@nolto/cli 0.10.0 → 0.12.0

package/README.md

@@ -79,18 +79,25 @@ paths, and sends an idempotent full upsert to the bound project. A legacy
 `.roadmap/roadmap.json` is migrated by `nolto sync` when no canonical roadmap
 exists; `nolto watch` only warns and never migrates.
 
+Timestamp fields (`updatedAt`, `startedAt`, and `completedAt`) must be RFC 3339 with a timezone offset (`2026-09-02T10:00:00+09:00` or `2026-09-02T01:00:00Z`); offset-less and date-only values are rejected. `dependsOn` items must be unique strings matching `^[a-z0-9][a-z0-9._-]*$`, and names, titles, and IDs must be actual strings.
+
+The shared proxy rejects a sync request body over 10 MB with HTTP `413`. Free
+plan documents are already limited to 2 MB per roadmap before that shared cap.
+
 `watch` uses the repository registry maintained by `nolto init`. Missing registered
 repositories are skipped with a warning.
 The CLI warns when an installed `roadmap-progress` skill version differs from the
 CLI version; run `nolto init` in that repository to refresh it.
 
-Use `nolto diff [slug]` before pushing to review structural task, phase, and
-metadata differences. It exits with code 1 when differences are found and does
-not change either side. `nolto pull [slug]` downloads all server roadmaps, or one
-named roadmap, and intentionally overwrites the corresponding local files after
-validation. It never deletes local-only roadmaps. Add `--merge` to preserve valid
-local changes using a deterministic structural merge, and review the result with
-`git diff` before committing.
+Use `nolto diff [slug]` before pushing to compare task status changes, added or
+removed tasks and phases, and roadmap `updatedAt`, `currentTaskId`, and `summary`.
+It does not compare `title`, `note`, `plan`, `dependsOn`, project metadata, or
+ordering; use `git diff` for those. It exits with code 1 when differences are
+found and does not change either side. `nolto pull [slug]` downloads all server
+roadmaps, or one named roadmap, and intentionally overwrites the corresponding
+local files after validation. It never deletes local-only roadmaps. Add `--merge`
+to preserve valid local changes using a deterministic structural merge, and review
+the result with `git diff` before committing.
 
 ## Merging roadmap conflicts
 
@@ -109,6 +116,32 @@ again for an existing repository. Git invokes the underlying command as:
 nolto merge-file <ours> <theirs> --base <ancestor>
 ```
 
+### Silent resolution rules
+
+The merge driver emits no conflict markers and exits `0` unless the merged
+output fails validation, in which case it exits `1`. Resolution is deterministic:
+
+- For fields changed on both sides, the side with the newer `updatedAt` wins.
+- `currentTaskId` comes from the newer side while it still points to an
+  `in-progress` task; otherwise the older side's value is used if it still
+  points to an `in-progress` task, and it is omitted when neither does.
+- Task status priority is `done` (with `completedAt`) > `blocked` >
+  `in-progress` > `todo`.
+- `startedAt` keeps the earliest value, `completedAt` keeps the latest value,
+  and `dependsOn` is a deduplicated union.
+- A deletion is honored only when both sides deleted the item.
+- Phase order is ours first, followed by phases found only in theirs; phase
+  status is re-derived from the merged tasks.
+
+Full diff coverage and interactive conflict display are tracked in
+[#475](https://github.com/uruca-kk/nolto/issues/475).
+
+### Legacy roadmap schema v1
+
+Schema v1 remains accepted with a warning and has no sunset date. The next
+`roadmap-progress` mutation upgrades it to v2 automatically. This compatibility
+policy remains in place through CLI 1.0 and will be reconsidered then.
+
 The result is written to `<ours>` as required by Git. Use
 `nolto pull --merge [slug]` when the server has changes that should be combined
 with a valid local roadmap before syncing.
