@natjswenson/devlog 0.1.5 → 0.1.6

package/SKILL.md

@@ -47,6 +47,25 @@ If the file does not exist or cannot be parsed, stop and tell the user:
 
 Validate that `targetRepo`, `gitAuthor`, `githubUser`, and `projects` (non-empty array) are all present. Each project must have `key`, `path`, and `remote`.
 
+### Step 0.5: SECURITY — validate config values before using them in shell commands
+
+**Critical:** every value below gets interpolated into shell commands. If any value contains shell metacharacters or breaks the expected shape, **STOP** and tell the user their config is malformed. Do not "fix" it — refuse to run.
+
+| Field | Required pattern |
+|---|---|
+| `targetRepo` | Matches `^[a-zA-Z0-9][a-zA-Z0-9._-]*\/[a-zA-Z0-9][a-zA-Z0-9._-]*$` (owner/repo, no leading dash) |
+| `branch` (optional) | Matches `^[a-zA-Z0-9][a-zA-Z0-9._/-]*$` (no leading dash, no `..`); defaults to `main` |
+| `gitAuthor` | Must NOT contain any of: `;` `&` `|` `` ` `` `$` `(` `)` `<` `>` `{` `}` `*` `?` `!` `#` `~` `"` `\` newline, carriage return |
+| `githubUser` | Matches `^[a-zA-Z0-9][a-zA-Z0-9-]*$` |
+| `projects[].key` | Matches `^[a-zA-Z0-9][a-zA-Z0-9._-]*$` AND must not contain `..` |
+| `projects[].path` | Must NOT contain shell metacharacters (same set as gitAuthor) AND must point to an existing directory |
+| `projects[].remote` | Same pattern as `targetRepo` |
+
+If any field fails validation, stop with:
+> Config field `<field>` failed security validation: `<value>`. Edit `~/.claude/skills/devlog/config.json` and retry.
+
+Once validated, the values are safe to interpolate into the shell commands below. Even so, **prefer `git -C <path>` form over `cd <path> && git ...`** (reduces shell-escape complexity) and **use the Write tool, not bash heredocs, when writing JSON or markdown files** (avoids accidentally re-injecting attacker-controlled content into shell).
+
 ## Step 1: Determine scope
 
 - If the user passed a project argument (e.g. `/devlog myproject`), filter `projects` to that one. If the key is not in the registry, list available keys and stop.
@@ -54,10 +73,10 @@ Validate that `targetRepo`, `gitAuthor`, `githubUser`, and `projects` (non-empty
 
 ## Step 2: Gather today's commits
 
-For each project in scope, run:
+For each project in scope, run (use `git -C` to avoid `cd` shell-composition):
 
 ```bash
-cd <project.path> && git log --author="<config.gitAuthor>" --since="midnight" --format="%H|%s|%D" --all
+git -C <project.path> log --author=<config.gitAuthor> --since=midnight --format=%H|%s|%D --all
 ```
 
 If no commits are found for a project, skip it. If no commits are found across all projects, inform the user and stop.
@@ -67,8 +86,8 @@ If no commits are found for a project, skip it. If no commits are found across a
 For each commit, check if it's on the `main` branch and if the remote is public:
 
 ```bash
-cd <project.path> && git remote get-url origin
-git branch --contains <hash> -r 2>/dev/null | grep -q 'origin/main'
+git -C <project.path> remote get-url origin
+git -C <project.path> branch --contains <hash> -r 2>/dev/null | grep -q 'origin/main'
 ```
 
 - If the remote URL matches `<project.remote>` (i.e. `github.com/<project.remote>` or the SSH equivalent) and the commit is on `origin/main`, it's a public commit — include a link using `https://github.com/<project.remote>/commit/<hash>`.
@@ -125,33 +144,38 @@ gh api repos/<config.targetRepo>/contents/<project.key>/YYYY-MM-DD.md --jq '.con
 
