@vladimir-ks/aigile 0.2.7 → 0.2.8

package/dist/bin/aigile.js

@@ -1246,7 +1246,7 @@ var init_connection = __esm({
 import { Command as Command23 } from "commander";
 
 // src/index.ts
-var VERSION = true ? "0.2.7" : "0.0.0-dev";
+var VERSION = true ? "0.2.8" : "0.0.0-dev";
 
 // src/bin/aigile.ts
 init_connection();
@@ -1254,7 +1254,7 @@ init_connection();
 // src/commands/init.ts
 import { Command } from "commander";
 import { existsSync as existsSync4, mkdirSync as mkdirSync4, appendFileSync, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
-import { resolve, join as join4, relative, basename as basename2 } from "path";
+import { resolve as resolve2, join as join4, relative, basename as basename2 } from "path";
 
 // src/utils/git.ts
 import { execSync } from "child_process";
@@ -1413,7 +1413,7 @@ function header(title, opts = {}) {
 
 // src/services/template-loader.ts
 import { readdirSync, statSync, readFileSync as readFileSync3, existsSync as existsSync3, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join3, dirname as dirname2 } from "path";
+import { join as join3, dirname as dirname2, resolve, sep } from "path";
 import { fileURLToPath } from "url";
 var __filename = fileURLToPath(import.meta.url);
 var __dirname = dirname2(__filename);
@@ -1465,8 +1465,17 @@ function writeTemplates(targetDir, templates) {
   let written = 0;
   let skipped = 0;
   const errors = [];
+  const resolvedTargetDir = resolve(targetDir);
   for (const template of templates) {
     const fullPath = join3(targetDir, template.relativePath);
+    const resolvedFullPath = resolve(fullPath);
+    if (!resolvedFullPath.startsWith(resolvedTargetDir + sep) && resolvedFullPath !== resolvedTargetDir) {
+      errors.push({
+        path: template.relativePath,
+        error: "Path traversal detected - file path escapes target directory"
+      });
+      continue;
+    }
     if (existsSync3(fullPath)) {
       skipped++;
       continue;
@@ -1494,7 +1503,7 @@ var initCommand = new Command("init").description("Initialize AIGILE in current
   "Module kind: library, service, ui, cli, other (for module profile)"
 ).option("--skip-templates", "Skip template file creation").option("-f, --force", "Reinitialize existing project").action(async (pathArg, options) => {
   const opts = getOutputOptions(initCommand);
-  const targetPath = resolve(pathArg ?? process.cwd());
+  const targetPath = resolve2(pathArg ?? process.cwd());
   try {
     await initProject(targetPath, options, opts);
   } catch (err) {
@@ -7796,11 +7805,11 @@ uxJourneyCommand.command("delete").alias("rm").argument("<key>", "Journey key").
 init_connection();
 import { Command as Command19 } from "commander";
 import { existsSync as existsSync7 } from "fs";
-import { resolve as resolve3, relative as relative4 } from "path";
+import { resolve as resolve4, relative as relative4 } from "path";
 
 // src/services/dependency-graph.ts
 init_connection();
-import { resolve as resolve2, relative as relative3, dirname as dirname3 } from "path";
+import { resolve as resolve3, relative as relative3, dirname as dirname3 } from "path";
 function buildDependencyGraph(projectId) {
   const docs = queryAll(
     `SELECT id, path, meta_status, last_approved_at, last_modified_at, meta_dependencies 
@@ -7835,7 +7844,7 @@ function buildDependencyGraph(projectId) {
 function resolveDocPath(fromPath, relativePath) {
   if (relativePath.startsWith("./") || relativePath.startsWith("../")) {
     const fromDir = dirname3(fromPath);
-    const resolved = resolve2(fromDir, relativePath);
+    const resolved = resolve3(fromDir, relativePath);
     return relative3(".", resolved);
   }
   return relativePath;
@@ -8139,7 +8148,7 @@ async function approveDocument(cwd, filePath, options, opts) {
