@litmers/cursorflow-orchestrator 0.1.15 → 0.1.20

package/src/cli/index.ts

@@ -34,10 +34,11 @@ function printHelp(): void {
 
 \x1b[1mCOMMANDS\x1b[0m
   \x1b[33minit\x1b[0m [options]              Initialize CursorFlow in project
+  \x1b[33msetup\x1b[0m [options]             Install Cursor IDE commands
   \x1b[33mprepare\x1b[0m <feature> [opts]    Prepare task directory and JSON files
   \x1b[33mrun\x1b[0m <tasks-dir> [options]   Run orchestration (DAG-based)
   \x1b[33mmonitor\x1b[0m [run-dir] [options] \x1b[36mInteractive\x1b[0m lane dashboard
-  \x1b[33mclean\x1b[0m <type> [options]      Clean branches/worktrees/logs
+  \x1b[33mclean\x1b[0m <type> [options]      Clean branches/worktrees/logs/tasks
   \x1b[33mresume\x1b[0m [lane] [options]     Resume lane(s) - use --all for batch resume
   \x1b[33mdoctor\x1b[0m [options]            Check environment and preflight
   \x1b[33msignal\x1b[0m <lane> <msg>         Directly intervene in a running lane
@@ -54,6 +55,9 @@ function printHelp(): void {
   $ \x1b[32mcursorflow prepare NewFeature --lanes 3\x1b[0m
   $ \x1b[32mcursorflow run _cursorflow/tasks/MyFeature/\x1b[0m
   $ \x1b[32mcursorflow monitor latest\x1b[0m
+  $ \x1b[32mcursorflow logs --all --follow\x1b[0m
+  $ \x1b[32mcursorflow resume --all\x1b[0m
+  $ \x1b[32mcursorflow doctor\x1b[0m
   $ \x1b[32mcursorflow models\x1b[0m
 
 \x1b[1mDOCUMENTATION\x1b[0m

package/src/cli/init.ts

@@ -9,6 +9,7 @@ import * as path from 'path';
 import * as logger from '../utils/logger';
 import { findProjectRoot, createDefaultConfig, CursorFlowConfig } from '../utils/config';
 import { setupCommands } from './setup-commands';
+import { safeJoin } from '../utils/path';
 
 interface InitOptions {
   example: boolean;
@@ -84,8 +85,8 @@ Examples:
 }
 
 function createDirectories(projectRoot: string, config: CursorFlowConfig): void {
-  const tasksDir = path.join(projectRoot, config.tasksDir);
-  const logsDir = path.join(projectRoot, config.logsDir);
+  const tasksDir = safeJoin(projectRoot, config.tasksDir);
+  const logsDir = safeJoin(projectRoot, config.logsDir);
   
   if (!fs.existsSync(tasksDir)) {
     fs.mkdirSync(tasksDir, { recursive: true });
@@ -103,7 +104,7 @@ function createDirectories(projectRoot: string, config: CursorFlowConfig): void
 }
 
 function createExampleTasks(projectRoot: string, config: CursorFlowConfig): void {
-  const exampleDir = path.join(projectRoot, config.tasksDir, 'example');
+  const exampleDir = safeJoin(projectRoot, config.tasksDir, 'example');
   
   if (!fs.existsSync(exampleDir)) {
     fs.mkdirSync(exampleDir, { recursive: true });
@@ -134,13 +135,13 @@ Create a simple hello.txt file with a greeting message.
     ]
   };
   
-  const taskPath = path.join(exampleDir, '01-hello.json');
+  const taskPath = safeJoin(exampleDir, '01-hello.json');
   fs.writeFileSync(taskPath, JSON.stringify(exampleTask, null, 2) + '\n', 'utf8');
   
   logger.success(`Created example task: ${path.relative(projectRoot, taskPath)}`);
   
   // Create README
-  const readmePath = path.join(exampleDir, 'README.md');
+  const readmePath = safeJoin(exampleDir, 'README.md');
   const readme = `# Example Task
 
 This is an example CursorFlow task to help you get started.
@@ -172,20 +173,23 @@ cursorflow run ${config.tasksDir}/example/
  * Add _cursorflow to .gitignore
  */
 function updateGitignore(projectRoot: string): void {
-  const gitignorePath = path.join(projectRoot, '.gitignore');
+  const gitignorePath = safeJoin(projectRoot, '.gitignore');
   const entry = '_cursorflow/';
   
