@georgedong32/ccs 7.67.0 → 8.0.0

package/dist/web-server/shared-routes-content.js

@@ -0,0 +1,152 @@
+"use strict";
+/**
+ * Shared Routes — Item content readers
+ *
+ * Resolves the full markdown content for a given shared item path,
+ * routing by collection type and enforcing allowed-root checks.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getSharedItemContent = exports.getSharedSettingsContent = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const shared_routes_path_guards_1 = require("./shared-routes-path-guards");
+const shared_routes_markdown_1 = require("./shared-routes-markdown");
+const shared_routes_plugins_1 = require("./shared-routes-plugins");
+const shared_routes_plugin_registry_content_1 = require("./shared-routes-plugin-registry-content");
+// ---------------------------------------------------------------------------
+// Settings
+// ---------------------------------------------------------------------------
+function getSharedSettingsContent(itemPath, allowedRoots) {
+    if (path.basename(itemPath) !== 'settings.json') {
+        return null;
+    }
+    const sharedRoot = Array.from(allowedRoots)[0];
+    if (!sharedRoot) {
+        return null;
+    }
+    const settingsPath = path.join(sharedRoot, 'settings.json');
+    const resolvedSettingsPath = (0, shared_routes_path_guards_1.safeRealPath)(settingsPath);
+    if (!resolvedSettingsPath || !(0, shared_routes_path_guards_1.isPathWithinAny)(resolvedSettingsPath, allowedRoots)) {
+        return null;
+    }
+    let stats;
+    try {
+        stats = fs.statSync(resolvedSettingsPath);
+    }
+    catch {
+        return null;
+    }
+    if (!stats.isFile() || stats.size > shared_routes_markdown_1.MAX_CONTENT_FILE_BYTES) {
+        return null;
+    }
+    try {
+        const rawContent = fs.readFileSync(resolvedSettingsPath, 'utf8');
+        const parsed = JSON.parse(rawContent);
+        return {
+            content: JSON.stringify(parsed, null, 2),
+            contentPath: resolvedSettingsPath,
+        };
+    }
+    catch {
+        const content = (0, shared_routes_markdown_1.readMarkdownContent)(resolvedSettingsPath, allowedRoots);
+        return content ? { content, contentPath: resolvedSettingsPath } : null;
+    }
+}
+exports.getSharedSettingsContent = getSharedSettingsContent;
+// ---------------------------------------------------------------------------
+// Generic item content
+// ---------------------------------------------------------------------------
+function getSharedItemContent(type, itemPath, allowedRoots, sharedDir) {
+    if (type === 'settings') {
+        return getSharedSettingsContent(itemPath, allowedRoots);
+    }
+    if (type === 'plugins') {
+        const pluginRegistryContent = (0, shared_routes_plugin_registry_content_1.getPluginRegistryContent)(itemPath, sharedDir, allowedRoots);
+        if (pluginRegistryContent) {
+            return pluginRegistryContent;
+        }
+    }
+    const resolvedItemPath = (0, shared_routes_path_guards_1.safeRealPath)(itemPath);
+    if (!resolvedItemPath || !(0, shared_routes_path_guards_1.isPathWithinAny)(resolvedItemPath, allowedRoots)) {
+        return null;
+    }
+    let itemStats;
+    try {
+        itemStats = fs.statSync(resolvedItemPath);
+    }
+    catch {
+        return null;
+    }
+    let markdownPath = null;
+    if (type === 'commands') {
+        if (!itemStats.isFile() || !itemPath.toLowerCase().endsWith('.md')) {
+            return null;
+        }
+        markdownPath = resolvedItemPath;
+    }
+    else if (type === 'skills') {
+        if (!itemStats.isDirectory()) {
+            return null;
+        }
+        markdownPath = (0, shared_routes_markdown_1.resolveReadableMarkdownPath)([path.join(resolvedItemPath, 'SKILL.md')], allowedRoots);
+    }
+    else if (type === 'plugins') {
+        if (!itemStats.isDirectory() || (0, shared_routes_plugins_1.isPluginInfrastructurePath)(resolvedItemPath, sharedDir)) {
+            return null;
+        }
+        markdownPath = (0, shared_routes_markdown_1.resolveReadableMarkdownPath)([
+            path.join(resolvedItemPath, 'README.md'),
+            path.join(resolvedItemPath, 'readme.md'),
+            path.join(resolvedItemPath, 'PLUGIN.md'),
+        ], allowedRoots);
+        if (!markdownPath) {
+            return null;
+        }
+    }
+    else {
+        // agents
+        if (itemStats.isDirectory()) {
+            markdownPath = (0, shared_routes_markdown_1.resolveReadableMarkdownPath)([
+                path.join(resolvedItemPath, 'prompt.md'),
+                path.join(resolvedItemPath, 'AGENT.md'),
+                path.join(resolvedItemPath, 'agent.md'),
+            ], allowedRoots);
+        }
+        else if (itemStats.isFile() && itemPath.toLowerCase().endsWith('.md')) {
+            markdownPath = resolvedItemPath;
+        }
+    }
+    if (!markdownPath) {
+        return null;
+    }
+    const content = (0, shared_routes_markdown_1.readMarkdownContent)(markdownPath, allowedRoots);
+    if (!content) {
+        return null;
+    }
+    return { content, contentPath: markdownPath };
+}
+exports.getSharedItemContent = getSharedItemContent;
+//# sourceMappingURL=shared-routes-content.js.map