   if (!config?.project?.key) {
     throw new Error("AIGILE not initialized in this directory");
   }
-  const absolutePath = resolve3(cwd, filePath);
+  const absolutePath = resolve4(cwd, filePath);
   if (!existsSync7(absolutePath)) {
     throw new Error(`File not found: ${filePath}`);
   }
@@ -8173,7 +8182,7 @@ async function approveDocument(cwd, filePath, options, opts) {
       blank();
       info(`Cascade approving ${cascadeResult.affectedDocs.length} dependents...`, opts);
       for (const depPath of cascadeResult.affectedDocs) {
-        const depAbsolute = resolve3(cwd, depPath);
+        const depAbsolute = resolve4(cwd, depPath);
         const depContent = readFileSync8(depAbsolute, "utf-8");
         const updatedDep = updateFrontmatterContent(depContent, {
           status: "APPROVED",
@@ -8200,7 +8209,7 @@ async function acknowledgeDocument(cwd, filePath, opts) {
   if (!config?.project?.key) {
     throw new Error("AIGILE not initialized in this directory");
   }
-  const absolutePath = resolve3(cwd, filePath);
+  const absolutePath = resolve4(cwd, filePath);
   if (!existsSync7(absolutePath)) {
     throw new Error(`File not found: ${filePath}`);
   }
@@ -8223,7 +8232,7 @@ async function markReady(cwd, filePath, opts) {
   if (!config?.project?.key) {
     throw new Error("AIGILE not initialized in this directory");
   }
-  const absolutePath = resolve3(cwd, filePath);
+  const absolutePath = resolve4(cwd, filePath);
   if (!existsSync7(absolutePath)) {
     throw new Error(`File not found: ${filePath}`);
   }
@@ -8251,7 +8260,7 @@ async function markException(cwd, filePath, reason, opts) {
   if (!config?.project?.key) {
     throw new Error("AIGILE not initialized in this directory");
   }
-  const absolutePath = resolve3(cwd, filePath);
+  const absolutePath = resolve4(cwd, filePath);
   if (!existsSync7(absolutePath)) {
     throw new Error(`File not found: ${filePath}`);
   }
@@ -8277,7 +8286,7 @@ async function markRefactoring(cwd, filePath, opts) {
   if (!config?.project?.key) {
     throw new Error("AIGILE not initialized in this directory");
   }
-  const absolutePath = resolve3(cwd, filePath);
+  const absolutePath = resolve4(cwd, filePath);
   if (!existsSync7(absolutePath)) {
     throw new Error(`File not found: ${filePath}`);
   }
@@ -8302,7 +8311,7 @@ async function archiveDocument(cwd, filePath, opts) {
   if (!config?.project?.key) {
     throw new Error("AIGILE not initialized in this directory");
   }
-  const absolutePath = resolve3(cwd, filePath);
+  const absolutePath = resolve4(cwd, filePath);
   if (!existsSync7(absolutePath)) {
     throw new Error(`File not found: ${filePath}`);
   }
@@ -8512,10 +8521,19 @@ var docCommand = new Command19("doc").description("Document integrity and status
 // src/commands/daemon.ts
 init_connection();
 import { Command as Command20 } from "commander";
-import { existsSync as existsSync11, writeFileSync as writeFileSync7, unlinkSync, readFileSync as readFileSync11, mkdirSync as mkdirSync5, statSync as statSync5, renameSync, readdirSync as readdirSync3 } from "fs";
+import {
+  existsSync as existsSync11,
+  writeFileSync as writeFileSync7,
+  unlinkSync,
+  readFileSync as readFileSync11,
+  mkdirSync as mkdirSync5,
+  statSync as statSync5,
+  renameSync,
+  readdirSync as readdirSync3
+} from "fs";
 import { join as join12, dirname as dirname4 } from "path";
 import { homedir as homedir2, platform } from "os";
-import { spawn, execSync as execSync2 } from "child_process";
+import { spawn, spawnSync, execSync as execSync2 } from "child_process";
 init_config();
 
 // src/services/daemon-manager.ts
@@ -8535,7 +8553,7 @@ init_config();
 // src/services/document-status-transitions.ts
 init_connection();
