@giwonn/claude-daily-review 0.3.13 → 0.3.14

package/.claude-plugin/marketplace.json

@@ -13,7 +13,7 @@
       "source": {
         "source": "url",
         "url": "https://github.com/giwonn/claude-daily-review.git",
-        "ref": "v0.3.13"
+        "ref": "v0.3.14"
       },
       "description": "Auto-capture conversations for daily review and career documentation",
       "author": {

package/hooks/recover-sessions.mjs

@@ -23,19 +23,25 @@ function acquireLock() {
 
   mkdirSync(dirname(lockPath), { recursive: true });
 
-  // Check for stale lock
-  if (existsSync(lockPath)) {
+  const lockData = JSON.stringify({ pid: process.pid, timestamp: new Date().toISOString() });
+
+  try {
+    writeFileSync(lockPath, lockData, { flag: 'wx' });
+    return true;
+  } catch {
+    // File exists — check if stale
     try {
       const lock = JSON.parse(readFileSync(lockPath, 'utf-8'));
       const age = Date.now() - new Date(lock.timestamp).getTime();
-      if (age < LOCK_STALE_MS) return false; // Another session is recovering
-    } catch { /* corrupt lock, take over */ }
+      if (age < LOCK_STALE_MS) return false;
+      unlinkSync(lockPath);
+      // Retry once after removing stale lock
+      try {
+        writeFileSync(lockPath, lockData, { flag: 'wx' });
+        return true;
+      } catch { return false; }
+    } catch { return false; }
   }
-
-  try {
-    writeFileSync(lockPath, JSON.stringify({ pid: process.pid, timestamp: new Date().toISOString() }));
-    return true;
-  } catch { return false; }
 }
 
 function releaseLock() {

package/lib/github-storage.mjs

@@ -15,21 +15,35 @@ export class GitHubStorageAdapter {
   }
 
   /** @private @param {string} path @returns {string} */
-  getUrl(path) { return this.basePath ? `${this.baseUrl}/${this.basePath}/${path}` : `${this.baseUrl}/${path}`; }
+  getUrl(path) {
+    if (path.split('/').includes('..')) throw new Error('Invalid path: traversal not allowed');
+    return this.basePath ? `${this.baseUrl}/${this.basePath}/${path}` : `${this.baseUrl}/${path}`;
+  }
+
+  /**
+   * @private
+   * @param {string} url
+   * @param {RequestInit} [options]
+   * @returns {Promise<Record<string, unknown> | null>}
+   */
+  async fetchOrNull(url, options) {
+    const res = await fetch(url, { ...options, headers: this.headers });
+    if (res.status === 404) return null;
+    if (!res.ok) throw new Error(`GitHub API error: ${res.status}`);
+    return /** @type {Record<string, unknown>} */ (await res.json());
+  }
 
   /** @private @param {string} path @returns {Promise<string | null>} */
   async getSha(path) {
-    const res = await fetch(this.getUrl(path), { method: 'GET', headers: this.headers });
-    if (res.status === 404) return null;
-    const data = /** @type {Record<string, unknown>} */ (await res.json());
+    const data = await this.fetchOrNull(this.getUrl(path), { method: 'GET' });
+    if (!data) return null;
     return /** @type {string | null} */ (data.sha || null);
   }
 
   /** @param {string} path @returns {Promise<string | null>} */
   async read(path) {
-    const res = await fetch(this.getUrl(path), { method: 'GET', headers: this.headers });
-    if (res.status === 404) return null;
-    const data = /** @type {Record<string, unknown>} */ (await res.json());
+    const data = await this.fetchOrNull(this.getUrl(path), { method: 'GET' });
+    if (!data) return null;
     return Buffer.from(/** @type {string} */ (data.content), 'base64').toString('utf-8');
   }
 
@@ -40,10 +54,13 @@ export class GitHubStorageAdapter {
     const body = { message: `update ${path}`, content: Buffer.from(content).toString('base64') };
     if (sha) body.sha = sha;
     const res = await fetch(this.getUrl(path), { method: 'PUT', headers: this.headers, body: JSON.stringify(body) });
-    if (!res.ok && res.status === 409) {
+    if (res.status === 409) {
       const freshSha = await this.getSha(path);
       if (freshSha) body.sha = freshSha;
-      await fetch(this.getUrl(path), { method: 'PUT', headers: this.headers, body: JSON.stringify(body) });
+      const retry = await fetch(this.getUrl(path), { method: 'PUT', headers: this.headers, body: JSON.stringify(body) });
+      if (!retry.ok) throw new Error(`GitHub API error: ${retry.status}`);
+    } else if (!res.ok) {
+      throw new Error(`GitHub API error: ${res.status}`);
     }
   }
 
@@ -55,16 +72,14 @@ export class GitHubStorageAdapter {
 
   /** @param {string} path @returns {Promise<boolean>} */
   async exists(path) {
-    const res = await fetch(this.getUrl(path), { method: 'GET', headers: this.headers });
-    return res.status !== 404;
+    const data = await this.fetchOrNull(this.getUrl(path), { method: 'GET' });
+    return data !== null;
   }
 
   /** @param {string} dir @returns {Promise<string[]>} */
   async list(dir) {
-    const res = await fetch(this.getUrl(dir), { method: 'GET', headers: this.headers });
-    if (res.status === 404) return [];
-    const data = await res.json();
-    if (!Array.isArray(data)) return [];
+    const data = await this.fetchOrNull(this.getUrl(dir), { method: 'GET' });
+    if (!data || !Array.isArray(data)) return [];
     return data.map((/** @type {{ name: string }} */ entry) => entry.name);
   }
 
@@ -73,9 +88,8 @@ export class GitHubStorageAdapter {
 
   /** @param {string} path @returns {Promise<boolean>} */
   async isDirectory(path) {
-    const res = await fetch(this.getUrl(path), { method: 'GET', headers: this.headers });
-    if (res.status === 404) return false;
-    const data = await res.json();
+    const data = await this.fetchOrNull(this.getUrl(path), { method: 'GET' });
+    if (!data) return false;
     return Array.isArray(data);
   }
 }

package/lib/storage.mjs

@@ -2,7 +2,7 @@
 /** @typedef {import('./types.d.ts').StorageAdapter} StorageAdapter */
 
 import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, readdirSync, statSync } from 'fs';
-import { dirname, join } from 'path';
+import { dirname, join, resolve as pathResolve } from 'path';
 
 /** @implements {StorageAdapter} */
 export class LocalStorageAdapter {
@@ -14,7 +14,11 @@ export class LocalStorageAdapter {
 
   /** @private @param {string} path @returns {string} */
   resolve(path) {
-    return join(this.basePath, path);
+    const full = pathResolve(this.basePath, path);
+    if (full !== this.basePath && !full.startsWith(this.basePath + '/')) {
+      throw new Error('Invalid path: traversal outside base directory');
+    }
+    return full;
   }
 
   /** @param {string} path @returns {Promise<string | null>} */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@giwonn/claude-daily-review",
-  "version": "0.3.13",
+  "version": "0.3.14",
   "type": "module",
   "description": "Claude Code plugin that auto-captures conversations for daily review and career documentation",
   "repository": {