package/dist/web-server/shared-routes-content.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-routes-content.js","sourceRoot":"","sources":["../../src/web-server/shared-routes-content.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAE7B,2EAA4E;AAC5E,qEAIkC;AAClC,mEAAqE;AACrE,mGAAmF;AAGnF,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,SAAgB,wBAAwB,CACtC,QAAgB,EAChB,YAAyB;IAEzB,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,eAAe,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAC5D,MAAM,oBAAoB,GAAG,IAAA,wCAAY,EAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,oBAAoB,IAAI,CAAC,IAAA,2CAAe,EAAC,oBAAoB,EAAE,YAAY,CAAC,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,+CAAsB,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAY,CAAC;QACjD,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACxC,WAAW,EAAE,oBAAoB;SAClC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,GAAG,IAAA,4CAAmB,EAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC;QACxE,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,CAAC;AACH,CAAC;AAzCD,4DAyCC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAgB,oBAAoB,CAClC,IAAuB,EACvB,QAAgB,EAChB,YAAyB,EACzB,SAAiB;IAEjB,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,OAAO,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,qBAAqB,GAAG,IAAA,gEAAwB,EAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QAC1F,IAAI,qBAAqB,EAAE,CAAC;YAC1B,OAAO,qBAAqB,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAA,wCAAY,EAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAA,2CAAe,EAAC,gBAAgB,EAAE,YAAY,CAAC,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,SAAmB,CAAC;IACxB,IAAI,CAAC;QACH,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,YAAY,GAAkB,IAAI,CAAC;IAEvC,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,YAAY,GAAG,gBAAgB,CAAC;IAClC,CAAC;SAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,YAAY,GAAG,IAAA,oDAA2B,EACxC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC,EACzC,YAAY,CACb,CAAC;IACJ,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,IAAA,kDAA0B,EAAC,gBAAgB,EAAE,SAAS,CAAC,EAAE,CAAC;YACxF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,YAAY,GAAG,IAAA,oDAA2B,EACxC;YACE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC;SACzC,EACD,YAAY,CACb,CAAC;QACF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;SAAM,CAAC;QACN,SAAS;QACT,IAAI,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5B,YAAY,GAAG,IAAA,oDAA2B,EACxC;gBACE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC;gBACxC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC;gBACvC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC;aACxC,EACD,YAAY,CACb,CAAC;QACJ,CAAC;aAAM,IAAI,SAAS,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,YAAY,GAAG,gBAAgB,CAAC;QAClC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,4CAAmB,EAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAChD,CAAC;AArFD,oDAqFC"}

