@flood-md/cli 0.2.3 → 0.2.4

package/README.md

@@ -16,3 +16,9 @@ Read the skill's routing reference for the task/source/check matrix. Doctor chec
 the complete guide set and package alignment; it does not validate application
 behavior, CSS imports or agent compliance. Merge customized guide upgrades
 deliberately; init has no overwrite mode.
+
+Init and doctor reject linked project-directory ancestry. Init also requires a
+regular nonlinked package.json (including no hardlinks), validates its project
+object and React dependency, and rechecks paths after npm before owned writes.
+These checks do not sandbox npm or stop an external process from racing filesystem
+changes; run installs only in a trusted project and inspect npm failures.

package/lib/index.mjs

@@ -1,9 +1,9 @@
 import { readFile, writeFile, mkdir, lstat } from "node:fs/promises";
-import { resolve, join } from "node:path";
+import { resolve, join, parse, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "node:child_process";
 
-export const VERSION = "0.2.3";
+export const VERSION = "0.2.4";
 const packages = ["@flood-md/tokens", "@flood-md/react", "@flood-md/agent"];
 const json = async (path) => JSON.parse(await readFile(path, "utf8"));
 const agentFile = (name) =>
@@ -19,6 +19,39 @@ if (agentManifest.schemaVersion !== 1 || agentManifest.version !== VERSION || !A
   throw new Error("Invalid Flood agent file manifest.");
 export const AGENT_FILES = Object.freeze(agentManifest.files.map(file => Object.freeze({ ...file })));
 
+async function projectDirectory(root) {
+  const absolute = resolve(root);
+  const anchor = parse(absolute).root;
+  let current = anchor;
+  // Inspect prefixes before descendants so a linked ancestor cannot redirect
+  // either package.json reads or subsequent npm/configuration writes.
+  for (const part of ["", ...relative(anchor, absolute).split(sep).filter(Boolean)]) {
+    if (part) current = join(current, part);
+    const info = await lstat(current).catch(() => {
+      throw new Error("Run Flood inside an existing project directory.");
+    });
+    if (info.isSymbolicLink()) throw new Error(`Refusing linked project directory: ${current}`);
+    if (!info.isDirectory()) throw new Error("Run Flood inside a regular project directory.");
+  }
+  return absolute;
+}
+
+async function projectManifest(root) {
+  const path = join(root, "package.json");
+  const info = await lstat(path).catch(() => {
+    throw new Error("Run init inside a React project with a package.json.");
+  });
+  if (info.isSymbolicLink()) throw new Error("Refusing linked path: package.json");
+  if (!info.isFile()) throw new Error("package.json must be a regular file.");
+  if (info.nlink > 1) throw new Error("Refusing linked path: package.json");
+  const manifest = await json(path).catch(() => {
+    throw new Error("package.json must contain a valid project object.");
+  });
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest))
+    throw new Error("package.json must contain a valid project object.");
+  return manifest;
+}
+
 async function inspectTarget(root, relative) {
   let current = root;
   let info;
@@ -64,10 +97,9 @@ export async function initProject(
   root,
   { dryRun = false, installer = install, log = console.log } = {},
 ) {
-  const manifest = await json(join(root, "package.json")).catch(() => {
-    throw new Error("Run init inside a React project with a package.json.");
-  });
-  if (!(manifest.dependencies?.react || manifest.devDependencies?.react))
+  root = await projectDirectory(root);
+  const manifest = await projectManifest(root);
+  if (![manifest.dependencies?.react, manifest.devDependencies?.react].some(value => typeof value === "string" && value.trim()))
     throw new Error(
       "React was not found. Create a React or Next.js project first.",
     );
@@ -86,6 +118,8 @@ export async function initProject(
     ...file, content: await readFile(agentFile(file.source)),
   })));
   await installer(root);
+  await projectDirectory(root);
+  await projectManifest(root);
   const config = {
     $schema: "https://flood.md/schema/config.json",
     version: VERSION,
@@ -113,6 +147,7 @@ export async function initProject(
 }
 
 export async function doctor(root, log = console.log) {
+  root = await projectDirectory(root);
   const configInfo = await inspectTarget(root, "flood.json");
   if (!configInfo?.isFile()) throw new Error("No regular flood.json. Run init first.");
   const config = await json(join(root, "flood.json")).catch(() => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flood-md/cli",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "type": "module",
   "description": "Connect Flood to React and Next.js projects.",
   "license": "MIT",
@@ -21,7 +21,7 @@
     "node": ">=22.12.0"
   },
   "dependencies": {
-    "@flood-md/agent": "0.2.3"
+    "@flood-md/agent": "0.2.4"
   },
   "publishConfig": {
     "access": "public"