@vib3code/sdk 2.0.3-canary.183c93e → 2.0.3-canary.1f10a9c

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vib3code/sdk",
-  "version": "2.0.3-canary.183c93e",
+  "version": "2.0.3-canary.1f10a9c",
   "description": "VIB3+ 4D Visualization SDK - Unified engine with 6D rotation, MCP agentic integration, and cross-platform support",
   "type": "module",
   "main": "src/core/VIB3Engine.js",
@@ -9,9 +9,7 @@
     "vib3": "./src/cli/index.js",
     "vib3-mcp": "./src/agent/mcp/stdio-server.js"
   },
-  "sideEffects": [
-    "./src/geometry/builders/*.js"
-  ],
+  "sideEffects": false,
   "exports": {
     ".": {
       "types": "./types/adaptive-sdk.d.ts",

package/src/cli/index.js

@@ -5,9 +5,34 @@
  */
 
 import { performance } from 'node:perf_hooks';
+import path from 'node:path';
 import { mcpServer, toolDefinitions } from '../agent/index.js';
 import { schemaRegistry } from '../schemas/index.js';
 
+/**
+ * Resolves a file path and ensures it is within the current working directory.
+ * @param {string} filePath The path to validate
+ * @returns {string} The resolved absolute path
+ * @throws {Error} If the path is outside the allowed directory
+ */
+function getSafePath(filePath) {
+    if (!filePath) return filePath;
+
+    const cwd = process.cwd();
+    const resolvedPath = path.resolve(cwd, filePath);
+    const relative = path.relative(cwd, resolvedPath);
+
+    const isOutside = relative.startsWith('..') || path.isAbsolute(relative);
+
+    if (isOutside) {
+        const error = new Error('Security Error: Path traversal detected. Access denied.');
+        error.code = 'EACCES';
+        throw error;
+    }
+
+    return resolvedPath;
+}
+
 /**
  * CLI Configuration
  */
@@ -446,7 +471,7 @@ async function handleTools(parsed, startTime) {
  */
 async function handleValidate(parsed, startTime) {
     const subcommand = parsed.subcommand || 'pack';
-    const filePath = parsed.options.file || parsed.options.f || parsed.positional[0];
+    let filePath = parsed.options.file || parsed.options.f || parsed.positional[0];
 
     if (!filePath && subcommand !== 'schema') {
         return wrapResponse('validate', {
@@ -460,6 +485,10 @@ async function handleValidate(parsed, startTime) {
     }
 
     try {
+        if (filePath) {
+            filePath = getSafePath(filePath);
+        }
+
         switch (subcommand) {
             case 'pack': {
                 // Validate a .vib3 scene pack file
@@ -533,6 +562,17 @@ async function handleValidate(parsed, startTime) {
                 }, false, performance.now() - startTime);
         }
     } catch (error) {
+        if (error.code === 'EACCES') {
+            return wrapResponse('validate', {
+                error: {
+                    type: 'SecurityError',
+                    code: 'ACCESS_DENIED',
+                    message: error.message,
+                    suggestion: 'Ensure the file path is within the project directory'
+                }
+            }, false, performance.now() - startTime);
+        }
+
         if (error.code === 'ENOENT') {
             return wrapResponse('validate', {
                 error: {
@@ -659,7 +699,6 @@ async function main() {
  */
 async function handleInit(parsed, startTime) {
     const { writeFileSync, mkdirSync, existsSync } = await import('node:fs');
-    const { join } = await import('node:path');
 
     const projectName = parsed.subcommand || parsed.positional[0] || 'my-vib3-app';
     const template = parsed.options.template || parsed.options.t || 'vanilla';
@@ -677,7 +716,22 @@ async function handleInit(parsed, startTime) {
         }, false, performance.now() - startTime);
     }
 