package/dist/web-server/shared-routes-markdown-walker.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Shared Routes — Markdown directory walker
+ *
+ * Iterative BFS/DFS over a shared directory collecting all .md files
+ * within allowed roots and the configured traversal depth limit.
+ */
+export interface MarkdownFileEntry {
+    displayPath: string;
+    resolvedPath: string;
+}
+export declare function collectMarkdownFiles(sharedDir: string, allowedRoots: Set<string>): MarkdownFileEntry[];
+//# sourceMappingURL=shared-routes-markdown-walker.d.ts.map

package/dist/web-server/shared-routes-markdown-walker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-routes-markdown-walker.d.ts","sourceRoot":"","sources":["../../src/web-server/shared-routes-markdown-walker.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GACxB,iBAAiB,EAAE,CAmErB"}

package/dist/web-server/shared-routes-markdown-walker.js

@@ -0,0 +1,97 @@
+"use strict";
+/**
+ * Shared Routes — Markdown directory walker
+ *
+ * Iterative BFS/DFS over a shared directory collecting all .md files
+ * within allowed roots and the configured traversal depth limit.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectMarkdownFiles = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const shared_routes_path_guards_1 = require("./shared-routes-path-guards");
+const MAX_DIRECTORY_TRAVERSAL_DEPTH = 10;
+function collectMarkdownFiles(sharedDir, allowedRoots) {
+    const directoriesToVisit = [
+        { path: sharedDir, depth: 0 },
+    ];
+    const visitedDirectories = new Set();
+    const markdownFiles = [];
+    while (directoriesToVisit.length > 0) {
+        const current = directoriesToVisit.pop();
+        if (!current) {
+            continue;
+        }
+        const currentDir = current.path;
+        const resolvedCurrentDir = (0, shared_routes_path_guards_1.safeRealPath)(currentDir);
+        if (!resolvedCurrentDir || !(0, shared_routes_path_guards_1.isPathWithinAny)(resolvedCurrentDir, allowedRoots)) {
+            continue;
+        }
+        const normalizedDirPath = process.platform === 'win32'
+            ? path.resolve(resolvedCurrentDir).toLowerCase()
+            : path.resolve(resolvedCurrentDir);
+        if (visitedDirectories.has(normalizedDirPath)) {
+            continue;
+        }
+        visitedDirectories.add(normalizedDirPath);
+        let entries = [];
+        try {
+            entries = fs.readdirSync(currentDir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            const entryPath = path.join(currentDir, entry.name);
+            const resolvedEntryPath = (0, shared_routes_path_guards_1.safeRealPath)(entryPath);
+            if (!resolvedEntryPath || !(0, shared_routes_path_guards_1.isPathWithinAny)(resolvedEntryPath, allowedRoots)) {
+                continue;
+            }
+            let stats;
+            try {
+                stats = fs.statSync(resolvedEntryPath);
+            }
+            catch {
+                continue;
+            }
+            if (stats.isDirectory()) {
+                if (current.depth < MAX_DIRECTORY_TRAVERSAL_DEPTH) {
+                    directoriesToVisit.push({ path: entryPath, depth: current.depth + 1 });
+                }
+                continue;
+            }
+            if (stats.isFile() && entry.name.toLowerCase().endsWith('.md')) {
+                markdownFiles.push({
+                    displayPath: entryPath,
+                    resolvedPath: resolvedEntryPath,
+                });
+            }
+        }
+    }
+    return markdownFiles;
+}
+exports.collectMarkdownFiles = collectMarkdownFiles;
+//# sourceMappingURL=shared-routes-markdown-walker.js.map

