@jackwener/opencli 1.7.0 → 1.7.1

package/dist/src/logger.js

@@ -4,7 +4,7 @@
  * All framework output (warnings, debug info, errors) should go through
  * this module so that verbosity levels are respected consistently.
  */
-import chalk from 'chalk';
+import { styleText } from 'node:util';
 function isVerbose() {
     return !!process.env.OPENCLI_VERBOSE;
 }
@@ -14,42 +14,42 @@ function isDebug() {
 export const log = {
     /** Informational message (always shown) */
     info(msg) {
-        process.stderr.write(`${chalk.blue('ℹ')}  ${msg}\n`);
+        process.stderr.write(`${styleText('blue', 'ℹ')}  ${msg}\n`);
     },
     /** Lightweight status line for adapter progress updates */
     status(msg) {
-        process.stderr.write(`${chalk.dim(msg)}\n`);
+        process.stderr.write(`${styleText('dim', msg)}\n`);
     },
     /** Positive completion/status line without the heavier info prefix */
     success(msg) {
-        process.stderr.write(`${chalk.green(msg)}\n`);
+        process.stderr.write(`${styleText('green', msg)}\n`);
     },
     /** Warning (always shown) */
     warn(msg) {
-        process.stderr.write(`${chalk.yellow('⚠')}  ${msg}\n`);
+        process.stderr.write(`${styleText('yellow', '⚠')}  ${msg}\n`);
     },
     /** Error (always shown) */
     error(msg) {
-        process.stderr.write(`${chalk.red('✖')}  ${msg}\n`);
+        process.stderr.write(`${styleText('red', '✖')}  ${msg}\n`);
     },
     /** Verbose output (only when OPENCLI_VERBOSE is set or -v flag) */
     verbose(msg) {
         if (isVerbose()) {
-            process.stderr.write(`${chalk.dim('[verbose]')} ${msg}\n`);
+            process.stderr.write(`${styleText('dim', '[verbose]')} ${msg}\n`);
         }
     },
     /** Debug output (only when DEBUG includes 'opencli') */
     debug(msg) {
         if (isDebug()) {
-            process.stderr.write(`${chalk.dim('[debug]')} ${msg}\n`);
+            process.stderr.write(`${styleText('dim', '[debug]')} ${msg}\n`);
         }
     },
     /** Step-style debug (for pipeline steps, etc.) */
     step(stepNum, total, op, preview = '') {
-        process.stderr.write(`  ${chalk.dim(`[${stepNum}/${total}]`)} ${chalk.bold.cyan(op)}${preview}\n`);
+        process.stderr.write(`  ${styleText('dim', `[${stepNum}/${total}]`)} ${styleText(['bold', 'cyan'], op)}${preview}\n`);
     },
     /** Step result summary */
     stepResult(summary) {
-        process.stderr.write(`       ${chalk.dim(`→ ${summary}`)}\n`);
+        process.stderr.write(`       ${styleText('dim', `→ ${summary}`)}\n`);
     },
 };

package/dist/src/main.js

@@ -17,12 +17,14 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { getCompletionsFromManifest, hasAllManifests, printCompletionScriptFast } from './completion-fast.js';
-import { getCliManifestPath } from './package-paths.js';
+import { findPackageRoot, getCliManifestPath } from './package-paths.js';
 import { PKG_VERSION } from './version.js';
 import { EXIT_CODES } from './errors.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
-const BUILTIN_CLIS = path.resolve(__dirname, '..', 'clis');
+// Adapters are JS-first and live at <package-root>/clis/.
+// Use findPackageRoot so the path works both in dev (src/main.ts) and prod (dist/src/main.js).
+const BUILTIN_CLIS = path.join(findPackageRoot(__filename), 'clis');
 const USER_CLIS = path.join(os.homedir(), '.opencli', 'clis');
 // ── Ultra-fast path: lightweight commands bypass full discovery ──────────
 // These are high-frequency or trivial paths that must not pay the startup tax.
@@ -81,10 +83,20 @@ const { emitHook } = await import('./hooks.js');
 const { installNodeNetwork } = await import('./node-network.js');
 const { registerUpdateNoticeOnExit, checkForUpdateBackground } = await import('./update-check.js');
 installNodeNetwork();
-// Sequential: plugins must run after built-in discovery so they can override built-in commands.
-await ensureUserCliCompatShims();
-await ensureUserAdapters();
-await discoverClis(BUILTIN_CLIS, USER_CLIS);
+// Parallelise independent startup I/O:
+//  - Built-in adapter discovery has no dependency on user-dir setup.
+//  - ensureUserCliCompatShims and ensureUserAdapters operate on different paths
+//    (~/.opencli/node_modules/ vs ~/.opencli/clis/ + adapter-manifest.json).
+//  - registerCommand() overwrites on name collision (see registry.ts), so
+//    user-CLI discovery MUST run after built-in discovery to preserve the
+//    intended override order (user adapters override built-in ones).
+//  - discoverPlugins runs last: plugins may override both built-in and user CLIs.
+const [, ,] = await Promise.all([
+    ensureUserCliCompatShims(),
+    ensureUserAdapters(),
+    discoverClis(BUILTIN_CLIS),
+]);
+await discoverClis(USER_CLIS);
 await discoverPlugins();
 // Register exit hook: notice appears after command output (same as npm/gh/yarn)
 registerUpdateNoticeOnExit();

