@goodandready/dsh-github-ops 0.2.9 → 0.2.11

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 0.2.11
+
+### Security
+- **Strict CSRF & Origin Verification on SCM Writes** (#98, #81, #99): Added `isTrustedWriteRequest` guarding `POST /scm`. Discarded client-supplied `X-Forwarded-Host` in favor of validated `Host` header. Enforced strict fail-closed policy on cross-site requests (`Sec-Fetch-Site: cross-site`) across loopback and local networks.
+- **Path Segment Encoding & Traversal Defense** (#87): Added `encodeRepoPath` to prevent directory traversal (`..`) and URI-encode path segments in GitHub Contents API endpoints (`getFile`, `deleteFile`, and blob viewer route).
+- **Mirror Publication Isolation & Option Injection Defense** (#83, #91): Added strict validation on mirror destination URLs and branch names (`validateRemote`, `validateBranchName`) to reject leading hyphen flags and CLI option injection into git arguments. Replaced predictable temp index paths with `crypto.randomUUID()`-backed paths in `tmpdir()`.
+- **Release Asset Upload Workspace Containment** (#82): Restricted release asset file uploads to files within the workspace root or allowlisted local files, rejecting system directories (`/etc`, `/proc`, `/sys`, etc.), traversal paths, and control characters.
+
+## 0.2.10
+
+### Fixed
+- **Settings Surface & Volatile Fields on DSH 0.2** (#76, #85): Config fields declare `.volatile()` wrappers and live settings reads are unwrapped via `plainConfig()` to comply with the DSH 0.2 live-value contract and prevent settings from being marked unavailable.
+- **Dead settingsScope.replace Removed** (#100, #86): Removed unused dead `settingsScope.replace` method that swallowed errors.
+- **Client Fetch AbortSignal Timeout** (#101): Attached 15s/120s `AbortSignal` timeouts to all `fetch` calls in `lib/client.js` to prevent the UI from hanging indefinitely on stalled requests.
+- **Git Runner Timeout** (#90): SCM route passes `timeoutMs` (120000ms) to `execFileAsync` git runner options, properly enforcing timeouts on write operations.
+- **Presenter Interpolation Format** (#94): Fixed entity number interpolation in `issue_comment` (`#${number}`) and `pr_merge` (`Merged pull request #${number}`) cards.
+- **GraphQL Thread Mutation Validation** (#88): `resolveReviewThread` validates return thread existence and throws on empty/null responses instead of reporting false success.
+- **Merged PRs Filter** (#89): `mergedPulls` in insights now verifies `mergedAt` presence instead of counting closed-unmerged pull requests.
+- **Auth Device Secret Await** (#84): Fixed missing `await auth.secret()` in `register-write.js` that was passing a Promise instance as OAuth `client_secret`.
+
+## 0.2.9
+
+### Fixed
+- **Audit Findings & Stability**: Pre-release audit bundle addressing review thread mutations, auth credentials and input validation.
+
+
 ## 0.2.8
 
 ### Fixed

package/lib/client.js

@@ -20,6 +20,13 @@ window.__ModuleLoader__.load({
     const SCM_PATH = '/dsh-github-ops/scm'
     const PANEL_PATH = '/dsh-github-ops/panel'
 