 import { writeFileSync as writeFileSync6, readFileSync as readFileSync9, existsSync as existsSync8 } from "fs";
-import { resolve as resolve4 } from "path";
+import { resolve as resolve5 } from "path";
 import { createHash as createHash2 } from "crypto";
 async function handleDocumentEdit(projectId, docPath, absolutePath) {
   if (!existsSync8(absolutePath)) {
@@ -8633,7 +8651,7 @@ async function onFileChanged(projectId, projectPath, relativeDocPath) {
   if (!isAigileDoc(relativeDocPath)) {
     return;
   }
-  const absolutePath = resolve4(projectPath, relativeDocPath);
+  const absolutePath = resolve5(projectPath, relativeDocPath);
   const transitioned = await handleDocumentEdit(
     projectId,
     relativeDocPath,
@@ -9441,7 +9459,11 @@ function cleanupOldLogs(logDir) {
 function generateLaunchAgentPlist() {
   const paths = getDaemonPaths();
   const nodePath = process.execPath;
-  const aigilePath = join12(dirname4(dirname4(import.meta.url.replace("file://", ""))), "bin", "aigile.js");
+  const aigilePath = join12(
+    dirname4(dirname4(import.meta.url.replace("file://", ""))),
+    "bin",
+    "aigile.js"
+  );
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -9476,7 +9498,11 @@ function generateLaunchAgentPlist() {
 function generateSystemdService() {
   const paths = getDaemonPaths();
   const nodePath = process.execPath;
-  const aigilePath = join12(dirname4(dirname4(import.meta.url.replace("file://", ""))), "bin", "aigile.js");
+  const aigilePath = join12(
+    dirname4(dirname4(import.meta.url.replace("file://", ""))),
+    "bin",
+    "aigile.js"
+  );
   return `[Unit]
 Description=AIGILE File Watcher Daemon
 After=network.target
@@ -9495,7 +9521,9 @@ StandardError=append:${paths.logFile}
 [Install]
 WantedBy=default.target`;
 }
-daemonCommand.command("install").description("Install daemon to start automatically on system boot (watches ALL registered projects)").action(() => {
+daemonCommand.command("install").description(
+  "Install daemon to start automatically on system boot (watches ALL registered projects)"
+).action(() => {
   const opts = getOutputOptions(daemonCommand);
   const paths = getDaemonPaths();
   if (PLATFORM === "darwin") {
@@ -9660,12 +9688,15 @@ daemonCommand.command("status").description("Show daemon status for ALL register
   let totalFiles = { allow: 0, unknown: 0, total: 0 };
   for (const project of projects) {
     const valid = existsSync11(project.path) && existsSync11(join12(project.path, ".aigile"));
-    const counts = queryAll(`
+    const counts = queryAll(
+      `
         SELECT COALESCE(monitoring_category, 'unknown') as monitoring_category, COUNT(*) as count
         FROM documents
         WHERE project_id = ? AND status != 'deleted'
         GROUP BY monitoring_category
-      `, [project.id]);
+      `,
+      [project.id]
+    );
     let allow = 0;
     let unknown = 0;
     for (const row of counts) {
@@ -9689,28 +9720,32 @@ daemonCommand.command("status").description("Show daemon status for ALL register
   }
   const validCount = projectStats.filter((p) => p.valid).length;
   if (opts.json) {
-    console.log(JSON.stringify({
-      success: true,
-      data: {
-        running: status.running,
-        pid: status.pid ?? null,
-        platform: PLATFORM,
-        installed: PLATFORM === "darwin" ? paths.plist && existsSync11(paths.plist) : PLATFORM === "linux" ? paths.service && existsSync11(paths.service) : false,
-        projectCount: projects.length,
-        validProjectCount: validCount,
-        projects: projectStats,
-        totalFiles,
-        paths: {
-          database: getDbPath(),
-          pidFile: paths.pidFile,
-          logFile: paths.logFile
+    console.log(
+      JSON.stringify({
+        success: true,
+        data: {
+          running: status.running,
