@scotthamilton77/sidekick 0.1.10 → 0.1.11

package/dist/bin.js

@@ -58164,24 +58164,20 @@ var require_staging_paths = __commonJS({
     function getReminderPath(stateDir, sessionId, hookName, reminderName) {
       return (0, node_path_1.join)(getHookDir(stateDir, sessionId, hookName), `${reminderName}.json`);
     }
-    function isValidPathSegment(segment) {
-      if (!segment)
+    function isValidPathSegment(s) {
+      if (s === "")
         return false;
-      if (segment.includes("..") || segment.includes("/") || segment.includes("\\"))
+      if (s === "." || s === "..")
         return false;
-      if (segment.startsWith("."))
+      if (s.includes("/") || s.includes("\\"))
         return false;
-      return true;
+      if ((0, node_path_1.basename)(s) !== s)
+        return false;
+      return /^[a-zA-Z0-9._-]+$/.test(s);
     }
     function validatePathSegment(segment, name) {
-      if (!segment) {
-        throw new Error(`${name} cannot be empty`);
-      }
-      if (segment.includes("..") || segment.includes("/") || segment.includes("\\")) {
-        throw new Error(`Invalid ${name}: path traversal characters not allowed`);
-      }
-      if (segment.startsWith(".")) {
-        throw new Error(`Invalid ${name}: cannot start with '.'`);
+      if (!isValidPathSegment(segment)) {
+        throw new Error(`Invalid ${name}: must be a non-empty alphanumeric string without path separators`);
       }
     }
     exports2.CONSUMED_FILE_PATTERN = /\.\d+\.json$/;
@@ -58287,7 +58283,7 @@ var require_staging_service = __commonJS({
           persistent: data.persistent,
           ...enrichment
         }, { stagingPath: reminderPath });
-        (0, structured_logging_1.logEvent)(this.options.logger, event);
+        (0, structured_logging_1.logEvent)(this.options.logger.child({ context: { sessionId } }), event);
       }
       /**
        * Read a staged reminder.
@@ -83739,7 +83735,7 @@ var require_cli = __commonJS({
     var promises_12 = require("node:fs/promises");
     var node_stream_1 = require("node:stream");
     var yargs_parser_1 = __importDefault2(require_build());
-    var VERSION = true ? "0.1.10" : "dev";
+    var VERSION = true ? "0.1.11" : "dev";
     var SANDBOX_ERROR_MESSAGE = `Error: Daemon commands cannot run in sandbox mode.
 
 Claude Code's sandbox blocks Unix socket operations required for daemon IPC.

package/dist/daemon.js

@@ -57188,24 +57188,20 @@ var require_staging_paths = __commonJS({
     function getReminderPath(stateDir, sessionId, hookName, reminderName) {
       return (0, node_path_1.join)(getHookDir(stateDir, sessionId, hookName), `${reminderName}.json`);
     }
-    function isValidPathSegment(segment) {
-      if (!segment)
+    function isValidPathSegment(s) {
+      if (s === "")
         return false;
-      if (segment.includes("..") || segment.includes("/") || segment.includes("\\"))
+      if (s === "." || s === "..")
         return false;
-      if (segment.startsWith("."))
+      if (s.includes("/") || s.includes("\\"))
         return false;
-      return true;
+      if ((0, node_path_1.basename)(s) !== s)
+        return false;
+      return /^[a-zA-Z0-9._-]+$/.test(s);
     }
     function validatePathSegment(segment, name) {
-      if (!segment) {
-        throw new Error(`${name} cannot be empty`);
-      }
-      if (segment.includes("..") || segment.includes("/") || segment.includes("\\")) {
-        throw new Error(`Invalid ${name}: path traversal characters not allowed`);
-      }
-      if (segment.startsWith(".")) {
-        throw new Error(`Invalid ${name}: cannot start with '.'`);
+      if (!isValidPathSegment(segment)) {
+        throw new Error(`Invalid ${name}: must be a non-empty alphanumeric string without path separators`);
       }
     }
     exports2.CONSUMED_FILE_PATTERN = /\.\d+\.json$/;
@@ -57311,7 +57307,7 @@ var require_staging_service = __commonJS({
           persistent: data.persistent,
           ...enrichment
         }, { stagingPath: reminderPath });
-        (0, structured_logging_1.logEvent)(this.options.logger, event);
+        (0, structured_logging_1.logEvent)(this.options.logger.child({ context: { sessionId } }), event);
       }
       /**
        * Read a staged reminder.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scotthamilton77/sidekick",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "AI pair programming assistant with personas, session tracking, and contextual nudges",
   "bin": {
     "sidekick": "dist/bin.js"