package/dist/web-server/shared-routes-markdown-walker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-routes-markdown-walker.js","sourceRoot":"","sources":["../../src/web-server/shared-routes-markdown-walker.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAE7B,2EAA4E;AAE5E,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAOzC,SAAgB,oBAAoB,CAClC,SAAiB,EACjB,YAAyB;IAEzB,MAAM,kBAAkB,GAA2C;QACjE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;KAC9B,CAAC;IACF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,MAAM,aAAa,GAAwB,EAAE,CAAC;IAE9C,OAAO,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,EAAE,CAAC;QACzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;QAChC,MAAM,kBAAkB,GAAG,IAAA,wCAAY,EAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,kBAAkB,IAAI,CAAC,IAAA,2CAAe,EAAC,kBAAkB,EAAE,YAAY,CAAC,EAAE,CAAC;YAC9E,SAAS;QACX,CAAC;QAED,MAAM,iBAAiB,GACrB,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC1B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,WAAW,EAAE;YAChD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAEvC,IAAI,kBAAkB,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,kBAAkB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAE1C,IAAI,OAAO,GAAgB,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,iBAAiB,GAAG,IAAA,wCAAY,EAAC,SAAS,CAAC,CAAC;YAClD,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAA,2CAAe,EAAC,iBAAiB,EAAE,YAAY,CAAC,EAAE,CAAC;gBAC5E,SAAS;YACX,CAAC;YAED,IAAI,KAAe,CAAC;YACpB,IAAI,CAAC;gBACH,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,OAAO,CAAC,KAAK,GAAG,6BAA6B,EAAE,CAAC;oBAClD,kBAAkB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;gBACzE,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/D,aAAa,CAAC,IAAI,CAAC;oBACjB,WAAW,EAAE,SAAS;oBACtB,YAAY,EAAE,iBAAiB;iBAChC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAtED,oDAsEC"}

package/dist/web-server/shared-routes-markdown.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Shared Routes — Markdown file reading and description extraction
+ *
+ * Handles YAML frontmatter parsing, body-line extraction, and safe
+ * bounded reads for both description snippets and full content.
+ *
+ * Directory walking is in shared-routes-markdown-walker.ts.
+ */
+/** Exported for content module which uses a larger limit. */
+export declare const MAX_CONTENT_FILE_BYTES: number;
+export type { MarkdownFileEntry } from './shared-routes-markdown-walker';
+export { collectMarkdownFiles } from './shared-routes-markdown-walker';
+export declare function extractDescription(content: string): string;
+export declare function readMarkdownDescription(markdownPath: string, allowedRoots: Set<string>): string | null;
+export declare function readFirstMarkdownDescription(markdownPaths: string[], allowedRoots: Set<string>): string | null;
+export declare function readMarkdownContent(markdownPath: string, allowedRoots: Set<string>): string | null;
+export declare function resolveReadableMarkdownPath(markdownPaths: string[], allowedRoots: Set<string>): string | null;
+//# sourceMappingURL=shared-routes-markdown.d.ts.map

package/dist/web-server/shared-routes-markdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-routes-markdown.d.ts","sourceRoot":"","sources":["../../src/web-server/shared-routes-markdown.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,6DAA6D;AAC7D,eAAO,MAAM,sBAAsB,QAAkB,CAAC;AAGtD,YAAY,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AA8CvE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAgB1D;AAMD,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GACxB,MAAM,GAAG,IAAI,CAef;AAED,wBAAgB,4BAA4B,CAC1C,aAAa,EAAE,MAAM,EAAE,EACvB,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GACxB,MAAM,GAAG,IAAI,CAQf;AAED,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GACxB,MAAM,GAAG,IAAI,CAcf;AAED,wBAAgB,2BAA2B,CACzC,aAAa,EAAE,MAAM,EAAE,EACvB,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GACxB,MAAM,GAAG,IAAI,CAiBf"}

