@gobing-ai/ts-rule-engine 0.5.4 → 0.5.5

package/dist/fixers/fixers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fixers.d.ts","sourceRoot":"","sources":["../../src/fixers/fixers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAEH,KAAK,UAAU,EAGf,KAAK,eAAe,EAGvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAkB,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAIhG,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAEhF,6EAA6E;AAC7E,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAIjD,CAAC;AAEF,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACjC,0CAA0C;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAChC,kCAAkC;IAClC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;IACxB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC;IACzB,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACzB;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,IAAI,CAcxF;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,iFAAiF;AACjF,wBAAsB,UAAU,CAC5B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,SAAS,GAAG,EAAE,EACrB,MAAM,UAAQ,EACd,EAAE,GAAE,UAAmC,GACxC,OAAO,CAAC,oBAAoB,CAAC,CA0D/B;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAOzF;AA8BD;;;;;;GAMG;AACH,qBAAa,kBAAmB,YAAW,iBAAiB;IACxD,kDAAkD;IAC5C,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;CAoCtF;AAED;;;;;;GAMG;AACH,qBAAa,iBAAkB,YAAW,iBAAiB;IACvD,0DAA0D;IACpD,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;CAoBtF"}
+{"version":3,"file":"fixers.d.ts","sourceRoot":"","sources":["../../src/fixers/fixers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAGH,KAAK,UAAU,EAGf,KAAK,eAAe,EAGvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAkB,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAIhG,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAEhF,6EAA6E;AAC7E,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAIjD,CAAC;AAEF,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACjC,0CAA0C;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAChC,kCAAkC;IAClC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;IACxB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC;IACzB,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACzB;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,IAAI,CAcxF;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,iFAAiF;AACjF,wBAAsB,UAAU,CAC5B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,SAAS,GAAG,EAAE,EACrB,MAAM,UAAQ,EACd,EAAE,GAAE,UAAmC,GACxC,OAAO,CAAC,oBAAoB,CAAC,CA0D/B;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAOzF;AAiDD;;;;;;GAMG;AACH,qBAAa,kBAAmB,YAAW,iBAAiB;IACxD,kDAAkD;IAC5C,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;CAoCtF;AAED;;;;;;GAMG;AACH,qBAAa,iBAAkB,YAAW,iBAAiB;IACvD,0DAA0D;IACpD,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;CAoBtF"}

package/dist/fixers/fixers.js

@@ -4,7 +4,7 @@
  *
  * @module rule-engine/fixers
  */
-import { createNodeFileSystem, isAbsolutePath, joinPath, relativePath, resolvePath, } from '@gobing-ai/ts-runtime';
+import { createNodeFileSystem, dirnamePath, isAbsolutePath, joinPath, relativePath, resolvePath, } from '@gobing-ai/ts-runtime';
 import { TestStubFixer } from './test-stub-fixer.js';
 /** Numeric ordering for fix authority; higher means more write authority. */
 export const FIX_MODE_RANK = {
@@ -42,7 +42,7 @@ export async function applyFixes(workdir, fixes, dryRun = false, fs = createNode
     const diffs = [];
     for (const [filePath, fileFixes] of byFile) {
         const absPath = resolveWorkdirPath(workdir, filePath);
-        if (!isInsideWorkdir(workdir, absPath)) {
+        if (!(await isInsideWorkdir(workdir, absPath, fs))) {
             deferred.push(...fileFixes);
             continue;
         }
@@ -105,10 +105,31 @@ function selectNonOverlappingFixes(fixes) {
     }
     return { applied, deferred };
 }
-/** Return true when absPath is at or below workdir. */
-function isInsideWorkdir(workdir, absPath) {
-    const rel = relativePath(resolvePath(workdir), resolvePath(absPath));
-    return rel === '' || (!rel.startsWith('..') && !isAbsolutePath(rel));
+/** Return true when absPath is at or below workdir after symlink resolution. */
+async function isInsideWorkdir(workdir, absPath, fs) {
+    // Task 0087 R3: fail closed when symlink resolution is unavailable — without
+    // realPath the containment proof is unsound, so refuse instead of degrading.
+    if (fs.realPath === undefined)
+        return false;
+    const real = (p) => fs.realPath?.(p) ?? p;
+    const root = real(resolvePath(workdir));
+    // Task 0086 R16: resolve through the nearest existing ancestor (ADR-022
+    // walk approach) — a not-yet-existing file can still escape the workdir
+    // through a symlinked parent directory, which plain path math misses.
+    const target = resolvePath(absPath);
+    let prefix = target;
+    const tail = [];
+    while (!(await fs.exists(prefix))) {
+        const parent = dirnamePath(prefix);
+        if (parent === prefix)
+            break; // filesystem root
+        tail.unshift(prefix.slice(parent.length + 1));
+        prefix = parent;
+    }
+    const resolved = tail.length > 0 ? joinPath(real(prefix), ...tail) : real(prefix);
+    const rel = relativePath(root, resolved);
+    const first = rel.split(/[\\/]/)[0];
+    return rel === '' || (first !== '..' && !isAbsolutePath(rel));
 }
 /** Return true when [start, end] is a valid byte range for a string of contentLength bytes. */
 function isValidRange(start, end, contentLength) {
@@ -140,7 +161,7 @@ export class RegexFixerProvider {
             if (!finding.filePath)
                 continue;
             const absPath = resolveWorkdirPath(context.workdir, finding.filePath);
-            if (!isInsideWorkdir(context.workdir, absPath) || finding.line == null)
+            if (!(await isInsideWorkdir(context.workdir, absPath, fs)) || finding.line == null)
                 continue;
             if (!(await fs.exists(absPath)))
                 continue;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/ts-rule-engine",
-    "version": "0.5.4",
+    "version": "0.5.5",
     "description": "@gobing-ai/ts-rule-engine — Constraint rule schemas, loading, evaluation, and result formatting.",
     "keywords": [
         "typescript",
@@ -49,10 +49,10 @@
         "release": "echo 'Manual publish is disabled. Releases go through GitHub Actions via Trusted Publishing — push a tag: git tag @gobing-ai/ts-rule-engine-v<version> && git push --tags' && exit 1"
     },
     "dependencies": {
-        "@gobing-ai/ts-ai-runner": "^0.5.4",
-        "@gobing-ai/ts-infra": "^0.5.4",
-        "@gobing-ai/ts-runtime": "^0.5.4",
-        "@gobing-ai/ts-db": "^0.5.4",
+        "@gobing-ai/ts-ai-runner": "^0.5.5",
+        "@gobing-ai/ts-infra": "^0.5.5",
+        "@gobing-ai/ts-runtime": "^0.5.5",
+        "@gobing-ai/ts-db": "^0.5.5",
         "yaml": "^2.7.0",
         "zod": "^4.1.0"
     },