-    const projectDir = join(process.cwd(), projectName);
+    let projectDir;
+    try {
+        projectDir = getSafePath(projectName);
+    } catch (error) {
+        if (error.code === 'EACCES') {
+            return wrapResponse('init', {
+                error: {
+                    type: 'SecurityError',
+                    code: 'ACCESS_DENIED',
+                    message: error.message,
+                    suggestion: 'Choose a project name that results in a valid subdirectory'
+                }
+            }, false, performance.now() - startTime);
+        }
+        throw error;
+    }
 
     if (existsSync(projectDir)) {
         return wrapResponse('init', {
@@ -695,8 +749,8 @@ async function handleInit(parsed, startTime) {
     const files = getTemplateFiles(template, projectName);
 
     for (const [filename, content] of Object.entries(files)) {
-        const filepath = join(projectDir, filename);
-        const dir = join(projectDir, filename.split('/').slice(0, -1).join('/'));
+        const filepath = path.join(projectDir, filename);
+        const dir = path.join(projectDir, filename.split('/').slice(0, -1).join('/'));
         if (dir !== projectDir) {
             mkdirSync(dir, { recursive: true });
         }

package/src/export/SVGExporter.js

@@ -355,17 +355,21 @@ function projectPoints(points, rotor, dimension, width, height) {
     const centerY = height / 2;
     const scale = Math.min(width, height) * 0.4;
 
+    // Reuse vectors to minimize allocation
+    const rotatedBuffer = new Vec4();
+    const projectedBuffer = new Vec4();
+
     for (const point of points) {
         // Apply 4D rotation
-        const rotated = rotor.rotate(point);
+        rotor.rotate(point, rotatedBuffer);
 
         // Project to 3D (perspective from W)
-        const proj3d = rotated.projectPerspective(dimension);
+        rotatedBuffer.projectPerspective(dimension, projectedBuffer);
 
         // Project to 2D (simple orthographic for clean SVG)
-        const x = centerX + proj3d.x * scale;
-        const y = centerY - proj3d.y * scale; // Flip Y for SVG coordinates
-        const depth = proj3d.z; // Keep depth for styling
+        const x = centerX + projectedBuffer.x * scale;
+        const y = centerY - projectedBuffer.y * scale; // Flip Y for SVG coordinates
+        const depth = projectedBuffer.z; // Keep depth for styling
 
         projected.push({ x, y, depth, original: point });
     }

package/src/geometry/warp/HypersphereCore.js

@@ -16,13 +16,14 @@ import { Vec4 } from '../../math/Vec4.js';
  * @param {number} radius - Hypersphere radius
  * @returns {Vec4} Point on hypersphere
  */
-export function projectToHypersphere(point, radius = 1) {
+export function projectToHypersphere(point, radius = 1, target = null) {
     const len = point.length();
     if (len < 0.0001) {
         // Handle origin - project to north pole
+        if (target) return target.set(0, 0, 0, radius);
         return new Vec4(0, 0, 0, radius);
     }
-    return point.scale(radius / len);
+    return point.scale(radius / len, target);
 }
 
 /**
@@ -30,9 +31,10 @@ export function projectToHypersphere(point, radius = 1) {
  * Maps all of 3D space onto the 4D hypersphere
  * @param {Vec4} point - Input point (uses x, y, z)
  * @param {number} radius - Hypersphere radius
+ * @param {Vec4} [target=null] - Optional target vector
  * @returns {Vec4} Point on hypersphere
  */
-export function stereographicToHypersphere(point, radius = 1) {
+export function stereographicToHypersphere(point, radius = 1, target = null) {
     const x = point.x;
     const y = point.y;
     const z = point.z;
@@ -40,6 +42,15 @@ export function stereographicToHypersphere(point, radius = 1) {
     const sumSq = x * x + y * y + z * z;
     const denom = sumSq + 1;
 
