@skillsmith/core 0.5.4 → 0.5.6

package/dist/utils/version-check.test.js

@@ -0,0 +1,113 @@
+/**
+ * Tests for version-check utility
+ * @see SMI-1952: Add auto-update check to MCP server startup
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { checkForUpdates, formatUpdateNotification, } from './version-check.js';
+describe('version-check', () => {
+    const originalFetch = global.fetch;
+    beforeEach(() => {
+        vi.useFakeTimers();
+    });
+    afterEach(() => {
+        global.fetch = originalFetch;
+        vi.useRealTimers();
+    });
+    describe('checkForUpdates', () => {
+        it('returns update available when newer version exists', async () => {
+            global.fetch = vi.fn().mockResolvedValue({
+                ok: true,
+                json: () => Promise.resolve({ version: '1.2.0' }),
+            });
+            const result = await checkForUpdates('@skillsmith/mcp-server', '1.0.0');
+            expect(result).toEqual({
+                currentVersion: '1.0.0',
+                latestVersion: '1.2.0',
+                updateAvailable: true,
+                updateCommand: 'npx @skillsmith/mcp-server@latest',
+            });
+            expect(fetch).toHaveBeenCalledWith('https://registry.npmjs.org/@skillsmith/mcp-server/latest', expect.objectContaining({
+                headers: { Accept: 'application/json' },
+            }));
+        });
+        it('returns no update when version is current', async () => {
+            global.fetch = vi.fn().mockResolvedValue({
+                ok: true,
+                json: () => Promise.resolve({ version: '1.0.0' }),
+            });
+            const result = await checkForUpdates('@skillsmith/mcp-server', '1.0.0');
+            expect(result).toEqual({
+                currentVersion: '1.0.0',
+                latestVersion: '1.0.0',
+                updateAvailable: false,
+                updateCommand: 'npx @skillsmith/mcp-server@latest',
+            });
+        });
+        it('returns null on HTTP error', async () => {
+            global.fetch = vi.fn().mockResolvedValue({
+                ok: false,
+                status: 404,
+            });
+            const result = await checkForUpdates('nonexistent-package', '1.0.0');
+            expect(result).toBeNull();
+        });
+        it('returns null on network error', async () => {
+            global.fetch = vi.fn().mockRejectedValue(new Error('Network error'));
+            const result = await checkForUpdates('@skillsmith/mcp-server', '1.0.0');
+            expect(result).toBeNull();
+        });
+        it('returns null on invalid JSON response', async () => {
+            global.fetch = vi.fn().mockResolvedValue({
+                ok: true,
+                json: () => Promise.reject(new Error('Invalid JSON')),
+            });
+            const result = await checkForUpdates('@skillsmith/mcp-server', '1.0.0');
+            expect(result).toBeNull();
+        });
+        it('returns null when version field is missing', async () => {
+            global.fetch = vi.fn().mockResolvedValue({
+                ok: true,
+                json: () => Promise.resolve({ name: 'package', description: 'test' }),
+            });
+            const result = await checkForUpdates('@skillsmith/mcp-server', '1.0.0');
+            expect(result).toBeNull();
+        });
+        it('uses 3 second timeout via AbortSignal', async () => {
+            // Mock fetch to extract the signal
+            let capturedSignal;
+            global.fetch = vi.fn().mockImplementation((_url, options) => {
+                capturedSignal = options?.signal;
+                return Promise.resolve({
+                    ok: true,
+                    json: () => Promise.resolve({ version: '1.0.0' }),
+                });
+            });
+            await checkForUpdates('@skillsmith/mcp-server', '1.0.0');
+            // Verify AbortSignal was passed (we can't easily test the exact timeout value)
+            expect(capturedSignal).toBeDefined();
+        });
+        it('handles timeout gracefully', async () => {
+            global.fetch = vi.fn().mockImplementation(() => {
+                const error = new Error('The operation was aborted');
+                error.name = 'AbortError';
+                return Promise.reject(error);
+            });
+            const result = await checkForUpdates('@skillsmith/mcp-server', '1.0.0');
+            expect(result).toBeNull();
+        });
+    });
+    describe('formatUpdateNotification', () => {
+        it('formats notification message correctly', () => {
+            const result = {
+                currentVersion: '0.3.0',
+                latestVersion: '0.4.0',
+                updateAvailable: true,
+                updateCommand: 'npx @skillsmith/mcp-server@latest',
+            };
+            const message = formatUpdateNotification(result);
+            expect(message).toBe('[skillsmith] Update available: 0.3.0 → 0.4.0\n' +
+                'Restart Claude Code to use the latest version.');
+        });
+    });
+});
+//# sourceMappingURL=version-check.test.js.map

