@contractspec/bundle.workspace 3.6.0 → 3.7.1

package/dist/index.js

@@ -759,7 +759,8 @@ function createNodeAdapters(options = {}) {
 }
 // src/adapters/workspace.ts
 import { existsSync, readFileSync } from "fs";
-import { dirname as dirname3, join as join3, resolve as resolve4 } from "path";
+import { tmpdir } from "os";
+import { dirname as dirname3, isAbsolute as isAbsolute3, join as join3, relative as relative3, resolve as resolve4 } from "path";
 var LOCK_FILES = {
   "bun.lockb": "bun",
   "bun.lock": "bun",
@@ -774,14 +775,24 @@ var MONOREPO_FILES = [
   "turbo.json",
   "rush.json"
 ];
+function isWithinDirectory(target, directory) {
+  const pathFromDirectory = relative3(directory, target);
+  return pathFromDirectory === "" || !pathFromDirectory.startsWith("..") && !isAbsolute3(pathFromDirectory);
+}
+function getTraversalBoundary(startDir) {
+  const resolvedStartDir = resolve4(startDir);
+  const tempRoot = resolve4(tmpdir());
+  return isWithinDirectory(resolvedStartDir, tempRoot) ? tempRoot : undefined;
+}
 function findPackageRoot(startDir = process.cwd()) {
   let current = resolve4(startDir);
+  const traversalBoundary = getTraversalBoundary(startDir);
   while (true) {
     if (existsSync(join3(current, "package.json"))) {
       return current;
     }
     const parent = dirname3(current);
-    if (parent === current) {
+    if (parent === current || current === traversalBoundary) {
       break;
     }
     current = parent;
@@ -791,6 +802,7 @@ function findPackageRoot(startDir = process.cwd()) {
 function findWorkspaceRoot(startDir = process.cwd()) {
   let current = resolve4(startDir);
   let lastPackageJson = null;
+  const traversalBoundary = getTraversalBoundary(startDir);
   while (true) {
     for (const file of MONOREPO_FILES) {
       if (existsSync(join3(current, file))) {
@@ -813,7 +825,7 @@ function findWorkspaceRoot(startDir = process.cwd()) {
       }
     }
     const parent = dirname3(current);
-    if (parent === current) {
+    if (parent === current || current === traversalBoundary) {
       break;
     }
     current = parent;
@@ -942,12 +954,13 @@ function checkHasWorkspaces(dir) {
 }
 function findMetaRepoRoot(startDir) {
   let current = resolve4(startDir);
+  const traversalBoundary = getTraversalBoundary(startDir);
   while (true) {
     if (existsSync(join3(current, ".gitmodules"))) {
       return current;
     }
     const parent = dirname3(current);
-    if (parent === current) {
+    if (parent === current || current === traversalBoundary) {
       break;
     }
     current = parent;
@@ -1815,7 +1828,7 @@ ${task.existingCode}`;
 import { spawn } from "child_process";
 import { mkdir as mkdir3, readFile as readFile4, rm as rm2, writeFile as writeFile2 } from "fs/promises";
 import { join as join4 } from "path";
-import { homedir, tmpdir } from "os";
+import { homedir, tmpdir as tmpdir2 } from "os";
 import { existsSync as existsSync2 } from "fs";
 
 class CursorAgent {
@@ -1832,7 +1845,7 @@ class CursorAgent {
   }
   async generate(task) {
     try {
-      const workDir = join4(tmpdir(), `cursor-agent-${Date.now()}`);
+      const workDir = join4(tmpdir2(), `cursor-agent-${Date.now()}`);
       await mkdir3(workDir, { recursive: true });
       const result = await this.executeWithBestMethod(task, workDir);
       await this.cleanupWorkDir(workDir);
@@ -1846,7 +1859,7 @@ class CursorAgent {
   }
   async validate(task) {
     try {
-      const workDir = join4(tmpdir(), `cursor-validate-${Date.now()}`);
+      const workDir = join4(tmpdir2(), `cursor-validate-${Date.now()}`);
       await mkdir3(workDir, { recursive: true });
       await this.setupValidationWorkspace(task, workDir);
       const result = await this.executeWithBestMethod({
@@ -8577,7 +8590,7 @@ init_config();
 // src/services/drift.ts
 import path4 from "path";
 import { mkdtemp, rm as rm3 } from "fs/promises";
-import { tmpdir as tmpdir2 } from "os";
+import { tmpdir as tmpdir3 } from "os";
 