 ## Step 6: Push to GitHub
 
-Clone the repo once, write all project entries, then push:
+Clone the repo once, write all project entries, then push.
+
+**Important:** Claude Code's bash tool runs each invocation in a fresh shell — variables don't persist across calls. Use a single temp path you compute once and pass as an absolute path to every subsequent command. Do NOT rely on `$TMPDIR` or any other shell variable surviving between bash calls.
+
+```bash
+# Step 6.1: create temp dir, capture absolute path (use this exact path
+# in every subsequent command — do not reference $TMPDIR after this call)
+mktemp -d
+# → record the printed path, e.g. /var/folders/.../tmp.abc123
+
+# Step 6.2: clone (use --depth=1 to limit blast radius if remote is huge)
+git -C <abs-tmp-path> clone --depth=1 https://github.com/<config.targetRepo>.git
+```
+
+Write entries and manifest using the **Write tool** (not bash heredocs — avoids re-injecting content into shell):
+
+- For each project with commits:
+  - Path: `<abs-tmp-path>/<repo-name>/<project.key>/YYYY-MM-DD.md`
+  - Path: `<abs-tmp-path>/<repo-name>/<project.key>/manifest.json` — read with the Read tool, mutate the entries array (newest first), write back
+  - Entry object: `{ "date": "YYYY-MM-DD", "file": "YYYY-MM-DD.md", "title": "...", "summary": "..." }`
+  - If appending to existing entry, update title/summary only if changed
+  - If manifest doesn't exist, create it as `{ "entries": [...] }`
+
+Then commit and push:
 
 ```bash
-# Clone to temp directory
-TMPDIR=$(mktemp -d)
-cd "$TMPDIR"
-git clone https://github.com/<config.targetRepo>.git
-cd $(basename <config.targetRepo>)
-
-# For each project with commits:
-# - Create directory if needed: mkdir -p <project.key>/
-# - Write the entry file to <project.key>/YYYY-MM-DD.md
-# - Update <project.key>/manifest.json
-#   - Read manifest, add/update entry in entries array (newest first)
-#   - Entry object: { "date": "YYYY-MM-DD", "file": "YYYY-MM-DD.md", "title": "...", "summary": "..." }
-#   - If appending to existing entry, update title/summary only if changed
-#   - If manifest doesn't exist, create it as { "entries": [...] }
-
-# Stage all changed project directories
-git add .
-
-# Single commit covering all projects
-git commit -m "devlog: add entries for YYYY-MM-DD"
-git push origin <config.branch || 'main'>
-
-# Cleanup
-rm -rf "$TMPDIR"
+git -C <abs-tmp-path>/<repo-name> add .
+git -C <abs-tmp-path>/<repo-name> commit -m "devlog: add entries for YYYY-MM-DD"
+git -C <abs-tmp-path>/<repo-name> push origin <config.branch || 'main'>
+
+# Cleanup — pass the absolute path explicitly
+rm -rf <abs-tmp-path>
 ```
 
 ## Step 7: Confirm

package/bin/devlog.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { spawn, execSync } from 'node:child_process';
+import { spawn, spawnSync, execSync } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join, resolve, basename } from 'node:path';
@@ -8,6 +8,8 @@ import { createRequire } from 'node:module';
 import prompts from 'prompts';
 import kleur from 'kleur';
 
+const SHELL_METACHARS = /[;&|`$()<>{}*?!#~"\\\n\r]/;
+
 const require = createRequire(import.meta.url);
 const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const SKILL_SRC = join(PACKAGE_ROOT, 'SKILL.md');
@@ -29,6 +31,8 @@ function readPackageVersion() {
   return pkg.version;
 }
 
+// Runs a hardcoded shell command (no user input). Use tryExecArgs for any
+// command whose arguments include user-supplied values.
 function tryExec(cmd) {
   try {
     return execSync(cmd, { stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf8' }).trim();
@@ -37,6 +41,17 @@ function tryExec(cmd) {
   }
 }
 