-  // Check if .gitignore exists
-  if (!fs.existsSync(gitignorePath)) {
-    // Create new .gitignore
-    fs.writeFileSync(gitignorePath, `# CursorFlow\n${entry}\n`, 'utf8');
-    logger.success('Created .gitignore with _cursorflow/');
-    return;
+  // Try to read existing .gitignore (avoid TOCTOU by reading directly)
+  let content: string;
+  try {
+    content = fs.readFileSync(gitignorePath, 'utf8');
+  } catch (err: any) {
+    if (err.code === 'ENOENT') {
+      // File doesn't exist - create new .gitignore
+      fs.writeFileSync(gitignorePath, `# CursorFlow\n${entry}\n`, 'utf8');
+      logger.success('Created .gitignore with _cursorflow/');
+      return;
+    }
+    throw err;
   }
   
-  // Read existing .gitignore
-  const content = fs.readFileSync(gitignorePath, 'utf8');
-  
   // Check if already included
   const lines = content.split('\n');
   const hasEntry = lines.some(line => {

package/src/cli/logs.ts

@@ -6,12 +6,14 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as logger from '../utils/logger';
 import { loadConfig } from '../utils/config';
+import { safeJoin } from '../utils/path';
 import { 
   readJsonLog, 
   exportLogs, 
   stripAnsi,
   JsonLogEntry 
 } from '../utils/enhanced-logger';
+import { formatPotentialJsonMessage } from '../utils/log-formatter';
 
 interface LogsOptions {
   runDir?: string;
@@ -29,6 +31,13 @@ interface LogsOptions {
   help: boolean;
 }
 
+/**
+ * Escape special regex characters to prevent regex injection
+ */
+function escapeRegex(str: string): string {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
 function printHelp(): void {
   console.log(`
 Usage: cursorflow logs [run-dir] [options]
@@ -107,15 +116,15 @@ function parseArgs(args: string[]): LogsOptions {
  * Find the latest run directory
  */
 function findLatestRunDir(logsDir: string): string | null {
-  const runsDir = path.join(logsDir, 'runs');
+  const runsDir = safeJoin(logsDir, 'runs');
   if (!fs.existsSync(runsDir)) return null;
   
   const runs = fs.readdirSync(runsDir)
     .filter(d => d.startsWith('run-'))
     .map(d => ({ 
       name: d, 
-      path: path.join(runsDir, d), 
-      mtime: fs.statSync(path.join(runsDir, d)).mtime.getTime() 
+      path: safeJoin(runsDir, d), 
+      mtime: fs.statSync(safeJoin(runsDir, d)).mtime.getTime() 
     }))
     .sort((a, b) => b.mtime - a.mtime);
   
@@ -126,11 +135,11 @@ function findLatestRunDir(logsDir: string): string | null {
  * List lanes in a run directory
  */
 function listLanes(runDir: string): string[] {
-  const lanesDir = path.join(runDir, 'lanes');
+  const lanesDir = safeJoin(runDir, 'lanes');
   if (!fs.existsSync(lanesDir)) return [];
   
   return fs.readdirSync(lanesDir)
-    .filter(d => fs.statSync(path.join(lanesDir, d)).isDirectory());
+    .filter(d => fs.statSync(safeJoin(lanesDir, d)).isDirectory());
 }
 
 /**
@@ -141,9 +150,9 @@ function displayTextLogs(
   options: LogsOptions
 ): void {
   let logFile: string;
-  const readableLog = path.join(laneDir, 'terminal-readable.log');
-  const rawLog = path.join(laneDir, 'terminal-raw.log');
-  const cleanLog = path.join(laneDir, 'terminal.log');
+  const readableLog = safeJoin(laneDir, 'terminal-readable.log');
+  const rawLog = safeJoin(laneDir, 'terminal-raw.log');
+  const cleanLog = safeJoin(laneDir, 'terminal.log');
 
   if (options.raw) {
     logFile = rawLog;
@@ -164,10 +173,10 @@ function displayTextLogs(
   let content = fs.readFileSync(logFile, 'utf8');
   let lines = content.split('\n');
   
-  // Apply filter
+  // Apply filter (case-insensitive string match to avoid ReDoS)
   if (options.filter) {
-    const regex = new RegExp(options.filter, 'i');
-    lines = lines.filter(line => regex.test(line));
+    const filterLower = options.filter.toLowerCase();
+    lines = lines.filter(line => line.toLowerCase().includes(filterLower));
   }
   
