@bike4mind/cli 0.2.31-b4m-cli-undo-command.19534 → 0.2.31-b4m-cli-undo-command.19535

package/dist/{chunk-WVFOWKNW.js → chunk-M2QCFHVX.js}

@@ -3,7 +3,7 @@
 // package.json
 var package_default = {
   name: "@bike4mind/cli",
-  version: "0.2.31-b4m-cli-undo-command.19534+db45140bb",
+  version: "0.2.31-b4m-cli-undo-command.19535+040263f1d",
   type: "module",
   description: "Interactive CLI tool for Bike4Mind with ReAct agents",
   license: "UNLICENSED",
@@ -114,10 +114,10 @@ var package_default = {
   },
   devDependencies: {
     "@bike4mind/agents": "0.1.0",
-    "@bike4mind/common": "2.52.1-b4m-cli-undo-command.19534+db45140bb",
-    "@bike4mind/mcp": "1.31.1-b4m-cli-undo-command.19534+db45140bb",
-    "@bike4mind/services": "2.50.1-b4m-cli-undo-command.19534+db45140bb",
-    "@bike4mind/utils": "2.7.1-b4m-cli-undo-command.19534+db45140bb",
+    "@bike4mind/common": "2.52.1-b4m-cli-undo-command.19535+040263f1d",
+    "@bike4mind/mcp": "1.31.1-b4m-cli-undo-command.19535+040263f1d",
+    "@bike4mind/services": "2.50.1-b4m-cli-undo-command.19535+040263f1d",
+    "@bike4mind/utils": "2.7.1-b4m-cli-undo-command.19535+040263f1d",
     "@types/better-sqlite3": "^7.6.13",
     "@types/diff": "^5.0.9",
     "@types/jsonwebtoken": "^9.0.4",
@@ -138,7 +138,7 @@ var package_default = {
   optionalDependencies: {
     "@vscode/ripgrep": "^1.17.0"
   },
-  gitHead: "db45140bb943bbc4dbccd53c99a8e305cb792d88"
+  gitHead: "040263f1d1bb68be464392da9dc0129ea349940d"
 };
 
 // src/utils/updateChecker.ts

package/dist/commands/doctorCommand.js

@@ -3,7 +3,7 @@ import {
   fetchLatestVersion,
   forceCheckForUpdate,
   package_default
-} from "../chunk-WVFOWKNW.js";
+} from "../chunk-M2QCFHVX.js";
 
 // src/commands/doctorCommand.ts
 import { execSync } from "child_process";

package/dist/commands/updateCommand.js

@@ -2,7 +2,7 @@
 import {
   forceCheckForUpdate,
   package_default
-} from "../chunk-WVFOWKNW.js";
+} from "../chunk-M2QCFHVX.js";
 
 // src/commands/updateCommand.ts
 import { execSync } from "child_process";