+    if (target) {
+        return target.set(
+            (2 * x) / denom * radius,
+            (2 * y) / denom * radius,
+            (2 * z) / denom * radius,
+            (sumSq - 1) / denom * radius
+        );
+    }
+
     return new Vec4(
         (2 * x) / denom * radius,
         (2 * y) / denom * radius,
@@ -56,12 +67,22 @@ export function stereographicToHypersphere(point, radius = 1) {
  * @param {number} phi - Azimuth on base S² (0 to 2π)
  * @param {number} psi - Fiber angle (0 to 2π)
  * @param {number} radius - Hypersphere radius
+ * @param {Vec4} [target=null] - Optional target vector
  * @returns {Vec4} Point on hypersphere
  */
-export function hopfFibration(theta, phi, psi, radius = 1) {
+export function hopfFibration(theta, phi, psi, radius = 1, target = null) {
     const cosTheta2 = Math.cos(theta / 2);
     const sinTheta2 = Math.sin(theta / 2);
 
+    if (target) {
+        return target.set(
+            cosTheta2 * Math.cos((phi + psi) / 2) * radius,
+            cosTheta2 * Math.sin((phi + psi) / 2) * radius,
+            sinTheta2 * Math.cos((phi - psi) / 2) * radius,
+            sinTheta2 * Math.sin((phi - psi) / 2) * radius
+        );
+    }
+
     return new Vec4(
         cosTheta2 * Math.cos((phi + psi) / 2) * radius,
         cosTheta2 * Math.sin((phi + psi) / 2) * radius,
@@ -78,8 +99,9 @@ export function hopfFibration(theta, phi, psi, radius = 1) {
  * @returns {Vec4[]} Warped vertices
  */
 export function warpRadial(vertices, radius = 1, blendFactor = 1) {
+    const onSphere = new Vec4();
     return vertices.map(v => {
-        const onSphere = projectToHypersphere(v, radius);
+        projectToHypersphere(v, radius, onSphere);
         return v.lerp(onSphere, blendFactor);
     });
 }
@@ -93,8 +115,9 @@ export function warpRadial(vertices, radius = 1, blendFactor = 1) {
  * @returns {Vec4[]} Warped vertices
  */
 export function warpStereographic(vertices, radius = 1, scale = 1) {
+    const scaled = new Vec4();
     return vertices.map(v => {
-        const scaled = v.scale(scale);
+        v.scale(scale, scaled);
         return stereographicToHypersphere(scaled, radius);
     });
 }
@@ -146,25 +169,31 @@ export function warpHypersphereCore(geometry, options = {}) {
         twist = 1
     } = options;
 
-    let warpedVertices;
-
-    // Pre-scale vertices
-    const scaledVertices = geometry.vertices.map(v => v.scale(scale));
-
-    switch (method) {
-        case 'stereographic':
-            warpedVertices = warpStereographic(scaledVertices, radius, 1);
-            break;
-
-        case 'hopf':
-            warpedVertices = warpHopf(scaledVertices, radius, twist);
-            break;
+    const temp = new Vec4();
+    const warpedVertices = geometry.vertices.map(v => {
+        // Combined scaling and warping to minimize allocations
+        const result = v.scale(scale);
+
+        if (method === 'stereographic') {
+            stereographicToHypersphere(result, radius, result);
+        } else if (method === 'hopf') {
+            const r = result.length();
+            if (r < 0.0001) {
+                result.set(0, 0, 0, radius);
+            } else {
+                const theta = Math.acos(result.z / r);
+                const phi = Math.atan2(result.y, result.x);
+                const psi = result.w * twist + phi * 0.5;
+                hopfFibration(theta, phi, psi, radius, result);
+            }
+        } else {
+            // Radial (default)
+            projectToHypersphere(result, radius, temp);
+            result.lerp(temp, blend, result);
+        }
 
-        case 'radial':
-        default:
-            warpedVertices = warpRadial(scaledVertices, radius, blend);
-            break;
-    }
+        return result;
+    });
 
     return {
         ...geometry,