+// argv-style invocation; no shell, so user-supplied args cannot inject.
+function tryExecArgs(cmd, args) {
+  try {
+    const r = spawnSync(cmd, args, { stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf8' });
+    if (r.status !== 0) return null;
+    return (r.stdout || '').trim();
+  } catch {
+    return null;
+  }
+}
+
 function expandHome(p) {
   if (!p) return p;
   if (p === '~') return homedir();
@@ -76,7 +91,7 @@ function detectGitName() {
 }
 
 function detectProjectRemote(path) {
-  const url = tryExec(`git -C "${path}" remote get-url origin`);
+  const url = tryExecArgs('git', ['-C', path, 'remote', 'get-url', 'origin']);
   if (!url) return null;
   const m = url.match(/[:/]([^/:]+\/[^/]+?)(?:\.git)?$/);
   return m ? m[1] : null;
@@ -109,21 +124,25 @@ async function cmdInit() {
       name: 'gitAuthor',
       message: 'Your name (used to filter `git log --author`):',
       initial: defaults.gitAuthor,
-      validate: (v) => v.trim().length > 0 || 'Required',
+      validate: (v) => {
+        if (v.trim().length === 0) return 'Required';
+        if (SHELL_METACHARS.test(v)) return 'Invalid characters (no quotes, backticks, or shell metacharacters)';
+        return true;
+      },
     },
     {
       type: 'text',
       name: 'githubUser',
       message: 'Your GitHub username:',
       initial: defaults.githubUser,
-      validate: (v) => /^[a-z0-9-]+$/i.test(v.trim()) || 'Invalid username',
+      validate: (v) => /^[a-z0-9][a-z0-9-]*$/i.test(v.trim()) || 'Invalid username (must start with letter/digit, alphanumeric + hyphens only)',
     },
     {
       type: 'text',
       name: 'targetRepoName',
       message: 'Name of the repo where dev logs will be published:',
       initial: defaults.targetRepoName,
-      validate: (v) => /^[a-z0-9._-]+$/i.test(v.trim()) || 'Invalid repo name',
+      validate: (v) => /^[a-z0-9][a-z0-9._-]*$/i.test(v.trim()) || 'Invalid repo name (must start with letter/digit, no leading dash)',
     },
     {
       type: 'confirm',
@@ -143,21 +162,29 @@ async function cmdInit() {
         name: 'path',
         message: 'Project absolute path:',
         initial: cwd,
-        validate: (v) => existsSync(expandHome(v)) || 'Path does not exist',
+        validate: (v) => {
+          if (SHELL_METACHARS.test(v)) return 'Invalid characters (no quotes, backticks, or shell metacharacters)';
+          return existsSync(expandHome(v)) || 'Path does not exist';
+        },
       },
       {
         type: 'text',
         name: 'key',
         message: 'Project key (used as dev-log subdir name):',
         initial: (prev) => basename(expandHome(prev || cwd)),
-        validate: (v) => /^[a-z0-9._-]+$/i.test(v.trim()) || 'Invalid key',
+        validate: (v) => {
+          const t = v.trim();
+          if (!/^[a-z0-9][a-z0-9._-]*$/i.test(t)) return 'Invalid key (must start with letter/digit, alphanumeric + ._- only)';
+          if (t.includes('..')) return 'Invalid key (no `..`)';
+          return true;
+        },
       },
       {
         type: 'text',
         name: 'remote',
         message: 'Project GitHub remote (<owner>/<repo>):',
         initial: (_prev, values) => detectProjectRemote(expandHome(values.path)) || cwdRemote || `${answers.githubUser}/${basename(expandHome(values.path))}`,
-        validate: (v) => /^[\w.-]+\/[\w.-]+$/.test(v.trim()) || 'Expected <owner>/<repo>',
+        validate: (v) => /^[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*$/i.test(v.trim()) || 'Expected <owner>/<repo>, no leading dash',
       },
     ], { onCancel: () => process.exit(1) });
   }
@@ -191,20 +218,19 @@ async function cmdInit() {
 
   log.info('');
 
