@nolto/cli 0.9.0 → 0.11.0

package/README.md

@@ -45,7 +45,7 @@ nolto whoami               # Show resolved auth/config state and project count
 ```bash
 nolto link <projectId>     # Write or update nolto.json at the repository root
 nolto link --show          # Show the current binding, source, and repository identity
-nolto link --rebind        # Rebind the project to this repository (owner only)
+nolto link --rebind [--yes] # Rebind the project to this repository (owner only)
 nolto link --unlink        # Remove projectId from nolto.json
 ```
 
@@ -53,8 +53,11 @@ Commit `nolto.json` so everyone working in the repository targets the same Nolto
 project. A Nolto project is bound to the first repository identity it syncs from.
 The identity is the normalized `origin` remote, or a machine ID plus path when no
 remote is available. Syncing from a different repository fails with
-`409 repo_mismatch`. An owner can run `nolto link --rebind` in the correct
-repository to change the binding, at most once every seven days.
+`409 repo_mismatch`. Before rebinding, run `nolto link --show` and confirm that
+the project ID is intended for this repository. An owner can then run
+`nolto link --rebind` in the correct repository to change the binding, at most
+once every seven days. The command shows the project name and asks for
+confirmation; pass `--yes` (`-y`) to skip the prompt.
 
 CLI versions older than 0.8.0 do not send a repository identity and receive
 `426`; run `nolto update` before syncing.

package/dist/index.js

@@ -56,7 +56,7 @@ function mapHttpStatusToCliError(status, opts = {}) {
     return new CliError(
       opts.serverMessage ?? "This project is bound to a different repository.",
       2,
-      "Owner: run `nolto link --rebind` inside the repository that should own this project.",
+      "Check that nolto.json points to the project for this repository (nolto link --show). Owner: run `nolto link --rebind` inside the repository that should own this project.",
       status
     );
   }
@@ -374,7 +374,7 @@ function createHttpClient(opts) {
 import { Command } from "commander";
 
 // src/commands/init.ts
-import readline from "readline/promises";
+import readline2 from "readline/promises";
 import { createRequire } from "module";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import os3 from "os";
@@ -382,6 +382,7 @@ import path9 from "path";
 import fs from "fs";
 
