@beastmode-develeap/beastmode 0.1.324 → 0.1.326

package/dist/index.js

@@ -6387,8 +6387,19 @@ function getBoardRoutes(factoryDir) {
           const repoName = url.replace(/\.git$/, "").split(/[/:]/).filter(Boolean).pop() || "";
           if (!repoName) throw new Error("Could not derive repo name from URL");
           const baseDir = clone_target ? resolve4(clone_target) : process.env.BEASTMODE_CLONE_DIR ? resolve4(process.env.BEASTMODE_CLONE_DIR) : join14(homedir(), "repos");
+          const allowedRoots = _getAllowedRoots();
+          if (!_isPathAllowed(baseDir, allowedRoots)) {
+            throw new Error(
+              `clone_target not allowed: ${baseDir} is outside the configured allowlist`
+            );
+          }
           if (!existsSync16(baseDir)) mkdirSync12(baseDir, { recursive: true });
           resolvedPath = join14(baseDir, repoName);
+          if (!_isPathAllowed(resolvedPath, allowedRoots)) {
+            throw new Error(
+              `clone_target not allowed: ${resolvedPath} is outside the configured allowlist`
+            );
+          }
           if (existsSync16(resolvedPath)) {
             throw new Error(`Target path already exists: ${resolvedPath} \u2014 pick a different clone_target or rename the existing folder`);
           }