@exaudeus/workrail 0.6.1-beta.4 → 0.6.1-beta.5

package/dist/infrastructure/storage/enhanced-multi-source-workflow-storage.js

@@ -269,7 +269,7 @@ function createEnhancedMultiSourceWorkflowStorage(overrides = {}) {
     }
     else if (gitReposJson) {
         const cacheBaseDir = process.env['WORKRAIL_CACHE_DIR'] ||
-            path_1.default.join(process.cwd(), '.workrail-cache');
+            path_1.default.join(os_1.default.homedir(), '.workrail', 'cache');
         config.gitRepositories = gitReposJson.split(',').map((url, index) => {
             const trimmedUrl = url.trim();
             const repoName = trimmedUrl.split('/').pop()?.replace(/\.git$/, '') || `repo-${index}`;

package/dist/infrastructure/storage/git-workflow-storage.js

@@ -9,6 +9,7 @@ const util_1 = require("util");
 const path_1 = __importDefault(require("path"));
 const promises_1 = __importDefault(require("fs/promises"));
 const fs_1 = require("fs");
+const os_1 = __importDefault(require("os"));
 const storage_security_1 = require("../../utils/storage-security");
 const error_handler_1 = require("../../core/error-handler");
 const execAsync = (0, util_1.promisify)(child_process_1.exec);
@@ -29,11 +30,15 @@ class GitWorkflowStorage {
         const securityOptions = (0, storage_security_1.validateSecurityOptions)({
             maxFileSizeBytes: config.maxFileSize || 1024 * 1024
         });
+        const defaultCacheDir = path_1.default.join(os_1.default.homedir(), '.workrail', 'cache');
         const localPath = config.localPath ||
-            path_1.default.join(process.cwd(), '.workrail-cache', 'community-workflows');
+            path_1.default.join(defaultCacheDir, 'community-workflows');
         if (!config.skipSandboxCheck) {
             try {
-                (0, storage_security_1.assertWithinBase)(localPath, process.cwd());
+                const safeBaseDir = config.localPath
+                    ? path_1.default.dirname(path_1.default.dirname(config.localPath))
+                    : path_1.default.join(os_1.default.homedir(), '.workrail');
+                (0, storage_security_1.assertWithinBase)(localPath, safeBaseDir);
             }
             catch (error) {
                 throw new error_handler_1.SecurityError(`Local path outside safe boundaries: ${error.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exaudeus/workrail",
-  "version": "0.6.1-beta.4",
+  "version": "0.6.1-beta.5",
   "description": "MCP server for structured workflow orchestration and step-by-step task guidance",
   "license": "MIT",
   "bin": {