package/dist/src/output.js

@@ -1,7 +1,7 @@
 /**
  * Output formatting: table, JSON, Markdown, CSV, YAML.
  */
-import chalk from 'chalk';
+import { styleText } from 'node:util';
 import Table from 'cli-table3';
 import yaml from 'js-yaml';
 function normalizeRows(data) {
@@ -55,13 +55,13 @@ export function render(data, opts = {}) {
 function renderTable(data, opts) {
     const rows = normalizeRows(data);
     if (!rows.length) {
-        console.log(chalk.dim('(no data)'));
+        console.log(styleText('dim', '(no data)'));
         return;
     }
     const columns = resolveColumns(rows, opts);
     const header = columns.map(c => capitalize(c));
     const table = new Table({
-        head: header.map(h => chalk.bold(h)),
+        head: header.map(h => styleText('bold', h)),
         style: { head: [], border: [] },
         wordWrap: true,
         wrapOnWordBoundary: true,
@@ -74,7 +74,7 @@ function renderTable(data, opts) {
     }
     console.log();
     if (opts.title)
-        console.log(chalk.dim(`  ${opts.title}`));
+        console.log(styleText('dim', `  ${opts.title}`));
     console.log(table.toString());
     const footer = [];
     footer.push(`${rows.length} items`);
@@ -84,7 +84,7 @@ function renderTable(data, opts) {
         footer.push(opts.source);
     if (opts.footerExtra)
         footer.push(opts.footerExtra);
-    console.log(chalk.dim(footer.join(' · ')));
+    console.log(styleText('dim', footer.join(' · ')));
 }
 function renderJson(data) {
     console.log(JSON.stringify(data, null, 2));

package/dist/src/package-exports.test.js

@@ -14,16 +14,16 @@ import ts from 'typescript';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.resolve(__dirname, '..');
 const CLIS_DIR = path.join(ROOT, 'clis');
-/** Recursively collect all .ts files in a directory. */
-function collectTsFiles(dir, opts) {
+/** Recursively collect all JS adapter files in a directory. */
+function collectAdapterFiles(dir, opts) {
     const results = [];
     for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
         const full = path.join(dir, entry.name);
         if (entry.isDirectory()) {
-            results.push(...collectTsFiles(full, opts));
+            results.push(...collectAdapterFiles(full, opts));
         }
-        else if (entry.name.endsWith('.ts') && !entry.name.endsWith('.d.ts')) {
-            if (opts?.excludeTests && (entry.name.endsWith('.test.ts') || entry.name === 'test-utils.ts'))
+        else if (entry.name.endsWith('.js') && !entry.name.endsWith('.d.js')) {
+            if (opts?.excludeTests && (entry.name.endsWith('.test.js') || entry.name.startsWith('test-')))
                 continue;
             results.push(full);
         }
@@ -53,8 +53,8 @@ const FORBIDDEN_PATTERNS = [
     /(?:from|mock|importActual)\s*\(?['"](?:\.\.\/)+pipeline\//,
 ];
 describe('adapter imports use package exports', () => {
-    const adapterFiles = collectTsFiles(CLIS_DIR);
-    const runtimeAdapterFiles = collectTsFiles(CLIS_DIR, { excludeTests: true });
+    const adapterFiles = collectAdapterFiles(CLIS_DIR);
+    const runtimeAdapterFiles = collectAdapterFiles(CLIS_DIR, { excludeTests: true });
     it('found adapter files to check', () => {
         expect(adapterFiles.length).toBeGreaterThan(100);
     });
@@ -76,7 +76,7 @@ describe('adapter imports use package exports', () => {
         const violations = [];
         for (const file of runtimeAdapterFiles) {
             const source = fs.readFileSync(file, 'utf-8');
-            const module = ts.createSourceFile(file, source, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
+            const module = ts.createSourceFile(file, source, ts.ScriptTarget.Latest, true, ts.ScriptKind.JS);
             for (const stmt of module.statements) {
                 if (!ts.isImportDeclaration(stmt) && !ts.isExportDeclaration(stmt))
                     continue;