package/dist/web-server/shared-routes-markdown.js

@@ -0,0 +1,167 @@
+"use strict";
+/**
+ * Shared Routes — Markdown file reading and description extraction
+ *
+ * Handles YAML frontmatter parsing, body-line extraction, and safe
+ * bounded reads for both description snippets and full content.
+ *
+ * Directory walking is in shared-routes-markdown-walker.ts.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveReadableMarkdownPath = exports.readMarkdownContent = exports.readFirstMarkdownDescription = exports.readMarkdownDescription = exports.extractDescription = exports.collectMarkdownFiles = exports.MAX_CONTENT_FILE_BYTES = void 0;
+const fs = __importStar(require("fs"));
+const yaml = __importStar(require("js-yaml"));
+const shared_routes_path_guards_1 = require("./shared-routes-path-guards");
+const MAX_DESCRIPTION_LENGTH = 140;
+const MAX_MARKDOWN_FILE_BYTES = 1024 * 1024; // 1 MiB
+/** Exported for content module which uses a larger limit. */
+exports.MAX_CONTENT_FILE_BYTES = 2 * 1024 * 1024; // 2 MiB
+var shared_routes_markdown_walker_1 = require("./shared-routes-markdown-walker");
+Object.defineProperty(exports, "collectMarkdownFiles", { enumerable: true, get: function () { return shared_routes_markdown_walker_1.collectMarkdownFiles; } });
+// ---------------------------------------------------------------------------
+// Description extraction helpers
+// ---------------------------------------------------------------------------
+function isDescriptionBodyLine(line) {
+    if (!line) {
+        return false;
+    }
+    if (line === '---' || line === '...') {
+        return false;
+    }
+    return !line.startsWith('#') && !line.startsWith('<!--');
+}
+function extractFrontmatterDescription(content) {
+    const frontmatterMatch = content.match(/^---\s*\r?\n([\s\S]*?)\r?\n---(?:\s*\r?\n|$)/);
+    if (!frontmatterMatch) {
+        return null;
+    }
+    try {
+        const parsed = yaml.load(frontmatterMatch[1]);
+        const description = parsed?.description;
+        if (typeof description !== 'string') {
+            return null;
+        }
+        const trimmed = description.trim();
+        return trimmed.length > 0 ? trimmed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function stripFrontmatter(content) {
+    return content.replace(/^---\s*\r?\n[\s\S]*?\r?\n---\s*\r?\n?/, '');
+}
+function trimDescription(description) {
+    if (description.length <= MAX_DESCRIPTION_LENGTH) {
+        return description;
+    }
+    return `${description.slice(0, MAX_DESCRIPTION_LENGTH - 3).trimEnd()}...`;
+}
+function extractDescription(content) {
+    const frontmatterDescription = extractFrontmatterDescription(content);
+    if (frontmatterDescription) {
+        return trimDescription(frontmatterDescription);
+    }
+    // Fall back to first non-empty, non-heading body line.
+    const lines = stripFrontmatter(content).split('\n');
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (isDescriptionBodyLine(trimmed)) {
+            return trimDescription(trimmed);
+        }
+    }
+    return 'No description';
+}
+exports.extractDescription = extractDescription;
+// ---------------------------------------------------------------------------
+// File readers
+// ---------------------------------------------------------------------------
+function readMarkdownDescription(markdownPath, allowedRoots) {
+    try {
+        const resolvedMarkdownPath = (0, shared_routes_path_guards_1.safeRealPath)(markdownPath);
+        if (!resolvedMarkdownPath || !(0, shared_routes_path_guards_1.isPathWithinAny)(resolvedMarkdownPath, allowedRoots)) {
+            return null;
+        }
+        const stats = fs.statSync(resolvedMarkdownPath);
+        if (!stats.isFile() || stats.size > MAX_MARKDOWN_FILE_BYTES) {
+            return null;
+        }
+        const content = fs.readFileSync(resolvedMarkdownPath, 'utf8');
+        return extractDescription(content);
+    }
+    catch {
+        return null;
+    }
+}
+exports.readMarkdownDescription = readMarkdownDescription;
+function readFirstMarkdownDescription(markdownPaths, allowedRoots) {
+    for (const markdownPath of markdownPaths) {
+        const description = readMarkdownDescription(markdownPath, allowedRoots);
+        if (description) {
+            return description;
+        }
+    }
+    return null;
+}
+exports.readFirstMarkdownDescription = readFirstMarkdownDescription;
+function readMarkdownContent(markdownPath, allowedRoots) {
+    try {
+        const resolvedMarkdownPath = (0, shared_routes_path_guards_1.safeRealPath)(markdownPath);
+        if (!resolvedMarkdownPath || !(0, shared_routes_path_guards_1.isPathWithinAny)(resolvedMarkdownPath, allowedRoots)) {
+            return null;
+        }
+        const stats = fs.statSync(resolvedMarkdownPath);
+        if (!stats.isFile() || stats.size > exports.MAX_CONTENT_FILE_BYTES) {
+            return null;
+        }
+        return fs.readFileSync(resolvedMarkdownPath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+exports.readMarkdownContent = readMarkdownContent;
+function resolveReadableMarkdownPath(markdownPaths, allowedRoots) {
+    for (const markdownPath of markdownPaths) {
+        const resolvedMarkdownPath = (0, shared_routes_path_guards_1.safeRealPath)(markdownPath);
+        if (!resolvedMarkdownPath || !(0, shared_routes_path_guards_1.isPathWithinAny)(resolvedMarkdownPath, allowedRoots)) {
+            continue;
+        }
+        try {
+            const stats = fs.statSync(resolvedMarkdownPath);
+            if (!stats.isFile() || stats.size > exports.MAX_CONTENT_FILE_BYTES) {
+                continue;
+            }
+            return resolvedMarkdownPath;
+        }
+        catch {
+            continue;
+        }
+    }
+    return null;
+}
+exports.resolveReadableMarkdownPath = resolveReadableMarkdownPath;
+//# sourceMappingURL=shared-routes-markdown.js.map

