@wix/himalaya-cli 0.1116.0 → 0.1117.0

package/dist/cli.mjs

@@ -36089,10 +36089,10 @@ var init_render_fonts = __esm({
 
 // ../../core/dev-server/src/wix-cache-policy.ts
 function clampRule(rule, denyPrefixes, maxTTL) {
-  const denied = denyPrefixes.some((p) => rule.pathPrefix.startsWith(p));
+  const denied2 = denyPrefixes.some((p) => rule.pathPrefix.startsWith(p));
   return {
     ...rule,
-    cacheable: rule.cacheable && !denied,
+    cacheable: rule.cacheable && !denied2,
     ttl: Math.min(rule.ttl, maxTTL)
   };
 }
@@ -53854,7 +53854,8 @@ var init_cli_bridge = __esm({
 });
 
 // src/mcp/file-tools.ts
-import { lstatSync as lstatSync12, mkdirSync as mkdirSync26, readdirSync as readdirSync27, readFileSync as readFileSync59, realpathSync as realpathSync7, rmSync as rmSync12, statSync as statSync13, writeFileSync as writeFileSync21, existsSync as existsSync54 } from "node:fs";
+import { closeSync as closeSync4, constants, lstatSync as lstatSync12, mkdirSync as mkdirSync26, openSync as openSync3, readdirSync as readdirSync27, readFileSync as readFileSync59, realpathSync as realpathSync7, renameSync as renameSync6, rmSync as rmSync12, statSync as statSync13, writeSync, existsSync as existsSync54 } from "node:fs";
+import { randomBytes as randomBytes4 } from "node:crypto";
 import { dirname as dirname30, isAbsolute as isAbsolute5, join as join53, relative as relative11, resolve as resolve45, sep as sep14 } from "node:path";
 import * as z from "zod";
 function within(root, p) {
@@ -53871,37 +53872,99 @@ function realish(p) {
   }
   return join53(realpathSync7(cur), ...tail);
 }
+function symlinkComponent(base, abs) {
+  let cur = base;
+  for (const part of relative11(base, abs).split(sep14).filter(Boolean)) {
+    cur = join53(cur, part);
+    try {
+      if (lstatSync12(cur).isSymbolicLink()) return relative11(base, cur);
+    } catch {
+      return void 0;
+    }
+  }
+  return void 0;
+}
 async function confinedAppDir(args, deps) {
   const root = resolve45(await deps.defaultDir());
   const dir = typeof args.dir === "string" && args.dir ? resolve45(root, args.dir) : root;
   if (!existsSync54(root)) return refuse4("no_workspace", `the workspace folder ${root} does not exist`);
-  if (!within(realpathSync7(root), realish(dir))) return refuse4("outside_workspace", `"${String(args.dir)}" is outside the workspace folder`);
+  if (!within(root, dir) || !within(realpathSync7(root), realish(dir))) return refuse4("outside_workspace", `"${String(args.dir)}" is outside the workspace folder`);
+  const link = symlinkComponent(root, dir);
+  if (link) return refuse4("outside_workspace", `"${link}" is a symlink \u2014 the app folder must be a real folder in the workspace`);
+  const rel = relative11(root, dir);
+  if (rel && (isDeniedSourcePath(`${rel}/x`) || isDeniedSourcePath(`${rel.toLowerCase()}/x`))) return refuse4("denied", `"${rel}" is a folder this tool does not touch`);
+  if (!existsSync54(join53(dir, CONTENT_MARKER))) {
+    return refuse4("not_an_app", `"${rel || "."}" is not an app folder (no ${CONTENT_MARKER}) \u2014 see himi_list_apps, or create one with himi_init`);
+  }
   return dir;
 }
+function onDiskSpelling(abs) {
+  let cur = abs;
+  const tail = [];
+  while (!existsSync54(cur)) {
+    const up = dirname30(cur);
+    if (up === cur) break;
+    tail.unshift(cur.slice(up.length + (up.endsWith(sep14) ? 0 : 1)));
+    cur = up;
+  }
+  return join53(realpathSync7.native(cur), ...tail);
+}
+function denied(appDir3, abs) {
+  const rel = relative11(appDir3, abs);
+  if (isDeniedSourcePath(rel) || isDeniedSourcePath(rel.toLowerCase())) return true;
+  try {
+    return isDeniedSourcePath(relative11(realpathSync7.native(appDir3), onDiskSpelling(abs)));
+  } catch {
+    return true;
+  }
+}
 function confinedPath(appDir3, rel) {
   if (typeof rel !== "string" || !rel.trim()) return { error: "a path is required" };