package/dist/src/pipeline/steps/tap.js

@@ -10,6 +10,7 @@
  */
 import { render } from '../template.js';
 import { generateTapInterceptorJs } from '../../interceptor.js';
+import { CliError } from '../../errors.js';
 export async function stepTap(page, params, data, args) {
     const cfg = typeof params === 'object' && params !== null ? params : {};
     const storeName = String(render(cfg.store ?? '', { args, data }));
@@ -20,7 +21,7 @@ export async function stepTap(page, params, data, args) {
     const framework = cfg.framework ?? null;
     const actionArgs = cfg.args ?? [];
     if (!storeName || !actionName)
-        throw new Error('tap: store and action are required');
+        throw new CliError('TAP_MISSING_PARAMS', 'tap: store and action are required');
     // Build select chain for the captured response
     const selectChain = selectPath
         ? selectPath.split('.').map((p) => `?.[${JSON.stringify(p)}]`).join('')

package/dist/src/pipeline/template.js

@@ -188,14 +188,34 @@ const FORBIDDEN_EXPR_PATTERNS = /\b(constructor|__proto__|prototype|globalThis|p
 /**
  * Deep-copy plain data to sever prototype chains, preventing sandbox escape
  * via `args.constructor.constructor('return process')()` etc.
+ *
+ * Uses a WeakMap cache keyed by object reference: when the same object
+ * (e.g. `args` or `data`) is passed repeatedly across loop iterations,
+ * the expensive JSON round-trip is performed only once. The WeakMap
+ * lets entries be GC'd when the source object is no longer referenced.
+ */
+/**
+ * Cache serialized JSON strings (not parsed objects) by source reference.
+ * Caching the parsed object would be unsafe: the VM sandbox could mutate it,
+ * and the polluted version would leak to subsequent calls. By caching the
+ * string and returning a fresh JSON.parse() each time, every evaluation gets
+ * its own clean deep-copy while still avoiding redundant JSON.stringify()
+ * for the same unchanged source object across loop iterations.
  */
+const _sanitizeCache = new WeakMap();
 function sanitizeContext(obj) {
     if (obj === null || obj === undefined)
         return obj;
     if (typeof obj !== 'object' && typeof obj !== 'function')
         return obj;
+    const objRef = obj;
+    const cached = _sanitizeCache.get(objRef);
+    if (cached !== undefined)
+        return JSON.parse(cached);
     try {
-        return JSON.parse(JSON.stringify(obj));
+        const jsonStr = JSON.stringify(obj);
+        _sanitizeCache.set(objRef, jsonStr);
+        return JSON.parse(jsonStr);
     }
     catch {
         return {};
@@ -218,6 +238,51 @@ function getOrCompileScript(expr) {
     _vmCache.set(expr, script);
     return script;
 }
+/**
+ * Reusable VM sandbox context.
+ *
+ * vm.createContext() is expensive (~0.3ms per call) because it creates a new
+ * V8 context with its own global object. In pipeline loops (map/filter over
+ * hundreds of items), this adds up to significant overhead.
+ *
+ * Instead, we create the context once and mutate the sandbox properties
+ * before each evaluation. This is safe because:
+ *   1. Sandbox properties are sanitized (deep-copied) before assignment
+ *   2. Scripts run with a 50ms timeout
+ *   3. codeGeneration is disabled (no eval/Function inside the sandbox)
+ */
+let _reusableSandbox = null;
+let _reusableContext = null;
+function getReusableContext() {
+    if (_reusableSandbox && _reusableContext) {
+        return { sandbox: _reusableSandbox, context: _reusableContext };
+    }
+    _reusableSandbox = {
+        args: {},
+        item: {},
+        data: null,
+        index: 0,
+        encodeURIComponent,
+        decodeURIComponent,
+        JSON,
+        Math,
+        Number,
+        String,
+        Boolean,
+        Array,
+        Date,
+    };
+    _reusableContext = vm.createContext(_reusableSandbox, {
+        codeGeneration: { strings: false, wasm: false },
+    });
+    return { sandbox: _reusableSandbox, context: _reusableContext };
+}
+/** Properties that are part of the sandbox's initial shape and safe to keep. */
+const SANDBOX_WHITELIST = new Set([
+    'args', 'item', 'data', 'index',
+    'encodeURIComponent', 'decodeURIComponent',
+    'JSON', 'Math', 'Number', 'String', 'Boolean', 'Array', 'Date',
+]);
 function evalJsExpr(expr, ctx) {
     // Guard against absurdly long expressions that could indicate injection.
     if (expr.length > 2000)
@@ -225,33 +290,22 @@ function evalJsExpr(expr, ctx) {
     // Block obvious sandbox escape attempts.
     if (FORBIDDEN_EXPR_PATTERNS.test(expr))
         return undefined;
-    const args = sanitizeContext(ctx.args ?? {});
-    const item = sanitizeContext(ctx.item ?? {});
-    const data = sanitizeContext(ctx.data);
-    const index = ctx.index ?? 0;
     try {
         const script = getOrCompileScript(expr);
-        const sandbox = vm.createContext({
-            args,
-            item,
-            data,
-            index,
-            encodeURIComponent,
-            decodeURIComponent,
-            JSON,
-            Math,
-            Number,
-            String,
-            Boolean,
-            Array,
-            Date,
-        }, {
-            codeGeneration: {
-                strings: false,
-                wasm: false,
-            },
-        });
-        return script.runInContext(sandbox, { timeout: 50 });
+        const { sandbox, context } = getReusableContext();
+        // Clean non-whitelisted properties that a previous script may have added.
+        // Without this, `${{ x = 42 }}` would leak `x` into subsequent evaluations.
+        for (const key of Object.keys(sandbox)) {
+            if (!SANDBOX_WHITELIST.has(key)) {
+                delete sandbox[key];
+            }
+        }
+        // Update mutable sandbox properties — sanitizeContext severs prototype chains.
+        sandbox.args = sanitizeContext(ctx.args ?? {});
+        sandbox.item = sanitizeContext(ctx.item ?? {});
+        sandbox.data = sanitizeContext(ctx.data);
+        sandbox.index = ctx.index ?? 0;
+        return script.runInContext(context, { timeout: 50 });
     }
     catch {
         return undefined;