package/dist/utils/version-check.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-check.test.js","sourceRoot":"","sources":["../../src/utils/version-check.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AACxE,OAAO,EACL,eAAe,EACf,wBAAwB,GAEzB,MAAM,oBAAoB,CAAA;AAE3B,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAA;IAElC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,CAAC,KAAK,GAAG,aAAa,CAAA;QAC5B,EAAE,CAAC,aAAa,EAAE,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;gBACvC,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;aAClD,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;YAEvE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACrB,cAAc,EAAE,OAAO;gBACvB,aAAa,EAAE,OAAO;gBACtB,eAAe,EAAE,IAAI;gBACrB,aAAa,EAAE,mCAAmC;aACnD,CAAC,CAAA;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAChC,0DAA0D,EAC1D,MAAM,CAAC,gBAAgB,CAAC;gBACtB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACxC,CAAC,CACH,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;gBACvC,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;aAClD,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;YAEvE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACrB,cAAc,EAAE,OAAO;gBACvB,aAAa,EAAE,OAAO;gBACtB,eAAe,EAAE,KAAK;gBACtB,aAAa,EAAE,mCAAmC;aACnD,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;gBACvC,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;aACZ,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAA;YAEpE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC3B,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;YAC7C,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAA;YAEpE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;YAEvE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC3B,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;gBACvC,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;aACtD,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;YAEvE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC3B,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;gBACvC,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;aACtE,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;YAEvE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC3B,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;YACrD,mCAAmC;YACnC,IAAI,cAAuC,CAAA;YAC3C,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;gBAC1D,cAAc,GAAG,OAAO,EAAE,MAAM,CAAA;gBAChC,OAAO,OAAO,CAAC,OAAO,CAAC;oBACrB,EAAE,EAAE,IAAI;oBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;iBAClD,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YAEF,MAAM,eAAe,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;YAExD,+EAA+E;YAC/E,MAAM,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAA;QACtC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE;gBAC7C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;gBACpD,KAAK,CAAC,IAAI,GAAG,YAAY,CAAA;gBACzB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAC9B,CAAC,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;YAEvE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC3B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;QACxC,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,MAAM,GAAuB;gBACjC,cAAc,EAAE,OAAO;gBACvB,aAAa,EAAE,OAAO;gBACtB,eAAe,EAAE,IAAI;gBACrB,aAAa,EAAE,mCAAmC;aACnD,CAAA;YAED,MAAM,OAAO,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAA;YAEhD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAClB,gDAAgD;gBAC9C,gDAAgD,CACnD,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/validation/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Validation Utilities (SMI-726)
+ *
+ * Centralized validation patterns for security-critical operations.
+ * Extracted from RawUrlSourceAdapter and LocalFilesystemAdapter.
+ *
+ * Security Features:
+ * - SSRF prevention (SMI-721, SMI-729)
+ * - Path traversal prevention (SMI-720)
+ * - RegExp injection prevention (SMI-722)
+ *
+ * @module validation
+ */
+export { ValidationError } from './validation-error.js';
+export { validateUrl, validateIPv6, getIpRangeName } from './url-validators.js';
+export { validatePath } from './path-validators.js';
+export { sanitizeInput, safePatternMatch, validatePatterns } from './input-validators.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/validation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/validation/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAGvD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAG/E,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAGnD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA"}