+    const fetchWithTimeout = (url, options = {}, timeoutMs = 15000) => {
+      const signal = (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function')
+        ? AbortSignal.timeout(timeoutMs)
+        : undefined
+      return fetch(url, signal ? { signal, ...options } : options)
+    }
+
     // The repository a github.com link in the conversation pointed at, so the tab and the
     // panel can follow the human instead of asking again.
     const linkState = { repo: '', enabled: false }
@@ -283,7 +290,7 @@ window.__ModuleLoader__.load({
           setState({ phase: 'error', message: 'fetch is unavailable in this client' })
           return
         }
-        fetch(cwdQuery ? `${SCM_PATH}?${cwdQuery}` : SCM_PATH, { headers: { accept: 'application/json' } })
+        fetchWithTimeout(cwdQuery ? `${SCM_PATH}?${cwdQuery}` : SCM_PATH, { headers: { accept: 'application/json' } })
           .then((response) => (response.ok ? response.json() : Promise.reject(new Error(`HTTP ${response.status}`))))
           .then((payload) => setState({ phase: 'ready', payload }))
           .catch((err) => setState({ phase: 'error', message: String((err && err.message) || err) }))
@@ -296,11 +303,11 @@ window.__ModuleLoader__.load({
         if (typeof fetch !== 'function') return
         setBusy(action)
         setActionError('')
-        fetch(SCM_PATH, {
+        fetchWithTimeout(SCM_PATH, {
           method: 'POST',
           headers: { 'content-type': 'application/json', accept: 'application/json' },
           body: JSON.stringify(repoPath ? { action, args: args || {}, cwd: repoPath } : { action, args: args || {} }),
-        })
+        }, 120000)
           .then((response) => (response.ok ? response.json() : Promise.reject(new Error(`HTTP ${response.status}`))))
           .then((payload) => {
             setBusy('')
@@ -322,7 +329,7 @@ window.__ModuleLoader__.load({
         setSelected({ path: file.path, staged })
         setDiff({ phase: 'loading', text: '' })
         const query = `?file=${encodeURIComponent(file.path)}${staged ? '&staged=1' : ''}`
-        fetch(SCM_PATH + query, { headers: { accept: 'application/json' } })
+        fetchWithTimeout(SCM_PATH + query, { headers: { accept: 'application/json' } })
           .then((response) => (response.ok ? response.json() : Promise.reject(new Error(`HTTP ${response.status}`))))
           .then((payload) => setDiff({ phase: 'ready', text: payload.diff || '' }))
           .catch((err) => setDiff({ phase: 'error', text: String((err && err.message) || err) }))
@@ -518,7 +525,7 @@ window.__ModuleLoader__.load({
 
       const load = React.useCallback(() => {
         if (typeof fetch !== 'function') return
-        fetch(SCM_PATH, { headers: { accept: 'application/json' } })
+        fetchWithTimeout(SCM_PATH, { headers: { accept: 'application/json' } })
           .then((response) => (response.ok ? response.json() : Promise.reject(new Error(`HTTP ${response.status}`))))
           .then((payload) => setState({ phase: 'ready', payload }))
           .catch(() => setState({ phase: 'idle' }))
@@ -602,7 +609,7 @@ window.__ModuleLoader__.load({
       const call = React.useCallback((params) => {
         if (typeof fetch !== 'function') return Promise.reject(new Error('fetch is unavailable in this client'))
         const query = new URLSearchParams(params).toString()
-        return fetch(`${PANEL_PATH}?${query}`, { headers: { accept: 'application/json' } })
+        return fetchWithTimeout(`${PANEL_PATH}?${query}`, { headers: { accept: 'application/json' } })
           .then((response) => (response.ok ? response.json() : Promise.reject(new Error(`HTTP ${response.status}`))))
       }, [])
 
@@ -841,7 +848,7 @@ window.__ModuleLoader__.load({
           setStatusError('fetch is unavailable in this client')
           return
         }
-        fetch(STATUS_PATH, { headers: { accept: 'application/json' } })
+        fetchWithTimeout(STATUS_PATH, { headers: { accept: 'application/json' } })
           .then((response) => (response.ok ? response.json() : Promise.reject(new Error(`HTTP ${response.status}`))))
           .then((payload) => setAccessStatus(payload))
           .catch((err) => { setAccessStatus(null); setStatusError(String((err && err.message) || err)) })

package/lib/github.js

@@ -424,3 +424,17 @@ export function describeError(err) {
   }
   return String(err.message || err)
 }
+
+/**
+ * Safely encode a repository file path segment for the GitHub contents API.
+ * Rejects path traversal (..) and encodes each path component.
+ */
+export function encodeRepoPath(rawPath) {
+  const cleaned = String(rawPath == null ? '' : rawPath).trim().replace(/^\/+/, '')
+  if (!cleaned) throw new Error('path is required')
+  const segments = cleaned.split('/')
+  if (segments.some((s) => s === '..' || s === '.')) {
+    throw new Error('path must not contain traversal segments')
+  }
+  return segments.map(encodeURIComponent).join('/')
+}

package/lib/index.js

@@ -44,11 +44,12 @@ const callContext = new AsyncLocalStorage()
 