package/dist/src/plugin.js

@@ -12,8 +12,9 @@ import * as path from 'node:path';
 import { execSync, execFileSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { PLUGINS_DIR } from './discovery.js';
-import { getErrorMessage } from './errors.js';
+import { getErrorMessage, PluginError } from './errors.js';
 import { log } from './logger.js';
+import { isRecord } from './utils.js';
 import { readPluginManifest, isMonorepo, getEnabledPlugins, checkCompatibility, } from './plugin-manifest.js';
 const isWindows = process.platform === 'win32';
 const LOCAL_PLUGIN_SOURCE_PREFIX = 'local:';
@@ -52,9 +53,7 @@ function toStoredPluginSource(source) {
 function toLocalPluginSource(pluginDir) {
     return toStoredPluginSource({ kind: 'local', path: pluginDir });
 }
-function isRecord(value) {
-    return typeof value === 'object' && value !== null;
-}
+// isRecord is imported from './utils.js'
 function normalizeLegacyMonorepo(value) {
     if (!isRecord(value))
         return undefined;
@@ -166,7 +165,7 @@ function createSiblingTempPath(dest, kind) {
  */
 function promoteDir(stagingDir, dest, fsOps = fs) {
     if (fsOps.existsSync(dest)) {
-        throw new Error(`Destination already exists: ${dest}`);
+        throw new PluginError(`Destination already exists: ${dest}`);
     }
     fsOps.mkdirSync(path.dirname(dest), { recursive: true });
     const tempDest = createSiblingTempPath(dest, 'tmp');
@@ -195,7 +194,7 @@ function cloneRepoToTemp(cloneUrl) {
         });
     }
     catch (err) {
-        throw new Error(`Failed to clone plugin: ${getErrorMessage(err)}`);
+        throw new PluginError(`Failed to clone plugin: ${getErrorMessage(err)}`, 'Check the repository URL and your network connection.');
     }
     return tmpCloneDir;
 }
@@ -227,6 +226,13 @@ function pathExistsSync(p) {
         return false;
     }
 }
+function resolveRepoContainedPath(repoRoot, subPath) {
+    const resolved = path.resolve(repoRoot, subPath);
+    if (!resolved.startsWith(repoRoot + path.sep) && resolved !== repoRoot) {
+        throw new PluginError(`Plugin path "${subPath}" escapes repo root.`);
+    }
+    return resolved;
+}
 function removePathSync(p) {
     try {
         const stat = fs.lstatSync(p);
@@ -499,7 +505,7 @@ function installDependencies(dir) {
         });
     }
     catch (err) {
-        throw new Error(`npm install failed in ${dir}: ${getErrorMessage(err)}`);
+        throw new PluginError(`npm install failed in ${dir}: ${getErrorMessage(err)}`, 'Check your network connection and npm configuration.');
     }
 }
 function finalizePluginRuntime(pluginDir) {
@@ -528,7 +534,7 @@ function postInstallMonorepoLifecycle(repoDir, pluginDirs) {
 function ensureStandalonePluginReady(pluginDir) {
     const validation = validatePluginStructure(pluginDir);
     if (!validation.valid) {
-        throw new Error(`Invalid plugin structure:\n- ${validation.errors.join('\n- ')}`);
+        throw new PluginError(`Invalid plugin structure:\n- ${validation.errors.join('\n- ')}`);
     }
     postInstallLifecycle(pluginDir);
 }
@@ -553,7 +559,7 @@ function publishMonorepoPlugins(repoDir, pluginsDir, plugins, publishRepo, write
         const commitHash = getCommitHash(repoDir);
         for (const plugin of plugins) {
             const linkPath = path.join(pluginsDir, plugin.name);
-            const subDir = path.join(repoDir, plugin.subPath);
+            const subDir = resolveRepoContainedPath(repoDir, plugin.subPath);
             tx.track(beginReplaceSymlink(subDir, linkPath));
