@timekast/factory 1.17.0 → 1.17.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/lib/atomic-swap.js +4 -4
- package/package.json +1 -1
package/dist/lib/atomic-swap.js
CHANGED
|
@@ -26,21 +26,21 @@ import { CLIError } from './cli-error.js';
|
|
|
26
26
|
import { CLAUDE_MD_FILE, TIMEKAST_DIR } from './constants.js';
|
|
27
27
|
import { parseLockfile } from './lockfile.js';
|
|
28
28
|
/** Roots a manifest path may live under (mirrors `profiles.json#track`). */
|
|
29
|
-
const ALLOWED_ROOTS = ['.claude/', 'scripts/'];
|
|
29
|
+
const ALLOWED_ROOTS = ['.claude/', 'scripts/', '.husky/'];
|
|
30
30
|
/**
|
|
31
31
|
* Reject a manifest path that is unsafe to write: absolute, escaping via `..`, or
|
|
32
|
-
* outside the tracked scope (`.claude/**`, `scripts/**`, `CLAUDE.md
|
|
32
|
+
* outside the tracked scope (`.claude/**`, `scripts/**`, `CLAUDE.md`, `.husky/**`). A correct
|
|
33
33
|
* release never produces these — this guards a mispublished/tampered tarball from
|
|
34
34
|
* writing `src/` or escaping the repo root. Separator-agnostic (Windows-safe).
|
|
35
35
|
*/
|
|
36
|
-
function assertSafeTrackedPath(rel) {
|
|
36
|
+
export function assertSafeTrackedPath(rel) {
|
|
37
37
|
const segments = rel.split(/[\\/]/);
|
|
38
38
|
if (rel.length === 0 || path.isAbsolute(rel) || segments.includes('..')) {
|
|
39
39
|
throw new CLIError(`El manifest declara un path inseguro \`${rel}\` (absoluto o con \`..\`); no se tocó nada.`);
|
|
40
40
|
}
|
|
41
41
|
const tracked = rel === CLAUDE_MD_FILE || ALLOWED_ROOTS.some((root) => rel.startsWith(root));
|
|
42
42
|
if (!tracked) {
|
|
43
|
-
throw new CLIError(`El manifest declara \`${rel}\`, fuera del scope rastreado (\`.claude/\`, \`scripts/\`, \`CLAUDE.md
|
|
43
|
+
throw new CLIError(`El manifest declara \`${rel}\`, fuera del scope rastreado (\`.claude/\`, \`scripts/\`, \`CLAUDE.md\`, \`.husky/\`). ` +
|
|
44
44
|
'El release está mal construido; no se tocó nada.');
|
|
45
45
|
}
|
|
46
46
|
}
|