package/dist/validation/index.js

@@ -0,0 +1,22 @@
+/**
+ * Validation Utilities (SMI-726)
+ *
+ * Centralized validation patterns for security-critical operations.
+ * Extracted from RawUrlSourceAdapter and LocalFilesystemAdapter.
+ *
+ * Security Features:
+ * - SSRF prevention (SMI-721, SMI-729)
+ * - Path traversal prevention (SMI-720)
+ * - RegExp injection prevention (SMI-722)
+ *
+ * @module validation
+ */
+// Validation Error
+export { ValidationError } from './validation-error.js';
+// URL Validators (SSRF prevention)
+export { validateUrl, validateIPv6, getIpRangeName } from './url-validators.js';
+// Path Validators (Path traversal prevention)
+export { validatePath } from './path-validators.js';
+// Input Validators (General sanitization)
+export { sanitizeInput, safePatternMatch, validatePatterns } from './input-validators.js';
+//# sourceMappingURL=index.js.map

package/dist/validation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/validation/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,mCAAmC;AACnC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAE/E,8CAA8C;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD,0CAA0C;AAC1C,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA"}

package/dist/validation/input-validators.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Input Validation Utilities
+ *
+ * General input sanitization and pattern matching.
+ *
+ * Security Features:
+ * - RegExp injection prevention (SMI-722)
+ * - Input sanitization
+ * - Pattern validation
+ */
+/**
+ * Sanitize input string for safe use in various contexts
+ *
+ * Removes or escapes potentially dangerous characters.
+ *
+ * @param input - Input string to sanitize
+ * @param options - Sanitization options
+ * @returns Sanitized string
+ *
+ * @example
+ * ```typescript
+ * sanitizeInput('<script>alert(1)</script>')  // Returns: '&lt;script&gt;alert(1)&lt;/script&gt;'
+ * sanitizeInput('../../etc/passwd')           // Returns: 'etc/passwd'
+ * ```
+ */
+export declare function sanitizeInput(input: string, options?: {
+    /** Remove path traversal sequences like '../' (default: true) */
+    removePathTraversal?: boolean;
+    /** HTML-escape special characters (default: true) */
+    escapeHtml?: boolean;
+    /** Remove null bytes (default: true) */
+    removeNullBytes?: boolean;
+}): string;
+/**
+ * Safely test a string against a pattern, preventing RegExp injection (SMI-722)
+ *
+ * Tries exact match, prefix match, and regex match (with error handling).
+ * Falls back to includes check if regex is invalid.
+ *
+ * @param value - Value to test
+ * @param pattern - Pattern to match (string or regex)
+ * @returns True if value matches pattern
+ *
+ * @example
+ * ```typescript
+ * safePatternMatch('node_modules', 'node_modules')  // true (exact)
+ * safePatternMatch('node_modules/pkg', 'node_')     // true (prefix)
+ * safePatternMatch('test.js', '\\.js$')             // true (regex)
+ * safePatternMatch('test.js', '(evil')              // false (invalid regex, falls back)
+ * ```
+ */
+export declare function safePatternMatch(value: string, pattern: string): boolean;
+/**
+ * Validate that patterns array is safe to use
+ *
+ * Checks for potentially dangerous regex patterns that could cause ReDoS.
+ *
+ * @param patterns - Array of patterns to validate
+ * @returns Array of validation warnings (empty if all patterns are safe)
+ *
+ * @example
+ * ```typescript
+ * validatePatterns(['node_modules', '\\.js$'])  // []
+ * validatePatterns(['(a+)+b'])                  // ['Pattern may cause ReDoS: (a+)+b']
+ * ```
+ */
+export declare function validatePatterns(patterns: string[]): string[];
+//# sourceMappingURL=input-validators.d.ts.map

package/dist/validation/input-validators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-validators.d.ts","sourceRoot":"","sources":["../../src/validation/input-validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IACP,iEAAiE;IACjE,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,qDAAqD;IACrD,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,wCAAwC;IACxC,eAAe,CAAC,EAAE,OAAO,CAAA;CACrB,GACL,MAAM,CAqCR;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAuBxE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAyB7D"}

