@mandujs/core 0.54.26 → 0.54.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mandujs/core",
-  "version": "0.54.26",
+  "version": "0.54.27",
   "description": "Mandu Framework Core - Spec, Generator, Guard, Runtime",
   "type": "module",
   "main": "./src/index.ts",

package/src/devtools/client/catchers/network-proxy.ts

@@ -56,6 +56,8 @@ const DEFAULT_OPTIONS: Required<NetworkProxyOptions> = {
   ignorePatterns: [
     // DevTools 자체 요청
     /__mandu/,
+    // DevTools 에러 리포트 엔드포인트 (자기추적/피드백 루프 방지)
+    /__kitchen/,
     // HMR
     /__vite/,
     /\.hot-update\./,

package/src/devtools/server/source-context.ts

@@ -174,11 +174,22 @@ export class SourceContextProvider {
    * 안전한 경로 확인 (Path Traversal 방지)
    */
   private resolveSafePath(file: string): string | null {
+    // Reject absolute inputs outright: path.resolve(root, "/etc/passwd")
+    // returns "/etc/passwd", escaping the project root.
+    if (path.isAbsolute(file)) {
+      return null;
+    }
+
     const absolutePath = path.resolve(this.options.projectRoot, file);
     const normalizedRoot = path.normalize(this.options.projectRoot);
-
-    // 확인된 경로가 프로젝트 루트 내에 있는지 확인
-    if (!absolutePath.startsWith(normalizedRoot)) {
+    // Compare with a trailing separator so a sibling sharing the root's
+    // prefix (e.g. "/app/project-secrets" vs root "/app/project") is NOT
+    // treated as inside the root. Allow the root itself.
+    const rootWithSep = normalizedRoot.endsWith(path.sep)
+      ? normalizedRoot
+      : normalizedRoot + path.sep;
+
+    if (absolutePath !== normalizedRoot && !absolutePath.startsWith(rootWithSep)) {
       return null;
     }
 

package/src/devtools/worker/worker-manager.ts

@@ -245,6 +245,8 @@ export class WorkerManager {
         { source: '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\\\.[a-zA-Z]{2,}', label: 'EMAIL' },
         { source: '\\\\+?[1-9]\\\\d{1,14}', label: 'PHONE' },
         { source: '\\\\b(?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\b', label: 'IP' },
+        { source: '\\\\b(?:\\\\d{4}[- ]?){3}\\\\d{4}\\\\b', label: 'CARD' },
+        { source: '\\\\b\\\\d{3}-\\\\d{2}-\\\\d{4}\\\\b', label: 'SSN' },
       ];
 
       function applyPattern(text, pattern) {