 // src/services/generate-artifacts.ts
 import path3 from "path";
@@ -8737,7 +8750,7 @@ async function generateArtifacts(adapters, contractsDir, generatedDir, rootPath)
 
 // src/services/drift.ts
 async function detectDrift(adapters, contractsDir, generatedDir) {
-  const tempDir = await mkdtemp(path4.join(tmpdir2(), "contractspec-drift-"));
+  const tempDir = await mkdtemp(path4.join(tmpdir3(), "contractspec-drift-"));
   try {
     await generateArtifacts(adapters, contractsDir, tempDir);
     const differences = [];

package/dist/node/index.js

@@ -759,7 +759,8 @@ function createNodeAdapters(options = {}) {
 }
 // src/adapters/workspace.ts
 import { existsSync, readFileSync } from "node:fs";
-import { dirname as dirname3, join as join3, resolve as resolve4 } from "node:path";
+import { tmpdir } from "node:os";
+import { dirname as dirname3, isAbsolute as isAbsolute3, join as join3, relative as relative3, resolve as resolve4 } from "node:path";
 var LOCK_FILES = {
   "bun.lockb": "bun",
   "bun.lock": "bun",
@@ -774,14 +775,24 @@ var MONOREPO_FILES = [
   "turbo.json",
   "rush.json"
 ];
+function isWithinDirectory(target, directory) {
+  const pathFromDirectory = relative3(directory, target);
+  return pathFromDirectory === "" || !pathFromDirectory.startsWith("..") && !isAbsolute3(pathFromDirectory);
+}
+function getTraversalBoundary(startDir) {
+  const resolvedStartDir = resolve4(startDir);
+  const tempRoot = resolve4(tmpdir());
+  return isWithinDirectory(resolvedStartDir, tempRoot) ? tempRoot : undefined;
+}
 function findPackageRoot(startDir = process.cwd()) {
   let current = resolve4(startDir);
+  const traversalBoundary = getTraversalBoundary(startDir);
   while (true) {
     if (existsSync(join3(current, "package.json"))) {
       return current;
     }
     const parent = dirname3(current);
-    if (parent === current) {
+    if (parent === current || current === traversalBoundary) {
       break;
     }
     current = parent;
@@ -791,6 +802,7 @@ function findPackageRoot(startDir = process.cwd()) {
 function findWorkspaceRoot(startDir = process.cwd()) {
   let current = resolve4(startDir);
   let lastPackageJson = null;
+  const traversalBoundary = getTraversalBoundary(startDir);
   while (true) {
     for (const file of MONOREPO_FILES) {
       if (existsSync(join3(current, file))) {
@@ -813,7 +825,7 @@ function findWorkspaceRoot(startDir = process.cwd()) {
       }
     }
     const parent = dirname3(current);
-    if (parent === current) {
+    if (parent === current || current === traversalBoundary) {
       break;
     }
     current = parent;
@@ -942,12 +954,13 @@ function checkHasWorkspaces(dir) {
 }
 function findMetaRepoRoot(startDir) {
   let current = resolve4(startDir);
+  const traversalBoundary = getTraversalBoundary(startDir);
   while (true) {
     if (existsSync(join3(current, ".gitmodules"))) {
       return current;
     }
     const parent = dirname3(current);
-    if (parent === current) {
+    if (parent === current || current === traversalBoundary) {
       break;
     }
     current = parent;
@@ -1815,7 +1828,7 @@ ${task.existingCode}`;
 import { spawn } from "child_process";
 import { mkdir as mkdir3, readFile as readFile4, rm as rm2, writeFile as writeFile2 } from "fs/promises";
 import { join as join4 } from "path";
-import { homedir, tmpdir } from "os";
+import { homedir, tmpdir as tmpdir2 } from "os";
 import { existsSync as existsSync2 } from "fs";
 
