@claudetools/tools 0.2.1 → 0.2.2

package/dist/helpers/project-registration.js

@@ -85,15 +85,21 @@ async function ensureSystemRegistered() {
  */
 function detectGitRemote(localPath) {
     try {
+        // Resolve symlinks and validate path to prevent path traversal attacks
+        const resolvedPath = fs.realpathSync(localPath);
+        // Ensure path is absolute and doesn't contain path traversal
+        if (!path.isAbsolute(resolvedPath) || resolvedPath.includes('..')) {
+            return undefined;
+        }
         const gitRemote = execSync('git config --get remote.origin.url', {
-            cwd: localPath,
+            cwd: resolvedPath,
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'ignore'],
         }).trim();
         return gitRemote || undefined;
     }
     catch {
-        // Not a git repo or no remote configured
+        // Not a git repo, no remote configured, or invalid path
         return undefined;
     }
 }

package/dist/setup.js

@@ -728,7 +728,7 @@ export async function runSetup() {
         // Step 1: Authentication
         header('Authentication');
         if (config.apiKey) {
-            info(`Existing API key found: ${config.apiKey.substring(0, 10)}...`);
+            info(`Existing API key found: ${config.apiKey.substring(0, 6)}...`);
             const { replace } = await prompts({
                 type: 'confirm',
                 name: 'replace',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claudetools/tools",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Persistent AI memory, task management, and codebase intelligence for Claude Code",
   "type": "module",
   "main": "dist/index.js",