package/dist/web-server/shared-routes-markdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-routes-markdown.js","sourceRoot":"","sources":["../../src/web-server/shared-routes-markdown.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,8CAAgC;AAEhC,2EAA4E;AAE5E,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;AAErD,6DAA6D;AAChD,QAAA,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;AAI/D,iFAAuE;AAA9D,qIAAA,oBAAoB,OAAA;AAE7B,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,6BAA6B,CAAC,OAAe;IACpD,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACvF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAmC,CAAC;QAChF,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,CAAC;QACxC,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,OAAO,CAAC,OAAO,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,eAAe,CAAC,WAAmB;IAC1C,IAAI,WAAW,CAAC,MAAM,IAAI,sBAAsB,EAAE,CAAC;QACjD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC;AAC5E,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAAe;IAChD,MAAM,sBAAsB,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,eAAe,CAAC,sBAAsB,CAAC,CAAC;IACjD,CAAC;IAED,uDAAuD;IACvD,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAhBD,gDAgBC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,SAAgB,uBAAuB,CACrC,YAAoB,EACpB,YAAyB;IAEzB,IAAI,CAAC;QACH,MAAM,oBAAoB,GAAG,IAAA,wCAAY,EAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,oBAAoB,IAAI,CAAC,IAAA,2CAAe,EAAC,oBAAoB,EAAE,YAAY,CAAC,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,uBAAuB,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;QAC9D,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAlBD,0DAkBC;AAED,SAAgB,4BAA4B,CAC1C,aAAuB,EACvB,YAAyB;IAEzB,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,uBAAuB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QACxE,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAXD,oEAWC;AAED,SAAgB,mBAAmB,CACjC,YAAoB,EACpB,YAAyB;IAEzB,IAAI,CAAC;QACH,MAAM,oBAAoB,GAAG,IAAA,wCAAY,EAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,oBAAoB,IAAI,CAAC,IAAA,2CAAe,EAAC,oBAAoB,EAAE,YAAY,CAAC,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,8BAAsB,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,CAAC,YAAY,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAjBD,kDAiBC;AAED,SAAgB,2BAA2B,CACzC,aAAuB,EACvB,YAAyB;IAEzB,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,MAAM,oBAAoB,GAAG,IAAA,wCAAY,EAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,oBAAoB,IAAI,CAAC,IAAA,2CAAe,EAAC,oBAAoB,EAAE,YAAY,CAAC,EAAE,CAAC;YAClF,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;YAChD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,8BAAsB,EAAE,CAAC;gBAC3D,SAAS;YACX,CAAC;YACD,OAAO,oBAAoB,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AApBD,kEAoBC"}

