@goodandready/dsh-github-ops 0.6.0 → 0.6.1

package/lib/routes.js

@@ -12,6 +12,7 @@ import { statusPayload, isTrustedRequest, isTrustedWriteRequest, sendJson } from
 import { buildAction, validateCwd, validateStashRef, resolveConflictFile } from './scm-write.js'
 import { parseStatus, parseBranches, parseStashes, parseWorktrees, parseCount, scmPayload, mergeStateFrom, hasConflicts, parseConflictBlocks, parseDiffHunks, parseGitGraph } from './scm.js'
 import { SseEventManager } from './events.js'
+import { encodeRepoPath } from './github.js'
 import { listIssues } from './tools/issues.js'
 import { listRuns } from './tools/actions.js'
 import { listNotifications, repoTreeView } from './tools/panel-data.js'

package/lib/scm-write.js

@@ -1,5 +1,5 @@
 import { realpathSync, existsSync, readFileSync, writeFileSync } from 'node:fs'
-import { join as joinPath } from 'node:path'
+import { join as joinPath, posix, win32 } from 'node:path'
 import { hasConflicts, resolveConflictContent } from './scm.js'
 // Writing to a working copy, from the Source Control tab.
 //
@@ -206,29 +206,47 @@ export const OPERATION_VERBS = Object.freeze(CONTINUE_VERBS.slice())
  */
 const DISALLOWED_ROOTS = ['/etc', '/proc', '/sys', '/dev', '/root', '/bin', '/sbin', '/usr', '/boot', '/var/run']
 
+function checkDisallowed(p) {
+  const norm = p.replace(/\\/g, '/')
+  for (const root of DISALLOWED_ROOTS) {
+    if (norm === root || norm.startsWith(root + '/')) {
+      throw new Error(`access to system directory "${root}" is not allowed`)
+    }
+  }
+  const driveMatch = norm.match(/^[a-zA-Z]:(\/.*)?$/)
+  if (driveMatch) {
+    const sub = (driveMatch[1] || '/').toLowerCase()
+    if (sub === '/' || sub === '') {
+      throw new Error('access to system drive root is not allowed')
+    }
+    for (const winDir of ['/windows', '/winnt', '/system32', '/boot']) {
+      if (sub === winDir || sub.startsWith(winDir + '/')) {
+        throw new Error(`access to system directory "${winDir.slice(1)}" is not allowed`)
+      }
+    }
+  }
+}
+
 export function validateCwd(path) {
   const value = String(path == null ? '' : path).trim()
   if (!value) return ''
-  if (!value.startsWith('/')) throw new Error('a repository path must be absolute')
+  if (!posix.isAbsolute(value) && !win32.isAbsolute(value)) {
+    throw new Error('a repository path must be absolute')
+  }
   if (value.includes('..')) throw new Error('a repository path may not contain ".."')
   if (/[\x00-\x1f]/.test(value)) throw new Error('a repository path may not contain control characters')
   if (value.length > 500) throw new Error('a repository path is too long')
-  for (const root of DISALLOWED_ROOTS) {
-    if (value === root || value.startsWith(root + '/')) {
-      throw new Error(`access to system directory "${root}" is not allowed`)
-    }
-  }
+
+  checkDisallowed(value)
+
   let realPath = value
   try {
     realPath = realpathSync(value)
   } catch {
     realPath = value
   }
-  for (const root of DISALLOWED_ROOTS) {
-    if (realPath === root || realPath.startsWith(root + '/')) {
-      throw new Error(`access to system directory "${root}" is not allowed`)
-    }
-  }
+  checkDisallowed(realPath)
+
   return value
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-github-ops",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "GitHub operations for DeepSeek Harness: releases, tags, a guarded generic API pass-through, workflow runs, secrets and sanitized mirror publication.",
   "license": "MIT",
   "type": "module",