@@ -177,7 +210,7 @@ Errors are written to stderr:
 | 1 | Roadmap differences found (`nolto diff`) or unexpected command failure |
 | 2 | Local input or file validation error |
 | 3 | Authentication or authorization error |
-| 4 | Rate limit response |
+| 4 | Rate limit response, or plan / quota limit (HTTP 402) |
 | 5 | Network, DNS, or server error |
 
 ## License

package/dist/index.js

@@ -531,6 +531,7 @@ function normalizeRemote(raw) {
 // ../roadmap-schema/src/index.ts
 var STATUSES = /* @__PURE__ */ new Set(["todo", "in-progress", "done", "blocked"]);
 var ID_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
+var DATE_TIME_PATTERN = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:[Zz]|([+-])(\d{2}):(\d{2}))$/;
 var ALLOWED_KEYS = {
   roadmap: /* @__PURE__ */ new Set(["schemaVersion", "project", "updatedAt", "currentTaskId", "summary", "phases"]),
   project: /* @__PURE__ */ new Set(["id", "name", "repository"]),
@@ -546,11 +547,58 @@ function checkKeys(value, allowed, at, errors) {
     if (!allowed.has(key)) errors.push(`${at} contains unsupported property "${key}".`);
   }
 }
-function checkPlan(value, at, errors) {
-  if (value === void 0) return;
+function isValidPlanPath(value) {
+  if (typeof value !== "string" || value.length === 0) return false;
+  if (value.includes("\\") || value.startsWith("/") || /^[A-Za-z]:/.test(value)) return false;
+  return value.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
+}
+function daysInMonth(year, month) {
+  if (month === 2) {
+    const leap = year % 4 === 0 && year % 100 !== 0 || year % 400 === 0;
+    return leap ? 29 : 28;
+  }
+  return [4, 6, 9, 11].includes(month) ? 30 : 31;
+}
+function isValidDateTime(value) {
+  if (typeof value !== "string") return false;
+  const m = DATE_TIME_PATTERN.exec(value);
+  if (m === null) return false;
+  const year = Number(m[1]);
+  const month = Number(m[2]);
+  const day = Number(m[3]);
+  const hour = Number(m[4]);
+  const minute = Number(m[5]);
+  const second = Number(m[6]);
+  if (month < 1 || month > 12) return false;
+  if (day < 1 || day > daysInMonth(year, month)) return false;
+  if (hour > 23 || minute > 59 || second > 59) return false;
+  if (m[7] !== void 0) {
+    const offsetHour = Number(m[8]);
+    const offsetMinute = Number(m[9]);
+    if (offsetHour > 23 || offsetMinute > 59) return false;
+  }
+  return true;
+}
+function validateDateTime(value, at) {
+  if (!isValidDateTime(value)) {
+    return [`${at} must be an RFC 3339 date-time with timezone offset, e.g. 2026-09-02T10:00:00+09:00.`];
+  }
+  return [];
+}
+function validatePlanPath(value, at) {
   if (typeof value !== "string" || value.length === 0) {
-    errors.push(`${at}.plan must be a non-empty string.`);
+    return [`${at} must be a non-empty string.`];
+  }
+  if (!isValidPlanPath(value)) {
+    return [
+      `${at} must be a repository-relative path using '/' separators (no absolute paths, '\\', '.' or '..' segments).`
+    ];
   }
+  return [];
+}
+function checkPlan(value, at, errors) {
+  if (value === void 0) return;
+  errors.push(...validatePlanPath(value, `${at}.plan`));
 }
 function derivePhaseStatus(phase) {
   if (phase.tasks.length > 0 && phase.tasks.every((task) => task.status === "done")) return "done";
@@ -572,10 +620,10 @@ function validateRoadmap(value) {
   const project = value["project"];
   checkKeys(project, ALLOWED_KEYS.project, "project", errors);
   const projectRecord = isRecord(project) ? project : {};
-  if (!ID_PATTERN.test(String(projectRecord["id"] ?? ""))) errors.push("project.id is invalid.");