   if (rel.includes("\0")) return { error: "a path may not contain NUL" };
   if (isAbsolute5(rel)) return { error: `"${rel}" is absolute \u2014 give a path inside the app folder` };
   const abs = resolve45(appDir3, rel);
+  if (!within(appDir3, abs) || abs === appDir3) return { error: `"${rel}" is outside the app folder` };
   const real = realish(abs);
   const base = existsSync54(appDir3) ? realpathSync7(appDir3) : realish(appDir3);
   if (!within(base, real) || real === base) return { error: `"${rel}" is outside the app folder` };
-  const first = relative11(base, real).split(sep14)[0];
-  if (RESERVED.has(first)) return { error: `"${rel}" is inside ${first}/, which this tool does not touch` };
+  const link = symlinkComponent(appDir3, abs);
+  if (link) return { error: `"${link}" is a symlink, which this tool does not follow` };
+  if (denied(appDir3, abs)) return { error: `"${rel}" is on the deny-list (secrets, credentials, build output), which this tool does not touch` };
   return abs;
 }
+function writeNoFollow(appDir3, abs, content) {
+  mkdirSync26(dirname30(abs), { recursive: true });
+  const before = symlinkComponent(appDir3, abs);
+  if (before) throw new Error(`"${before}" became a symlink`);
+  const tmp = join53(dirname30(abs), `.himi-write-${process.pid}-${randomBytes4(6).toString("hex")}.tmp`);
+  const fd = openSync3(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 420);
+  try {
+    writeSync(fd, content);
+  } finally {
+    closeSync4(fd);
+  }
+  const link = symlinkComponent(appDir3, abs);
+  if (link || !within(realpathSync7(appDir3), realpathSync7(dirname30(abs)))) {
+    rmSync12(tmp, { force: true });
+    throw new Error(`"${link ?? relative11(appDir3, dirname30(abs))}" changed into a link while writing`);
+  }
+  renameSync6(tmp, abs);
+}
 function listFiles(appDir3) {
   const files = [];
   const walk2 = (d) => {
+    const parentRel = relative11(appDir3, d);
     for (const e of readdirSync27(d, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      if (RESERVED.has(e.name)) continue;
       if (e.isSymbolicLink()) continue;
       const p = join53(d, e.name);
       if (e.isDirectory()) {
+        if (isDeniedSourceDir(e.name, parentRel) || isDeniedSourceDir(e.name.toLowerCase(), parentRel)) continue;
         if (!walk2(p)) return false;
       } else if (e.isFile()) {
+        const rel = relative11(appDir3, p);
+        if (isDeniedSourcePath(rel) || isDeniedSourcePath(rel.toLowerCase())) continue;
         if (files.length >= MAX_LISTED) return false;
-        files.push({ path: relative11(appDir3, p).split(sep14).join("/"), bytes: statSync13(p).size });
+        files.push({ path: rel.split(sep14).join("/"), bytes: statSync13(p).size });
       }
     }
     return true;
@@ -53931,7 +53994,7 @@ function fileTools() {
     {
       name: "himi_list_files",
       title: "List app files",
-      description: `Every file in an app folder with its size (skips ${[...RESERVED].join(", ")}; at most ${MAX_LISTED}).`,
+      description: `Every file in an app folder with its size \u2014 at most ${MAX_LISTED}, skipping symlinks and what the source deny-list keeps off the machine (secrets, credentials, build output).`,
       annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
       inputSchema: z.object({ dir: DIR }),
       handler: async (a, d) => {
@@ -53980,14 +54043,20 @@ function fileTools() {
           else if (typeof f.content !== "string") refused2.push({ path: f.path, error: "content must be text" });
           else if (Buffer.byteLength(f.content) > MAX_FILE_BYTES) refused2.push({ path: f.path, error: `over the ${MAX_FILE_BYTES}-byte limit` });
           else if (existsSync54(p) && !lstatSync12(p).isFile()) refused2.push({ path: f.path, error: "not a regular file" });
+          else if (planned.some((q) => q.abs === p)) refused2.push({ path: f.path, error: "the same file twice in one call" });