package/src/fixers/fixers.ts

@@ -7,6 +7,7 @@
 
 import {
     createNodeFileSystem,
+    dirnamePath,
     type FileSystem,
     isAbsolutePath,
     joinPath,
@@ -83,7 +84,7 @@ export async function applyFixes(
 
     for (const [filePath, fileFixes] of byFile) {
         const absPath = resolveWorkdirPath(workdir, filePath);
-        if (!isInsideWorkdir(workdir, absPath)) {
+        if (!(await isInsideWorkdir(workdir, absPath, fs))) {
             deferred.push(...fileFixes);
             continue;
         }
@@ -155,10 +156,29 @@ function selectNonOverlappingFixes(fixes: readonly Fix[]): { applied: Fix[]; def
     return { applied, deferred };
 }
 
-/** Return true when absPath is at or below workdir. */
-function isInsideWorkdir(workdir: string, absPath: string): boolean {
-    const rel = relativePath(resolvePath(workdir), resolvePath(absPath));
-    return rel === '' || (!rel.startsWith('..') && !isAbsolutePath(rel));
+/** Return true when absPath is at or below workdir after symlink resolution. */
+async function isInsideWorkdir(workdir: string, absPath: string, fs: FileSystem): Promise<boolean> {
+    // Task 0087 R3: fail closed when symlink resolution is unavailable — without
+    // realPath the containment proof is unsound, so refuse instead of degrading.
+    if (fs.realPath === undefined) return false;
+    const real = (p: string) => fs.realPath?.(p) ?? p;
+    const root = real(resolvePath(workdir));
+    // Task 0086 R16: resolve through the nearest existing ancestor (ADR-022
+    // walk approach) — a not-yet-existing file can still escape the workdir
+    // through a symlinked parent directory, which plain path math misses.
+    const target = resolvePath(absPath);
+    let prefix = target;
+    const tail: string[] = [];
+    while (!(await fs.exists(prefix))) {
+        const parent = dirnamePath(prefix);
+        if (parent === prefix) break; // filesystem root
+        tail.unshift(prefix.slice(parent.length + 1));
+        prefix = parent;
+    }
+    const resolved = tail.length > 0 ? joinPath(real(prefix), ...tail) : real(prefix);
+    const rel = relativePath(root, resolved);
+    const first = rel.split(/[\\/]/)[0];
+    return rel === '' || (first !== '..' && !isAbsolutePath(rel));
 }
 
 /** Return true when [start, end] is a valid byte range for a string of contentLength bytes. */
@@ -191,7 +211,7 @@ export class RegexFixerProvider implements RuleFixerProvider {
         for (const finding of findings) {
             if (!finding.filePath) continue;
             const absPath = resolveWorkdirPath(context.workdir, finding.filePath);
-            if (!isInsideWorkdir(context.workdir, absPath) || finding.line == null) continue;
+            if (!(await isInsideWorkdir(context.workdir, absPath, fs)) || finding.line == null) continue;
             if (!(await fs.exists(absPath))) continue;
             const source = await fs.readFile(absPath);
             const line = getLineRange(source, finding.line);