package/dist/validation/input-validators.js

@@ -0,0 +1,133 @@
+/**
+ * Input Validation Utilities
+ *
+ * General input sanitization and pattern matching.
+ *
+ * Security Features:
+ * - RegExp injection prevention (SMI-722)
+ * - Input sanitization
+ * - Pattern validation
+ */
+/**
+ * Sanitize input string for safe use in various contexts
+ *
+ * Removes or escapes potentially dangerous characters.
+ *
+ * @param input - Input string to sanitize
+ * @param options - Sanitization options
+ * @returns Sanitized string
+ *
+ * @example
+ * ```typescript
+ * sanitizeInput('<script>alert(1)</script>')  // Returns: '&lt;script&gt;alert(1)&lt;/script&gt;'
+ * sanitizeInput('../../etc/passwd')           // Returns: 'etc/passwd'
+ * ```
+ */
+export function sanitizeInput(input, options = {}) {
+    const { removePathTraversal = true, escapeHtml = true, removeNullBytes = true } = options;
+    let sanitized = input;
+    // Remove null bytes (security risk)
+    if (removeNullBytes) {
+        sanitized = sanitized.replace(/\0/g, '');
+    }
+    // Remove path traversal sequences
+    // SMI-2262: Loop-based sanitization to prevent bypass with nested patterns
+    // e.g., '..././' becomes '../' after single-pass removal
+    if (removePathTraversal) {
+        let previousPass = '';
+        const maxIterations = 10; // Prevent infinite loops on malformed input
+        for (let i = 0; i < maxIterations && previousPass !== sanitized; i++) {
+            previousPass = sanitized;
+            // Remove '../' and '..\' patterns
+            sanitized = sanitized.replace(/\.\.[\\/]/g, '');
+            // Remove leading '../' or '..\'
+            sanitized = sanitized.replace(/^\.\.[\\/]+/, '');
+        }
+    }
+    // HTML escape
+    if (escapeHtml) {
+        sanitized = sanitized
+            .replace(/&/g, '&amp;')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;')
+            .replace(/"/g, '&quot;')
+            .replace(/'/g, '&#x27;');
+    }
+    return sanitized;
+}
+/**
+ * Safely test a string against a pattern, preventing RegExp injection (SMI-722)
+ *
+ * Tries exact match, prefix match, and regex match (with error handling).
+ * Falls back to includes check if regex is invalid.
+ *
+ * @param value - Value to test
+ * @param pattern - Pattern to match (string or regex)
+ * @returns True if value matches pattern
+ *
+ * @example
+ * ```typescript
+ * safePatternMatch('node_modules', 'node_modules')  // true (exact)
+ * safePatternMatch('node_modules/pkg', 'node_')     // true (prefix)
+ * safePatternMatch('test.js', '\\.js$')             // true (regex)
+ * safePatternMatch('test.js', '(evil')              // false (invalid regex, falls back)
+ * ```
+ */
+export function safePatternMatch(value, pattern) {
+    // Exact match
+    if (value === pattern) {
+        return true;
+    }
+    // Check if pattern looks like a regex (contains special chars)
+    // If it's a simple alphanumeric pattern, only do prefix matching
+    const isLikelyRegex = /[\\^$.*+?()[\]{}|]/.test(pattern);
+    if (!isLikelyRegex) {
+        // Simple pattern - only match as prefix
+        return value.startsWith(pattern);
+    }
+    // Try regex match with error handling for patterns that look like regex
+    try {
+        const regex = new RegExp(pattern);
+        return regex.test(value);
+    }
+    catch {
+        // Invalid regex - fall back to safe includes check
+        return value.includes(pattern);
+    }
+}
+/**
+ * Validate that patterns array is safe to use
+ *
+ * Checks for potentially dangerous regex patterns that could cause ReDoS.
+ *
+ * @param patterns - Array of patterns to validate
+ * @returns Array of validation warnings (empty if all patterns are safe)
+ *
+ * @example
+ * ```typescript
+ * validatePatterns(['node_modules', '\\.js$'])  // []
+ * validatePatterns(['(a+)+b'])                  // ['Pattern may cause ReDoS: (a+)+b']
+ * ```
+ */
+export function validatePatterns(patterns) {
+    const warnings = [];
+    for (const pattern of patterns) {
+        // Check for potentially dangerous nested quantifiers (ReDoS)
+        if (/(\(.*\+.*\))\+/.test(pattern) || /(\(.*\*.*\))\*/.test(pattern)) {
+            warnings.push(`Pattern may cause ReDoS (nested quantifiers): ${pattern}`);
+        }
+        // Check for extremely long patterns
+        if (pattern.length > 1000) {
+            warnings.push(`Pattern is suspiciously long (${pattern.length} chars): ${pattern.slice(0, 50)}...`);
+        }
+        // Try to compile as regex to check validity
+        try {
+            new RegExp(pattern);
+        }
+        catch {
+            warnings.push(`Invalid regex pattern: ${pattern}`);
+        }
+    }
+    return warnings;
+}
+//# sourceMappingURL=input-validators.js.map

