@tritard/waterbrother 0.16.1 → 0.16.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tritard/waterbrother",
-  "version": "0.16.1",
+  "version": "0.16.3",
   "description": "Waterbrother: bring-your-own-model coding CLI with local tools, sessions, operator modes, and approval controls",
   "type": "module",
   "bin": {

package/src/security.js

@@ -52,17 +52,33 @@ function checkFilePath(filePath, cwd) {
   const normalized = filePath.replace(/\\/g, "/");
   const cwdNorm = cwd.replace(/\\/g, "/");
 
+  // Resolve the actual target path
+  const resolved = path.resolve(cwd, filePath).replace(/\\/g, "/");
+  const resolvedLower = resolved.toLowerCase();
+  const cwdLower = cwdNorm.toLowerCase();
+
   // Scope escalation: writing outside project directory
-  if (!normalized.startsWith(cwdNorm) && !normalized.startsWith("./") && !normalized.startsWith("../")) {
-    // Absolute path outside cwd
-    if (path.isAbsolute(filePath)) {
-      reasons.push({ rule: "scope-escalation", message: `Writing outside project directory: ${filePath}` });
+  // Check for directory traversal (../../etc/passwd) and absolute paths outside cwd
+  if (!resolvedLower.startsWith(cwdLower + "/") && resolvedLower !== cwdLower) {
+    reasons.push({ rule: "scope-escalation", message: `Writing outside project directory: ${filePath}` });
+  }
+
+  // Dangerous system paths — never allow regardless of cwd
+  const dangerousPaths = ["/etc", "/usr", "/bin", "/sbin", "/var", "/root", "/sys", "/proc", "C:/Windows", "C:/Program Files"];
+  for (const dp of dangerousPaths) {
+    if (resolvedLower.startsWith(dp.toLowerCase())) {
+      reasons.push({ rule: "system-path-write", message: `Writing to system directory: ${resolved}` });
+      break;
     }
   }
 
-  // Home directory protection
+  // Home directory protection — only block writes to home dir root itself
+  // Allow writes to subdirectories (Desktop/my-project, Documents/app, etc.)
   if (HOME_DIR && cwdNorm === HOME_DIR) {
-    reasons.push({ rule: "home-dir-write", message: "Writing files in home directory — use a project directory instead" });
+    const depth = resolved.split("/").length - HOME_DIR.split("/").length;
+    if (depth <= 1) {
+      reasons.push({ rule: "home-dir-write", message: "Writing files in home directory — use a project directory instead" });
+    }
   }
 
   // Self-modification