           else planned.push({ abs: p, rel: String(f.path), content: f.content });
         }
         if (refused2.length) return { ...ok({ ok: false, error: "refused", written: [], refused: refused2 }), isError: true };
+        const written = [];
         for (const f of planned) {
-          mkdirSync26(dirname30(f.abs), { recursive: true });
-          writeFileSync21(f.abs, f.content);
+          try {
+            writeNoFollow(app, f.abs, f.content);
+            written.push(f.rel);
+          } catch (e) {
+            return { ...ok({ ok: false, error: "write_failed", message: e.message, written }), isError: true };
+          }
         }
-        return ok({ ok: true, dir: app, written: planned.map((f) => f.rel) });
+        return ok({ ok: true, dir: app, written });
       }
     },
     {
@@ -54001,28 +54070,32 @@ function fileTools() {
         if (typeof app !== "string") return app;
         const paths = Array.isArray(a.paths) ? a.paths : [];
         const planned = [];
+        const deleted = [];
         const refused2 = [];
         for (const rel of paths) {
           const p = confinedPath(app, rel);
           if (typeof p !== "string") refused2.push({ path: rel, error: p.error });
           else if (!existsSync54(p)) refused2.push({ path: rel, error: "no such file" });
           else if (!lstatSync12(p).isFile()) refused2.push({ path: rel, error: "not a regular file" });
-          else planned.push(p);
+          else if (!planned.includes(p)) {
+            planned.push(p);
+            deleted.push(rel);
+          }
         }
         if (refused2.length) return { ...ok({ ok: false, error: "refused", deleted: [], refused: refused2 }), isError: true };
         for (const p of planned) rmSync12(p);
-        return ok({ ok: true, dir: app, deleted: paths });
+        return ok({ ok: true, dir: app, deleted });
       }
     }
   ];
 }
-var MAX_FILE_BYTES, MAX_FILES_PER_WRITE, MAX_LISTED, RESERVED, CONTENT_MARKER, ok, refuse4, DIR, WRITE_ANN;
+var MAX_FILE_BYTES, MAX_FILES_PER_WRITE, MAX_LISTED, CONTENT_MARKER, ok, refuse4, DIR, WRITE_ANN;
 var init_file_tools = __esm({
   "src/mcp/file-tools.ts"() {
+    init_source_deny();
     MAX_FILE_BYTES = 1024 * 1024;
     MAX_FILES_PER_WRITE = 100;
     MAX_LISTED = 2e3;
-    RESERVED = /* @__PURE__ */ new Set([".git", "node_modules", "dist"]);
     CONTENT_MARKER = "himalaya.content.json";
     ok = (o) => ({ content: [{ type: "text", text: JSON.stringify(o, null, 2) }] });
     refuse4 = (error, message) => ({ content: [{ type: "text", text: JSON.stringify({ ok: false, error, message }, null, 2) }], isError: true });
@@ -54533,7 +54606,7 @@ __export(native_decode_exports, {
   runNativeDecode: () => runNativeDecode
 });
 import { execFileSync as execFileSync5, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync55, mkdtempSync as mkdtempSync2, readFileSync as readFileSync61, rmSync as rmSync13, writeFileSync as writeFileSync22 } from "node:fs";
+import { existsSync as existsSync55, mkdtempSync as mkdtempSync2, readFileSync as readFileSync61, rmSync as rmSync13, writeFileSync as writeFileSync21 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join54 } from "node:path";
 import { fileURLToPath as fileURLToPath22 } from "node:url";
@@ -54667,7 +54740,7 @@ function runNativeDecode(options) {
       if (typeof descriptor.descriptorJson !== "string") {
         throw new Error(`native decode cannot judge ${descriptor.screenId}: the release builder did not return its exact baked JSON bytes`);
       }
-      writeFileSync22(join54(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
+      writeFileSync21(join54(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
     }
     options.progress?.("building cached Swift oracle");
     execFileSync5("swift", ["build", "--package-path", options.packageDir, "--product", "himi-decode-oracle"], {