 // src/commands/link.ts
+import readline from "readline/promises";
 import os2 from "os";
 import path5 from "path";
 import { statSync as statSync2 } from "fs";
@@ -545,11 +546,25 @@ function checkKeys(value, allowed, at, errors) {
     if (!allowed.has(key)) errors.push(`${at} contains unsupported property "${key}".`);
   }
 }
-function checkPlan(value, at, errors) {
-  if (value === void 0) return;
+function isValidPlanPath(value) {
+  if (typeof value !== "string" || value.length === 0) return false;
+  if (value.includes("\\") || value.startsWith("/") || /^[A-Za-z]:/.test(value)) return false;
+  return value.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
+}
+function validatePlanPath(value, at) {
   if (typeof value !== "string" || value.length === 0) {
-    errors.push(`${at}.plan must be a non-empty string.`);
+    return [`${at} must be a non-empty string.`];
   }
+  if (!isValidPlanPath(value)) {
+    return [
+      `${at} must be a repository-relative path using '/' separators (no absolute paths, '\\', '.' or '..' segments).`
+    ];
+  }
+  return [];
+}
+function checkPlan(value, at, errors) {
+  if (value === void 0) return;
+  errors.push(...validatePlanPath(value, `${at}.plan`));
 }
 function derivePhaseStatus(phase) {
   if (phase.tasks.length > 0 && phase.tasks.every((task) => task.status === "done")) return "done";
@@ -819,14 +834,51 @@ async function handleShow(deps, projectBindingPath, mode2) {
     }
   }
 }
-async function handleRebind(deps, projectId, root, mode2) {
+async function handleRebind(deps, projectId, root, mode2, yes) {
   if (!UUID_RE.test(projectId)) {
     throw new CliError(
       `Invalid project ID: "${projectId}". Must be a UUID (e.g. 00000000-0000-0000-0000-000000000001).`,
       2
     );
   }
+  const result = await deps.http.get("/api/projects");
+  const projects = Array.isArray(result.projects) ? result.projects : [];
+  const project = projects.find((candidate) => candidate.id === projectId);
+  if (project == null) {
+    throw new CliError(
+      `Project ${projectId} is not in your accessible projects. Check nolto.json (nolto link --show) before rebinding.`,
+      2
+    );
+  }
   const repoIdentity = await makeRepoIdentityResolver(deps)(root);
+  if (mode2 !== "json") {
+    process.stdout.write(`Project   : ${project.name} (${project.id})
+`);
+    process.stdout.write(`Bound to  : ${project.repoIdentity ?? "not bound"}
+`);
+    process.stdout.write(`Rebind to : ${repoIdentity.kind}:${repoIdentity.value}
+`);
+  }
+  if (!yes) {
+    if (mode2 === "json") {
+      throw new CliError(
+        "--rebind requires confirmation. Pass --yes to skip the prompt in --json mode.",
+        2
+      );
+    }
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    let confirmed = false;
+    try {
+      const answer = await rl.question(`Rebind "${project.name}" to this repository? [y/N] `);
+      confirmed = answer.trim().toLowerCase() === "y";
+    } finally {
+      rl.close();
+    }
+    if (!confirmed) {
+      process.stdout.write("Aborted.\n");
+      return;
+    }
+  }
   await deps.http.post(`/api/projects/${projectId}/repo-binding`, { repoIdentity });
   if (mode2 === "json") {
     printResult({ rebound: true, projectId, repoIdentity }, mode2);
@@ -945,7 +997,7 @@ Commit nolto.json to share the binding with your team.
 function register(program, deps) {
   const cmd = program.command("link [projectId]").description(
     "Bind this repository to a Nolto project.\nWrites nolto.json at the repo root. Commit it to share the binding with your team.\n\nExamples:\n  nolto link <uuid>      Write / update nolto.json\n  nolto link --show      Show the current binding\n  nolto link --rebind    Rebind the project to this repository\n  nolto link --unlink    Remove the projectId from nolto.json"
-  ).option("--show", "Show the current repo binding (path + projectId + source)").option("--rebind", "Rebind the project to this repository (owner only, once per 7 days)").option("--unlink", "Remove the projectId key from nolto.json");
+  ).option("--show", "Show the current repo binding (path + projectId + source)").option("--rebind", "Rebind the project to this repository (owner only, once per 7 days)").option("-y, --yes", "Skip the rebind confirmation prompt").option("--unlink", "Remove the projectId key from nolto.json");
   cmd.action(async (projectId) => {
     const { output } = deps;
     const projectBindingPath = deps.repoBinding?.path ?? deps.projectBindingPath ?? null;
@@ -973,7 +1025,7 @@ function register(program, deps) {
       }
       const startDir = resolveStartDir(process.env, process.cwd());
       const root = findRepoRoot(startDir).root;
-      await handleRebind(deps, effectiveProjectId, root, mode2);
+      await handleRebind(deps, effectiveProjectId, root, mode2, cmd.opts()["yes"] === true);
       return;
     }
     if (projectId == null || projectId.trim().length === 0) {
@@ -1203,10 +1255,27 @@ async function pickProject(rl, http, projects, promptText) {
   }
   return void 0;
 }
+async function selectRepoProject(rl, http, projects, defaultProjectId) {
+  const defaultProject = defaultProjectId == null ? void 0 : projects.find((project) => project.id === defaultProjectId);
+  if (defaultProject != null) {
+    const useDefault = await rl.question(
+      `Use "${defaultProject.name}" (${defaultProject.id}) for this repository? [Y/n] `
+    );
+    if (useDefault.trim().toLowerCase() !== "n") {
+      return defaultProject;
+    }
+  }
+  return pickProject(
+    rl,
+    http,
+    projects,
+    "Project number for this repository, 'c' to create new (or Enter to skip): "
+  );
+}
 function register2(program, deps) {
   program.command("init").description("Interactive setup: configure token, base URL, and default project.").option("--force", "Overwrite existing config without prompting").action(async (opts) => {
     const configPath = deps.configPath;
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
     try {
       let configureGlobal = opts.force === true;
       if (!configureGlobal) {
@@ -1262,6 +1331,9 @@ function register2(program, deps) {
         );
         defaultProjectId = selected?.id;
         defaultProjectName = selected?.name;
+        if (selected != null && !projects.some((project) => project.id === selected.id)) {
+          projects = [...projects, selected];
+        }
         await saveConfigFile(configPath, {
           token,
           baseUrl: baseUrl !== DEFAULT_BASE_URL ? baseUrl : void 0,
@@ -1298,19 +1370,35 @@ Saved ${configPath}
         return;
       }
       const existingBinding = deps.repoBinding?.error == null ? deps.repoBinding?.binding ?? null : null;
-      let repoProject = existingBinding != null ? { id: existingBinding.projectId, name: path9.basename(root) } : defaultProjectId != null ? { id: defaultProjectId, name: defaultProjectName ?? path9.basename(root) } : void 0;
-      if (repoProject == null) {
-        http ??= createHttpClient({ baseUrl, token, version: getCliVersion() });
-        if (projects == null) {
-          const result = await http.get("/api/projects");
-          projects = Array.isArray(result.projects) ? result.projects : [];
+      const repoHttp = http ?? deps.http;
+      if (projects == null) {
+        const result = await repoHttp.get("/api/projects");
+        projects = Array.isArray(result.projects) ? result.projects : [];
+      }
+      let keepExistingBinding = false;
+      let repoProject;
+      if (existingBinding != null) {
+        const boundProject = projects.find(
+          (project) => project.id === existingBinding.projectId
+        );
+        if (boundProject != null) {
+          process.stdout.write(
+            `Existing binding: nolto.json \u2192 "${boundProject.name}" (${boundProject.id})
+`
+          );
+        } else {
+          process.stderr.write(
+            `Warning: nolto.json points to project ${existingBinding.projectId}, which is not in your accessible projects.
+`
+          );
         }
-        repoProject = await pickProject(
-          rl,
-          http,
-          projects,
-          "Project number for this repository, 'c' to create new (or Enter to skip): "
+        const keep = await rl.question(
+          boundProject != null ? "Keep this binding? [Y/n] " : "Keep this binding? [y/N] "
         );
+        keepExistingBinding = boundProject != null ? keep.trim().toLowerCase() !== "n" : keep.trim().toLowerCase() === "y";
+        repoProject = keepExistingBinding ? boundProject ?? { id: existingBinding.projectId, name: path9.basename(root) } : await selectRepoProject(rl, repoHttp, projects, defaultProjectId);
+      } else {
+        repoProject = await selectRepoProject(rl, repoHttp, projects, defaultProjectId);
       }
       if (repoProject == null) {
         process.stdout.write("Skipped repo setup (no project selected).\n");
@@ -1323,8 +1411,8 @@ Set up this repository (${root}) for roadmap sync? [Y/n] `);
         return;
       }
       const bindingPath = deps.repoBinding?.path ?? path9.join(root, "nolto.json");
-      if (existingBinding != null) {
-        process.stdout.write(`binding:        kept ${bindingPath} (${existingBinding.projectId})
+      if (keepExistingBinding) {
+        process.stdout.write(`binding:        kept ${bindingPath} (${repoProject.id})
 `);
       } else {
         if (deps.repoBinding?.error != null) {
@@ -1407,7 +1495,7 @@ async function promptHidden(rl, prompt) {
 }
 