-  const repoExists = tryExec(`gh repo view ${targetRepo} --json name`) !== null;
+  const repoExists = tryExecArgs('gh', ['repo', 'view', targetRepo, '--json', 'name']) !== null;
   if (repoExists) {
     log.warn(`Repo github.com/${targetRepo} already exists. Will use it as-is.`);
   } else {
     log.step(`Creating github.com/${targetRepo}...`);
-    try {
-      execSync(`gh repo create ${targetRepo} --public --description "Daily dev log" --add-readme`, {
-        stdio: 'inherit',
-      });
-      log.ok('Repo created');
-    } catch {
+    const r = spawnSync('gh', ['repo', 'create', targetRepo, '--public', '--description', 'Daily dev log', '--add-readme'], {
+      stdio: 'inherit',
+    });
+    if (r.status !== 0) {
       log.err('Failed to create repo. Check `gh` permissions.');
       process.exit(1);
     }
+    log.ok('Repo created');
   }
 
   if (!existsSync(CONFIG_DIR)) {

package/examples/react/DevLogPage.jsx

@@ -8,8 +8,12 @@ import './DevLogPage.css';
 const ENTRIES_PER_PAGE = 10;
 
 function formatDate(dateStr) {
-  const [year, month, day] = dateStr.split('-');
-  const date = new Date(year, month - 1, day);
+  if (typeof dateStr !== 'string') return '';
+  const parts = dateStr.split('-');
+  if (parts.length !== 3) return '';
+  const [year, month, day] = parts;
+  const date = new Date(Number(year), Number(month) - 1, Number(day));
+  if (isNaN(date.getTime())) return '';
   return date.toLocaleDateString('en-US', {
     month: 'short',
     day: 'numeric',

package/examples/react/useDevLogEntries.js

@@ -1,24 +1,44 @@
 import { useState, useEffect, useRef, useCallback, useMemo } from 'react';
 import { DEVLOG_CONFIG as DEFAULT_CONFIG } from './devlog-config.js';
 
+// Allowlist of frontmatter keys we recognize. Anything else is ignored —
+// prevents prototype-pollution via crafted keys like `__proto__`.
+const FRONTMATTER_KEYS = new Set(['title', 'date', 'project', 'summary']);
+
 /**
  * Parse YAML-ish frontmatter from a markdown string.
  * Returns { metadata: { title, date, project, summary }, body: string }
  */
 function parseFrontmatter(raw) {
   const match = raw.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/);
-  if (!match) return { metadata: {}, body: raw };
-
-  const frontmatter = match[1];
-  const body = match[2];
-  const metadata = {};
+  // Use Object.create(null) so the returned object has no prototype chain.
+  const metadata = Object.create(null);
+  if (!match) return { metadata, body: raw };
 
-  for (const line of frontmatter.split('\n')) {
+  for (const line of match[1].split('\n')) {
     const m = line.match(/^(\w+)\s*:\s*"?([^"]*)"?\s*$/);
-    if (m) metadata[m[1]] = m[2].trim();
+    if (m && FRONTMATTER_KEYS.has(m[1])) metadata[m[1]] = m[2].trim();
   }
 
-  return { metadata, body };
+  return { metadata, body: match[2] };
+}
+
+// Schema validation for fetched manifest. Reject anything that isn't shaped
+// like { entries: [{ date, file, title, summary }, ...] } so a hostile commit
+// to the dev-log repo can't crash the page.
+function validateManifest(data) {
+  if (!data || typeof data !== 'object') return null;
+  if (!Array.isArray(data.entries)) return null;
+  const entries = [];
+  for (const e of data.entries) {
+    if (!e || typeof e !== 'object') continue;
+    const { date, file, title, summary } = e;
+    if (typeof date !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(date)) continue;
+    if (typeof file !== 'string' || !/^[a-zA-Z0-9._-]+\.md$/.test(file)) continue;
+    if (typeof title !== 'string' || typeof summary !== 'string') continue;
+    entries.push({ date, file, title, summary });
+  }
+  return { entries };
 }
 
