@floomhq/floom 1.0.44 → 1.0.45

package/dist/cli.js

@@ -105,7 +105,7 @@ function commandUsage() {
    ${c.dim("Advanced")}
      ${c.cyan("library")}            Create, browse, and subscribe to libraries
                        ${c.dim("Alias: lib")}
-     ${c.cyan("move")} ${c.dim("<slug> --folder <path>")}  Place a saved skill in a local folder
+     ${c.cyan("move")} ${c.dim("<slug> --folder <path>")}  Place a saved skill in a relative folder
      ${c.cyan("mcp")}                Print optional MCP setup guidance
      ${c.cyan("sync")}               Preview pull of published, saved, and library skills
                        ${c.dim(`Flags: --target ${TARGET_HINT} (default: claude)`)}
@@ -163,13 +163,13 @@ function moveUsage() {
     process.stdout.write(`
  ${c.bold("Usage:")} ${c.cyan(`${CLI_COMMAND} move`)} ${c.dim("<slug> --folder <path> [--tag <tag>]")}
 
- ${c.bold("Place a saved or subscribed skill in a local folder.")}
+ ${c.bold("Place a saved or subscribed skill in a portable library folder.")}
    ${c.cyan(`${CLI_COMMAND} move support-tone --folder support/tone`)}
    ${c.cyan(`${CLI_COMMAND} move support-tone --root`)}
    ${c.cyan(`${CLI_COMMAND} move support-tone --folder support --tags support,tone`)}
 
  ${c.bold("Flags")}
-   ${c.cyan("--folder <path>")}     Folder path for synced installs
+   ${c.cyan("--folder <path>")}     Relative folder path for synced installs
    ${c.cyan("--root")}              Put the skill at the root
    ${c.cyan("--tag <tag>")}         Add one tag, repeatable
    ${c.cyan("--tags a,b")}          Add comma-separated tags
@@ -589,7 +589,20 @@ function parseDoctorFlags(argv) {
     return out;
 }
 function normalizeFolder(value) {
-    return value === "root" || value === "/" || value === "." ? null : value;
+    const normalized = value.trim().replace(/\\/g, "/").replace(/\/+/g, "/");
+    if (normalized === "root" || normalized === "/" || normalized === ".")
+        return null;
+    if (normalized.startsWith("/")) {
+        throw new FloomError("Invalid --folder: use a relative sync folder.", "Floom folders are portable library paths like `support/tone`, not absolute filesystem paths like `/tmp/floom-move-target`.");
+    }
+    if (normalized === ".." ||
+        normalized.startsWith("../") ||
+        normalized.includes("/../") ||
+        normalized.endsWith("/..")) {
+        throw new FloomError("Invalid --folder: path traversal is not allowed.", "Use a relative sync folder like `support/tone`, or use `--root`.");
+    }
+    const relative = normalized.startsWith("./") ? normalized.slice(2) : normalized;
+    return relative || null;
 }
 function parseFolderTagFlags(argv) {
     const out = { tags: [], rest: [] };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floomhq/floom",
-  "version": "1.0.44",
+  "version": "1.0.45",
   "description": "Sync AI skills across agents and machines.",
   "license": "MIT",
   "type": "module",