@beastmode-develeap/beastmode 0.1.314 → 0.1.316

package/dist/index.js

@@ -5257,11 +5257,43 @@ var init_chat_handler = __esm({
 
 // src/cli/ui/board-api-routes.ts
 import { readFileSync as readFileSync13, writeFileSync as writeFileSync13, existsSync as existsSync16, readdirSync as readdirSync8, unlinkSync as unlinkSync4, mkdirSync as mkdirSync12, statSync as statSync6, rmSync as rmSync3 } from "fs";
-import { join as join14, basename as basename5, resolve as resolve4, dirname as dirname5 } from "path";
+import { join as join14, basename as basename5, resolve as resolve4, dirname as dirname5, sep } from "path";
 import { homedir } from "os";
 import { randomUUID as randomUUID2 } from "crypto";
 import { execSync as execSync3, spawnSync } from "child_process";
 import http2 from "http";
+function _getAllowedRoots() {
+  const roots = [];
+  const homeRaw = process.env.HOME && process.env.HOME.length > 0 ? process.env.HOME : homedir();
+  roots.push(resolve4(homeRaw));
+  const projectDir = process.env.PROJECT_DIR;
+  if (projectDir && projectDir.length > 0) {
+    roots.push(resolve4(projectDir));
+  }
+  const cloneDir = process.env.BEASTMODE_CLONE_DIR;
+  if (cloneDir && cloneDir.length > 0) {
+    roots.push(resolve4(cloneDir));
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const deduped = [];
+  for (const r of roots) {
+    if (!seen.has(r)) {
+      seen.add(r);
+      deduped.push(r);
+    }
+  }
+  return deduped;
+}
+function _isPathAllowed(targetPath, roots) {
+  if (roots.length === 0) return false;
+  const target = resolve4(targetPath);
+  for (const r of roots) {
+    const root = resolve4(r);
+    if (target === root) return true;
+    if (target.startsWith(root + sep)) return true;
+  }
+  return false;
+}
 function assertSafeName(name) {
   if (!name || /[/\\]/.test(name) || name === "." || name === "..") {
     throw new Error(`Invalid name: ${name}`);
@@ -6308,6 +6340,12 @@ function getBoardRoutes(factoryDir) {
         const { path: queryPath } = body || {};
         const startPath = queryPath || homedir();
         const target = resolve4(startPath);
+        const allowedRoots = _getAllowedRoots();
+        if (!_isPathAllowed(target, allowedRoots)) {
+          throw new Error(
+            `Path not allowed: ${target} is outside the configured allowlist`
+          );
+        }
         if (!existsSync16(target)) throw new Error(`Path not found: ${target}`);
         const st = statSync6(target);
         if (!st.isDirectory()) throw new Error(`Not a directory: ${target}`);