@grainulation/orchard 1.0.4 → 1.1.1

package/lib/farmer.js

@@ -11,7 +11,7 @@ let _warnedNoToken = false;
 /**
  * POST an activity event to farmer.
  * Graceful failure -- catch and warn, never crash.
- * @param {string} farmerUrl - Base URL of farmer (e.g. http://localhost:9090)
+ * @param {string} farmerUrl - Base URL of farmer
  * @param {object} event - Event object (e.g. { type: "scan", data: {...} })
  * @param {object} [opts] - Options
  * @param {string} [opts.token] - Bearer token for Authorization header
@@ -89,7 +89,7 @@ function notify(farmerUrl, event, opts) {
  * CLI handler for `orchard connect farmer`.
  * Reads/writes .farmer.json in targetDir.
  * @param {string} targetDir - Working directory
- * @param {string[]} args - CLI arguments (e.g. ["farmer", "--url", "http://..."])
+ * @param {string[]} args - CLI arguments (e.g. ["farmer", "--url", "<farmer-url>"])
  */
 async function connect(targetDir, args) {
   const subcommand = args[0];

package/lib/server.js

@@ -790,6 +790,14 @@ ${ROUTES.map((r) => "<tr><td><code>" + r.method + "</code></td><td><code>" + r.p
   let filePath = url.pathname;
   filePath = join(PUBLIC_DIR, filePath);
 
+  // Prevent directory traversal
+  const resolved = resolve(filePath);
+  if (!resolved.startsWith(PUBLIC_DIR + "/") && resolved !== PUBLIC_DIR) {
+    res.writeHead(403);
+    res.end("Forbidden");
+    return;
+  }
+
   if (existsSync(filePath) && !statSync(filePath).isDirectory()) {
     const ext = extname(filePath);
     const mime = MIME[ext] || "application/octet-stream";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@grainulation/orchard",
-  "version": "1.0.4",
+  "version": "1.1.1",
   "description": "Multi-sprint research orchestrator — coordinate parallel research across teams",
   "main": "lib/planner.js",
   "exports": {