@grainulation/silo 1.0.5 → 1.1.1

package/bin/silo.js

@@ -423,7 +423,6 @@ try {
       const serverPath = path.join(__dirname, "..", "lib", "server.js");
       const child = fork(serverPath, serverArgs, {
         stdio: "inherit",
-        env: process.env,
       });
       child.on("error", (err) => {
         process.stderr.write(`silo: error starting server: ${err.message}\n`);

package/lib/confluence.js

@@ -25,14 +25,10 @@ class Confluence {
    * @param {string} opts.spaceKey   — Default space key
    */
   constructor(opts = {}) {
-    this.baseUrl = (
-      opts.baseUrl ||
-      process.env.CONFLUENCE_BASE_URL ||
-      ""
-    ).replace(/\/+$/, "");
-    this.token = opts.token || process.env.CONFLUENCE_TOKEN || "";
-    this.email = opts.email || process.env.CONFLUENCE_EMAIL || "";
-    this.spaceKey = opts.spaceKey || process.env.CONFLUENCE_SPACE_KEY || "";
+    this.baseUrl = (opts.baseUrl || "").replace(/\/+$/, "");
+    this.token = opts.token || "";
+    this.email = opts.email || "";
+    this.spaceKey = opts.spaceKey || "";
   }
 
   /** Check if the adapter is configured with required credentials. */

package/lib/serve-mcp.js

@@ -52,7 +52,12 @@ const search = new Search(store);
 const io = new ImportExport(store);
 const packs = new Packs(store);
 const graph = new Graph(store);
-const confluence = new Confluence();
+const confluence = new Confluence({
+  baseUrl: process.env.CONFLUENCE_BASE_URL,
+  token: process.env.CONFLUENCE_TOKEN,
+  email: process.env.CONFLUENCE_EMAIL,
+  spaceKey: process.env.CONFLUENCE_SPACE_KEY,
+});
 
 // ─── Tool implementations ───────────────────────────────────────────────────
 
@@ -108,7 +113,14 @@ function toolPull(dir, args) {
     };
   }
 
-  const targetFile = into || path.join(dir, "claims.json");
+  const targetFile = into ? path.resolve(dir, into) : path.join(dir, "claims.json");
+  // Prevent path traversal — target must stay within workspace
+  if (targetFile !== dir && !targetFile.startsWith(dir + path.sep)) {
+    return {
+      status: "error",
+      message: `Target path escapes workspace directory.`,
+    };
+  }
   if (!fs.existsSync(targetFile)) {
     return {
       status: "error",
@@ -135,7 +147,14 @@ function toolStore(dir, args) {
     return { status: "error", message: "Required field: name" };
   }
 
-  const sourceFile = from || path.join(dir, "claims.json");
+  const sourceFile = from ? path.resolve(dir, from) : path.join(dir, "claims.json");
+  // Prevent path traversal — source must stay within workspace
+  if (sourceFile !== dir && !sourceFile.startsWith(dir + path.sep)) {
+    return {
+      status: "error",
+      message: `Source path escapes workspace directory.`,
+    };
+  }
   if (!fs.existsSync(sourceFile)) {
     return { status: "error", message: `Source file not found: ${sourceFile}` };
   }
@@ -247,7 +266,14 @@ function toolConfluence(dir, args) {
     case "publish": {
       const { title, from, spaceKey, parentId, pageId } = args;
       if (!title) return { status: "error", message: "Required field: title" };
-      const sourceFile = from || path.join(dir, "claims.json");
+      const sourceFile = from ? path.resolve(dir, from) : path.join(dir, "claims.json");
+      // Prevent path traversal — source must stay within workspace
+      if (sourceFile !== dir && !sourceFile.startsWith(dir + path.sep)) {
+        return {
+          status: "error",
+          message: `Source path escapes workspace directory.`,
+        };
+      }
       if (!fs.existsSync(sourceFile))
         return {
           status: "error",
@@ -269,6 +295,16 @@ function toolConfluence(dir, args) {
       const target = pid || searchTitle;
       if (!target)
         return { status: "error", message: "Required: pageId or title" };
+      // Prevent path traversal — target must stay within workspace
+      if (into) {
+        const checkPath = path.resolve(dir, into);
+        if (checkPath !== dir && !checkPath.startsWith(dir + path.sep)) {
+          return {
+            status: "error",
+            message: `Target path escapes workspace directory.`,
+          };
+        }
+      }
       return confluence
         .pull(target, { spaceKey })
         .then((result) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@grainulation/silo",
-  "version": "1.0.5",
+  "version": "1.1.1",
   "description": "Reusable knowledge for research sprints -- shared claim libraries, templates, and knowledge packs",
   "main": "lib/index.js",
   "exports": {