   // Apply tail
@@ -190,7 +199,7 @@ function displayJsonLogs(
   laneDir: string, 
   options: LogsOptions
 ): void {
-  const logFile = path.join(laneDir, 'terminal.jsonl');
+  const logFile = safeJoin(laneDir, 'terminal.jsonl');
   
   if (!fs.existsSync(logFile)) {
     console.log('No JSON log file found.');
@@ -204,10 +213,13 @@ function displayJsonLogs(
     entries = entries.filter(e => e.level === options.level);
   }
   
-  // Apply regex filter
+  // Apply filter (case-insensitive string match to avoid ReDoS)
   if (options.filter) {
-    const regex = new RegExp(options.filter, 'i');
-    entries = entries.filter(e => regex.test(e.message) || regex.test(e.task || ''));
+    const filterLower = options.filter.toLowerCase();
+    entries = entries.filter(e => 
+      e.message.toLowerCase().includes(filterLower) || 
+      (e.task && e.task.toLowerCase().includes(filterLower))
+    );
   }
   
   // Apply tail
@@ -222,7 +234,8 @@ function displayJsonLogs(
     for (const entry of entries) {
       const levelColor = getLevelColor(entry.level);
       const ts = new Date(entry.timestamp).toLocaleTimeString();
-      console.log(`${levelColor}[${ts}] [${entry.level.toUpperCase().padEnd(6)}]${logger.COLORS.reset} ${entry.message}`);
+      const formattedMsg = formatPotentialJsonMessage(entry.message);
+      console.log(`${levelColor}[${ts}] [${entry.level.toUpperCase().padEnd(6)}]${logger.COLORS.reset} ${formattedMsg}`);
     }
   }
 }
@@ -283,8 +296,8 @@ function readAllLaneLogs(runDir: string): MergedLogEntry[] {
   const allEntries: MergedLogEntry[] = [];
   
   lanes.forEach((laneName, index) => {
-    const laneDir = path.join(runDir, 'lanes', laneName);
-    const jsonLogPath = path.join(laneDir, 'terminal.jsonl');
+    const laneDir = safeJoin(runDir, 'lanes', laneName);
+    const jsonLogPath = safeJoin(laneDir, 'terminal.jsonl');
     
     if (fs.existsSync(jsonLogPath)) {
       const entries = readJsonLog(jsonLogPath);
@@ -326,13 +339,13 @@ function displayMergedLogs(runDir: string, options: LogsOptions): void {
     entries = entries.filter(e => e.level === options.level);
   }
   
-  // Apply regex filter
+  // Apply filter (case-insensitive string match to avoid ReDoS)
   if (options.filter) {
-    const regex = new RegExp(options.filter, 'i');
+    const filterLower = options.filter.toLowerCase();
     entries = entries.filter(e => 
-      regex.test(e.message) || 
-      regex.test(e.task || '') ||
-      regex.test(e.laneName)
+      e.message.toLowerCase().includes(filterLower) || 
+      (e.task && e.task.toLowerCase().includes(filterLower)) ||
+      e.laneName.toLowerCase().includes(filterLower)
     );
   }
   
@@ -380,7 +393,8 @@ function displayMergedLogs(runDir: string, options: LogsOptions): void {
       continue;
     }
     
-    console.log(`${logger.COLORS.gray}[${ts}]${logger.COLORS.reset} ${laneColor}[${lanePad}]${logger.COLORS.reset} ${levelColor}[${levelPad}]${logger.COLORS.reset} ${entry.message}`);
+    const formattedMsg = formatPotentialJsonMessage(entry.message);
+    console.log(`${logger.COLORS.gray}[${ts}]${logger.COLORS.reset} ${laneColor}[${lanePad}]${logger.COLORS.reset} ${levelColor}[${levelPad}]${logger.COLORS.reset} ${formattedMsg}`);
   }
   
   console.log(`\n${logger.COLORS.cyan}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${logger.COLORS.reset}`);
@@ -419,12 +433,11 @@ function followAllLogs(runDir: string, options: LogsOptions): void {
     const newEntries: MergedLogEntry[] = [];
     