+          pid: status.pid ?? null,
+          platform: PLATFORM,
+          installed: PLATFORM === "darwin" ? paths.plist && existsSync11(paths.plist) : PLATFORM === "linux" ? paths.service && existsSync11(paths.service) : false,
+          projectCount: projects.length,
+          validProjectCount: validCount,
+          projects: projectStats,
+          totalFiles,
+          paths: {
+            database: getDbPath(),
+            pidFile: paths.pidFile,
+            logFile: paths.logFile
+          }
         }
-      }
-    }));
+      })
+    );
     return;
   }
   console.log("\n\u{1F4CA} Daemon Status\n");
-  console.log(`\u251C\u2500\u2500 Running: ${status.running ? "\u2705 Yes" : "\u274C No"}${status.pid ? ` (PID: ${status.pid})` : ""}`);
+  console.log(
+    `\u251C\u2500\u2500 Running: ${status.running ? "\u2705 Yes" : "\u274C No"}${status.pid ? ` (PID: ${status.pid})` : ""}`
+  );
   console.log(`\u251C\u2500\u2500 Platform: ${PLATFORM}`);
   const installed = PLATFORM === "darwin" ? paths.plist && existsSync11(paths.plist) : PLATFORM === "linux" ? paths.service && existsSync11(paths.service) : false;
   console.log(`\u251C\u2500\u2500 Installed: ${installed ? "\u2705 Yes" : "\u274C No"}`);
@@ -9733,7 +9768,9 @@ daemonCommand.command("status").description("Show daemon status for ALL register
   console.log(`    \u2514\u2500\u2500 Log File: ${paths.logFile}`);
   console.log("");
   if (projectStats.some((p) => !p.valid)) {
-    console.log('\u26A0\uFE0F  Some projects have invalid paths. Run "aigile project cleanup" to remove them.\n');
+    console.log(
+      '\u26A0\uFE0F  Some projects have invalid paths. Run "aigile project cleanup" to remove them.\n'
+    );
   }
 });
 function getRelativeTime(isoDate) {
@@ -9782,25 +9819,35 @@ daemonCommand.command("run").option("--skip-resync", "Skip initial resync on sta
   });
   rotateLogIfNeeded();
   writeFileSync7(paths.pidFile, String(process.pid));
-  console.log(`[${(/* @__PURE__ */ new Date()).toISOString()}] Starting AIGILE daemon for all registered projects...`);
-  console.log(`[${(/* @__PURE__ */ new Date()).toISOString()}] PID: ${process.pid}, Node: ${process.version}, Platform: ${platform()}`);
+  console.log(
+    `[${(/* @__PURE__ */ new Date()).toISOString()}] Starting AIGILE daemon for all registered projects...`
+  );
+  console.log(
+    `[${(/* @__PURE__ */ new Date()).toISOString()}] PID: ${process.pid}, Node: ${process.version}, Platform: ${platform()}`
+  );
   const manager = getDaemonManager();
   if (!options.skipResync) {
     console.log(`[${(/* @__PURE__ */ new Date()).toISOString()}] Performing initial resync for all projects...`);
     try {
       const results = await manager.resyncAll();
       const projectCount = Object.keys(results).length;
-      console.log(`[${(/* @__PURE__ */ new Date()).toISOString()}] Resync complete: ${projectCount} projects synced`);
+      console.log(
+        `[${(/* @__PURE__ */ new Date()).toISOString()}] Resync complete: ${projectCount} projects synced`
+      );
     } catch (err) {
       console.error(`[${(/* @__PURE__ */ new Date()).toISOString()}] Resync warning: ${err}`);
     }
   }
   manager.on("sync", (event) => {
     const categoryStr = event.category ? ` [${event.category}]` : "";
-    console.log(`[${(/* @__PURE__ */ new Date()).toISOString()}] [${event.project}] Synced: ${event.type} ${event.path}${categoryStr}`);
+    console.log(
+      `[${(/* @__PURE__ */ new Date()).toISOString()}] [${event.project}] Synced: ${event.type} ${event.path}${categoryStr}`
+    );
   });
   manager.on("syncError", ({ project, event, error: err }) => {
-    console.error(`[${(/* @__PURE__ */ new Date()).toISOString()}] [${project}] Sync error: ${event.type} ${event.path} - ${err}`);