-  if (projectRecord["name"] == null || projectRecord["name"] === "") errors.push("project.name is required.");
-  if (projectRecord["repository"] == null || projectRecord["repository"] === "") errors.push("project.repository is required.");
-  if (Number.isNaN(Date.parse(String(value["updatedAt"])))) errors.push("updatedAt must be a valid date-time.");
+  if (typeof projectRecord["id"] !== "string" || !ID_PATTERN.test(projectRecord["id"])) errors.push("project.id is invalid.");
+  if (typeof projectRecord["name"] !== "string" || projectRecord["name"].length === 0) errors.push("project.name must be a non-empty string.");
+  if (typeof projectRecord["repository"] !== "string" || projectRecord["repository"].length === 0) errors.push("project.repository must be a non-empty string.");
+  errors.push(...validateDateTime(value["updatedAt"], "updatedAt"));
   if (typeof value["summary"] !== "string") errors.push("summary must be a string.");
   if (!Array.isArray(value["phases"])) errors.push("phases must be an array.");
   const allIds = /* @__PURE__ */ new Set();
@@ -585,11 +633,14 @@ function validateRoadmap(value) {
     const at = `phases[${phaseIndex}]`;
     checkKeys(rawPhase, ALLOWED_KEYS.phase, at, errors);
     const phase = isRecord(rawPhase) ? rawPhase : {};
-    const phaseId = String(phase["id"] ?? "");
-    if (!ID_PATTERN.test(phaseId)) errors.push(`${at}.id is invalid.`);
-    if (allIds.has(phaseId)) errors.push(`Duplicate id "${phaseId}".`);
-    allIds.add(phaseId);
-    if (phase["title"] == null || phase["title"] === "") errors.push(`${at}.title is required.`);
+    const phaseId = typeof phase["id"] === "string" ? phase["id"] : "";
+    if (typeof phase["id"] !== "string" || !ID_PATTERN.test(phase["id"])) {
+      errors.push(`${at}.id is invalid.`);
+    } else {
+      if (allIds.has(phaseId)) errors.push(`Duplicate id "${phaseId}".`);
+      allIds.add(phaseId);
+    }
+    if (typeof phase["title"] !== "string" || phase["title"].length === 0) errors.push(`${at}.title must be a non-empty string.`);
     if (!STATUSES.has(String(phase["status"]))) errors.push(`${at}.status is invalid.`);
     checkPlan(phase["plan"], at, errors);
     if (!Array.isArray(phase["tasks"])) errors.push(`${at}.tasks must be an array.`);
@@ -598,34 +649,64 @@ function validateRoadmap(value) {
       const taskAt = `${at}.tasks[${taskIndex}]`;
       checkKeys(rawTask, ALLOWED_KEYS.task, taskAt, errors);
       const task = isRecord(rawTask) ? rawTask : {};
-      const taskId = String(task["id"] ?? "");
-      if (!ID_PATTERN.test(taskId)) errors.push(`${taskAt}.id is invalid.`);
-      if (allIds.has(taskId)) errors.push(`Duplicate id "${taskId}".`);
-      allIds.add(taskId);
-      tasks.set(taskId, task);
-      if (task["title"] == null || task["title"] === "") errors.push(`${taskAt}.title is required.`);
+      const taskId = typeof task["id"] === "string" ? task["id"] : "";
+      if (typeof task["id"] !== "string" || !ID_PATTERN.test(task["id"])) {
+        errors.push(`${taskAt}.id is invalid.`);
+      } else {
+        if (allIds.has(taskId)) errors.push(`Duplicate id "${taskId}".`);
+        allIds.add(taskId);
+        tasks.set(taskId, task);
+      }
+      if (typeof task["title"] !== "string" || task["title"].length === 0) errors.push(`${taskAt}.title must be a non-empty string.`);
       if (!STATUSES.has(String(task["status"]))) errors.push(`${taskAt}.status is invalid.`);
       checkPlan(task["plan"], taskAt, errors);
+      if (task["startedAt"] !== void 0 && task["startedAt"] !== null) {
