@phren/cli 0.0.14 → 0.0.16

package/mcp/dist/skill-registry.js

@@ -3,6 +3,7 @@ import * as path from "path";
 import { getProjectDirs } from "./shared.js";
 import { parseSkillFrontmatter } from "./link-skills.js";
 import { isSkillEnabled } from "./skill-state.js";
+import { safeProjectPath } from "./utils.js";
 function normalizeCommand(raw, fallbackName) {
     const value = typeof raw === "string" && raw.trim() ? raw.trim() : `/${fallbackName}`;
     return value.startsWith("/") ? value : `/${value}`;
@@ -28,13 +29,35 @@ function collectSkills(phrenPath, root, sourceLabel, scopeType, sourceKind, seen
     if (!fs.existsSync(root))
         return [];
     const results = [];
+    const realRoot = (() => {
+        try {
+            return fs.realpathSync(root);
+        }
+        catch {
+            return path.resolve(root);
+        }
+    })();
     for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
         const isFolder = entry.isDirectory();
-        const filePath = isFolder
+        const candidatePath = isFolder
             ? path.join(root, entry.name, "SKILL.md")
             : entry.name.endsWith(".md") ? path.join(root, entry.name) : null;
-        if (!filePath || seen.has(filePath) || !fs.existsSync(filePath))
+        if (!candidatePath)
+            continue;
+        const safeCandidate = safeProjectPath(root, path.relative(root, candidatePath));
+        if (!safeCandidate || seen.has(safeCandidate) || !fs.existsSync(safeCandidate))
             continue;
+        try {
+            if (fs.lstatSync(safeCandidate).isSymbolicLink())
+                continue;
+            const realCandidate = fs.realpathSync(safeCandidate);
+            if (realCandidate !== realRoot && !realCandidate.startsWith(realRoot + path.sep))
+                continue;
+        }
+        catch {
+            continue;
+        }
+        const filePath = safeCandidate;
         seen.add(filePath);
         const name = isFolder ? entry.name : entry.name.replace(/\.md$/, "");
         const { frontmatter } = parseSkillFrontmatter(fs.readFileSync(filePath, "utf8"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phren/cli",
-  "version": "0.0.14",
+  "version": "0.0.16",
   "description": "Knowledge layer for AI agents. Phren learns and recalls.",
   "type": "module",
   "bin": {