAbsolute(rel)) {
-            throw new AkaiPathError(`ctx.writeFile: name escapes the output directory: "${name}"`);
+        const abs = resolve(root, name);
+        if (abs === root) {
+            throw new AkaiPathError(`ctx.writeFile: name cannot reference the output directory itself: "${name}"`);
         }
+        // realpath-stabilises parents → a symlink can't redirect outside the root.
+        const target = safePath(abs);
         await mkdir(dirname(target), { recursive: true });
         const bytes = typeof data === 'string' ? Buffer.from(data, 'utf8') : data;
         await fsWriteFile(target, bytes);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akai-workflow-builder/cli-sdk",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Authoring SDK for atomic, agent-executable CLIs and tools.",
   "keywords": [
     "akai",