@juspay/neurolink 9.88.0 → 9.88.2

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [9.88.2](https://github.com/juspay/neurolink/compare/v9.88.1...v9.88.2) (2026-07-15)
+
+### Bug Fixes
+
+- **(security):** harden isMultimodalInput guard + remove hardcoded AWS account ID ([b9d140f](https://github.com/juspay/neurolink/commit/b9d140fadcc09349a90389bf93f98167583b5d7b)), closes [#278](https://github.com/juspay/neurolink/issues/278)
+
+## [9.88.1](https://github.com/juspay/neurolink/compare/v9.88.0...v9.88.1) (2026-07-15)
+
+### Bug Fixes
+
+- **(tools):** sandbox built-in file tools to the working directory ([4fc8520](https://github.com/juspay/neurolink/commit/4fc8520dbc024dec826a69a5f8264af7a25ff0e1))
+
 ## [9.88.0](https://github.com/juspay/neurolink/compare/v9.87.4...v9.88.0) (2026-07-15)
 
 ### Features

package/dist/agent/directTools.d.ts

@@ -56,6 +56,12 @@ export declare const directAgentTools: {
         path: string;
         includeHidden: boolean;
     }, {
+        success: boolean;
+        error: string;
+        path?: undefined;
+        items?: undefined;
+        count?: undefined;
+    } | {
         success: boolean;
         path: string;
         items: {

package/dist/agent/directTools.js

@@ -14,6 +14,28 @@ function truncateOutput(output) {
     }
     return output;
 }
+/**
+ * Contain a built-in file tool to the process working directory.
+ *
+ * Returns the resolved absolute path when it lies inside `process.cwd()`, or an
+ * `error` string otherwise. This is the sandbox for the default-enabled
+ * `readFile` / `writeFile` / `listDirectory` / `analyzeCSV` tools: without it an
+ * agent can pass an absolute path (`/etc/passwd`) or `../` traversal and reach
+ * arbitrary files. The previous guard (`!resolvedPath.startsWith(cwd) &&
+ * !path.isAbsolute(filePath)`) was always false for absolute paths, so it never
+ * fired. The `cwd + path.sep` suffix prevents a sibling-prefix bypass
+ * (`/home/app` vs `/home/app-evil`).
+ */
+function resolveWithinCwd(filePath) {
+    const resolvedPath = path.resolve(filePath);
+    const cwd = path.resolve(process.cwd());
+    if (resolvedPath !== cwd && !resolvedPath.startsWith(cwd + path.sep)) {
+        return {
+            error: `Access denied: "${filePath}" resolves outside the working directory`,
+        };
+    }
+    return { path: resolvedPath };
+}
 // Runtime Google Search tool creation - bypasses TypeScript strict typing
 function createGoogleSearchTools() {
     const searchTool = {};
@@ -71,15 +93,13 @@ export const directAgentTools = {
         }),
         execute: async ({ path: filePath }) => {
             try {
-                // Security check - prevent reading outside current directory for relative paths
-                const resolvedPath = path.resolve(filePath);
-                const cwd = process.cwd();
-                if (!resolvedPath.startsWith(cwd) && !path.isAbsolute(filePath)) {
-                    return {
-                        success: false,
-                        error: `Access denied: Cannot read files outside current directory`,
-                    };
+                // Sandbox: contain reads to the working directory (blocks absolute-path
+                // escape and ../ traversal).
+                const guard = resolveWithinCwd(filePath);
+                if ("error" in guard) {
+                    return { success: false, error: guard.error };
                 }
+                const resolvedPath = guard.path;
                 const content = fs.readFileSync(resolvedPath, "utf-8");
                 const stats = fs.statSync(resolvedPath);
                 return {
@@ -113,7 +133,12 @@ export const directAgentTools = {
         }),
         execute: async ({ path: dirPath, includeHidden }) => {
             try {
-                const resolvedPath = path.resolve(dirPath);
+                // Sandbox: contain directory listing to the working directory.
+                const guard = resolveWithinCwd(dirPath);
+                if ("error" in guard) {
+                    return { success: false, error: guard.error };
+                }
+                const resolvedPath = guard.path;
                 const items = fs.readdirSync(resolvedPath);
                 const filteredItems = includeHidden
                     ? items
@@ -229,15 +254,13 @@ export const directAgentTools = {
         }),
         execute: async ({ path: filePath, content, mode }) => {
             try {
-                const resolvedPath = path.resolve(filePath);
-                const cwd = process.cwd();
-                // Security check
-                if (!resolvedPath.startsWith(cwd) && !path.isAbsolute(filePath)) {
-                    return {
-                        success: false,
-                        error: `Access denied: Cannot write files outside current directory`,
-                    };
+                // Sandbox: contain writes to the working directory (blocks absolute-path
+                // escape and ../ traversal).
+                const guard = resolveWithinCwd(filePath);
+                if ("error" in guard) {
+                    return { success: false, error: guard.error };
                 }
+                const resolvedPath = guard.path;
                 // Check if file exists for create mode
                 if (mode === "create" && fs.existsSync(resolvedPath)) {
                     return {
@@ -326,11 +349,12 @@ export const directAgentTools = {
             try {
                 // Resolve file path
                 logger.debug(`[analyzeCSV] Resolving file: ${filePath}`);
-                const path = await import("path");
-                // Resolve path (support both relative and absolute)
-                const resolvedPath = path.isAbsolute(filePath)
-                    ? filePath
-                    : path.resolve(process.cwd(), filePath);
+                // Sandbox: contain CSV reads to the working directory.
+                const guard = resolveWithinCwd(filePath);
+                if ("error" in guard) {
+                    return { success: false, error: guard.error };
+                }
+                const resolvedPath = guard.path;
                 logger.debug(`[analyzeCSV] Resolved path: ${resolvedPath}`);
                 // Parse CSV using streaming from disk (memory efficient)
                 logger.info(`[analyzeCSV] Starting CSV parsing (max ${maxRows} rows)...`);