 /** git runner: never throws, always answers with a code and both streams. */
 function makeGitRunner() {
-  return async (args, { cwd, env } = {}) => {
+  return async (args, { cwd, env, timeoutMs, timeout } = {}) => {
     try {
       const { stdout, stderr } = await execFileAsync('git', args, {
         cwd: cwd || process.cwd(),
         env: { ...process.env, ...(env || {}) },
+        timeout: typeof timeoutMs === 'number' ? timeoutMs : (typeof timeout === 'number' ? timeout : undefined),
         maxBuffer: 8 * 1024 * 1024,
       })
       return { code: 0, stdout, stderr }
@@ -171,25 +172,21 @@ export const Config = Schema.object({
 })
 
 export function apply(ctx, rawConfig) {
-  const config = { ...Config(), ...(rawConfig || {}) }
+  const config = plainConfig({ ...Config(), ...(rawConfig || {}) })
   let settingsScope = null
 
   ctx.inject(['settings'], (sctx) => {
     try {
       settingsScope = {
-      get: () => {
-        try {
-          const row = sctx.settings?.describe?.().find((r) => r && r.ns === name);
-          return row?.value ?? config  ?? {};
-        } catch { return config  ?? {}; }
-      },
-      replace: async (next) => {
-        try {
-          const row = sctx.settings?.describe?.().find((r) => r && r.ns === name);
-          return await sctx.settings?.replace?.(name, next, row?.revision);
-        } catch {}
-      },
-    }
+        get: () => {
+          try {
+            const row = sctx.settings?.describe?.().find((r) => r && (r.ns === name || r.ns === '@goodandready/dsh-github-ops'))
+            return plainConfig(row?.value ?? config ?? {})
+          } catch {
+            return plainConfig(config ?? {})
+          }
+        },
+      }
     } catch (err) {
       ctx.logger?.warn?.('[dsh-github-ops] settings namespace unavailable:', err && err.message)
     }
@@ -211,9 +208,9 @@ export function apply(ctx, rawConfig) {
   function liveConfig() {
     try {
       const fromScope = settingsScope && settingsScope.get && settingsScope.get()
-      return { ...config, ...(fromScope || {}) }
+      return plainConfig({ ...config, ...(fromScope || {}) })
     } catch {
-      return config
+      return plainConfig(config)
     }
   }
 
@@ -378,7 +375,7 @@ export function apply(ctx, rawConfig) {
     },
   }
 
-  const deps = { tool, asRepo, client, liveConfig, reviewRules, auth: authSeam }
+  const deps = { tool, asRepo, client, liveConfig, reviewRules, auth: authSeam, defaultCwd: () => (typeof ctx.cwd === 'string' && ctx.cwd) || process.cwd() }
   registerCoreTools(deps)
   registerCollabTools(deps)
   registerOpsTools(deps)