+        errors.push(...validateDateTime(task["startedAt"], `${taskAt}.startedAt`));
+      }
+      if (task["completedAt"] !== void 0 && task["completedAt"] !== null) {
+        errors.push(...validateDateTime(task["completedAt"], `${taskAt}.completedAt`));
+      }
       if (task["status"] === "done" && task["completedAt"] == null) warnings.push(`${taskId} is done without completedAt.`);
       if (task["status"] === "in-progress" && task["startedAt"] == null) warnings.push(`${taskId} is in-progress without startedAt.`);
-      if (task["dependsOn"] !== void 0 && !Array.isArray(task["dependsOn"])) errors.push(`${taskAt}.dependsOn must be an array.`);
+      if (task["dependsOn"] !== void 0 && !Array.isArray(task["dependsOn"])) {
+        errors.push(`${taskAt}.dependsOn must be an array.`);
+      } else if (Array.isArray(task["dependsOn"])) {
+        const seenDeps = /* @__PURE__ */ new Set();
+        for (const [i, dep] of task["dependsOn"].entries()) {
+          if (typeof dep !== "string") {
+            errors.push(`${taskAt}.dependsOn[${i}] must be a string.`);
+            continue;
+          }
+          if (!ID_PATTERN.test(dep)) {
+            errors.push(`${taskAt}.dependsOn[${i}] is invalid.`);
+            continue;
+          }
+          if (seenDeps.has(dep)) errors.push(`${taskAt}.dependsOn contains duplicate id "${dep}".`);
+          seenDeps.add(dep);
+        }
+      }
     }
-    if (Array.isArray(phase["tasks"]) && STATUSES.has(String(phase["status"]))) {
+    if (Array.isArray(phase["tasks"]) && rawTasks.every(isRecord) && STATUSES.has(String(phase["status"]))) {
       const expected = derivePhaseStatus({ ...phase, tasks: rawTasks });
       if (phase["status"] !== expected) warnings.push(`${phaseId} status is ${String(phase["status"])}; task states derive ${expected}.`);
     }
   }
   for (const task of tasks.values()) {
     for (const dependency of task.dependsOn ?? []) {
+      if (typeof dependency !== "string") continue;
       if (!tasks.has(dependency)) warnings.push(`${task.id} depends on unknown task ${dependency}.`);
       if (task.id === dependency) errors.push(`${task.id} cannot depend on itself.`);
     }
   }
   const currentTaskId = value["currentTaskId"];
   if (currentTaskId !== null && currentTaskId !== void 0) {
-    const current = tasks.get(String(currentTaskId));
-    if (current == null) errors.push(`currentTaskId ${String(currentTaskId)} does not exist.`);
-    else if (current.status !== "in-progress") warnings.push(`currentTaskId ${String(currentTaskId)} is not in-progress.`);
+    if (typeof currentTaskId !== "string") {
+      errors.push("currentTaskId must be a string id or null.");
+    } else {
+      const current = tasks.get(currentTaskId);
+      if (current == null) errors.push(`currentTaskId ${String(currentTaskId)} does not exist.`);
+      else if (current.status !== "in-progress") warnings.push(`currentTaskId ${String(currentTaskId)} is not in-progress.`);
+    }
   }
   return { errors, warnings };
 }
@@ -1671,7 +1752,7 @@ function register4(program, deps) {
 }
 
 // src/commands/sync.ts
-import { copyFile, mkdir as mkdir6, readFile as readFile6, readdir as readdir2, rename as rename2, rmdir, unlink as unlink2 } from "fs/promises";
+import { copyFile, mkdir as mkdir6, readFile as readFile6, readdir as readdir2, realpath, rename as rename2, rmdir, unlink as unlink2 } from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
 
 // src/sync-repo.ts
@@ -1726,11 +1807,31 @@ async function loadValidRoadmap(filePath, readFile12) {
 async function buildSyncBody(args) {
   const planDocuments = [];