 // src/commands/login.ts
-import readline2 from "readline/promises";
+import readline3 from "readline/promises";
 
 // src/login-poll.ts
 async function pollUntilToken(opts) {
@@ -1473,7 +1561,7 @@ function register3(program, deps) {
         } catch {
         }
         if (existing?.token) {
-          const rl = readline2.createInterface({
+          const rl = readline3.createInterface({
             input: process.stdin,
             output: process.stdout
           });
@@ -1597,7 +1685,7 @@ function register4(program, deps) {
 }
 
 // src/commands/sync.ts
-import { copyFile, mkdir as mkdir6, readFile as readFile6, readdir as readdir2, rename as rename2, rmdir, unlink as unlink2 } from "fs/promises";
+import { copyFile, mkdir as mkdir6, readFile as readFile6, readdir as readdir2, realpath, rename as rename2, rmdir, unlink as unlink2 } from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
 
 // src/sync-repo.ts
@@ -1652,11 +1740,31 @@ async function loadValidRoadmap(filePath, readFile12) {
 async function buildSyncBody(args) {
   const planDocuments = [];
   for (const ref of collectPlanRefs(args.roadmap)) {
-    const absolute = path10.join(args.repoRoot, ref.path);
+    const root = path10.resolve(args.repoRoot);
+    const absolute = path10.resolve(root, ref.path);
+    if (absolute !== root && !absolute.startsWith(root + path10.sep)) {
+      args.deps.warn(`plan path outside repository root, skipping: ${ref.path}`);
+      continue;
+    }
     if (!args.deps.fileExists(absolute)) {
       args.deps.warn(`plan file not found, skipping: ${ref.path}`);
       continue;
     }
+    if (args.deps.realpath !== void 0) {
+      let real;
+      let realRoot;
+      try {
+        real = await args.deps.realpath(absolute);
+        realRoot = await args.deps.realpath(root);
+      } catch {
+        args.deps.warn(`plan file not found, skipping: ${ref.path}`);
+        continue;
+      }
+      if (real !== realRoot && !real.startsWith(realRoot + path10.sep)) {
+        args.deps.warn(`symlink escapes repository root, skipping: ${ref.path}`);
+        continue;
+      }
+    }
     const content = await args.deps.readFile(absolute);
     planDocuments.push({
       path: ref.path,
@@ -1687,6 +1795,21 @@ async function runSync(args, deps) {
 
