@nolto/cli 0.10.0 → 0.11.0

package/dist/index.js

@@ -546,11 +546,25 @@ function checkKeys(value, allowed, at, errors) {
     if (!allowed.has(key)) errors.push(`${at} contains unsupported property "${key}".`);
   }
 }
-function checkPlan(value, at, errors) {
-  if (value === void 0) return;
+function isValidPlanPath(value) {
+  if (typeof value !== "string" || value.length === 0) return false;
+  if (value.includes("\\") || value.startsWith("/") || /^[A-Za-z]:/.test(value)) return false;
+  return value.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
+}
+function validatePlanPath(value, at) {
   if (typeof value !== "string" || value.length === 0) {
-    errors.push(`${at}.plan must be a non-empty string.`);
+    return [`${at} must be a non-empty string.`];
+  }
+  if (!isValidPlanPath(value)) {
+    return [
+      `${at} must be a repository-relative path using '/' separators (no absolute paths, '\\', '.' or '..' segments).`
+    ];
   }
+  return [];
+}
+function checkPlan(value, at, errors) {
+  if (value === void 0) return;
+  errors.push(...validatePlanPath(value, `${at}.plan`));
 }
 function derivePhaseStatus(phase) {
   if (phase.tasks.length > 0 && phase.tasks.every((task) => task.status === "done")) return "done";
@@ -1671,7 +1685,7 @@ function register4(program, deps) {
 }
 
 // src/commands/sync.ts
-import { copyFile, mkdir as mkdir6, readFile as readFile6, readdir as readdir2, rename as rename2, rmdir, unlink as unlink2 } from "fs/promises";
+import { copyFile, mkdir as mkdir6, readFile as readFile6, readdir as readdir2, realpath, rename as rename2, rmdir, unlink as unlink2 } from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
 
 // src/sync-repo.ts
@@ -1726,11 +1740,31 @@ async function loadValidRoadmap(filePath, readFile12) {
 async function buildSyncBody(args) {
   const planDocuments = [];
   for (const ref of collectPlanRefs(args.roadmap)) {
-    const absolute = path10.join(args.repoRoot, ref.path);
+    const root = path10.resolve(args.repoRoot);
+    const absolute = path10.resolve(root, ref.path);
+    if (absolute !== root && !absolute.startsWith(root + path10.sep)) {
+      args.deps.warn(`plan path outside repository root, skipping: ${ref.path}`);
+      continue;
+    }
     if (!args.deps.fileExists(absolute)) {
       args.deps.warn(`plan file not found, skipping: ${ref.path}`);
       continue;
     }
+    if (args.deps.realpath !== void 0) {
+      let real;
+      let realRoot;
+      try {
+        real = await args.deps.realpath(absolute);
+        realRoot = await args.deps.realpath(root);
+      } catch {
+        args.deps.warn(`plan file not found, skipping: ${ref.path}`);
+        continue;
+      }
+      if (real !== realRoot && !real.startsWith(realRoot + path10.sep)) {
+        args.deps.warn(`symlink escapes repository root, skipping: ${ref.path}`);
+        continue;
+      }
+    }
     const content = await args.deps.readFile(absolute);
     planDocuments.push({
       path: ref.path,
@@ -1761,6 +1795,21 @@ async function runSync(args, deps) {
 
