@mulmoclaude/core 1.6.0 → 1.7.0

package/dist/{discovery-CKR4TOX3.js → discovery-_fjsluLx.js}

@@ -1,5 +1,5 @@
 import { t as writeFileAtomic } from "./atomic-DPpdrJzO.js";
-import { a as isSafeSlug, c as COMPUTED_TYPES, g as fieldTextOrNull, h as fieldText, i as isSafeRecordId, l as FEED_SCHEDULES, m as storageKindFor, n as SAFE_SLUG_PATTERN, p as isReadOnlySchema, s as AGENT_INGEST_KIND, t as SAFE_RECORD_ID_PATTERN, u as INGEST_KINDS } from "./ids-s4GfmE93.js";
+import { A as fieldTextOrNull, C as FEED_SCHEDULES, D as isReadOnlySchema, O as storageKindFor, S as COMPUTED_TYPES, g as SAFE_SLUG_PATTERN, h as SAFE_RECORD_ID_PATTERN, k as fieldText, v as isSafeRecordId, w as INGEST_KINDS, x as AGENT_INGEST_KIND, y as isSafeSlug } from "./calendarGrid-CrGxeCOG.js";
 import { t as projectRecordFields } from "./project-bU98ycsy.js";
 import { n as isSafeCustomViewI18nPath, r as isSafeCustomViewPath, t as isSafeActionTemplatePath } from "./templatePath-k_WNbL_Q.js";
 import { realpathSync, watch } from "node:fs";
@@ -305,6 +305,35 @@ async function readItem(dataDir, itemId, opts = {}) {
 		throw err;
 	}
 }
+/** The symlink-containment refusal every record path shares: one check, one
+*  warn, one answer. Extracted because this is a security RULE applied at
+*  three sites (write pre-mkdir, write post-mkdir, delete) — a fix to the
+*  check must not be able to land at only one of them.
+*
+*  `stage` names the call site so the warn stays as diagnosable as the three
+*  hand-written copies were.
+*
+*  Scope, stated explicitly because a reviewer asks every time: this catches
+*  a symlink that EXISTS when we look — `isContainedInRoot` realpaths the
+*  closest existing ancestor, so a pre-planted escape is refused. It does not
+*  and cannot close the check-then-use race, where an ancestor is swapped for
+*  a symlink between this call and the `mkdir` / `open` / `unlink` that
+*  follows. Closing that needs directory-handle I/O anchored at the workspace
+*  (`openat` + `O_NOFOLLOW`), which `node:fs` does not expose — it would mean
+*  a different I/O layer, not a tighter check here.
+*
+*  That race is deliberately outside this app's threat model: the process is
+*  loopback-bound and bearer-authed, so anyone able to swap directories inside
+*  the workspace is already the workspace owner — the same trust principal the
+*  writes belong to. Revisit if collections ever serve a lower-trust caller. */
+function escapesWorkspace(dataDir, workspaceRoot, itemId, stage) {
+	if (isContainedInRoot(dataDir, workspaceRoot)) return false;
+	log.warn("collections", `${stage} refused: dataDir escapes workspace via symlink`, {
+		dataDir,
+		itemId
+	});
+	return true;
+}
 /** Write a record. Ensures the directory exists, validates the id,
 *  re-checks symlink containment after mkdir, and writes atomically.
 *
@@ -326,27 +355,15 @@ async function writeItem(dataDir, itemId, item, opts = {}) {
 		itemId
 	};
 	const workspaceRoot = opts.workspaceRoot ?? getWorkspaceRoot();
-	if (!isContainedInRoot(dataDir, workspaceRoot)) {
-		log.warn("collections", "writeItem refused: dataDir escapes workspace via symlink (pre-mkdir)", {
-			dataDir,
-			itemId: safeId
-		});
-		return {
-			kind: "path-escape",
-			itemId: safeId
-		};
-	}
+	if (escapesWorkspace(dataDir, workspaceRoot, safeId, "writeItem (pre-mkdir)")) return {
+		kind: "path-escape",
+		itemId: safeId
+	};
 	await mkdir(dataDir, { recursive: true });
-	if (!isContainedInRoot(dataDir, workspaceRoot)) {
-		log.warn("collections", "writeItem refused: dataDir escapes workspace via symlink (post-mkdir)", {
-			dataDir,
-			itemId: safeId
-		});
-		return {
-			kind: "path-escape",
-			itemId: safeId
-		};
-	}
+	if (escapesWorkspace(dataDir, workspaceRoot, safeId, "writeItem (post-mkdir)")) return {
+		kind: "path-escape",
+		itemId: safeId
+	};
 	const filePath = itemFilePath(dataDir, safeId);
 	const payload = `${JSON.stringify(item, null, 2)}\n`;
 	if (opts.refuseOverwrite) {
@@ -383,16 +400,10 @@ async function deleteItem(dataDir, itemId, opts = {}) {
 		kind: "invalid-id",
 		itemId
 	};
-	if (!isContainedInRoot(dataDir, opts.workspaceRoot ?? getWorkspaceRoot())) {
-		log.warn("collections", "deleteItem refused: dataDir escapes workspace via symlink", {
-			dataDir,
-			itemId: safeId
-		});
-		return {
-			kind: "path-escape",
-			itemId: safeId
-		};
-	}
+	if (escapesWorkspace(dataDir, opts.workspaceRoot ?? getWorkspaceRoot(), safeId, "deleteItem")) return {
+		kind: "path-escape",
+		itemId: safeId
+	};
 	const filePath = itemFilePath(dataDir, safeId);
 	try {
 		await unlink(filePath);
@@ -2655,4 +2666,4 @@ function toDetail(collection) {
 //#endregion
 export { skillsStagingDir as $, deleteItem as A, itemFilePath as B, compileCsvQuery as C, MAX_QUERY_ROWS as D, DEFAULT_QUERY_ROWS as E, resolveCreateItemId as F, archiveDir as G, resolveTemplatePath as H, writeItem as I, getWorkspaceRoot as J, collectionsRegistriesConfigPath as K, SCHEMA_FILE as L, isRegularFile as M, listItems as N, BackendUnavailableError as O, readItem as P, setCollectionChangePublisher as Q, isContainedInRoot as R, queryCsv as S, CollectionQueryZ as T, safeRecordId as U, resolveDataDir as V, safeSlugName as W, log as X, isPresetSlug as Y, publishCollectionChange as Z, csvRowToItem as _, toDetail as a, encodeCsvRecordId as b, resolveMutateSet as c, storeFor as d, createForwardingLogger as et, checkpointSqliteDatabase as f, cacheDir as g, MAX_CSV_ROWS as h, resolvePrimaryField as i, generateItemId as j, isBackendUnavailable as k, collectionWritable as l, projectItemFields as m, discoverCollections as n, toSummary as o, pageFromFullRead as p, configureCollectionHost as q, loadCollection as r, CollectionSchemaZ as s, acceptParsedSchema as t, createHostSlot as tt, readOnlyRefusal as u, decodeCsvRecordId as v, compileJsonlQuery as w, normalizeCsvValue as x, dedupeByRecordId as y, isContainedInWorkspace as z };
 
-//# sourceMappingURL=discovery-CKR4TOX3.js.map
+//# sourceMappingURL=discovery-_fjsluLx.js.map