 // src/sync-repo.ts
 var ROADMAP_SLUG_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
+function collectContainedPlanAbsPaths(roadmaps, root, warn) {
+  const planAbsPaths = /* @__PURE__ */ new Set();
+  const resolvedRoot = path11.resolve(root);
+  for (const roadmap of roadmaps) {
+    for (const ref of collectPlanRefs(roadmap)) {
+      const absolute = path11.resolve(resolvedRoot, ref.path);
+      if (absolute !== resolvedRoot && !absolute.startsWith(resolvedRoot + path11.sep)) {
+        warn(`chokidar target outside repo, skipping: ${ref.path}`);
+        continue;
+      }
+      planAbsPaths.add(absolute);
+    }
+  }
+  return [...planAbsPaths];
+}
 async function listRoadmapFiles(roadmapsDir, io) {
   try {
     const entries = await io.listDir(roadmapsDir);
@@ -1767,23 +1890,29 @@ async function syncRepo(args, io) {
       return { slug, roadmap: await loadValidRoadmap(filePath, io.readFile) };
     })
   );
-  const planAbsPaths = /* @__PURE__ */ new Set();
-  for (const { roadmap } of roadmaps) {
-    for (const ref of collectPlanRefs(roadmap)) {
-      planAbsPaths.add(path11.join(args.root, ref.path));
-    }
-  }
+  const planAbsPaths = collectContainedPlanAbsPaths(
+    roadmaps.map(({ roadmap }) => roadmap),
+    args.root,
+    io.warn
+  );
   const results = [];
   const repoIdentity = await io.repoIdentity(args.root);
   for (const { slug, roadmap } of roadmaps) {
     results.push(
       await runSync(
         { repoRoot: args.root, projectId, slug, roadmap, repoIdentity },
-        { http: io.http, readFile: io.readFile, fileExists: io.fileExists, log: io.log, warn: io.warn }
+        {
+          http: io.http,
+          readFile: io.readFile,
+          fileExists: io.fileExists,
+          realpath: io.realpath,
+          log: io.log,
+          warn: io.warn
+        }
       )
     );
   }
-  return { results, planAbsPaths: [...planAbsPaths] };
+  return { results, planAbsPaths };
 }
 
 // src/commands/sync.ts
@@ -1805,6 +1934,7 @@ function register5(program, deps) {
       { root, defaultProjectId: deps.settings.defaultProjectId, migrateLegacy: true },
       {
         readFile: (p) => readFile6(p, "utf8"),
+        realpath: (p) => realpath(p),
         fileExists: (p) => existsSync3(p),
         listDir: (p) => readdir2(p),
         rename: rename2,
@@ -2370,7 +2500,7 @@ function register7(program, deps) {
 }
 
 // src/commands/watch.ts
-import { copyFile as copyFile2, mkdir as mkdir8, readFile as readFile9, readdir as readdir4, rename as rename3, rmdir as rmdir2, unlink as unlink3 } from "fs/promises";
+import { copyFile as copyFile2, mkdir as mkdir8, readFile as readFile9, readdir as readdir4, realpath as realpath2, rename as rename3, rmdir as rmdir2, unlink as unlink3 } from "fs/promises";
 import { existsSync as existsSync4 } from "fs";
 import path16 from "path";
 import chokidar from "chokidar";
@@ -2662,6 +2792,7 @@ function register8(program, deps) {
           { root, defaultProjectId: deps.settings.defaultProjectId, migrateLegacy: false },
           {
             readFile: (p) => readFile9(p, "utf8"),
+            realpath: (p) => realpath2(p),
             fileExists: (p) => existsSync4(p),
             listDir: (p) => readdir4(p),
             rename: rename3,
@@ -2736,7 +2867,7 @@ function register8(program, deps) {
 // src/update-cli.ts
 import { execFile as execFile3 } from "child_process";
 import { existsSync as existsSync5 } from "fs";
-import { realpath } from "fs/promises";
+import { realpath as realpath3 } from "fs/promises";
 import { createRequire as createRequire2 } from "module";
 import path18 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
@@ -2964,7 +3095,7 @@ function getCurrentVersion() {
 }
 async function updateCli(opts = {}) {
   const execFileAsync = promisify2(execFile3);
-  const scriptPath = await realpath(process.argv[1] ?? "");
+  const scriptPath = await realpath3(process.argv[1] ?? "");
   return updateCliWith({
     currentVersion: getCurrentVersion(),
     scriptPath,
@@ -2985,7 +3116,7 @@ async function updateCli(opts = {}) {
         };
       }
     },
-    realpath,
+    realpath: realpath3,
     fetchLatest: () => fetchLatestFromRegistry(UPDATE_REQUEST_TIMEOUT_MS, UPDATE_FETCH_OPTIONS),
     writeCache: writeUpdateCache,
     unitExists: existsSync5,