+    console.error(
+      `[${(/* @__PURE__ */ new Date()).toISOString()}] [${project}] Sync error: ${event.type} ${event.path} - ${err}`
+    );
   });
   manager.on("watcherError", ({ project, error: err }) => {
     console.error(`[${(/* @__PURE__ */ new Date()).toISOString()}] [${project}] Watcher error: ${err}`);
@@ -9811,7 +9858,9 @@ daemonCommand.command("run").option("--skip-resync", "Skip initial resync on sta
     isShuttingDown = true;
     console.log(`[${(/* @__PURE__ */ new Date()).toISOString()}] Shutting down...`);
     const forceExitTimeout = setTimeout(() => {
-      console.error(`[${(/* @__PURE__ */ new Date()).toISOString()}] Shutdown timeout (${SHUTDOWN_TIMEOUT_MS}ms) - forcing exit`);
+      console.error(
+        `[${(/* @__PURE__ */ new Date()).toISOString()}] Shutdown timeout (${SHUTDOWN_TIMEOUT_MS}ms) - forcing exit`
+      );
       if (existsSync11(paths.pidFile)) {
         try {
           unlinkSync(paths.pidFile);
@@ -9834,15 +9883,20 @@ daemonCommand.command("run").option("--skip-resync", "Skip initial resync on sta
   };
   process.on("SIGTERM", shutdown);
   process.on("SIGINT", shutdown);
-  const logRotationInterval = setInterval(() => {
-    rotateLogIfNeeded();
-  }, 60 * 60 * 1e3);
+  const logRotationInterval = setInterval(
+    () => {
+      rotateLogIfNeeded();
+    },
+    60 * 60 * 1e3
+  );
   process.on("exit", () => {
     clearInterval(logRotationInterval);
   });
   try {
     const status = await manager.start();
-    console.log(`[${(/* @__PURE__ */ new Date()).toISOString()}] Daemon started - watching ${status.watchingCount} projects`);
+    console.log(
+      `[${(/* @__PURE__ */ new Date()).toISOString()}] Daemon started - watching ${status.watchingCount} projects`
+    );
     for (const p of status.projects) {
       if (p.watching) {
         console.log(`[${(/* @__PURE__ */ new Date()).toISOString()}]   \u2713 ${p.key}: ${p.path}`);
@@ -9863,6 +9917,11 @@ daemonCommand.command("logs").option("-n, --lines <number>", "Number of lines to
     info("No log file found. Daemon may not have run yet.", opts);
     return;
   }
+  const lines = parseInt(options.lines, 10);
+  if (isNaN(lines) || lines < 1 || lines > 1e4) {
+    error("Invalid lines parameter. Must be a number between 1 and 10000.", opts);
+    return;
+  }
   if (options.follow) {
     const tail = spawn("tail", ["-f", paths.logFile], {
       stdio: "inherit"
@@ -9873,8 +9932,14 @@ daemonCommand.command("logs").option("-n, --lines <number>", "Number of lines to
     });
   } else {
     try {
-      const output = execSync2(`tail -n ${options.lines} "${paths.logFile}"`, { encoding: "utf-8" });
-      console.log(output);
+      const result = spawnSync("tail", ["-n", lines.toString(), paths.logFile], {
+        encoding: "utf-8"
+      });
+      if (result.status === 0 && result.stdout) {
+        console.log(result.stdout);
+      } else {
+        error("Failed to read log file", opts);
+      }
     } catch {
       error("Failed to read log file", opts);
     }
@@ -9892,13 +9957,15 @@ daemonCommand.command("resync").option("--project <key>", "Resync only a specifi
         process.exit(1);
       }
       if (opts.json) {
-        console.log(JSON.stringify({
-          success: true,
-          data: {
-            project: options.project,
-            ...result
-          }
-        }));
+        console.log(
+          JSON.stringify({
+            success: true,
+            data: {
+              project: options.project,
+              ...result
+            }
+          })
+        );
       } else {
         success(`Resync complete for ${options.project}:`, opts);
         console.log(`  Allow:   ${result.allow}`);
@@ -9917,13 +9984,15 @@ daemonCommand.command("resync").option("--project <key>", "Resync only a specifi
