@cannbot-ai/install-helper 0.0.2-beta.32 → 0.0.2-beta.33

package/dist/index.js

@@ -1027,8 +1027,12 @@ function parseFrontmatter(filePath) {
     const parsed = parseYaml2(yamlBlock);
     if (!parsed || typeof parsed !== "object") return null;
     if (!parsed.name || typeof parsed.name !== "string") return null;
+    const trimmedName = parsed.name.trim();
+    if (!trimmedName || /[\/\\]|\.\./.test(trimmedName) || !/^[a-zA-Z0-9._-]+$/.test(trimmedName)) {
+      return null;
+    }
     return {
-      name: parsed.name.trim(),
+      name: trimmedName,
       description: (parsed.description || "").trim()
     };
   } catch {
@@ -1887,9 +1891,18 @@ async function installPlugin(opts) {
         currentPlugin.pluginId,
         currentPlugin.pluginName
       );
-      if (backupInfo) {
-        logger.success(`${t("backup_created")}: ${backupInfo.filePath}`);
+      if (!backupInfo) {
+        logger.error(t("backup_failed"));
+        return {
+          success: false,
+          pluginId: opts.pluginId,
+          skillsCount: 0,
+          agentsCount: 0,
+          errors: [t("backup_failed")],
+          warnings: []
+        };
       }
+      logger.success(`${t("backup_created")}: ${backupInfo.filePath}`);
     }
   }
   try {
@@ -1980,10 +1993,11 @@ async function installSkills(skillIds, tool, level, repoPath) {
       continue;
     }
     try {
+      const resolvedSource = realpathSync(sourcePath);
       if (existsSync11(targetPath) || isSymlink2(targetPath)) {
         unlinkSync3(targetPath);
       }
-      symlinkSync(realpathSync(sourcePath), targetPath);
+      symlinkSync(resolvedSource, targetPath);
       results.push({ skillId, success: true });
       installedIds.push(skillId);
     } catch (error) {
@@ -3016,6 +3030,7 @@ async function installPlugins(pluginIds, tool, level, repoPath, installPath, yes
 
 // src/commands/uninstall.ts
 import { existsSync as existsSync14, unlinkSync as unlinkSync5, rmdirSync as rmdirSync2, readdirSync as readdirSync6, lstatSync as lstatSync4 } from "fs";
+import { resolve } from "path";
 import chalk11 from "chalk";
 async function uninstallCommand(names, options) {
   const tool = options.tool ? validateTool(options.tool) : "opencode";
@@ -3045,9 +3060,16 @@ async function uninstallCommand(names, options) {
       continue;
     }
     logger.info(`${t("uninstall_in_progress")} ${plugin.displayName}...`);
+    const configRoot = getConfigRoot(record.tool, record.level);
+    const allowedBases = [resolve(configRoot), resolve(record.installPath)];
+    const isSafePath = (p) => {
+      const resolved = resolve(p);
+      return allowedBases.some((base) => resolved === base || resolved.startsWith(base + "/"));
+    };
     let removedFiles = 0;
     let removedDirs = 0;
     for (const filePath of record.files) {
+      if (!isSafePath(filePath)) continue;
       try {
         if (existsSync14(filePath) || isSymlink3(filePath)) {
           unlinkSync5(filePath);
@@ -3058,11 +3080,10 @@ async function uninstallCommand(names, options) {
       } catch {
       }
     }
-    const configRoot = getConfigRoot(record.tool, record.level);
-    const sortedDirs = [...record.directories].sort((a, b) => b.length - a.length);
+    const sortedDirs = [...record.directories].filter(isSafePath).sort((a, b) => b.length - a.length);
     for (const dirPath of sortedDirs) {
       try {
-        if (dirPath === configRoot) {
+        if (resolve(dirPath) === resolve(configRoot)) {
           continue;
         }
         if (existsSync14(dirPath)) {
@@ -3298,7 +3319,7 @@ function createCLI() {
     setLanguage(config.language);
   }
   const program2 = new Command();
-  program2.name("install-helper").description("CANNBot Install Helper - Interactive installer for CANN operator development skills").version("0.0.2-beta.32");
+  program2.name("install-helper").description("CANNBot Install Helper - Interactive installer for CANN operator development skills").version("0.0.2-beta.33");
   program2.command("init", { isDefault: false }).description("Run interactive installation wizard").action(async () => {
     await initCommand();
   });