package/dist/web-server/shared-routes-path-guards.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Shared Routes — Path safety helpers
+ *
+ * Prevents directory traversal by resolving real paths and checking
+ * containment within allowed roots before any file I/O.
+ */
+import { getCcsDir } from '../config/config-loader-facade';
+import type { SharedCollectionType } from './shared-routes-types';
+export declare function safeRealPath(targetPath: string): string | null;
+export declare function normalizeForPathComparison(targetPath: string): string;
+export declare function isPathWithin(candidatePath: string, basePath: string): boolean;
+export declare function isPathWithinAny(candidatePath: string, basePaths: Set<string>): boolean;
+export declare function resolveAllowedRoots(type: SharedCollectionType, ccsDir: string, sharedDirRoot: string): Set<string>;
+export declare function resolveSettingsAllowedRoots(ccsDir: string, sharedDirRoot: string): Set<string>;
+export { getCcsDir };
+//# sourceMappingURL=shared-routes-path-guards.d.ts.map

package/dist/web-server/shared-routes-path-guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-routes-path-guards.d.ts","sourceRoot":"","sources":["../../src/web-server/shared-routes-path-guards.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM9D;AAED,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAGrE;AAED,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAK7E;AAED,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAOtF;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,oBAAoB,EAC1B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,GAAG,CAAC,MAAM,CAAC,CAeb;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAS9F;AAGD,OAAO,EAAE,SAAS,EAAE,CAAC"}

package/dist/web-server/shared-routes-path-guards.js

@@ -0,0 +1,93 @@
+"use strict";
+/**
+ * Shared Routes — Path safety helpers
+ *
+ * Prevents directory traversal by resolving real paths and checking
+ * containment within allowed roots before any file I/O.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCcsDir = exports.resolveSettingsAllowedRoots = exports.resolveAllowedRoots = exports.isPathWithinAny = exports.isPathWithin = exports.normalizeForPathComparison = exports.safeRealPath = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const claude_config_path_1 = require("../utils/claude-config-path");
+const config_loader_facade_1 = require("../config/config-loader-facade");
+Object.defineProperty(exports, "getCcsDir", { enumerable: true, get: function () { return config_loader_facade_1.getCcsDir; } });
+function safeRealPath(targetPath) {
+    try {
+        return fs.realpathSync(targetPath);
+    }
+    catch {
+        return null;
+    }
+}
+exports.safeRealPath = safeRealPath;
+function normalizeForPathComparison(targetPath) {
+    const normalized = path.resolve(targetPath);
+    return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
+}
+exports.normalizeForPathComparison = normalizeForPathComparison;
+function isPathWithin(candidatePath, basePath) {
+    const normalizedCandidate = normalizeForPathComparison(candidatePath);
+    const normalizedBase = normalizeForPathComparison(basePath);
+    const relative = path.relative(normalizedBase, normalizedCandidate);
+    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+exports.isPathWithin = isPathWithin;
+function isPathWithinAny(candidatePath, basePaths) {
+    for (const basePath of basePaths) {
+        if (isPathWithin(candidatePath, basePath)) {
+            return true;
+        }
+    }
+    return false;
+}
+exports.isPathWithinAny = isPathWithinAny;
+function resolveAllowedRoots(type, ccsDir, sharedDirRoot) {
+    if (type === 'commands' || type === 'plugins') {
+        return new Set([sharedDirRoot]);
+    }
+    return new Set([
+        sharedDirRoot,
+        ...[
+            path.join((0, claude_config_path_1.getClaudeConfigDir)(), type),
+            path.join(ccsDir, '.claude', type),
+            path.join(ccsDir, 'shared', type),
+        ]
+            .map((dirPath) => safeRealPath(dirPath))
+            .filter((dirPath) => typeof dirPath === 'string'),
+    ]);
+}
+exports.resolveAllowedRoots = resolveAllowedRoots;
+function resolveSettingsAllowedRoots(ccsDir, sharedDirRoot) {
+    const claudeConfigDir = (0, claude_config_path_1.getClaudeConfigDir)();
+    return new Set([
+        sharedDirRoot,
+        safeRealPath(path.join(claudeConfigDir, 'settings.json')),
+        safeRealPath(path.join(ccsDir, '.claude', 'settings.json')),
+    ].filter((dirPath) => typeof dirPath === 'string'));
+}
+exports.resolveSettingsAllowedRoots = resolveSettingsAllowedRoots;
+//# sourceMappingURL=shared-routes-path-guards.js.map