         }
         writeLock?.(commitHash);
@@ -606,7 +612,7 @@ function installSinglePlugin(cloneDir, cloneUrl, name, manifest) {
     const pluginName = manifest?.name ?? name;
     const targetDir = path.join(PLUGINS_DIR, pluginName);
     if (fs.existsSync(targetDir)) {
-        throw new Error(`Plugin "${pluginName}" is already installed at ${targetDir}`);
+        throw new PluginError(`Plugin "${pluginName}" is already installed at ${targetDir}`, 'Use "opencli plugin uninstall" first, or pick a different name.');
     }
     ensureStandalonePluginReady(cloneDir);
     publishStandalonePlugin(cloneDir, targetDir, (commitHash) => {
@@ -628,24 +634,24 @@ function installSinglePlugin(cloneDir, cloneUrl, name, manifest) {
  */
 function installLocalPlugin(localPath, name) {
     if (!fs.existsSync(localPath)) {
-        throw new Error(`Local plugin path does not exist: ${localPath}`);
+        throw new PluginError(`Local plugin path does not exist: ${localPath}`);
     }
     const stat = fs.statSync(localPath);
     if (!stat.isDirectory()) {
-        throw new Error(`Local plugin path is not a directory: ${localPath}`);
+        throw new PluginError(`Local plugin path is not a directory: ${localPath}`);
     }
     const manifest = readPluginManifest(localPath);
     if (manifest?.opencli && !checkCompatibility(manifest.opencli)) {
-        throw new Error(`Plugin requires opencli ${manifest.opencli}, but current version is incompatible.`);
+        throw new PluginError(`Plugin requires opencli ${manifest.opencli}, but current version is incompatible.`, 'Upgrade opencli to a compatible version.');
     }
     const pluginName = manifest?.name ?? name;
     const targetDir = path.join(PLUGINS_DIR, pluginName);
     if (fs.existsSync(targetDir)) {
-        throw new Error(`Plugin "${pluginName}" is already installed at ${targetDir}`);
+        throw new PluginError(`Plugin "${pluginName}" is already installed at ${targetDir}`, 'Use "opencli plugin uninstall" first, or pick a different name.');
     }
     const validation = validatePluginStructure(localPath);
     if (!validation.valid) {
-        throw new Error(`Invalid plugin structure:\n- ${validation.errors.join('\n- ')}`);
+        throw new PluginError(`Invalid plugin structure:\n- ${validation.errors.join('\n- ')}`);
     }
     fs.mkdirSync(PLUGINS_DIR, { recursive: true });
     const resolvedPath = path.resolve(localPath);
@@ -685,7 +691,7 @@ function installMonorepo(cloneDir, cloneUrl, repoName, manifest, subPlugin) {
     const repoRoot = repoAlreadyInstalled ? repoDir : cloneDir;
     const effectiveManifest = repoAlreadyInstalled ? readPluginManifest(repoDir) : manifest;
     if (!effectiveManifest || !isMonorepo(effectiveManifest)) {
-        throw new Error(`Monorepo manifest missing or invalid at ${repoRoot}`);
+        throw new PluginError(`Monorepo manifest missing or invalid at ${repoRoot}`);
     }
     let pluginsToInstall = getEnabledPlugins(effectiveManifest);
     // If a specific sub-plugin was requested, filter to just that one
@@ -695,9 +701,9 @@ function installMonorepo(cloneDir, cloneUrl, repoName, manifest, subPlugin) {
             // Check if it exists but is disabled
             const disabled = effectiveManifest.plugins?.[subPlugin];
             if (disabled) {
-                throw new Error(`Sub-plugin "${subPlugin}" is disabled in the manifest.`);
+                throw new PluginError(`Sub-plugin "${subPlugin}" is disabled in the manifest.`);
             }