package/lib/present.js

@@ -102,7 +102,7 @@ const PRESENTATIONS = {
   },
   issue_comment: {
     call: (args) => pending(`Comment on #${args.number}`, pick(args, ['repository', 'number'])),
-    result: (_args, r) => failure('Comment not posted', r) || text(`Commented on #${r.data.id ? '' : ''}`, `comment id ${r.data.id}`),
+    result: (_args, r) => failure('Comment not posted', r) || text(`Commented on #${_args?.number || (r.data && r.data.id) || ''}`, `comment id ${r.data.id}`),
   },
   issue_close: {
     call: (args) => pending(`Close #${args.number}`, pick(args, ['repository', 'number', 'stateReason'])),
@@ -126,7 +126,7 @@ const PRESENTATIONS = {
   pr_merge: {
     call: (args) => pending(`Merge pull request #${args.number}`, pick(args, ['repository', 'number', 'method', 'deleteBranch'])),
     result: (_args, r) => failure('Pull request not merged', r)
-      || text(r.data.merged ? `Merged #${'pull request'}` : 'Merge not performed', `${r.data.message || ''}${r.data.sha ? `\n${String(r.data.sha).slice(0, 7)}` : ''}${r.data.branchDeleted ? `\nhead branch ${r.data.branchDeleted} deleted` : ''}`),
+      || text(r.data.merged ? `Merged pull request #${_args?.number || (r.data && r.data.number) || ''}` : 'Merge not performed', `${r.data.message || ''}${r.data.sha ? `\n${String(r.data.sha).slice(0, 7)}` : ''}${r.data.branchDeleted ? `\nhead branch ${r.data.branchDeleted} deleted` : ''}`),
   },
   gh_review: {
     call: (args) => pending(`Review pull request #${args.number}`, pick(args, ['repository', 'number', 'maxDiffChars'])),

package/lib/routes.js

@@ -8,7 +8,7 @@
 import { existsSync, statSync } from 'node:fs'
 import { join as joinPath } from 'node:path'
 
-import { statusPayload, isTrustedRequest, sendJson } from './status.js'
+import { statusPayload, isTrustedRequest, isTrustedWriteRequest, sendJson } from './status.js'
 import { buildAction, validateCwd } from './scm-write.js'
 import { parseStatus, parseBranches, parseStashes, parseWorktrees, parseCount, scmPayload, mergeStateFrom } from './scm.js'
 import { listIssues } from './tools/issues.js'
@@ -94,7 +94,11 @@ export function registerRoutes(ctx, deps = {}) {
         path: SCM_PATH,
         handler: async (req, res) => {
           if (req.method !== 'GET' && req.method !== 'POST') return sendJson(res, 405, { error: 'method not allowed' })
-          if (!isTrustedRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+          if (req.method === 'POST') {
+            if (!isTrustedWriteRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+          } else {
+            if (!isTrustedRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+          }
           const git = makeGitRunner()
           const url = new URL(req.url || '/', 'http://localhost')
           const file = url.searchParams.get('file') || ''
@@ -254,7 +258,13 @@ export function registerRoutes(ctx, deps = {}) {
               return sendJson(res, 200, { configured: true, ...view })
             }
             if (what === 'blob') {
-              const { data } = await github.get(`/repos/${repoOwner}/${repoName}/contents/${path}`, { query: ref ? { ref } : undefined })
+              let encodedPath = ''
+              try {
+                encodedPath = encodeRepoPath(path)
+              } catch (err) {
+                return sendJson(res, 400, { configured: true, error: (err && err.message) || String(err) })
+              }
+              const { data } = await github.get(`/repos/${repoOwner}/${repoName}/contents/${encodedPath}`, { query: ref ? { ref } : undefined })
               if (Array.isArray(data)) return sendJson(res, 200, { configured: true, entries: data.map((e) => ({ name: e.name, type: e.type, size: e.size, path: e.path })) })
               const encoded = String((data && data.content) || '').replace(/\n/g, '')
               const text = encoded ? Buffer.from(encoded, 'base64').toString('utf8') : ''

package/lib/status.js

@@ -7,43 +7,97 @@
 // The payload never contains the access value. The route answers only a local or same-origin
 // caller, because the payload describes the machine's account.
 