 // src/sync-repo.ts
 var ROADMAP_SLUG_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
+function collectContainedPlanAbsPaths(roadmaps, root, warn) {
+  const planAbsPaths = /* @__PURE__ */ new Set();
+  const resolvedRoot = path11.resolve(root);
+  for (const roadmap of roadmaps) {
+    for (const ref of collectPlanRefs(roadmap)) {
+      const absolute = path11.resolve(resolvedRoot, ref.path);
+      if (absolute !== resolvedRoot && !absolute.startsWith(resolvedRoot + path11.sep)) {
+        warn(`chokidar target outside repo, skipping: ${ref.path}`);
+        continue;
+      }
+      planAbsPaths.add(absolute);
+    }
+  }
+  return [...planAbsPaths];
+}
 async function listRoadmapFiles(roadmapsDir, io) {
   try {
     const entries = await io.listDir(roadmapsDir);
@@ -1841,23 +1890,29 @@ async function syncRepo(args, io) {
       return { slug, roadmap: await loadValidRoadmap(filePath, io.readFile) };
     })
   );
-  const planAbsPaths = /* @__PURE__ */ new Set();
-  for (const { roadmap } of roadmaps) {
-    for (const ref of collectPlanRefs(roadmap)) {
-      planAbsPaths.add(path11.join(args.root, ref.path));
-    }
-  }
+  const planAbsPaths = collectContainedPlanAbsPaths(
+    roadmaps.map(({ roadmap }) => roadmap),
+    args.root,
+    io.warn
+  );
   const results = [];
   const repoIdentity = await io.repoIdentity(args.root);
   for (const { slug, roadmap } of roadmaps) {
     results.push(
       await runSync(
         { repoRoot: args.root, projectId, slug, roadmap, repoIdentity },
-        { http: io.http, readFile: io.readFile, fileExists: io.fileExists, log: io.log, warn: io.warn }
+        {
+          http: io.http,
+          readFile: io.readFile,
+          fileExists: io.fileExists,
+          realpath: io.realpath,
+          log: io.log,
+          warn: io.warn
+        }
       )
     );
   }
-  return { results, planAbsPaths: [...planAbsPaths] };
+  return { results, planAbsPaths };
 }
 
 // src/commands/sync.ts
@@ -1879,6 +1934,7 @@ function register5(program, deps) {
       { root, defaultProjectId: deps.settings.defaultProjectId, migrateLegacy: true },
       {
         readFile: (p) => readFile6(p, "utf8"),
+        realpath: (p) => realpath(p),
         fileExists: (p) => existsSync3(p),
         listDir: (p) => readdir2(p),
         rename: rename2,
@@ -2444,7 +2500,7 @@ function register7(program, deps) {
 }
 
 // src/commands/watch.ts
-import { copyFile as copyFile2, mkdir as mkdir8, readFile as readFile9, readdir as readdir4, rename as rename3, rmdir as rmdir2, unlink as unlink3 } from "fs/promises";
+import { copyFile as copyFile2, mkdir as mkdir8, readFile as readFile9, readdir as readdir4, realpath as realpath2, rename as rename3, rmdir as rmdir2, unlink as unlink3 } from "fs/promises";
 import { existsSync as existsSync4 } from "fs";
 import path16 from "path";
 import chokidar from "chokidar";
@@ -2736,6 +2792,7 @@ function register8(program, deps) {
           { root, defaultProjectId: deps.settings.defaultProjectId, migrateLegacy: false },
           {
             readFile: (p) => readFile9(p, "utf8"),
+            realpath: (p) => realpath2(p),
             fileExists: (p) => existsSync4(p),
             listDir: (p) => readdir4(p),
             rename: rename3,
@@ -2810,7 +2867,7 @@ function register8(program, deps) {
 // src/update-cli.ts
 import { execFile as execFile3 } from "child_process";
 import { existsSync as existsSync5 } from "fs";
-import { realpath } from "fs/promises";
+import { realpath as realpath3 } from "fs/promises";
 import { createRequire as createRequire2 } from "module";
 import path18 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
@@ -3038,7 +3095,7 @@ function getCurrentVersion() {
 }
 async function updateCli(opts = {}) {
   const execFileAsync = promisify2(execFile3);
-  const scriptPath = await realpath(process.argv[1] ?? "");
+  const scriptPath = await realpath3(process.argv[1] ?? "");
   return updateCliWith({
     currentVersion: getCurrentVersion(),
     scriptPath,
@@ -3059,7 +3116,7 @@ async function updateCli(opts = {}) {
         };
       }
     },
-    realpath,
+    realpath: realpath3,
     fetchLatest: () => fetchLatestFromRegistry(UPDATE_REQUEST_TIMEOUT_MS, UPDATE_FETCH_OPTIONS),
     writeCache: writeUpdateCache,
     unitExists: existsSync5,