   for (const ref of collectPlanRefs(args.roadmap)) {
-    const absolute = path10.join(args.repoRoot, ref.path);
+    const root = path10.resolve(args.repoRoot);
+    const absolute = path10.resolve(root, ref.path);
+    if (absolute !== root && !absolute.startsWith(root + path10.sep)) {
+      args.deps.warn(`plan path outside repository root, skipping: ${ref.path}`);
+      continue;
+    }
     if (!args.deps.fileExists(absolute)) {
       args.deps.warn(`plan file not found, skipping: ${ref.path}`);
       continue;
     }
+    if (args.deps.realpath !== void 0) {
+      let real;
+      let realRoot;
+      try {
+        real = await args.deps.realpath(absolute);
+        realRoot = await args.deps.realpath(root);
+      } catch {
+        args.deps.warn(`plan file not found, skipping: ${ref.path}`);
+        continue;
+      }
+      if (real !== realRoot && !real.startsWith(realRoot + path10.sep)) {
+        args.deps.warn(`symlink escapes repository root, skipping: ${ref.path}`);
+        continue;
+      }
+    }
     const content = await args.deps.readFile(absolute);
     planDocuments.push({
       path: ref.path,
@@ -1761,6 +1862,21 @@ async function runSync(args, deps) {
 
 // src/sync-repo.ts
 var ROADMAP_SLUG_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
+function collectContainedPlanAbsPaths(roadmaps, root, warn) {
+  const planAbsPaths = /* @__PURE__ */ new Set();
+  const resolvedRoot = path11.resolve(root);
+  for (const roadmap of roadmaps) {
+    for (const ref of collectPlanRefs(roadmap)) {
+      const absolute = path11.resolve(resolvedRoot, ref.path);
+      if (absolute !== resolvedRoot && !absolute.startsWith(resolvedRoot + path11.sep)) {
+        warn(`chokidar target outside repo, skipping: ${ref.path}`);
+        continue;
+      }
+      planAbsPaths.add(absolute);
+    }
+  }
+  return [...planAbsPaths];
+}
 async function listRoadmapFiles(roadmapsDir, io) {
   try {
     const entries = await io.listDir(roadmapsDir);
@@ -1841,23 +1957,29 @@ async function syncRepo(args, io) {
       return { slug, roadmap: await loadValidRoadmap(filePath, io.readFile) };
     })
   );
-  const planAbsPaths = /* @__PURE__ */ new Set();
-  for (const { roadmap } of roadmaps) {
-    for (const ref of collectPlanRefs(roadmap)) {
-      planAbsPaths.add(path11.join(args.root, ref.path));
-    }
-  }
+  const planAbsPaths = collectContainedPlanAbsPaths(
+    roadmaps.map(({ roadmap }) => roadmap),
+    args.root,
+    io.warn
+  );
   const results = [];
   const repoIdentity = await io.repoIdentity(args.root);
   for (const { slug, roadmap } of roadmaps) {
     results.push(
       await runSync(
         { repoRoot: args.root, projectId, slug, roadmap, repoIdentity },
-        { http: io.http, readFile: io.readFile, fileExists: io.fileExists, log: io.log, warn: io.warn }
+        {
+          http: io.http,
+          readFile: io.readFile,
+          fileExists: io.fileExists,
+          realpath: io.realpath,
+          log: io.log,
+          warn: io.warn
+        }
       )
     );
   }
-  return { results, planAbsPaths: [...planAbsPaths] };
+  return { results, planAbsPaths };
 }
 
 // src/commands/sync.ts
@@ -1879,6 +2001,7 @@ function register5(program, deps) {
       { root, defaultProjectId: deps.settings.defaultProjectId, migrateLegacy: true },
       {
         readFile: (p) => readFile6(p, "utf8"),
+        realpath: (p) => realpath(p),
         fileExists: (p) => existsSync3(p),
         listDir: (p) => readdir2(p),
         rename: rename2,
@@ -2444,7 +2567,7 @@ function register7(program, deps) {
 }
 