 class CursorAgent {
@@ -1832,7 +1845,7 @@ class CursorAgent {
   }
   async generate(task) {
     try {
-      const workDir = join4(tmpdir(), `cursor-agent-${Date.now()}`);
+      const workDir = join4(tmpdir2(), `cursor-agent-${Date.now()}`);
       await mkdir3(workDir, { recursive: true });
       const result = await this.executeWithBestMethod(task, workDir);
       await this.cleanupWorkDir(workDir);
@@ -1846,7 +1859,7 @@ class CursorAgent {
   }
   async validate(task) {
     try {
-      const workDir = join4(tmpdir(), `cursor-validate-${Date.now()}`);
+      const workDir = join4(tmpdir2(), `cursor-validate-${Date.now()}`);
       await mkdir3(workDir, { recursive: true });
       await this.setupValidationWorkspace(task, workDir);
       const result = await this.executeWithBestMethod({
@@ -8577,7 +8590,7 @@ init_config();
 // src/services/drift.ts
 import path4 from "path";
 import { mkdtemp, rm as rm3 } from "node:fs/promises";
-import { tmpdir as tmpdir2 } from "node:os";
+import { tmpdir as tmpdir3 } from "node:os";
 
 // src/services/generate-artifacts.ts
 import path3 from "path";
@@ -8737,7 +8750,7 @@ async function generateArtifacts(adapters, contractsDir, generatedDir, rootPath)
 
 // src/services/drift.ts
 async function detectDrift(adapters, contractsDir, generatedDir) {
-  const tempDir = await mkdtemp(path4.join(tmpdir2(), "contractspec-drift-"));
+  const tempDir = await mkdtemp(path4.join(tmpdir3(), "contractspec-drift-"));
   try {
     await generateArtifacts(adapters, contractsDir, tempDir);
     const differences = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contractspec/bundle.workspace",
-  "version": "3.6.0",
+  "version": "3.7.1",
   "description": "Workspace utilities for monorepo development",
   "keywords": [
     "contractspec",
@@ -33,14 +33,14 @@
   "dependencies": {
     "@ai-sdk/anthropic": "3.0.58",
     "@ai-sdk/openai": "3.0.41",
-    "@contractspec/lib.ai-agent": "6.0.0",
-    "@contractspec/lib.ai-providers": "3.6.0",
-    "@contractspec/lib.contracts-spec": "3.6.0",
-    "@contractspec/lib.contracts-integrations": "3.6.0",
-    "@contractspec/lib.contracts-transformers": "3.6.0",
-    "@contractspec/lib.source-extractors": "2.6.0",
-    "@contractspec/module.workspace": "3.6.0",
-    "@contractspec/lib.utils-typescript": "3.6.0",
+    "@contractspec/lib.ai-agent": "7.0.1",
+    "@contractspec/lib.ai-providers": "3.7.1",
+    "@contractspec/lib.contracts-spec": "3.7.1",
+    "@contractspec/lib.contracts-integrations": "3.7.1",
+    "@contractspec/lib.contracts-transformers": "3.7.1",
+    "@contractspec/lib.source-extractors": "2.7.1",
+    "@contractspec/module.workspace": "3.7.1",
+    "@contractspec/lib.utils-typescript": "3.7.1",
     "ai": "6.0.116",
     "chalk": "^5.6.2",
     "chokidar": "^5.0.0",
@@ -52,12 +52,12 @@
     "zod": "^4.3.5"
   },
   "devDependencies": {
-    "@contractspec/tool.typescript": "3.6.0",
+    "@contractspec/tool.typescript": "3.7.1",
     "@types/bun": "^1.3.10",
     "@types/micromatch": "^4.0.10",
     "@types/node": "^25.3.5",
     "typescript": "^5.9.3",
-    "@contractspec/tool.bun": "3.6.0"
+    "@contractspec/tool.bun": "3.7.1"
   },
   "exports": {
     ".": {