package/dist/validation/input-validators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-validators.js","sourceRoot":"","sources":["../../src/validation/input-validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,UAOI,EAAE;IAEN,MAAM,EAAE,mBAAmB,GAAG,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,eAAe,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;IAEzF,IAAI,SAAS,GAAG,KAAK,CAAA;IAErB,oCAAoC;IACpC,IAAI,eAAe,EAAE,CAAC;QACpB,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC1C,CAAC;IAED,kCAAkC;IAClC,2EAA2E;IAC3E,yDAAyD;IACzD,IAAI,mBAAmB,EAAE,CAAC;QACxB,IAAI,YAAY,GAAG,EAAE,CAAA;QACrB,MAAM,aAAa,GAAG,EAAE,CAAA,CAAC,4CAA4C;QAErE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACrE,YAAY,GAAG,SAAS,CAAA;YACxB,kCAAkC;YAClC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;YAC/C,gCAAgC;YAChC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;IAED,cAAc;IACd,IAAI,UAAU,EAAE,CAAC;QACf,SAAS,GAAG,SAAS;aAClB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;aACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;aACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;aACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;aACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC5B,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,OAAe;IAC7D,cAAc;IACd,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,+DAA+D;IAC/D,iEAAiE;IACjE,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAExD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,wCAAwC;QACxC,OAAO,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,wEAAwE;IACxE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAA;QACjC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;QACnD,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAkB;IACjD,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,6DAA6D;QAC7D,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrE,QAAQ,CAAC,IAAI,CAAC,iDAAiD,OAAO,EAAE,CAAC,CAAA;QAC3E,CAAC;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CACX,iCAAiC,OAAO,CAAC,MAAM,YAAY,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CACrF,CAAA;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,OAAO,CAAC,CAAA;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/validation/path-validators.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Path Validation Utilities (SMI-720)
+ *
+ * Path traversal prevention validators.
+ */
+/**
+ * Validate file path to prevent path traversal attacks (SMI-720)
+ *
+ * Ensures the resolved path remains within the allowed root directory.
+ *
+ * @param path - Path to validate (can be relative or absolute)
+ * @param rootDir - Root directory that must contain the path
+ * @throws {ValidationError} if path escapes root directory
+ *
+ * @example
+ * ```typescript
+ * validatePath('skills/my-skill', '/home/user/.claude')  // OK
+ * validatePath('../etc/passwd', '/home/user/.claude')    // Throws ValidationError
+ * validatePath('/etc/passwd', '/home/user/.claude')      // Throws ValidationError
+ * ```
+ */
+export declare function validatePath(path: string, rootDir: string): void;
+//# sourceMappingURL=path-validators.d.ts.map

package/dist/validation/path-validators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-validators.d.ts","sourceRoot":"","sources":["../../src/validation/path-validators.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CA2BhE"}

package/dist/validation/path-validators.js

@@ -0,0 +1,47 @@
+/**
+ * Path Validation Utilities (SMI-720)
+ *
+ * Path traversal prevention validators.
+ */
+import { resolve } from 'path';
+import { ValidationError } from './validation-error.js';
+/**
+ * Validate file path to prevent path traversal attacks (SMI-720)
+ *
+ * Ensures the resolved path remains within the allowed root directory.
+ *
+ * @param path - Path to validate (can be relative or absolute)
+ * @param rootDir - Root directory that must contain the path
+ * @throws {ValidationError} if path escapes root directory
+ *
+ * @example
+ * ```typescript
+ * validatePath('skills/my-skill', '/home/user/.claude')  // OK
+ * validatePath('../etc/passwd', '/home/user/.claude')    // Throws ValidationError
+ * validatePath('/etc/passwd', '/home/user/.claude')      // Throws ValidationError
+ * ```
+ */
+export function validatePath(path, rootDir) {
+    if (!path) {
+        throw new ValidationError('Path cannot be empty', 'EMPTY_PATH');
+    }
+    if (!rootDir) {
+        throw new ValidationError('Root directory cannot be empty', 'EMPTY_ROOT_DIR');
+    }
+    // Normalize both paths to resolve '..' and '.'
+    // Resolve path relative to rootDir so relative paths work correctly
+    const normalizedPath = resolve(rootDir, path);
+    const normalizedRoot = resolve(rootDir);
+    // Check that normalized path is within root directory
+    // Handle edge case where path equals root exactly
+    const isWithinRoot = normalizedPath.startsWith(normalizedRoot + '/') || normalizedPath === normalizedRoot;
+    if (!isWithinRoot) {
+        throw new ValidationError(`Path traversal detected: ${path}`, 'PATH_TRAVERSAL', {
+            originalPath: path,
+            normalizedPath,
+            rootDir,
+            normalizedRoot,
+        });
+    }
+}
+//# sourceMappingURL=path-validators.js.map