+/** Whether a request may read the status payload. Fail-closed. */
+function isTrustedHost(host) {
+  if (!host || typeof host !== 'string') return false
+  let hostname = host.trim()
+  if (hostname.startsWith('[')) {
+    const end = hostname.indexOf(']')
+    if (end > 0) hostname = hostname.slice(1, end)
+  } else {
+    hostname = hostname.split(':')[0]
+  }
+  hostname = hostname.toLowerCase()
+  if (!hostname) return false
+  if (hostname === 'localhost' || hostname.endsWith('.local') || hostname.endsWith('.lan')) return true
+  const clean = hostname.replace(/^::ffff:/, '')
+  if (clean === '127.0.0.1' || clean === '::1' || clean.startsWith('127.')) return true
+  if (clean.startsWith('10.') || clean.startsWith('192.168.')) return true
+  const match172 = clean.match(/^172\.(\d+)\./)
+  if (match172) {
+    const octet = parseInt(match172[1], 10)
+    if (octet >= 16 && octet <= 31) return true
+  }
+  return false
+}
+
 /** Whether a request may read the status payload. Fail-closed. */
 export function isTrustedRequest(req) {
   if (!req) return false
-  const address = (req.socket && (req.socket.remoteAddress || req.socket.address?.().address)) || ''
-  const loopback = address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1'
-  if (loopback) return true
 
-  // For non-loopback callers: fail-closed source verification
+  // Fail-closed against cross-site fetches regardless of source IP
   const secFetchSite = header(req, 'sec-fetch-site')
   if (secFetchSite === 'cross-site') return false
 
-  const host = header(req, 'x-forwarded-host') || header(req, 'host')
+  const address = (req.socket && (req.socket.remoteAddress || req.socket.address?.().address)) || ''
+  const cleanIp = address.replace(/^::ffff:/, '')
+  const loopback = cleanIp === '127.0.0.1' || cleanIp === '::1' || cleanIp.startsWith('127.')
+
+  const host = header(req, 'host')
   const origin = header(req, 'origin') || header(req, 'referer')
-  if (!host || !origin) return false
 
-  try {
-    const originUrl = new URL(origin)
-    if (originUrl.host.toLowerCase() !== host.toLowerCase()) return false
+  // If host is provided, it MUST be a trusted local/private host (DNS rebinding guard)
+  if (host && !isTrustedHost(host)) return false
+
+  // If browser headers (origin/referer/sec-fetch-site) are absent and caller is loopback, allow local caller
+  if (!origin && !secFetchSite && loopback) return true
 
+  // If origin/referer is present, verify it matches host or is a trusted local host
+  if (origin) {
+    try {
+      const originUrl = new URL(origin)
+      if (!isTrustedHost(originUrl.hostname)) return false
+      if (host && originUrl.host.toLowerCase() !== host.toLowerCase()) return false
+      return true
+    } catch {
+      return false
+    }
+  }
 
+  // Non-loopback caller without origin/referer is refused
+  if (!loopback) return false
 
-    // DNS rebinding guard: host must be a loopback, local or private LAN address
-    const hostname = host.split(':')[0].toLowerCase()
-    const isPrivate =
-      hostname === 'localhost' ||
-      hostname === '127.0.0.1' ||
-      hostname === '::1' ||
-      /^192\.168\.\d{1,3}\.\d{1,3}$/.test(hostname) ||
-      /^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(hostname) ||
-      /^172\.(1[6-9]|2\d|3[0-1])\.\d{1,3}\.\d{1,3}$/.test(hostname) ||
-      hostname.endsWith('.local') ||
-      hostname.endsWith('.lan')
+  return true
+}
 
-    return isPrivate
-  } catch {
+/** Whether a write/mutating request (e.g. POST /scm) is safe. Strict write guard against CSRF. */
+export function isTrustedWriteRequest(req) {
+  if (!req) return false
+  if (!isTrustedRequest(req)) return false
+
+  const secFetchSite = header(req, 'sec-fetch-site')
+  if (secFetchSite && secFetchSite !== 'same-origin' && secFetchSite !== 'none') {
     return false
   }
+
+  const host = header(req, 'host')
+  const origin = header(req, 'origin') || header(req, 'referer')
+  if (origin) {
+    try {
+      const originUrl = new URL(origin)
+      if (host && originUrl.host.toLowerCase() !== host.toLowerCase()) return false
+    } catch {
+      return false
+    }
+  } else {
+    // Write request without origin: only permit local loopback
+    const address = (req.socket && (req.socket.remoteAddress || req.socket.address?.().address)) || ''
+    const cleanIp = address.replace(/^::ffff:/, '')
+    const loopback = cleanIp === '127.0.0.1' || cleanIp === '::1' || cleanIp.startsWith('127.')
+    if (!loopback) return false
+  }
+
+  return true
 }
 