-            throw new Error(`Sub-plugin "${subPlugin}" not found in monorepo. Available: ${Object.keys(effectiveManifest.plugins ?? {}).join(', ')}`);
+            throw new PluginError(`Sub-plugin "${subPlugin}" not found in monorepo. Available: ${Object.keys(effectiveManifest.plugins ?? {}).join(', ')}`);
         }
     }
     const installedNames = [];
@@ -710,7 +716,14 @@ function installMonorepo(cloneDir, cloneUrl, repoName, manifest, subPlugin) {
             log.warn(`Skipping "${name}": requires opencli ${entry.opencli}`);
             continue;
         }
-        const subDir = path.join(repoRoot, entry.path);
+        let subDir;
+        try {
+            subDir = resolveRepoContainedPath(repoRoot, entry.path);
+        }
+        catch {
+            log.warn(`Skipping "${name}": path "${entry.path}" escapes repo root.`);
+            continue;
+        }
         if (!fs.existsSync(subDir)) {
             log.warn(`Skipping "${name}": path "${entry.path}" not found in repo.`);
             continue;
@@ -732,10 +745,10 @@ function installMonorepo(cloneDir, cloneUrl, repoName, manifest, subPlugin) {
     }
     const publishPlugins = eligiblePlugins.map(({ name, entry }) => ({ name, subPath: entry.path }));
     if (repoAlreadyInstalled) {
-        postInstallMonorepoLifecycle(repoDir, eligiblePlugins.map((p) => path.join(repoDir, p.entry.path)));
+        postInstallMonorepoLifecycle(repoDir, eligiblePlugins.map((p) => resolveRepoContainedPath(repoDir, p.entry.path)));
     }
     else {
-        postInstallMonorepoLifecycle(cloneDir, eligiblePlugins.map((p) => path.join(cloneDir, p.entry.path)));
+        postInstallMonorepoLifecycle(cloneDir, eligiblePlugins.map((p) => resolveRepoContainedPath(cloneDir, p.entry.path)));
     }
     publishMonorepoPlugins(repoDir, PLUGINS_DIR, publishPlugins, repoAlreadyInstalled ? undefined : { stagingDir: cloneDir, parentDir: monoreposDir }, (commitHash) => {
         for (const { name, entry } of eligiblePlugins) {
@@ -768,7 +781,7 @@ function collectUpdatedMonorepoPlugins(monoName, lock, manifest, cloneUrl, tmpCl
         if (manifestEntry.opencli && !checkCompatibility(manifestEntry.opencli)) {
             throw new Error(`Sub-plugin "${pluginName}" requires opencli ${manifestEntry.opencli}`);
         }
-        const subDir = path.join(tmpCloneDir, manifestEntry.path);
+        const subDir = resolveRepoContainedPath(tmpCloneDir, manifestEntry.path);
         const validation = validatePluginStructure(subDir);
         if (!validation.valid) {
             throw new Error(`Updated sub-plugin "${pluginName}" is invalid:\n- ${validation.errors.join('\n- ')}`);
@@ -883,7 +896,7 @@ export function updatePlugin(name) {
             }
             const updatedPlugins = collectUpdatedMonorepoPlugins(monoName, lock, manifest, cloneUrl, tmpCloneDir);
             if (updatedPlugins.length > 0) {
-                postInstallMonorepoLifecycle(tmpCloneDir, updatedPlugins.map((plugin) => path.join(tmpCloneDir, plugin.manifestEntry.path)));
+                postInstallMonorepoLifecycle(tmpCloneDir, updatedPlugins.map((plugin) => resolveRepoContainedPath(tmpCloneDir, plugin.manifestEntry.path)));
             }
             publishMonorepoPlugins(monoDir, PLUGINS_DIR, updatedPlugins.map((plugin) => ({ name: plugin.name, subPath: plugin.manifestEntry.path })), { stagingDir: tmpCloneDir, parentDir: path.dirname(monoDir) }, (commitHash) => {
                 updateMonorepoLockEntries(lock, updatedPlugins, cloneUrl, monoName, commitHash);