     for (const lane of lanes) {
-      const laneDir = path.join(runDir, 'lanes', lane);
-      const jsonLogPath = path.join(laneDir, 'terminal.jsonl');
-      
-      if (!fs.existsSync(jsonLogPath)) continue;
+      const laneDir = safeJoin(runDir, 'lanes', lane);
+      const jsonLogPath = safeJoin(laneDir, 'terminal.jsonl');
       
       try {
+        // Use statSync directly to avoid TOCTOU race condition
         const stats = fs.statSync(jsonLogPath);
         if (stats.size > lastPositions[lane]!) {
           const fd = fs.openSync(jsonLogPath, 'r');
@@ -467,10 +480,12 @@ function followAllLogs(runDir: string, options: LogsOptions): void {
       // Apply level filter
       if (options.level && entry.level !== options.level) continue;
       
-      // Apply regex filter
+      // Apply filter (case-insensitive string match to avoid ReDoS)
       if (options.filter) {
-        const regex = new RegExp(options.filter, 'i');
-        if (!regex.test(entry.message) && !regex.test(entry.task || '') && !regex.test(entry.laneName)) {
+        const filterLower = options.filter.toLowerCase();
+        if (!entry.message.toLowerCase().includes(filterLower) && 
+            !(entry.task && entry.task.toLowerCase().includes(filterLower)) && 
+            !entry.laneName.toLowerCase().includes(filterLower)) {
           continue;
         }
       }
@@ -490,7 +505,8 @@ function followAllLogs(runDir: string, options: LogsOptions): void {
         continue;
       }
       
-      console.log(`${logger.COLORS.gray}[${ts}]${logger.COLORS.reset} ${entry.laneColor}[${lanePad}]${logger.COLORS.reset} ${levelColor}[${levelPad}]${logger.COLORS.reset} ${entry.message}`);
+      const formattedMsg = formatPotentialJsonMessage(entry.message);
+      console.log(`${logger.COLORS.gray}[${ts}]${logger.COLORS.reset} ${entry.laneColor}[${lanePad}]${logger.COLORS.reset} ${levelColor}[${levelPad}]${logger.COLORS.reset} ${formattedMsg}`);
     }
   }, 100);
   
@@ -628,7 +644,9 @@ function escapeHtml(text: string): string {
     .replace(/</g, '&lt;')
     .replace(/>/g, '&gt;')
     .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#039;');
+    .replace(/'/g, '&#039;')
+    .replace(/`/g, '&#x60;')
+    .replace(/\//g, '&#x2F;');
 }
 
 /**
@@ -636,9 +654,9 @@ function escapeHtml(text: string): string {
  */
 function followLogs(laneDir: string, options: LogsOptions): void {
   let logFile: string;
-  const readableLog = path.join(laneDir, 'terminal-readable.log');
-  const rawLog = path.join(laneDir, 'terminal-raw.log');
-  const cleanLog = path.join(laneDir, 'terminal.log');
+  const readableLog = safeJoin(laneDir, 'terminal-readable.log');
+  const rawLog = safeJoin(laneDir, 'terminal-raw.log');
+  const cleanLog = safeJoin(laneDir, 'terminal.log');
 
   if (options.raw) {
     logFile = rawLog;
@@ -657,9 +675,11 @@ function followLogs(laneDir: string, options: LogsOptions): void {
   
   let lastSize = 0;
   try {
-    lastSize = fs.existsSync(logFile) ? fs.statSync(logFile).size : 0;
+    // Use statSync directly to avoid TOCTOU race condition
+    lastSize = fs.statSync(logFile).size;
   } catch {
-    // Ignore
+    // File doesn't exist yet or other error - start from 0
+    lastSize = 0;
   }
   
   console.log(`${logger.COLORS.cyan}Following ${logFile}... (Ctrl+C to stop)${logger.COLORS.reset}\n`);
@@ -677,11 +697,11 @@ function followLogs(laneDir: string, options: LogsOptions): void {
         
         let content = buffer.toString();
         
-        // Apply filter
+        // Apply filter (case-insensitive string match to avoid ReDoS)
         if (options.filter) {
-          const regex = new RegExp(options.filter, 'i');
+          const filterLower = options.filter.toLowerCase();
           const lines = content.split('\n');
-          content = lines.filter(line => regex.test(line)).join('\n');
+          content = lines.filter(line => line.toLowerCase().includes(filterLower)).join('\n');
         }
         