 function header(req, name) {

package/lib/tools/insights.js

@@ -102,7 +102,7 @@ export async function weeklyDigest(client, { owner, repo, days = 7, limit = 10 }
     since,
     releases: releases.releases.filter((r) => after(r.publishedAt || r.createdAt)),
     newIssues: issues.issues.filter((i) => after(i.createdAt)),
-    mergedPulls: pulls.issues.filter((i) => after(i.closedAt || i.updatedAt)),
+    mergedPulls: pulls.issues.filter((i) => Boolean(i.mergedAt) && after(i.mergedAt)),
     commits: commits.commits,
   }
 }

package/lib/tools/issues.js

@@ -26,6 +26,7 @@ export function normalizeIssue(data, { mine = '' } = {}) {
     createdAt: data.created_at,
     updatedAt: data.updated_at,
     closedAt: data.closed_at,
+    mergedAt: (data.pull_request && data.pull_request.merged_at) || data.merged_at || null,
     url: data.html_url,
     body: typeof data.body === 'string' ? data.body : '',
     isMine: mine ? (data.user && data.user.login) === mine : undefined,

package/lib/tools/mirror.js

@@ -1,3 +1,6 @@
+import { randomUUID } from 'node:crypto'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
 // Sanitized mirror publication.
 //
 // A GitHub mirror is a product channel, not a copy of the history: only the npm
@@ -76,7 +79,30 @@ async function readManifest(git, { cwd, ref }) {
  * Read-only plan: which files would be published, how many would be left behind, and
  * whether the publication must be refused (forbidden path present, required file missing).
  */
+
+const REMOTE_NAME_RE = /^(?!-)[a-zA-Z0-9._/-]+$/
+const BRANCH_NAME_RE = /^(?!-)[a-zA-Z0-9._/-]+$/
+
+export function validateRemote(remote) {
+  const val = String(remote || '').trim()
+  if (!val || val.startsWith('-') || !REMOTE_NAME_RE.test(val)) {
+    throw new Error(`invalid mirror remote name: "${remote}"`)
+  }
+  return val
+}
+
+export function validateBranchName(branch) {
+  const val = String(branch || '').trim()
+  if (!val || val.startsWith('-') || !BRANCH_NAME_RE.test(val)) {
+    throw new Error(`invalid branch name: "${branch}"`)
+  }
+  return val
+}
+
 export async function planMirror({ git, cwd, ref = 'origin/main', allow, forbidden, required = DEFAULT_REQUIRED }) {
+  if (String(ref || '').trim().startsWith('-')) {
+    throw new Error(`invalid source ref: "${ref}"`)
+  }
   const manifest = await readManifest(git, { cwd, ref })
   const allowlist = allow || allowlistFromManifest(manifest)
   const ls = await git(['ls-tree', '-r', '--name-only', ref], { cwd })
@@ -115,6 +141,11 @@ export async function publishMirror({
   git, cwd, ref = 'origin/main', mirror = 'github', branch = 'main',
   allow, forbidden, required = DEFAULT_REQUIRED, dryRun = false, message,
 }) {
+  validateRemote(mirror)
+  validateBranchName(branch)
+  if (String(ref || '').trim().startsWith('-')) {
+    throw new Error(`invalid source ref: "${ref}"`)
+  }
   const plan = await planMirror({ git, cwd, ref, allow, forbidden, required })
   if (plan.refused) {
     const err = new Error(plan.refused)
@@ -131,7 +162,7 @@ export async function publishMirror({
 
   if (dryRun) return { ...plan, mirror: mirrorRef, parent, commit: null, pushed: false }
 