     const results = await manager.resyncAll();
     const projectKeys = Object.keys(results);
     if (opts.json) {
-      console.log(JSON.stringify({
-        success: true,
-        data: {
-          projectCount: projectKeys.length,
-          projects: results
-        }
-      }));
+      console.log(
+        JSON.stringify({
+          success: true,
+          data: {
+            projectCount: projectKeys.length,
+            projects: results
+          }
+        })
+      );
     } else {
       success(`Resync complete: ${projectKeys.length} projects`, opts);
       for (const [key, result] of Object.entries(results)) {
@@ -9947,29 +10016,36 @@ daemonCommand.command("review").option("--list", "Just list unknown files withou
     error("Could not load project config.", opts);
     process.exit(1);
   }
-  const project = queryOne("SELECT id FROM projects WHERE key = ?", [config.project.key]);
+  const project = queryOne("SELECT id FROM projects WHERE key = ?", [
+    config.project.key
+  ]);
   if (!project) {
     error(`Project "${config.project.key}" not found in database.`, opts);
     process.exit(1);
   }
-  const unknownFiles = queryAll(`
+  const unknownFiles = queryAll(
+    `
       SELECT id, path, extension, size_bytes, updated_at
       FROM documents
       WHERE project_id = ? AND monitoring_category = 'unknown' AND status != 'deleted'
       ORDER BY path
-    `, [project.id]);
+    `,
+    [project.id]
+  );
   if (unknownFiles.length === 0) {
     success("No unknown files to review! All files are classified.", opts);
     return;
   }
   if (opts.json) {
-    console.log(JSON.stringify({
-      success: true,
-      data: {
-        count: unknownFiles.length,
-        files: unknownFiles
-      }
-    }));
+    console.log(
+      JSON.stringify({
+        success: true,
+        data: {
+          count: unknownFiles.length,
+          files: unknownFiles
+        }
+      })
+    );
     return;
   }
   if (options.list) {
@@ -9991,14 +10067,18 @@ daemonCommand.command("review").option("--list", "Just list unknown files withou
       ],
       opts
     );
-    console.log('\nUse "aigile daemon allow <pattern>" or "aigile daemon deny <pattern>" to classify files.');
+    console.log(
+      '\nUse "aigile daemon allow <pattern>" or "aigile daemon deny <pattern>" to classify files.'
+    );
     return;
   }
   console.log(`
 \u{1F4CB} Unknown Files (${unknownFiles.length} total)
 `);
   console.log('Run "aigile daemon review --list" to see all files.');
-  console.log('Use "aigile daemon allow <pattern>" or "aigile daemon deny <pattern>" to classify.\n');
+  console.log(
+    'Use "aigile daemon allow <pattern>" or "aigile daemon deny <pattern>" to classify.\n'
+  );
   const sample = unknownFiles.slice(0, 10);
   for (const file of sample) {
     console.log(`  ${file.path} (.${file.extension || "no ext"})`);
@@ -10936,7 +11016,7 @@ init_connection();
 init_connection();
 import { Command as Command22 } from "commander";
 import { glob as glob2 } from "glob";
-import { relative as relative7, resolve as resolve5 } from "path";
+import { relative as relative7, resolve as resolve6 } from "path";
 init_config();
 function safeParseArray(json) {
   if (!json) return [];
@@ -10983,7 +11063,7 @@ chunkCommand.command("create").argument("<id>", "Chunk ID (e.g., chunk-001)").op
   if (options.pattern) {
     for (const pattern of options.pattern) {
       const matches = await glob2(pattern, { cwd: projectRoot, nodir: true });
-      assignedFiles.push(...matches.map((f) => relative7(projectRoot, resolve5(projectRoot, f))));
+      assignedFiles.push(...matches.map((f) => relative7(projectRoot, resolve6(projectRoot, f))));
     }
   }
   if (options.assign) {