 /**
@@ -51,7 +71,9 @@ export function useDevLogEntries(project, configOverride) {
     setError(null);
 
     try {
-      const url = `${config.baseUrl}/${project}/manifest.json`;
+      // Encode project key to neutralize any path-traversal characters
+      // (the project key is allowlisted upstream, but defense-in-depth).
+      const url = `${config.baseUrl}/${encodeURIComponent(project)}/manifest.json`;
       const res = await fetch(url);
       if (!res.ok) {
         if (res.status === 404) {
@@ -61,7 +83,9 @@ export function useDevLogEntries(project, configOverride) {
         throw new Error(`Failed to fetch manifest (${res.status})`);
       }
       const data = await res.json();
-      setEntries(data.entries || []);
+      const validated = validateManifest(data);
+      if (!validated) throw new Error('Manifest failed schema validation');
+      setEntries(validated.entries);
     } catch (err) {
       setError(err.message);
     } finally {
@@ -76,8 +100,15 @@ export function useDevLogEntries(project, configOverride) {
   const fetchEntryContent = useCallback(async (filename) => {
     if (contentCache.current.has(filename)) return;
 
+    // Final filename gate (manifest validation already enforces the same
+    // pattern — keep this here so any consumer calling fetchEntryContent
+    // directly is also protected).
+    if (typeof filename !== 'string' || !/^[a-zA-Z0-9._-]+\.md$/.test(filename)) {
+      return;
+    }
+
     try {
-      const url = `${config.baseUrl}/${project}/${filename}`;
+      const url = `${config.baseUrl}/${encodeURIComponent(project)}/${filename}`;
       const res = await fetch(url);
       if (!res.ok) throw new Error(`Failed to fetch entry (${res.status})`);
       const raw = await res.text();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@natjswenson/devlog",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Daily dev log generator — Claude Code skill + preview app for publishing git-based dev logs to your site",
   "license": "MIT",
   "author": "Nate Swenson",

package/preview/App.jsx

@@ -11,7 +11,18 @@ const isDemo = !owner || !repo;
 
 let realProjects = [];
 try {
-  realProjects = projectsRaw ? JSON.parse(projectsRaw) : [];
+  const parsed = projectsRaw ? JSON.parse(projectsRaw) : [];
+  // Schema-validate: must be array of {key, label?} where key matches a safe
+  // allowlist. Anything else gets dropped silently.
+  if (Array.isArray(parsed)) {
+    for (const p of parsed) {
+      if (!p || typeof p !== 'object') continue;
+      if (typeof p.key !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(p.key)) continue;
+      if (p.key.includes('..')) continue;
+      const label = typeof p.label === 'string' ? p.label : p.key;
+      realProjects.push({ key: p.key, label });
+    }
+  }
 } catch {
   realProjects = [];
 }

package/preview/main.jsx

@@ -4,7 +4,10 @@ import App from './App.jsx';
 import { installDemoFetch } from './demo.js';
 import './preview.css';
 
-if (!import.meta.env.VITE_DEVLOG_OWNER || !import.meta.env.VITE_DEVLOG_REPO) {
+// Gate the global window.fetch override behind DEV. In production builds
+// (e.g. when adopters deploy the preview directory standalone), demo content
+// must NOT silently intercept fetches — show the empty-state UX instead.
+if (import.meta.env.DEV && (!import.meta.env.VITE_DEVLOG_OWNER || !import.meta.env.VITE_DEVLOG_REPO)) {
   installDemoFetch();
 }
 

package/preview/vite.config.js

@@ -19,8 +19,16 @@ export default defineConfig({
       'style-to-js',
     ],
   },
+  // Bind preview server to localhost only — the dev server has no auth and
+  // serves transformed source modules. Don't expose it to LAN by default.
+  // (npm audit flags moderate CVEs in dev-server CORS handling for any
+  // deployment that allows cross-origin reads; localhost-binding is
+  // defense-in-depth on top of vite's own patches.)
   server: {
+    host: 'localhost',
     port: 5173,
     open: true,
+    strictPort: false,
+    cors: false,
   },
 });