-  const indexFile = `/tmp/dsh-github-ops-mirror-${process.pid}-${Date.now()}.index`
+  const indexFile = path.join(tmpdir(), `dsh-mirror-${process.pid}-${randomUUID()}.index`)
   const env = { GIT_INDEX_FILE: indexFile }
   try {
     await git(['read-tree', '--empty'], { cwd, env })

package/lib/tools/pulls.js

@@ -329,8 +329,12 @@ export async function resolveReviewThread(client, { owner, repo, threadId, resol
     ? data?.resolveReviewThread?.thread
     : data?.unresolveReviewThread?.thread
 
+  if (!thread) {
+    throw new Error(`failed to ${shouldResolve ? 'resolve' : 'unresolve'} review thread: mutation returned no thread`)
+  }
+
   return {
     threadId,
-    isResolved: thread ? Boolean(thread.isResolved) : shouldResolve,
+    isResolved: Boolean(thread.isResolved),
   }
 }

package/lib/tools/register-core.js

@@ -14,7 +14,7 @@ const REPOSITORY = {
   repository: { type: 'string', description: 'Repository as "owner/repo". Omit to use the default from settings.' },
 }
 
-export function registerCoreTools({ tool, asRepo, client, liveConfig }) {
+export function registerCoreTools({ tool, asRepo, client, liveConfig, defaultCwd }) {
   const repoParams = (extra = {}) => ({ ...REPOSITORY, ...extra })
 
   // ------------------------------------------------------------------ repository
@@ -223,6 +223,7 @@ export function registerCoreTools({ tool, asRepo, client, liveConfig }) {
         name: args.name,
         label: args.label,
         contentType: args.contentType,
+        cwd: typeof defaultCwd === 'function' ? defaultCwd() : undefined,
       })
     },
   )

package/lib/tools/register-write.js

@@ -188,7 +188,7 @@ export function registerWriteTools({ tool, asRepo, client, liveConfig, auth }) {
       const cfg = authConfig()
       const outcome = await pollDeviceFlow({
         clientId: cfg.clientId || DEFAULT_CLIENT_ID,
-        clientSecret: auth.secret(),
+        clientSecret: await auth.secret(),
         deviceCode: pending.deviceCode,
         intervalSeconds: pending.intervalSeconds,
         maxWaitMs: args.maxWaitMs,

package/lib/tools/releases.js

@@ -139,23 +139,61 @@ export async function listReleaseAssets(client, { owner, repo, tag, releaseId, l
   return { assets, count: assets.length, releaseId: id, rateLimit }
 }
 
-export async function uploadReleaseAsset(client, { owner, repo, tag, releaseId, filePath, name, label, contentType }) {
+const DISALLOWED_ROOTS = ['/etc', '/proc', '/sys', '/dev', '/root', '/bin', '/sbin', '/usr', '/boot', '/var/run']
+
+function checkDisallowedRoots(resolvedPath, sep) {
+  for (const root of DISALLOWED_ROOTS) {
+    if (resolvedPath === root || resolvedPath.startsWith(root + sep) || resolvedPath.startsWith(root + '/')) {
+      throw new Error(`access to system directory "${root}" is not allowed`)
+    }
+  }
+}
+
+export async function uploadReleaseAsset(client, { owner, repo, tag, releaseId, filePath, name, label, contentType, cwd }) {
   ensureRepo({ owner, repo })
-  if (!filePath) throw new Error('filePath is required')
-  const id = await resolveReleaseId(client, { owner, repo, tag, releaseId })
+  if (!filePath || typeof filePath !== 'string') throw new Error('filePath is required')
+  if (/[\x00-\x1f]/.test(filePath)) throw new Error('filePath may not contain control characters')
 
   const fs = await import('node:fs/promises')
   const path = await import('node:path')
 