         // Clean ANSI if needed (unless raw mode)
@@ -724,11 +744,11 @@ function displaySummary(runDir: string): void {
   }
   
   for (const lane of lanes) {
-    const laneDir = path.join(runDir, 'lanes', lane);
-    const cleanLog = path.join(laneDir, 'terminal.log');
-    const rawLog = path.join(laneDir, 'terminal-raw.log');
-    const jsonLog = path.join(laneDir, 'terminal.jsonl');
-    const readableLog = path.join(laneDir, 'terminal-readable.log');
+    const laneDir = safeJoin(runDir, 'lanes', lane);
+    const cleanLog = safeJoin(laneDir, 'terminal.log');
+    const rawLog = safeJoin(laneDir, 'terminal-raw.log');
+    const jsonLog = safeJoin(laneDir, 'terminal.jsonl');
+    const readableLog = safeJoin(laneDir, 'terminal-readable.log');
     
     console.log(`  ${logger.COLORS.green}📁 ${lane}${logger.COLORS.reset}`);
     
@@ -829,7 +849,7 @@ async function logs(args: string[]): Promise<void> {
   }
   
   // Find lane directory
-  const laneDir = path.join(runDir, 'lanes', options.lane);
+  const laneDir = safeJoin(runDir, 'lanes', options.lane);
   if (!fs.existsSync(laneDir)) {
     const lanes = listLanes(runDir);
     throw new Error(`Lane not found: ${options.lane}\nAvailable lanes: ${lanes.join(', ')}`);

package/src/cli/monitor.ts

@@ -9,6 +9,7 @@ import * as logger from '../utils/logger';
 import { loadState, readLog } from '../utils/state';
 import { LaneState, ConversationEntry } from '../utils/types';
 import { loadConfig } from '../utils/config';
+import { safeJoin } from '../utils/path';
 
 interface LaneWithDeps {
   name: string;
@@ -339,11 +340,11 @@ class InteractiveMonitor {
     if (!lane) return;
 
     try {
-      const interventionPath = path.join(lane.path, 'intervention.txt');
+      const interventionPath = safeJoin(lane.path, 'intervention.txt');
       fs.writeFileSync(interventionPath, message, 'utf8');
 
       // Also log it to the conversation
-      const convoPath = path.join(lane.path, 'conversation.jsonl');
+      const convoPath = safeJoin(lane.path, 'conversation.jsonl');
       const entry = {
         timestamp: new Date().toISOString(),
         role: 'user',
@@ -372,7 +373,7 @@ class InteractiveMonitor {
         return;
       }
 
-      const timeoutPath = path.join(lane.path, 'timeout.txt');
+      const timeoutPath = safeJoin(lane.path, 'timeout.txt');
       fs.writeFileSync(timeoutPath, String(timeoutMs), 'utf8');
       
       this.showNotification(`Timeout updated to ${Math.round(timeoutMs/1000)}s`, 'success');
@@ -385,7 +386,7 @@ class InteractiveMonitor {
     if (!this.selectedLaneName) return;
     const lane = this.lanes.find(l => l.name === this.selectedLaneName);
     if (!lane) return;
-    const convoPath = path.join(lane.path, 'conversation.jsonl');
+    const convoPath = safeJoin(lane.path, 'conversation.jsonl');
     this.currentLogs = readLog<ConversationEntry>(convoPath);
     // Keep selection in bounds after refresh
     if (this.selectedMessageIndex >= this.currentLogs.length) {
@@ -505,8 +506,12 @@ class InteractiveMonitor {
           nextAction = '🏁 Done';
         }
       } else if (status.status === 'waiting') {
-        const missingDeps = status.dependsOn.filter((d: string) => laneStatuses[d] && laneStatuses[d].status !== 'completed');
-        nextAction = `Wait for: ${missingDeps.join(', ')}`;
+        if (status.waitingFor && status.waitingFor.length > 0) {
+          nextAction = `Wait for task: ${status.waitingFor.join(', ')}`;
+        } else {
+          const missingDeps = status.dependsOn.filter((d: string) => laneStatuses[d] && laneStatuses[d].status !== 'completed');
+          nextAction = `Wait for lane: ${missingDeps.join(', ')}`;
+        }
       } else if (status.status === 'running') {
         nextAction = '🚀 Working...';
       }
@@ -533,7 +538,7 @@ class InteractiveMonitor {
     }
 
     const status = this.getLaneStatus(lane.path, lane.name);
-    const logPath = path.join(lane.path, 'terminal.log');
+    const logPath = safeJoin(lane.path, 'terminal.log');
     let liveLog = '(No live terminal output)';
     if (fs.existsSync(logPath)) {
       const content = fs.readFileSync(logPath, 'utf8');
@@ -553,6 +558,10 @@ class InteractiveMonitor {
     process.stdout.write(`  Chat ID:   ${status.chatId}\n`);
     process.stdout.write(`  Depends:   ${status.dependsOn.join(', ') || 'None'}\n`);
     
