@unbrained/pm-cli 2026.7.2 → 2026.7.4

package/dist/cli/commands/validate.d.ts

@@ -163,6 +163,7 @@ declare function classifyOrphanedPath(pathValue: string): OrphanedPathClassifica
 declare function sharedDirectoryPrefixLength(left: string, right: string): number;
 declare function buildOrphanedPathRows(orphanedFiles: readonly string[], items: readonly ItemWithBody[]): OrphanedPathRow[];
 declare function summarizeOrphanedPathRows(rows: readonly OrphanedPathRow[]): string[];
+declare function linkedArtifactPathExceedsFilesystemLimits(artifactPath: string): boolean;
 declare function buildLifecycleCheck(items: ItemWithBody[], includeStaleBlockers: boolean, dependencyCycleSeverity: ValidateDependencyCycleSeverity, parentCycleSeverity: ValidateDependencyCycleSeverity, statusRegistry: RuntimeStatusRegistry, lifecyclePatternPolicy: LifecyclePatternPolicy, verboseDiagnostics: boolean, idPrefix?: string): {
     check: ValidateCheck;
     warnings: string[];
@@ -215,6 +216,7 @@ export declare const _testOnlyValidateCommand: {
     extractItemIds: typeof extractItemIds;
     findLifecycleDependencyCycleComponents: typeof findLifecycleDependencyCycleComponents;
     isMetadataFieldMissing: typeof isMetadataFieldMissing;
+    linkedArtifactPathExceedsFilesystemLimits: typeof linkedArtifactPathExceedsFilesystemLimits;
     listFilesRecursive: typeof listFilesRecursive;
     resolveDependencyCycleSeverity: typeof resolveDependencyCycleSeverity;
     resolveParentCycleSeverity: typeof resolveParentCycleSeverity;

package/dist/cli/commands/validate.js

@@ -4,7 +4,7 @@
  * Implements the pm validate command surface and its agent-facing runtime behavior.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="96011574-703c-57e6-979f-dbae265fd01b")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e12634b8-369c-5ccf-99ad-ffd5ed8c0182")}catch(e){}}();
 import fs from "node:fs/promises";
 import { realpathSync } from "node:fs";
 import { execFile } from "node:child_process";
@@ -122,6 +122,9 @@ const METADATA_TRUNCATED_KEY_BY_FIELD = {
 const GIT_LS_FILES_MAX_BUFFER = 32 * 1024 * 1024;
 const FILE_LIST_SUMMARY_LIMIT = 40;
 const DIAGNOSTIC_LIST_SUMMARY_LIMIT = 5;
+// Conservative pre-stat guard for common filesystem limits; over-limit links are unreadable, not prune-safe.
+const LINKED_ARTIFACT_MAX_PATH_LENGTH = 4096;
+const LINKED_ARTIFACT_MAX_SEGMENT_LENGTH = 255;
 const execFileAsync = promisify(execFile);
 function normalizeRelativePath(value) {
     return value.replaceAll("\\", "/").replace(/^\.\/+/, "").replace(/^\/+/, "");
@@ -536,9 +539,9 @@ const RESOLUTION_REMEDIATION_PLACEHOLDER_BY_FIELD = {
 };
 function buildResolutionRemediationCommand(row) {
     const fieldArguments = row.missing_fields
-        .map((field) => `${RESOLUTION_REMEDIATION_FLAG_BY_FIELD[field]} \"${RESOLUTION_REMEDIATION_PLACEHOLDER_BY_FIELD[field]}\"`)
+        .map((field) => `${RESOLUTION_REMEDIATION_FLAG_BY_FIELD[field]} "${RESOLUTION_REMEDIATION_PLACEHOLDER_BY_FIELD[field]}"`)
         .join(" ");
-    return `pm update ${row.id} ${fieldArguments} --message \"Backfill resolution metadata\"`;
+    return `pm update ${row.id} ${fieldArguments} --message "Backfill resolution metadata"`;
 }
 /**
  * Attach a uniform, machine-executable `fix_hints` array to a validate check's
@@ -1267,8 +1270,16 @@ function buildLifecycleWarnings(rows, includeStaleBlockers, dependencyCycleSever
     const parentWarning = lifecycleCycleWarningToken("validate_hierarchy_parent_cycle", parentCycleSeverity, parentCycleCount);
     return [...warnings, ...(dependencyWarning ? [dependencyWarning] : []), ...(parentWarning ? [parentWarning] : [])];
 }
+function linkedArtifactPathExceedsFilesystemLimits(artifactPath) {
+    const normalized = normalizeRelativePath(artifactPath);
+    return (normalized.length > LINKED_ARTIFACT_MAX_PATH_LENGTH ||
+        normalized.split(/[\\/]/).some((segment) => segment.length > LINKED_ARTIFACT_MAX_SEGMENT_LENGTH));
+}
 async function linkedArtifactIsMissing(workspaceRoot, artifactPath) {
     const absolutePath = path.isAbsolute(artifactPath) ? artifactPath : path.resolve(workspaceRoot, artifactPath);
+    if (linkedArtifactPathExceedsFilesystemLimits(absolutePath)) {
+        return false;
+    }
     try {
         const stats = await fs.stat(absolutePath);
         return !stats.isFile() && !stats.isDirectory();
@@ -1800,6 +1811,7 @@ export const _testOnlyValidateCommand = {
     extractItemIds,
     findLifecycleDependencyCycleComponents,
     isMetadataFieldMissing,
+    linkedArtifactPathExceedsFilesystemLimits,
     listFilesRecursive,
     resolveDependencyCycleSeverity,
     resolveParentCycleSeverity,
@@ -1983,4 +1995,4 @@ export async function runValidate(options, global) {
 }
 /* c8 ignore stop */
 //# sourceMappingURL=validate.js.map
-//# debugId=96011574-703c-57e6-979f-dbae265fd01b
+//# debugId=e12634b8-369c-5ccf-99ad-ffd5ed8c0182