@dreamlogic-ai/cli 2.0.1 → 2.0.2

package/dist/commands/setup-mcp.js

@@ -40,7 +40,8 @@ function getAgents(server, key) {
             generate: () => ({
                 mcpServers: {
                     "dreamlogic-skills": {
-                        url: `${server}/sse?api_key=${key}`,
+                        url: `${server}/sse`,
+                        headers: { "Authorization": `Bearer ${key}` },
                     },
                 },
             }),
@@ -87,7 +88,7 @@ function getAgents(server, key) {
             },
             generate: () => ({
                 // R1-02: Store args as array, not interpolated string
-                args: ["mcp", "add", "dreamlogic-skills", "--url", `${server}/sse?api_key=${key}`],
+                args: ["mcp", "add", "dreamlogic-skills", "--url", `${server}/sse`, "--header", `Authorization: Bearer ${key}`],
             }),
             apply: (config) => {
                 // R1-02: execFileSync with arg array — no shell injection possible
@@ -101,7 +102,8 @@ function getAgents(server, key) {
             generate: () => ({
                 mcpServers: {
                     "dreamlogic-skills": {
-                        url: `${server}/sse?api_key=${key}`,
+                        url: `${server}/sse`,
+                        headers: { "Authorization": `Bearer ${key}` },
                     },
                 },
             }),
@@ -170,7 +172,7 @@ export async function setupMcpCommand(opts) {
         const config = agent.generate(server, apiKey);
         // D-11: Show what will be written (R1-01: mask key in display)
         if (agent.name === "Claude CLI") {
-            const maskedCmd = `claude mcp add dreamlogic-skills --url "${server}/sse?api_key=${maskKey(apiKey)}"`;
+            const maskedCmd = `claude mcp add dreamlogic-skills --url "${server}/sse" --header "Authorization: Bearer ${maskKey(apiKey)}"`;
             ui.line(`  Command: ${chalk.cyan(maskedCmd)}`);
         }
         else {

package/dist/lib/agents.js

@@ -77,6 +77,11 @@ export function getAllAgents() {
  */
 export function registerSkillWithAgents(skillId, skillPath, agents) {
     const results = [];
+    // R3-08: Validate skill ID to prevent path traversal via symlink target
+    const SAFE_SKILL_ID = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/;
+    if (!SAFE_SKILL_ID.test(skillId)) {
+        return [{ agent: "all", path: "", status: "error", error: "Invalid skill ID" }];
+    }
     const resolvedSkillPath = resolve(skillPath);
     // Deduplicate by resolved dir (universal agents share .agents/skills)
     const seenDirs = new Set();

package/dist/lib/config.js

@@ -6,7 +6,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, statSync
 import { join } from "path";
 import { homedir } from "os";
 import { CONFIG_DIR_NAME, DEFAULT_SERVER, DEFAULT_INSTALL_DIR_NAME, } from "../types.js";
-/** CFG-01 FIX: Strip prototype pollution keys from parsed JSON */
+/** CFG-01 FIX: Recursively strip prototype pollution keys from parsed JSON */
 function sanitize(obj) {
     if (typeof obj !== "object" || obj === null)
         return obj;
@@ -15,6 +15,9 @@ function sanitize(obj) {
         if (BANNED.has(key)) {
             delete obj[key];
         }
+        else {
+            obj[key] = sanitize(obj[key]);
+        }
     }
     return obj;
 }

package/dist/types.d.ts

@@ -33,6 +33,6 @@ export interface InstalledRegistry {
 export declare const DEFAULT_SERVER = "https://skill.dreamlogic-claw.com";
 export declare const DEFAULT_INSTALL_DIR_NAME = "dreamlogic-skills";
 export declare const CONFIG_DIR_NAME = ".dreamlogic";
-export declare const CLI_VERSION = "2.0.1";
+export declare const CLI_VERSION = "2.0.2";
 export declare const CLI_NAME = "Dreamlogic CLI";
 export declare const CLI_AUTHOR = "Dreamlogic-ai by MAJORNINE";

package/dist/types.js

@@ -2,6 +2,6 @@
 export const DEFAULT_SERVER = "https://skill.dreamlogic-claw.com";
 export const DEFAULT_INSTALL_DIR_NAME = "dreamlogic-skills";
 export const CONFIG_DIR_NAME = ".dreamlogic";
-export const CLI_VERSION = "2.0.1";
+export const CLI_VERSION = "2.0.2";
 export const CLI_NAME = "Dreamlogic CLI";
 export const CLI_AUTHOR = "Dreamlogic-ai by MAJORNINE";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dreamlogic-ai/cli",
-  "version": "2.0.1",
+  "version": "2.0.2",
   "description": "Dreamlogic AI Skill Manager — Install, update and manage AI agent skills",
   "type": "module",
   "bin": {