package/dist/skill/roadmap-progress/references/schema.md

@@ -59,10 +59,10 @@ Use this reference when creating or structurally editing `.nolto/roadmaps/<slug>
 - `summary`: One or two current sentences; do not use as a changelog.
 - `phases`: Ordered delivery phases.
 - `phase.status`: `todo`, `in-progress`, `done`, or `blocked`.
-- `phase.plan`: Optional repository-relative path to a markdown plan document.
+- `phase.plan`: Optional repository-relative path (`/`-separated) to a Markdown plan document, for example `docs/plans/auth.md`. Absolute paths, backslashes, and `.`/`..` segments are rejected.
 - `tasks`: Ordered work items. Each must be small enough to verify clearly.
 - `task.status`: `todo`, `in-progress`, `done`, or `blocked`.
-- `task.plan`: Optional repository-relative path to a markdown plan document.
+- `task.plan`: Optional repository-relative path (`/`-separated) to a Markdown plan document, for example `docs/plans/auth.md`. Absolute paths, backslashes, and `.`/`..` segments are rejected.
 - `startedAt`: Required in practice for `in-progress` tasks.
 - `completedAt`: Required in practice for `done` tasks.
 - `note`: Current implementation detail or blocker. Omit when it adds no value.

package/dist/skill/roadmap-progress/scripts/roadmap.mjs

@@ -10,6 +10,14 @@ const ALLOWED_KEYS = {
   phase: new Set(["id", "title", "status", "plan", "tasks"]),
   task: new Set(["id", "title", "status", "startedAt", "completedAt", "note", "dependsOn", "plan"])
 };
+const PLAN_PATH_ERROR = "plan --path must be a repository-relative path using '/' separators (no absolute paths, '\\', '.' or '..' segments).";
+
+// Keep in sync with packages/roadmap-schema/src/index.ts isValidPlanPath.
+function isValidPlanPath(value) {
+  if (typeof value !== "string" || value.length === 0) return false;
+  if (value.includes("\\") || value.startsWith("/") || /^[A-Za-z]:/.test(value)) return false;
+  return value.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
+}
 
 function parseArguments(argv) {
   const options = { file: null, note: undefined, summary: undefined, text: undefined, path: undefined, positional: [] };
@@ -258,15 +266,20 @@ try {
   } else if (command === "plan") {
     if (!taskId) throw new Error("plan requires a task id.");
     if (!options.path) throw new Error("plan requires --path <repo-relative-md-path>.");
+    if (!isValidPlanPath(options.path)) throw new Error(PLAN_PATH_ERROR);
+    const repoRoot = path.resolve(repoRootForRoadmap(filePath));
+    const resolvedPlanPath = path.resolve(repoRoot, options.path);
+    if (resolvedPlanPath !== repoRoot && !resolvedPlanPath.startsWith(repoRoot + path.sep)) {
+      throw new Error(PLAN_PATH_ERROR);
+    }
     const { task } = findTask(roadmap, taskId);
     task.plan = options.path;
     roadmap.schemaVersion = 2;
     roadmap.updatedAt = localIsoNow();
-    const repoRoot = repoRootForRoadmap(filePath);
     try {
-      await access(path.join(repoRoot, options.path));
+      await access(resolvedPlanPath);
     } catch {
-      console.warn(`WARN plan file not found at ${path.join(repoRoot, options.path)}`);
+      console.warn(`WARN plan file not found at ${resolvedPlanPath}`);
     }
     const result = validate(roadmap);
     if (result.errors.length) throw new Error(`Mutation failed validation: ${result.errors.join(" ")}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nolto/cli",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "CLI for syncing repository roadmaps with Nolto.",
   "license": "MIT",
   "type": "module",