package/dist/index.js

@@ -16,7 +16,7 @@ import {
 import {
   checkForUpdate,
   package_default
-} from "./chunk-WVFOWKNW.js";
+} from "./chunk-M2QCFHVX.js";
 import {
   selectActiveBackgroundAgents,
   useCliStore
@@ -2912,13 +2912,16 @@ var CheckpointStore = class {
     try {
       let hasChanges = false;
       for (const filePath of filePaths) {
-        const absolutePath = path6.resolve(this.projectDir, filePath);
+        const absolutePath = this.validatePathWithinProject(filePath);
         const shadowPath = path6.join(this.shadowRepoDir, filePath);
         const shadowDir = path6.dirname(shadowPath);
         const absentMarkerPath = path6.join(shadowDir, `${path6.basename(filePath)}${ABSENT_MARKER}`);
         await fs5.mkdir(shadowDir, { recursive: true });
         if (existsSync4(absolutePath)) {
-          const stats = await fs5.stat(absolutePath);
+          const stats = await fs5.lstat(absolutePath);
+          if (stats.isSymbolicLink()) {
+            continue;
+          }
           if (stats.size > MAX_FILE_SIZE2) {
             continue;
           }
@@ -2995,7 +2998,7 @@ var CheckpointStore = class {
       throw new Error(`Checkpoint #${index} not found. Use /checkpoints to see available restore points.`);
     }
     for (const filePath of checkpoint.filePaths) {
-      const absolutePath = path6.resolve(this.projectDir, filePath);
+      const absolutePath = this.validatePathWithinProject(filePath);
       try {
         const content = this.git("show", `${checkpoint.id}:${filePath}`);
         await fs5.mkdir(path6.dirname(absolutePath), { recursive: true });
@@ -3031,7 +3034,9 @@ var CheckpointStore = class {
     }
     const diffParts = [];
     for (const filePath of checkpoint.filePaths) {
-      const absolutePath = path6.resolve(this.projectDir, filePath);
+      const absolutePath = this.validatePathWithinProject(filePath);
+      const tmpCheckpoint = path6.join(this.shadowRepoDir, ".diff-a");
+      const tmpCurrent = path6.join(this.shadowRepoDir, ".diff-b");
       try {
         let checkpointContent;
         try {
@@ -3046,8 +3051,6 @@ var CheckpointStore = class {
         if (checkpointContent === currentContent) {
           continue;
         }
-        const tmpCheckpoint = path6.join(this.shadowRepoDir, ".diff-a");
-        const tmpCurrent = path6.join(this.shadowRepoDir, ".diff-b");
         writeFileSync(tmpCheckpoint, checkpointContent, "utf-8");
         writeFileSync(tmpCurrent, currentContent, "utf-8");
         try {
@@ -3070,12 +3073,16 @@ ${output}`);
             }
           }
         }
+      } catch {
+      } finally {
         try {
           unlinkSync(tmpCheckpoint);
+        } catch {
+        }
+        try {
           unlinkSync(tmpCurrent);
         } catch {
         }
-      } catch {
       }
     }
     return diffParts.join("\n");
@@ -3109,6 +3116,18 @@ ${output}`);
     }
   }
   // --- Private helpers ---
+  /**
+   * Validate that a file path resolves within the project directory.
+   * Prevents path traversal attacks (e.g., ../../etc/passwd).
+   */
+  validatePathWithinProject(filePath) {
+    const absolutePath = path6.resolve(this.projectDir, filePath);
+    const normalizedProject = path6.resolve(this.projectDir) + path6.sep;
+    if (!absolutePath.startsWith(normalizedProject) && absolutePath !== path6.resolve(this.projectDir)) {
+      throw new Error(`Path traversal detected: ${filePath}`);
+    }
+    return absolutePath;
+  }
   /**
    * Execute a git command in the shadow repo
    */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bike4mind/cli",
-  "version": "0.2.31-b4m-cli-undo-command.19534+db45140bb",
+  "version": "0.2.31-b4m-cli-undo-command.19535+040263f1d",
   "type": "module",
   "description": "Interactive CLI tool for Bike4Mind with ReAct agents",
   "license": "UNLICENSED",
@@ -111,10 +111,10 @@
   },
   "devDependencies": {
     "@bike4mind/agents": "0.1.0",
-    "@bike4mind/common": "2.52.1-b4m-cli-undo-command.19534+db45140bb",
-    "@bike4mind/mcp": "1.31.1-b4m-cli-undo-command.19534+db45140bb",
-    "@bike4mind/services": "2.50.1-b4m-cli-undo-command.19534+db45140bb",
-    "@bike4mind/utils": "2.7.1-b4m-cli-undo-command.19534+db45140bb",
+    "@bike4mind/common": "2.52.1-b4m-cli-undo-command.19535+040263f1d",
+    "@bike4mind/mcp": "1.31.1-b4m-cli-undo-command.19535+040263f1d",
+    "@bike4mind/services": "2.50.1-b4m-cli-undo-command.19535+040263f1d",
+    "@bike4mind/utils": "2.7.1-b4m-cli-undo-command.19535+040263f1d",
     "@types/better-sqlite3": "^7.6.13",
     "@types/diff": "^5.0.9",
     "@types/jsonwebtoken": "^9.0.4",
@@ -135,5 +135,5 @@
   "optionalDependencies": {
     "@vscode/ripgrep": "^1.17.0"
   },
-  "gitHead": "db45140bb943bbc4dbccd53c99a8e305cb792d88"
+  "gitHead": "040263f1d1bb68be464392da9dc0129ea349940d"
 }