@remnic/core 9.3.665 → 9.3.666

package/dist/{chunk-VH6EIKVS.js → chunk-WKMCC4NQ.js}

@@ -5,6 +5,9 @@ import {
 import {
   isErrnoCode
 } from "./chunk-5UZXUTVO.js";
+import {
+  assertPathInsideRoot
+} from "./chunk-5GPPACXK.js";
 import {
   DEFAULT_CITATION_FORMAT,
   hasCitation,
@@ -50,13 +53,13 @@ import {
 import {
   sanitizeMemoryContent
 } from "./chunk-FVQJYWH7.js";
+import {
+  createVersion
+} from "./chunk-VF4XKTX3.js";
 import {
   isConsolidationOperator,
   isValidDerivedFromEntry
 } from "./chunk-G7D6GZ5J.js";
-import {
-  createVersion
-} from "./chunk-VF4XKTX3.js";
 import {
   matchEntitySchemaSection,
   normalizeEntityStructuredSection,
@@ -84,7 +87,7 @@ import {
 } from "./chunk-VS2IYZRU.js";
 
 // src/storage.ts
-import { access, readdir, readFile, stat, writeFile, mkdir, unlink, appendFile, open } from "fs/promises";
+import { access, lstat, readdir, readFile, realpath, stat, writeFile, mkdir, unlink, appendFile, open } from "fs/promises";
 import { appendFileSync, createReadStream, mkdirSync, readFileSync, statSync } from "fs";
 import { createHash } from "crypto";
 import path from "path";
@@ -3122,22 +3125,38 @@ ${sanitized.text}
   }
   async collectActiveMemoryPaths() {
     const filePaths = [];
+    let memoryRootReal;
+    try {
+      memoryRootReal = await realpath(this.baseDir);
+    } catch {
+      return filePaths;
+    }
     const collectPaths = async (dir) => {
+      let entries;
       try {
-        const entries = await readdir(dir, { withFileTypes: true });
-        const subdirs = [];
-        for (const entry of entries) {
-          const fullPath = path.join(dir, entry.name);
-          if (entry.isDirectory()) {
-            subdirs.push(fullPath);
-          } else if (entry.name.endsWith(".md")) {
+        const dirStat = await lstat(dir);
+        if (dirStat.isSymbolicLink() || !dirStat.isDirectory()) return;
+        assertPathInsideRoot(memoryRootReal, await realpath(dir), dir);
+        entries = await readdir(dir, { withFileTypes: true });
+      } catch {
+        return;
+      }
+      const subdirs = [];
+      for (const entry of entries) {
+        if (entry.isSymbolicLink()) continue;
+        const fullPath = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+          subdirs.push(fullPath);
+        } else if (entry.name.endsWith(".md")) {
+          try {
+            assertPathInsideRoot(memoryRootReal, await realpath(fullPath), fullPath);
             filePaths.push(fullPath);
+          } catch {
           }
         }
-        for (const subdir of subdirs) {
-          await collectPaths(subdir);
-        }
-      } catch {
+      }
+      for (const subdir of subdirs) {
+        await collectPaths(subdir);
       }
     };
     for (const dir of RECALL_FALLBACK_DIRS) {
@@ -5561,4 +5580,4 @@ export {
   serializeEntityFile,
   StorageManager
 };
-//# sourceMappingURL=chunk-VH6EIKVS.js.map
+//# sourceMappingURL=chunk-WKMCC4NQ.js.map