@cspeach/cli 1.1.24 → 1.1.25

package/dist/projects/detail-path.js

@@ -0,0 +1,117 @@
+// cspeach-cli/src/projects/detail-path.ts
+/**
+ * SEC (review round 2): `content.detailPath` inside a saved envelope is DATA
+ * the model can write — never a trusted path. Every reader that turns it into
+ * a file access (upgrade merge baseline hash, the register's CCA objects.json,
+ * promote's file_read hint) goes through here:
+ *
+ *   - safeDetailRel: the string must be a plain project-relative path under a
+ *     skill working folder — `.cspeach/<domain>/…` (or the legacy
+ *     `.abapforge/<domain>/…`). No absolute paths, drive letters, `..`, `:`
+ *     streams, control characters, trailing dots/spaces or device names.
+ *   - resolveDetailFile(Sync): the REAL file must sit in that working folder
+ *     under the project root (or the workspace folder) and not be a protected
+ *     path. Returns null for refused AND missing alike, so callers can give ONE
+ *     message and never act as an existence oracle.
+ */
+import * as path from 'node:path';
+import { realpathSync, statSync } from 'node:fs';
+import { CSPEACH_WORK_SUBDIRS, isDenylistedPath, isWindowsReservedName } from '../tools/_filesystem-shared.js';
+import { workspaceFolderFor } from '../lane/roots.js';
+/** Working-folder roots a detail path may start with (current, legacy). */
+const DETAIL_ROOTS = ['.cspeach', '.abapforge'];
+/**
+ * The normalised '/'-separated project-relative detail path, or null when the
+ * value is not a safe path into `<root>/<domain>/` (any domain when omitted).
+ */
+export function safeDetailRel(detailPath, domain) {
+    if (typeof detailPath !== 'string' || detailPath.length === 0 || detailPath.length > 512)
+        return null;
+    if (/[\u0000-\u001f\u007f]/.test(detailPath))
+        return null;
+    if (path.posix.isAbsolute(detailPath) || path.win32.isAbsolute(detailPath) || /^[A-Za-z]:/.test(detailPath))
+        return null;
+    const segs = detailPath.replace(/\\/g, '/').split('/');
+    while (segs[0] === '.')
+        segs.shift();
+    if (segs.length < 3)
+        return null;
+    for (const seg of segs) {
+        if (seg === '' || seg === '.' || seg === '..')
+            return null;
+        if (seg.includes(':') || /[. ]$/.test(seg) || /[<>"|?*]/.test(seg))
+            return null;
+        if (isWindowsReservedName(seg))
+            return null;
+    }
+    const rootSeg = segs[0].toLowerCase();
+    const domainSeg = segs[1].toLowerCase();
+    if (!DETAIL_ROOTS.includes(rootSeg))
+        return null;
+    if (domain ? domainSeg !== domain : !CSPEACH_WORK_SUBDIRS.includes(domainSeg))
+        return null;
+    return segs.join('/');
+}
+function realOrNull(p) {
+    try {
+        return realpathSync.native(p);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The real path of the first candidate that exists, is a regular file, stays
+ * inside `<base>/<first two segments of rel>/` after links are followed, and
+ * is not denylisted relative to `cwd`. null otherwise.
+ */
+function firstContained(cands, cwd) {
+    for (const { base, rel, keep } of cands) {
+        const realBase = realOrNull(path.resolve(base));
+        const real = realOrNull(path.join(path.resolve(base), ...rel.split('/')));
+        if (!realBase || !real)
+            continue;
+        const segs = rel.split('/');
+        const folder = path.join(realBase, ...segs.slice(0, keep));
+        const inner = path.relative(folder, real);
+        if (inner === '' || inner.startsWith('..') || path.isAbsolute(inner))
+            continue;
+        if (isDenylistedPath(real, cwd).blocked)
+            continue;
+        try {
+            if (!statSync(real).isFile())
+                continue;
+        }
+        catch {
+            continue;
+        }
+        return real;
+    }
+    return null;
+}
+/** Sync resolution under the project root only (callers without a workspace). */
+export function resolveDetailFileSync(detailPath, domain, projectRoot) {
+    const rel = safeDetailRel(detailPath, domain);
+    if (!rel)
+        return null;
+    return firstContained([{ base: projectRoot, rel, keep: 2 }], projectRoot);
+}
+/**
+ * Resolution under the project root (cwd) and the resolved workspace folder
+ * (which may sit elsewhere: a git-root `.cspeach/`, a configured folder). For
+ * the workspace, a `.cspeach/<domain>/x` path maps to `<workspace>/<domain>/x`.
+ */
+export async function resolveDetailFile(detailPath, domain, cwd) {
+    const rel = safeDetailRel(detailPath, domain);
+    if (!rel)
+        return null;
+    const cands = [{ base: cwd, rel, keep: 2 }];
+    const segs = rel.split('/');
+    if (segs[0].toLowerCase() === '.cspeach') {
+        try {
+            cands.push({ base: await workspaceFolderFor(cwd), rel: segs.slice(1).join('/'), keep: 1 });
+        }
+        catch { /* no workspace — project root only */ }
+    }
+    return firstContained(cands, cwd);
+}