+    if (status.waitingFor && status.waitingFor.length > 0) {
+      process.stdout.write(`\x1b[33m  Wait For:  ${status.waitingFor.join(', ')}\x1b[0m\n`);
+    }
+    
     if (status.error) {
       process.stdout.write(`\x1b[31m  Error:     ${status.error}\x1b[0m\n`);
     }
@@ -672,7 +681,7 @@ class InteractiveMonitor {
       return;
     }
 
-    const logPath = path.join(lane.path, 'terminal.log');
+    const logPath = safeJoin(lane.path, 'terminal.log');
     let logLines: string[] = [];
     if (fs.existsSync(logPath)) {
       const content = fs.readFileSync(logPath, 'utf8');
@@ -753,21 +762,21 @@ class InteractiveMonitor {
   }
 
   private listLanesWithDeps(runDir: string): LaneWithDeps[] {
-    const lanesDir = path.join(runDir, 'lanes');
+    const lanesDir = safeJoin(runDir, 'lanes');
     if (!fs.existsSync(lanesDir)) return [];
     
     const config = loadConfig();
-    const tasksDir = path.join(config.projectRoot, config.tasksDir);
+    const tasksDir = safeJoin(config.projectRoot, config.tasksDir);
     
     const laneConfigs = this.listLaneFilesFromDir(tasksDir);
     
     return fs.readdirSync(lanesDir)
-      .filter(d => fs.statSync(path.join(lanesDir, d)).isDirectory())
+      .filter(d => fs.statSync(safeJoin(lanesDir, d)).isDirectory())
       .map(name => {
         const config = laneConfigs.find(c => c.name === name);
         return {
           name,
-          path: path.join(lanesDir, name),
+          path: safeJoin(lanesDir, name),
           dependsOn: config?.dependsOn || [],
         };
       });
@@ -778,7 +787,7 @@ class InteractiveMonitor {
     return fs.readdirSync(tasksDir)
       .filter(f => f.endsWith('.json'))
       .map(f => {
-        const filePath = path.join(tasksDir, f);
+        const filePath = safeJoin(tasksDir, f);
         try {
           const config = JSON.parse(fs.readFileSync(filePath, 'utf8'));
           return { name: path.basename(f, '.json'), dependsOn: config.dependsOn || [] };
@@ -789,7 +798,7 @@ class InteractiveMonitor {
   }
 
   private getLaneStatus(lanePath: string, laneName: string) {
-    const statePath = path.join(lanePath, 'state.json');
+    const statePath = safeJoin(lanePath, 'state.json');
     const state = loadState<LaneState & { chatId?: string }>(statePath);
     
     const laneInfo = this.lanes.find(l => l.name === laneName);
@@ -815,9 +824,10 @@ class InteractiveMonitor {
       dependsOn,
       duration,
       error: state.error,
-      pid: state.pid
+      pid: state.pid,
+      waitingFor: state.waitingFor || [],
     };
-  }
+}
 
   private formatDuration(ms: number): string {
     if (ms <= 0) return '-';
@@ -848,11 +858,11 @@ class InteractiveMonitor {
  * Find the latest run directory
  */
 function findLatestRunDir(logsDir: string): string | null {
-  const runsDir = path.join(logsDir, 'runs');
+  const runsDir = safeJoin(logsDir, 'runs');
   if (!fs.existsSync(runsDir)) return null;
   const runs = fs.readdirSync(runsDir)
     .filter(d => d.startsWith('run-'))
-    .map(d => ({ name: d, path: path.join(runsDir, d), mtime: fs.statSync(path.join(runsDir, d)).mtime.getTime() }))
+    .map(d => ({ name: d, path: safeJoin(runsDir, d), mtime: fs.statSync(safeJoin(runsDir, d)).mtime.getTime() }))
     .sort((a, b) => b.mtime - a.mtime);
   return runs.length > 0 ? runs[0]!.path : null;
 }