 // src/commands/watch.ts
-import { copyFile as copyFile2, mkdir as mkdir8, readFile as readFile9, readdir as readdir4, rename as rename3, rmdir as rmdir2, unlink as unlink3 } from "fs/promises";
+import { copyFile as copyFile2, mkdir as mkdir8, readFile as readFile9, readdir as readdir4, realpath as realpath2, rename as rename3, rmdir as rmdir2, unlink as unlink3 } from "fs/promises";
 import { existsSync as existsSync4 } from "fs";
 import path16 from "path";
 import chokidar from "chokidar";
@@ -2736,6 +2859,7 @@ function register8(program, deps) {
           { root, defaultProjectId: deps.settings.defaultProjectId, migrateLegacy: false },
           {
             readFile: (p) => readFile9(p, "utf8"),
+            realpath: (p) => realpath2(p),
             fileExists: (p) => existsSync4(p),
             listDir: (p) => readdir4(p),
             rename: rename3,
@@ -2810,7 +2934,7 @@ function register8(program, deps) {
 // src/update-cli.ts
 import { execFile as execFile3 } from "child_process";
 import { existsSync as existsSync5 } from "fs";
-import { realpath } from "fs/promises";
+import { realpath as realpath3 } from "fs/promises";
 import { createRequire as createRequire2 } from "module";
 import path18 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
@@ -3038,7 +3162,7 @@ function getCurrentVersion() {
 }
 async function updateCli(opts = {}) {
   const execFileAsync = promisify2(execFile3);
-  const scriptPath = await realpath(process.argv[1] ?? "");
+  const scriptPath = await realpath3(process.argv[1] ?? "");
   return updateCliWith({
     currentVersion: getCurrentVersion(),
     scriptPath,
@@ -3059,7 +3183,7 @@ async function updateCli(opts = {}) {
         };
       }
     },
-    realpath,
+    realpath: realpath3,
     fetchLatest: () => fetchLatestFromRegistry(UPDATE_REQUEST_TIMEOUT_MS, UPDATE_FETCH_OPTIONS),
     writeCache: writeUpdateCache,
     unitExists: existsSync5,

package/dist/skill/roadmap-progress/SKILL.md

@@ -78,6 +78,7 @@ Use direct JSON edits to add, remove, rename, or reorder phases and tasks, then
 - Preserve task IDs across title changes so `dependsOn` remains stable.
 - Keep exactly one `currentTaskId`; it must point to an `in-progress` task. Use `null` when nothing is active.
 - Require `completedAt` for done tasks and `startedAt` for in-progress tasks.
+- Timestamps must be RFC 3339 with a timezone offset (`2026-09-02T10:00:00+09:00` or `2026-09-02T01:00:00Z`; never `2026-09-02T10:00:00`); `dependsOn` items must be plain task ID strings and unique.
 - Keep notes factual and current; replace stale implementation notes instead of accumulating a log.
 - Never rewrite repository history or source code solely to make the roadmap appear complete.
 - Finish every mutation by running `validate` and reporting the task status changed.

package/dist/skill/roadmap-progress/references/schema.md

@@ -54,19 +54,19 @@ Use this reference when creating or structurally editing `.nolto/roadmaps/<slug>
 - `project.id`: Stable lowercase identifier matching `^[a-z0-9][a-z0-9._-]*$`.
 - `project.name`: Display name.
 - `project.repository`: Absolute repository path when known.
-- `updatedAt`: Date-time of the last meaningful roadmap mutation.
+- `updatedAt`: RFC 3339 date-time with a timezone offset (for example, `2026-07-20T14:30:00+09:00` or `2026-07-20T05:30:00Z`). Offset-less values (`2026-07-20T14:30:00`) and date-only values (`2026-07-20`) are rejected.
 - `currentTaskId`: One active task ID or `null`.
 - `summary`: One or two current sentences; do not use as a changelog.
 - `phases`: Ordered delivery phases.