package/dist/projects/merge-cca.js

@@ -27,6 +27,7 @@
  *     file must be consulted for full coverage
  */
 import { OUTPUT_ROOT } from './output-paths.js';
+import { isWindowsReservedName } from '../tools/_filesystem-shared.js';
 /** Higher = more restrictive. Conflict resolution picks the max. */
 const RESTRICTIVENESS = {
     retire: 3,
@@ -94,6 +95,19 @@ export function scopePatternsIntersect(a, b) {
 function todayUtc() {
     return new Date().toISOString().slice(0, 10);
 }
+/** A folder/file-name slug: `^[A-Za-z0-9._-]+$`, no `..`, not `.`, no device name. */
+export function assertMergeSlug(label, value) {
+    const ok = typeof value === 'string'
+        && value.length > 0 && value.length <= 100
+        && /^[A-Za-z0-9._-]+$/.test(value)
+        && !value.includes('..') && value !== '.'
+        && !/[. ]$/.test(value)
+        && !isWindowsReservedName(value);
+    if (!ok) {
+        throw new Error(`${label} ${JSON.stringify(value)} cannot name a folder — use letters, digits, ".", "_" and "-" only `
+            + '(no "..", no device names such as CON or NUL).');
+    }
+}
 export function mergeCcaAssessments(inputs, opts = {}) {
     if (inputs.length < 2) {
         throw new Error(`cca merge requires at least 2 inputs (got ${inputs.length}) — a single assessment needs no merge`);
@@ -214,6 +228,11 @@ export function mergeCcaAssessments(inputs, opts = {}) {
     // overlap is already warned about above).
     const uncategorized = inputs.reduce((sum, inp) => sum + (inp.content.summary.uncategorized || 0), 0);
     const date = opts.mergedDate ?? todayUtc();
+    // SEC (review round 2): projectId comes from INSIDE an envelope (model-
+    // writable) and becomes a folder name under .cspeach/cca/projects/. Only a
+    // plain slug may do that — never `../`, a drive, a stream or a device name.
+    assertMergeSlug('projectId', first.content.projectId);
+    assertMergeSlug('merged date', date);
     const mergedProjectId = `${first.content.projectId}_merged_${date}`;
     const scopes = [];
     for (const inp of inputs) {

