@probelabs/visor 0.1.185 → 0.1.186

package/dist/sdk/{chunk-YBXNG75V.mjs → chunk-XX6WT332.mjs}

@@ -250,26 +250,9 @@ var init_config_loader = __esm({
         }
         if (defaultConfigPath) {
           console.error(`\u{1F4E6} Loading bundled default configuration from ${defaultConfigPath}`);
-          const content = fs.readFileSync(defaultConfigPath, "utf8");
-          let config = yaml.load(content);
-          if (!config || typeof config !== "object") {
-            throw new Error("Invalid default configuration");
-          }
-          if (config.include && !config.extends) {
-            const inc = config.include;
-            config.extends = Array.isArray(inc) ? inc : [inc];
-            delete config.include;
-          }
+          const defaultConfigDir = path.dirname(defaultConfigPath);
+          let config = await this.fetchBundledConfigFile(defaultConfigPath, defaultConfigDir);
           config = this.normalizeStepsAndChecks(config);
-          if (config.extends) {
-            const previousBaseDir = this.options.baseDir;
-            try {
-              this.options.baseDir = path.dirname(defaultConfigPath);
-              return await this.processExtends(config);
-            } finally {
-              this.options.baseDir = previousBaseDir;
-            }
-          }
           return config;
         }
         console.warn("\u26A0\uFE0F  Bundled default configuration not found, using minimal defaults");
@@ -285,6 +268,70 @@ var init_config_loader = __esm({
           }
         };
       }
+      /**
+       * Load a bundled config and its includes without using project-local path resolution.
+       *
+       * `extends: default` is a built-in source. Its sibling includes are part of the Visor
+       * package/action bundle, so they must resolve inside that bundle rather than inside the
+       * caller's repository root.
+       */
+      async fetchBundledConfigFile(filePath, bundledRoot, currentDepth = 0, seen = /* @__PURE__ */ new Set()) {
+        if (currentDepth >= (this.options.maxDepth || 10)) {
+          throw new Error(
+            `Maximum bundled default include depth (${this.options.maxDepth}) exceeded. Check for circular dependencies.`
+          );
+        }
+        const resolvedPath = path.resolve(filePath);
+        this.validateBundledPath(resolvedPath, bundledRoot);
+        if (seen.has(resolvedPath)) {
+          throw new Error(`Circular dependency detected in bundled defaults: ${resolvedPath}`);
+        }
+        seen.add(resolvedPath);
+        try {
+          const content = fs.readFileSync(resolvedPath, "utf8");
+          const config = yaml.load(content);
+          if (!config || typeof config !== "object") {
+            throw new Error(`Invalid default configuration: ${resolvedPath}`);
+          }
+          const extendsValue = config.extends || config.include;
+          delete config.extends;
+          delete config.include;
+          this.annotateToolsBaseDir(config, path.dirname(resolvedPath));
+          if (!extendsValue) {
+            return config;
+          }
+          const { ConfigMerger: ConfigMerger2 } = await import("./config-merger-5C3USRYD.mjs");
+          const merger = new ConfigMerger2();
+          const sources = Array.isArray(extendsValue) ? extendsValue : [extendsValue];
+          let mergedParents = {};
+          for (const source of sources) {
+            if (typeof source !== "string" || this.getSourceType(source) !== "local" /* LOCAL */) {
+              throw new Error(
+                `Bundled default configuration can only include local bundled files: ${String(source)}`
+              );
+            }
+            const parentPath = path.isAbsolute(source) ? source : path.resolve(path.dirname(resolvedPath), source);
+            const parentConfig = await this.fetchBundledConfigFile(
+              parentPath,
+              bundledRoot,
+              currentDepth + 1,
+              seen
+            );
+            mergedParents = merger.merge(mergedParents, parentConfig);
+          }
+          return merger.merge(mergedParents, config);
+        } catch (error) {
+          if (error && (error.code === "ENOENT" || error.code === "ENOTDIR")) {
+            throw new Error(`Bundled default configuration file not found: ${resolvedPath}`);
+          }
+          if (error instanceof Error) {
+            throw error;
+          }
+          throw error;
+        } finally {
+          seen.delete(resolvedPath);
+        }
+      }
       /**
        * Process extends directive in a configuration
        */
@@ -371,6 +418,26 @@ var init_config_loader = __esm({
           }
         }
       }
+      /**
+       * Validate that bundled default includes stay inside the Visor package/action bundle.
+       */
+      validateBundledPath(resolvedPath, bundledRoot) {
+        const canonicalize = (p) => {
+          const resolved = path.resolve(p);
+          try {
+            return path.normalize(fs.realpathSync.native(resolved));
+          } catch {
+            return path.normalize(resolved);
+          }
+        };
+        const normalizedPath = canonicalize(resolvedPath);
+        const normalizedRoot = canonicalize(bundledRoot);
+        if (normalizedPath !== normalizedRoot && !normalizedPath.startsWith(`${normalizedRoot}${path.sep}`)) {
+          throw new Error(
+            `Security error: Bundled default include resolves outside bundled defaults directory: ${bundledRoot}`
+          );
+        }
+      }
       /**
        * Find package root directory
        */
@@ -6048,4 +6115,4 @@ export {
   config_exports,
   init_config
 };
-//# sourceMappingURL=chunk-YBXNG75V.mjs.map
+//# sourceMappingURL=chunk-XX6WT332.mjs.map