package/dist/skill/roadmap-progress/references/schema.md

@@ -59,10 +59,10 @@ Use this reference when creating or structurally editing `.nolto/roadmaps/<slug>
 - `summary`: One or two current sentences; do not use as a changelog.
 - `phases`: Ordered delivery phases.
 - `phase.status`: `todo`, `in-progress`, `done`, or `blocked`.
-- `phase.plan`: Optional repository-relative path to a markdown plan document.
+- `phase.plan`: Optional repository-relative path (`/`-separated) to a Markdown plan document, for example `docs/plans/auth.md`. Absolute paths, backslashes, and `.`/`..` segments are rejected.
 - `tasks`: Ordered work items. Each must be small enough to verify clearly.
 - `task.status`: `todo`, `in-progress`, `done`, or `blocked`.
-- `task.plan`: Optional repository-relative path to a markdown plan document.
+- `task.plan`: Optional repository-relative path (`/`-separated) to a Markdown plan document, for example `docs/plans/auth.md`. Absolute paths, backslashes, and `.`/`..` segments are rejected.
 - `startedAt`: Required in practice for `in-progress` tasks.
 - `completedAt`: Required in practice for `done` tasks.
 - `note`: Current implementation detail or blocker. Omit when it adds no value.

package/dist/skill/roadmap-progress/scripts/roadmap.mjs

@@ -10,6 +10,14 @@ const ALLOWED_KEYS = {
   phase: new Set(["id", "title", "status", "plan", "tasks"]),
   task: new Set(["id", "title", "status", "startedAt", "completedAt", "note", "dependsOn", "plan"])
 };
+const PLAN_PATH_ERROR = "plan --path must be a repository-relative path using '/' separators (no absolute paths, '\\', '.' or '..' segments).";
+
+// Keep in sync with packages/roadmap-schema/src/index.ts isValidPlanPath.
+function isValidPlanPath(value) {
+  if (typeof value !== "string" || value.length === 0) return false;
+  if (value.includes("\\") || value.startsWith("/") || /^[A-Za-z]:/.test(value)) return false;
+  return value.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
+}
 
 function parseArguments(argv) {
   const options = { file: null, note: undefined, summary: undefined, text: undefined, path: undefined, positional: [] };
@@ -258,15 +266,20 @@ try {
   } else if (command === "plan") {
     if (!taskId) throw new Error("plan requires a task id.");
     if (!options.path) throw new Error("plan requires --path <repo-relative-md-path>.");
+    if (!isValidPlanPath(options.path)) throw new Error(PLAN_PATH_ERROR);
+    const repoRoot = path.resolve(repoRootForRoadmap(filePath));
+    const resolvedPlanPath = path.resolve(repoRoot, options.path);
+    if (resolvedPlanPath !== repoRoot && !resolvedPlanPath.startsWith(repoRoot + path.sep)) {
+      throw new Error(PLAN_PATH_ERROR);
+    }
     const { task } = findTask(roadmap, taskId);
     task.plan = options.path;
     roadmap.schemaVersion = 2;
     roadmap.updatedAt = localIsoNow();
-    const repoRoot = repoRootForRoadmap(filePath);
     try {
-      await access(path.join(repoRoot, options.path));
+      await access(resolvedPlanPath);
     } catch {
-      console.warn(`WARN plan file not found at ${path.join(repoRoot, options.path)}`);
+      console.warn(`WARN plan file not found at ${resolvedPlanPath}`);
     }
     const result = validate(roadmap);
     if (result.errors.length) throw new Error(`Mutation failed validation: ${result.errors.join(" ")}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nolto/cli",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "CLI for syncing repository roadmaps with Nolto.",
   "license": "MIT",
   "type": "module",