package/dist/projects/merge-upgrade.js

@@ -17,6 +17,22 @@
  *   - counts RECOMPUTED from merged rows — never trusted from inputs
  */
 import { OUTPUT_ROOT } from './output-paths.js';
+import { isWindowsReservedName } from '../tools/_filesystem-shared.js';
+/**
+ * SEC (review round 2): the merged detail FILE NAME is built from the last
+ * segment of the baseline path, which comes from inside an envelope (model-
+ * writable). On Windows `base.json:ads` would write an NTFS stream and `CON`
+ * opens the console. Keep only `[A-Za-z0-9._-]`, drop a stream suffix, never
+ * `..` or a device name; fall back to `baseline`.
+ */
+export function safeStem(baselinePath) {
+    const last = (typeof baselinePath === 'string' ? baselinePath : '').split(/[\\/]/).pop() ?? '';
+    let stem = last.split(':')[0].replace(/\.json$/i, '');
+    stem = stem.replace(/[^A-Za-z0-9._-]/g, '_').replace(/\.{2,}/g, '_').replace(/^[._-]+|[._ -]+$/g, '');
+    if (!stem || stem.length > 100 || isWindowsReservedName(stem))
+        return 'baseline';
+    return stem;
+}
 /** Higher = wins the reconciliation. */
 const STATUS_PRECEDENCE = {
     failed: 3,
@@ -124,7 +140,9 @@ export function mergeUpgradeProgress(inputs, baseline) {
     }
     const baselinePath = baseline.path ?? inputs[0].content.baselineRef.path;
     const date = baseline.mergedDate ?? todayUtc();
-    const stem = (baselinePath.split(/[\\\/]/).pop() ?? 'baseline').replace(/\.json$/i, '');
+    const stem = safeStem(baselinePath);
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(date))
+        throw new Error(`merged date ${JSON.stringify(date)} must be YYYY-MM-DD`);
     const merged = {
         detailPath: `${OUTPUT_ROOT}/upgrades/${stem}_progress_merged_${date}.json`,
         baselineRef: { path: baselinePath, sha256: baseline.sha256 },

package/dist/projects/promote.js

@@ -1,4 +1,5 @@
 import { canonicalSha256 } from './canonicalize.js';
+import { safeDetailRel } from './detail-path.js';
 function itemTextFor(env, itemId) {
     if (env.artefactType === 'spec-gap') {
         for (const s of env.content.sections) {
@@ -105,7 +106,12 @@ export function buildReviewDecisionsBlock(source) {
  * makes readable — so we hand the skill that exact path to `file_read` directly.
  */
 export function buildDetailPathHint(source) {
-    const detailPath = source.content?.detailPath;
+    // SEC (review round 2): detailPath is envelope DATA (model-writable). Only a
+    // plain project-relative path into a skill working folder
+    // (.cspeach/<cca|upgrades|modernize|tests>/…) is handed to the skill as a
+    // file_read target — never an absolute path, `..`, a stream, a protected
+    // file, or text carrying a newline into the prompt.
+    const detailPath = safeDetailRel(source.content?.detailPath);
     if (!detailPath)
         return null;
     return [

package/dist/register/records.js

@@ -12,6 +12,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { classificationFromCcaDetail, fromCcaDetailKey, normalizeKey, normalizeRuleId, objectKey, } from '@cspeach/register-core';
 import { defaultRand, readBaseline } from './store.js';
+import { safeDetailRel, resolveDetailFileSync } from '../projects/detail-path.js';
 const FIX_STATUSES = new Set(['fixed', 'skipped', 'failed', 'pending']);
 export function writeRecord(joined, recordType, rows, by, opts = {}) {
     const known = new Set(readBaseline(joined.projectDir).map((o) => objectKey(o.type, o.name)));
@@ -69,8 +70,12 @@ export function writeRecord(joined, recordType, rows, by, opts = {}) {
  */
 export function decisionRowsFromCca(content, projectRoot) {
     const rows = new Map();
-    const detail = path.join(projectRoot, path.dirname(content.detailPath ?? ''), 'objects.json');
-    if (content.detailPath && fs.existsSync(detail)) {
+    // SEC (review round 2): detailPath is envelope DATA. objects.json is read only
+    // from beside a safe `.cspeach/cca/…` detail path, as a real file inside the
+    // project's cca working folder — never from an arbitrary location.
+    const rel = safeDetailRel(content.detailPath, 'cca');
+    const detail = rel ? resolveDetailFileSync(`${path.posix.dirname(rel)}/objects.json`, 'cca', projectRoot) : null;
+    if (detail) {
         try {
             const objects = JSON.parse(fs.readFileSync(detail, 'utf8'));
             for (const [detailKey, o] of Object.entries(objects ?? {})) {

package/dist/skills/bundled-skills.js

@@ -1,6 +1,6 @@
 // GENERATED FILE — bundled skills for local mode.
 // Source: https://manifest.cspeach.dev/v1.json
-// Generated: 2026-10-02T01:44:09.559Z
+// Generated: 2026-10-02T14:32:26.255Z
 // Manifest signature verified at build time.
 export const BUNDLED_SKILLS = {
     "abap-app": {