 - `phase.status`: `todo`, `in-progress`, `done`, or `blocked`.
-- `phase.plan`: Optional repository-relative path to a markdown plan document.
+- `phase.plan`: Optional repository-relative path (`/`-separated) to a Markdown plan document, for example `docs/plans/auth.md`. Absolute paths, backslashes, and `.`/`..` segments are rejected.
 - `tasks`: Ordered work items. Each must be small enough to verify clearly.
 - `task.status`: `todo`, `in-progress`, `done`, or `blocked`.
-- `task.plan`: Optional repository-relative path to a markdown plan document.
-- `startedAt`: Required in practice for `in-progress` tasks.
-- `completedAt`: Required in practice for `done` tasks.
+- `task.plan`: Optional repository-relative path (`/`-separated) to a Markdown plan document, for example `docs/plans/auth.md`. Absolute paths, backslashes, and `.`/`..` segments are rejected.
+- `startedAt`: Required in practice for `in-progress` tasks. Uses the same RFC 3339 date-time format as `updatedAt`.
+- `completedAt`: Required in practice for `done` tasks. Uses the same RFC 3339 date-time format as `updatedAt`.
 - `note`: Current implementation detail or blocker. Omit when it adds no value.
-- `dependsOn`: IDs of prerequisite tasks in the same roadmap.
+- `dependsOn`: IDs of prerequisite tasks in the same roadmap. Each item must be a string matching `^[a-z0-9][a-z0-9._-]*$`; duplicates are rejected.
 
 ## Phase status derivation
 

package/dist/skill/roadmap-progress/scripts/roadmap.mjs

@@ -10,6 +10,14 @@ const ALLOWED_KEYS = {
   phase: new Set(["id", "title", "status", "plan", "tasks"]),
   task: new Set(["id", "title", "status", "startedAt", "completedAt", "note", "dependsOn", "plan"])
 };
+const PLAN_PATH_ERROR = "plan --path must be a repository-relative path using '/' separators (no absolute paths, '\\', '.' or '..' segments).";
+
+// Keep in sync with packages/roadmap-schema/src/index.ts isValidPlanPath.
+function isValidPlanPath(value) {
+  if (typeof value !== "string" || value.length === 0) return false;
+  if (value.includes("\\") || value.startsWith("/") || /^[A-Za-z]:/.test(value)) return false;
+  return value.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
+}
 
 function parseArguments(argv) {
   const options = { file: null, note: undefined, summary: undefined, text: undefined, path: undefined, positional: [] };
@@ -258,15 +266,20 @@ try {
   } else if (command === "plan") {
     if (!taskId) throw new Error("plan requires a task id.");
     if (!options.path) throw new Error("plan requires --path <repo-relative-md-path>.");
+    if (!isValidPlanPath(options.path)) throw new Error(PLAN_PATH_ERROR);
+    const repoRoot = path.resolve(repoRootForRoadmap(filePath));
+    const resolvedPlanPath = path.resolve(repoRoot, options.path);
+    if (resolvedPlanPath !== repoRoot && !resolvedPlanPath.startsWith(repoRoot + path.sep)) {
+      throw new Error(PLAN_PATH_ERROR);
+    }
     const { task } = findTask(roadmap, taskId);
     task.plan = options.path;
     roadmap.schemaVersion = 2;
     roadmap.updatedAt = localIsoNow();
-    const repoRoot = repoRootForRoadmap(filePath);
     try {
-      await access(path.join(repoRoot, options.path));
+      await access(resolvedPlanPath);
     } catch {
-      console.warn(`WARN plan file not found at ${path.join(repoRoot, options.path)}`);
+      console.warn(`WARN plan file not found at ${resolvedPlanPath}`);
     }
     const result = validate(roadmap);
     if (result.errors.length) throw new Error(`Mutation failed validation: ${result.errors.join(" ")}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nolto/cli",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "CLI for syncing repository roadmaps with Nolto.",
   "license": "MIT",
   "type": "module",