package/dist/validation/path-validators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-validators.js","sourceRoot":"","sources":["../../src/validation/path-validators.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAe;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,eAAe,CAAC,sBAAsB,EAAE,YAAY,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,gCAAgC,EAAE,gBAAgB,CAAC,CAAA;IAC/E,CAAC;IAED,+CAA+C;IAC/C,oEAAoE;IACpE,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC7C,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAEvC,sDAAsD;IACtD,kDAAkD;IAClD,MAAM,YAAY,GAChB,cAAc,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,IAAI,cAAc,KAAK,cAAc,CAAA;IAEtF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,eAAe,CAAC,4BAA4B,IAAI,EAAE,EAAE,gBAAgB,EAAE;YAC9E,YAAY,EAAE,IAAI;YAClB,cAAc;YACd,OAAO;YACP,cAAc;SACf,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}

package/dist/validation/url-validators.d.ts

@@ -0,0 +1,55 @@
+/**
+ * URL Validation Utilities (SMI-721, SMI-729)
+ *
+ * SSRF prevention validators for URL access.
+ *
+ * Security Features:
+ * - Protocol validation (http/https only)
+ * - Private IPv4 range blocking
+ * - Private IPv6 range blocking
+ * - Localhost and loopback blocking
+ */
+/**
+ * Get human-readable IP range name for error messages
+ */
+export declare function getIpRangeName(a: number, b: number): string;
+/**
+ * Validate IPv6 address to prevent SSRF attacks (SMI-729)
+ *
+ * Blocks:
+ * - Link-local: fe80::/10
+ * - Unique local addresses (ULA): fc00::/7
+ * - Multicast: ff00::/8
+ * - IPv4-mapped IPv6: ::ffff:0:0/96
+ * - Loopback ::1 (already blocked above)
+ *
+ * @param hostname - IPv6 hostname to validate
+ * @param url - Full URL for error context
+ * @throws {ValidationError} if IPv6 address is not allowed
+ */
+export declare function validateIPv6(hostname: string, url: string): void;
+/**
+ * Validate URL to prevent SSRF attacks (SMI-721, SMI-729)
+ *
+ * Blocks:
+ * - Non-http(s) protocols
+ * - Private IPv4 ranges (10.x, 172.16-31.x, 192.168.x)
+ * - Private IPv6 ranges (fe80::/10, fc00::/7, ff00::/8, ::ffff:0:0/96)
+ * - Localhost variants (127.x, localhost, ::1, 0.0.0.0)
+ * - Link-local addresses (169.254.x, fe80::/10)
+ * - Current network (0.x)
+ *
+ * @param url - URL to validate
+ * @throws {ValidationError} if URL is not allowed
+ *
+ * @example
+ * ```typescript
+ * validateUrl('https://example.com/api')  // OK
+ * validateUrl('http://localhost:3000')    // Throws ValidationError
+ * validateUrl('ftp://example.com')        // Throws ValidationError
+ * validateUrl('http://192.168.1.1')       // Throws ValidationError
+ * validateUrl('http://[fe80::1]')         // Throws ValidationError (IPv6 link-local)
+ * ```
+ */
+export declare function validateUrl(url: string): void;
+//# sourceMappingURL=url-validators.d.ts.map

package/dist/validation/url-validators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-validators.d.ts","sourceRoot":"","sources":["../../src/validation/url-validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH;;GAEG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ3D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAgNhE;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAoE7C"}