package/dist/src/plugin.test.js

@@ -1279,6 +1279,47 @@ describe('updatePlugin transactional staging', () => {
             subPath: 'packages/moved-alpha',
         });
     });
+    it('rejects monorepo updates whose manifest path escapes the repo root', () => {
+        const oldSubDir = path.join(monorepoRepoDir, 'packages', 'old-alpha');
+        fs.mkdirSync(oldSubDir, { recursive: true });
+        fs.writeFileSync(path.join(oldSubDir, 'old.js'), 'cli({ site: "old", name: "old" })');
+        fs.mkdirSync(PLUGINS_DIR, { recursive: true });
+        fs.symlinkSync(oldSubDir, monorepoLink, 'dir');
+        const lock = _readLockFile();
+        lock[monorepoPluginName] = {
+            source: {
+                kind: 'monorepo',
+                url: 'https://github.com/user/opencli-plugins-__test-transactional-mono-update__.git',
+                repoName: monorepoName,
+                subPath: 'packages/old-alpha',
+            },
+            commitHash: 'oldmonooldmonooldmonooldmonooldmonoold',
+            installedAt: '2025-01-01T00:00:00.000Z',
+        };
+        _writeLockFile(lock);
+        mockExecFileSync.mockImplementation((cmd, args) => {
+            if (cmd === 'git' && Array.isArray(args) && args[0] === 'clone') {
+                const cloneDir = String(args[4]);
+                fs.mkdirSync(cloneDir, { recursive: true });
+                fs.writeFileSync(path.join(cloneDir, 'opencli-plugin.json'), JSON.stringify({
+                    plugins: {
+                        [monorepoPluginName]: { path: '../outside-alpha' },
+                    },
+                }));
+                return '';
+            }
+            if (cmd === 'git' && Array.isArray(args) && args[0] === 'rev-parse' && args[1] === 'HEAD') {
+                return '1234567890abcdef1234567890abcdef12345678\n';
+            }
+            return '';
+        });
+        expect(() => updatePlugin(monorepoPluginName)).toThrow('escapes repo root');
+        expect(fs.realpathSync(monorepoLink)).toBe(fs.realpathSync(oldSubDir));
+        expect(_readLockFile()[monorepoPluginName]?.source).toMatchObject({
+            kind: 'monorepo',
+            subPath: 'packages/old-alpha',
+        });
+    });
     it('rolls back the monorepo repo swap when relinking fails', () => {
         const oldSubDir = path.join(monorepoRepoDir, 'packages', 'old-alpha');
         fs.mkdirSync(oldSubDir, { recursive: true });