@saga-ai/cli 0.3.0 → 0.4.0

package/dist/cli.cjs

@@ -3037,7 +3037,7 @@ var {
 } = import_index.default;
 
 // src/cli.ts
-var import_node_path6 = require("node:path");
+var import_node_path7 = require("node:path");
 var import_node_fs6 = require("node:fs");
 
 // src/commands/init.ts
@@ -4957,7 +4957,7 @@ function buildScopeSettings() {
     hooks: {
       PreToolUse: [
         {
-          matcher: "Read|Write|Edit",
+          matcher: "Read|Write|Edit|Glob|Grep",
           hooks: [hookCommand]
         }
       ]
@@ -5196,10 +5196,12 @@ async function dashboardCommand(options) {
 }
 
 // src/commands/scope-validator.ts
-function getFilePathFromInput(toolInput) {
+var import_node_path5 = require("node:path");
+function getFilePathFromInput(hookInput) {
   try {
-    const data = JSON.parse(toolInput);
-    return data.file_path || data.path || null;
+    const data = JSON.parse(hookInput);
+    const toolInput = data.tool_input || {};
+    return toolInput.file_path || toolInput.path || null;
   } catch {
     return null;
   }
@@ -5213,6 +5215,15 @@ function normalizePath(path) {
 function isArchiveAccess(path) {
   return path.includes(".saga/archive");
 }
+function isWithinWorktree(filePath, worktreePath) {
+  const absoluteFilePath = (0, import_node_path5.resolve)(filePath);
+  const absoluteWorktree = (0, import_node_path5.resolve)(worktreePath);
+  const relativePath = (0, import_node_path5.relative)(absoluteWorktree, absoluteFilePath);
+  if (relativePath.startsWith("..") || (0, import_node_path5.resolve)(relativePath) === relativePath) {
+    return false;
+  }
+  return true;
+}
 function checkStoryAccess(path, allowedEpic, allowedStory) {
   if (!path.includes(".saga/epics/")) {
     return true;
@@ -5233,24 +5244,27 @@ function checkStoryAccess(path, allowedEpic, allowedStory) {
     return pathEpic === allowedEpic;
   }
 }
-function printScopeViolation(filePath, epicSlug, storySlug, reason) {
+function printScopeViolation(filePath, epicSlug, storySlug, worktreePath, reason) {
   console.error(`SCOPE VIOLATION: ${reason}
 
 Attempted path: ${filePath}
 
 Your scope is limited to:
+  Worktree: ${worktreePath}
   Epic: ${epicSlug}
   Story: ${storySlug}
-  Allowed: .saga/epics/${epicSlug}/stories/${storySlug}/
+  Allowed story files: .saga/epics/${epicSlug}/stories/${storySlug}/
 
+Workers cannot access files outside the worktree directory.
 To access other stories, start a new /implement session for that story.`);
 }
 async function scopeValidatorCommand() {
+  const worktreePath = process.env.SAGA_PROJECT_DIR || "";
   const epicSlug = process.env.SAGA_EPIC_SLUG || "";
   const storySlug = process.env.SAGA_STORY_SLUG || "";
-  if (!epicSlug || !storySlug) {
+  if (!worktreePath || !epicSlug || !storySlug) {
     console.error(
-      "ERROR: scope-validator requires SAGA_EPIC_SLUG and SAGA_STORY_SLUG environment variables"
+      "ERROR: scope-validator requires SAGA_PROJECT_DIR, SAGA_EPIC_SLUG, and SAGA_STORY_SLUG environment variables"
     );
     process.exit(2);
   }
@@ -5264,11 +5278,22 @@ async function scopeValidatorCommand() {
     process.exit(0);
   }
   const normPath = normalizePath(filePath);
+  if (!isWithinWorktree(normPath, worktreePath)) {
+    printScopeViolation(
+      filePath,
+      epicSlug,
+      storySlug,
+      worktreePath,
+      "Access outside worktree blocked\nReason: Workers can only access files within their assigned worktree directory."
+    );
+    process.exit(2);
+  }
   if (isArchiveAccess(normPath)) {
     printScopeViolation(
       filePath,
       epicSlug,
       storySlug,
+      worktreePath,
       "Access to archive folder blocked\nReason: The archive folder contains completed stories and is read-only during execution."
     );
     process.exit(2);
@@ -5278,6 +5303,7 @@ async function scopeValidatorCommand() {
       filePath,
       epicSlug,
       storySlug,
+      worktreePath,
       "Access to other story blocked\nReason: Workers can only access their assigned story's files."
     );
     process.exit(2);
@@ -5308,7 +5334,7 @@ async function findCommand(query, options) {
 }
 
 // src/commands/worktree.ts
-var import_node_path5 = require("node:path");
+var import_node_path6 = require("node:path");
 var import_node_fs5 = require("node:fs");
 var import_node_child_process2 = require("node:child_process");
 function runGitCommand(args, cwd) {
@@ -5340,7 +5366,7 @@ function getMainBranch(cwd) {
 }
 function createWorktree(projectPath, epicSlug, storySlug) {
   const branchName = `story-${storySlug}-epic-${epicSlug}`;
-  const worktreePath = (0, import_node_path5.join)(
+  const worktreePath = (0, import_node_path6.join)(
     projectPath,
     ".saga",
     "worktrees",
@@ -5371,7 +5397,7 @@ function createWorktree(projectPath, epicSlug, storySlug) {
       error: `Failed to create branch: ${createBranchResult.output}`
     };
   }
-  const worktreeParent = (0, import_node_path5.join)(projectPath, ".saga", "worktrees", epicSlug);
+  const worktreeParent = (0, import_node_path6.join)(projectPath, ".saga", "worktrees", epicSlug);
   (0, import_node_fs5.mkdirSync)(worktreeParent, { recursive: true });
   const createWorktreeResult = runGitCommand(
     ["worktree", "add", worktreePath, branchName],
@@ -5406,7 +5432,7 @@ async function worktreeCommand(epicSlug, storySlug, options) {
 }
 
 // src/cli.ts
-var packageJsonPath = (0, import_node_path6.join)(__dirname, "..", "package.json");
+var packageJsonPath = (0, import_node_path7.join)(__dirname, "..", "package.json");
 var packageJson = JSON.parse((0, import_node_fs6.readFileSync)(packageJsonPath, "utf-8"));
 var program2 = new Command();
 program2.name("saga").description("CLI for SAGA - Structured Autonomous Goal Achievement").version(packageJson.version).addHelpCommand("help [command]", "Display help for a command");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saga-ai/cli",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "CLI for SAGA - Structured Autonomous Goal Achievement",
   "type": "module",
   "bin": {