package/dist/web-server/shared-routes-path-guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-routes-path-guards.js","sourceRoot":"","sources":["../../src/web-server/shared-routes-path-guards.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAE7B,oEAAiE;AACjE,yEAA2D;AAiElD,0FAjEA,gCAAS,OAiEA;AA9DlB,SAAgB,YAAY,CAAC,UAAkB;IAC7C,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAND,oCAMC;AAED,SAAgB,0BAA0B,CAAC,UAAkB;IAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AAC9E,CAAC;AAHD,gEAGC;AAED,SAAgB,YAAY,CAAC,aAAqB,EAAE,QAAgB;IAClE,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,aAAa,CAAC,CAAC;IACtE,MAAM,cAAc,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;IACpE,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvF,CAAC;AALD,oCAKC;AAED,SAAgB,eAAe,CAAC,aAAqB,EAAE,SAAsB;IAC3E,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,YAAY,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAPD,0CAOC;AAED,SAAgB,mBAAmB,CACjC,IAA0B,EAC1B,MAAc,EACd,aAAqB;IAErB,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,IAAI,GAAG,CAAS,CAAC,aAAa,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,IAAI,GAAG,CAAS;QACrB,aAAa;QACb,GAAG;YACD,IAAI,CAAC,IAAI,CAAC,IAAA,uCAAkB,GAAE,EAAE,IAAI,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC;SAClC;aACE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;aACvC,MAAM,CAAC,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC;KACvE,CAAC,CAAC;AACL,CAAC;AAnBD,kDAmBC;AAED,SAAgB,2BAA2B,CAAC,MAAc,EAAE,aAAqB;IAC/E,MAAM,eAAe,GAAG,IAAA,uCAAkB,GAAE,CAAC;IAC7C,OAAO,IAAI,GAAG,CACZ;QACE,aAAa;QACb,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QACzD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;KAC5D,CAAC,MAAM,CAAC,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CACtE,CAAC;AACJ,CAAC;AATD,kEASC"}

package/dist/web-server/shared-routes-plugin-registry-content.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Shared Routes — Plugin registry content renderer
+ *
+ * Renders the markdown content for an installed plugin entry,
+ * pulling from installed_plugins.json, known_marketplaces.json,
+ * and blocklist.json within the allowed roots.
+ */
+export declare function getPluginRegistryContent(itemPath: string, sharedDir: string, allowedRoots: Set<string>): {
+    content: string;
+    contentPath: string;
+} | null;
+//# sourceMappingURL=shared-routes-plugin-registry-content.d.ts.map

package/dist/web-server/shared-routes-plugin-registry-content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-routes-plugin-registry-content.d.ts","sourceRoot":"","sources":["../../src/web-server/shared-routes-plugin-registry-content.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAkCH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GACxB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA0DjD"}