+  const baseDir = cwd ? path.resolve(cwd) : null
+  const resolvedPath = baseDir ? path.resolve(baseDir, filePath) : path.resolve(filePath)
+
+  if (baseDir) {
+    if (resolvedPath !== baseDir && !resolvedPath.startsWith(baseDir + path.sep)) {
+      throw new Error(`filePath must reside within the workspace directory: ${filePath}`)
+    }
+  }
+
+  checkDisallowedRoots(resolvedPath, path.sep)
+
+  let realTarget = resolvedPath
+  try {
+    realTarget = await fs.realpath(resolvedPath)
+  } catch (err) {
+    throw new Error(`cannot access file "${filePath}": ${err && err.message}`)
+  }
+
+  checkDisallowedRoots(realTarget, path.sep)
+
+  if (baseDir) {
+    const realBase = await fs.realpath(baseDir).catch(() => baseDir)
+    if (realTarget !== realBase && !realTarget.startsWith(realBase + path.sep)) {
+      throw new Error(`filePath must reside within the workspace directory: ${filePath}`)
+    }
+  }
+
   let stats
   try {
-    stats = await fs.stat(filePath)
+    stats = await fs.stat(realTarget)
   } catch (err) {
     throw new Error(`cannot access file "${filePath}": ${err && err.message}`)
   }
   if (!stats.isFile()) throw new Error(`"${filePath}" is not a file`)
 
-  const fileBuffer = await fs.readFile(filePath)
+  const id = await resolveReleaseId(client, { owner, repo, tag, releaseId })
+  const fileBuffer = await fs.readFile(realTarget)
   const assetName = name || path.basename(filePath)
   const mimeType = contentType || 'application/octet-stream'
 

package/lib/tools/repos.js

@@ -1,3 +1,4 @@
+import { encodeRepoPath } from '../github.js'
 // Repository and file operations: metadata, file content at a ref, repository
 // search (its own quota), plus repository creation and edits.
 
@@ -36,8 +37,8 @@ export async function getRepo(client, { owner, repo }) {
 
 export async function getFile(client, { owner, repo, path, ref }) {
   ensureRepo({ owner, repo })
-  if (!path) throw new Error('path is required')
-  const { data } = await client.get(`/repos/${owner}/${repo}/contents/${path}`, {
+  const encodedPath = encodeRepoPath(path)
+  const { data } = await client.get(`/repos/${owner}/${repo}/contents/${encodedPath}`, {
     query: ref ? { ref } : undefined,
   })
   if (Array.isArray(data)) {

package/lib/tools/write-files.js

@@ -1,3 +1,4 @@
+import { encodeRepoPath } from '../github.js'
 // Writing files without a local checkout.
 //
 // A commit is built the way git builds it: blobs, a tree on top of the branch's tree, a
@@ -185,14 +186,14 @@ export async function uploadProject(client, {
 /** Delete one file, resolving its blob sha first (the contents API requires it). */
 export async function deleteFile(client, { owner, repo, path, message, branch } = {}) {
   ensureRepo({ owner, repo })
-  if (!path) throw new Error('path is required')
   if (!message) throw new Error('message is required')
-  const { data: current } = await client.get(`/repos/${owner}/${repo}/contents/${String(path).replace(/^\/+/, '')}`, {
+  const encodedPath = encodeRepoPath(path)
+  const { data: current } = await client.get(`/repos/${owner}/${repo}/contents/${encodedPath}`, {
     query: branch ? { ref: branch } : undefined,
   })
   const sha = current && current.sha
   if (!sha) throw new Error(`cannot resolve ${path}`)
-  const { data } = await client.del(`/repos/${owner}/${repo}/contents/${String(path).replace(/^\/+/, '')}`, {
+  const { data } = await client.del(`/repos/${owner}/${repo}/contents/${encodedPath}`, {
     body: { message, sha, ...(branch ? { branch } : {}) },
   })
   return { deleted: true, path, commit: data && data.commit ? data.commit.sha : null }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-github-ops",
-  "version": "0.2.9",
+  "version": "0.2.11",
   "description": "GitHub operations for DeepSeek Harness: releases, tags, a guarded generic API pass-through, workflow runs, secrets and sanitized mirror publication.",
   "license": "MIT",
   "type": "module",