@@ -54705,7 +54778,7 @@ function runAndroidNativeDecode(options) {
       if (typeof descriptor.descriptorJson !== "string") {
         throw new Error(`native decode cannot judge ${descriptor.screenId}: the release builder did not return its exact baked JSON bytes`);
       }
-      writeFileSync22(join54(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
+      writeFileSync21(join54(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
     }
     options.progress?.(`running real Kotlin decoder over ${options.descriptors.length} screen${options.descriptors.length === 1 ? "" : "s"}`);
     execFileSync5(options.gradlew, [
@@ -54789,7 +54862,7 @@ __export(browser_authoring_exports, {
   sdkSubpathReader: () => sdkSubpathReader
 });
 import { createServer as createServer5 } from "node:http";
-import { createHash as createHash29, randomBytes as randomBytes4 } from "node:crypto";
+import { createHash as createHash29, randomBytes as randomBytes5 } from "node:crypto";
 import { existsSync as existsSync56, readdirSync as readdirSync28, readFileSync as readFileSync62, realpathSync as realpathSync8, statSync as statSync14 } from "node:fs";
 import { join as join55, posix as posix2, relative as relative12, sep as sep15 } from "node:path";
 function humanMs(ms) {
@@ -54887,7 +54960,7 @@ function sdkSubpathReader(resolve54) {
 function encodeJob(job) {
   return Buffer.from(JSON.stringify(job), "utf8").toString("base64");
 }
-function mintToken2(payload, nonce = randomBytes4(16).toString("hex")) {
+function mintToken2(payload, nonce = randomBytes5(16).toString("hex")) {
   const digest2 = createHash29("sha256").update(payload, "utf8").digest("base64url");
   return `${nonce}.${digest2}`;
 }
@@ -55050,7 +55123,7 @@ __export(coverage_exports, {
   suppressedNativeKeys: () => suppressedNativeKeys,
   trendAndStore: () => trendAndStore
 });
-import { existsSync as existsSync57, mkdirSync as mkdirSync27, readFileSync as readFileSync63, writeFileSync as writeFileSync23 } from "node:fs";
+import { existsSync as existsSync57, mkdirSync as mkdirSync27, readFileSync as readFileSync63, writeFileSync as writeFileSync22 } from "node:fs";
 import { dirname as dirname31, join as join56 } from "node:path";
 function suppressedNativeKeys(oracle) {
   return [...oracle.ios ? [] : ["native-decode|ios"], ...oracle.android ? [] : ["native-decode|android"]];
@@ -55244,7 +55317,7 @@ function trendAndStore(dir, entries, suppressed) {
   const stored = [.../* @__PURE__ */ new Set([...current, ...(previous ?? []).filter((key2) => (suppressed ?? []).includes(key2))])];
   try {
     mkdirSync27(dirname31(p), { recursive: true });
-    writeFileSync23(p, JSON.stringify({ keys: stored, ts: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
+    writeFileSync22(p, JSON.stringify({ keys: stored, ts: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
   } catch {
     return null;
   }
@@ -55289,7 +55362,7 @@ function diffAndStoreObservations(dir, current) {
   }
   try {
     mkdirSync27(dirname31(p), { recursive: true });
-    writeFileSync23(p, JSON.stringify({ screens: current, ts: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
+    writeFileSync22(p, JSON.stringify({ screens: current, ts: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
   } catch {
     return null;
   }
@@ -55900,8 +55973,8 @@ ${releaseId}`;
     const pin = resolvePin(request, url);
     let bytes2 = null;
     if (pin) {
-      const denied = await authorizePinnedRead(request, url, app, pin);
-      if (denied) return { ok: false, response: denied };
+      const denied2 = await authorizePinnedRead(request, url, app, pin);
+      if (denied2) return { ok: false, response: denied2 };
       const m = await pinnedManifest(app, pin);
       if (!m) return { ok: false, response: json4(404, { error: "release_not_found", app, releaseId: pin }) };
       bytes2 = m.appConfigHash ? await pinnedBody(app, m.appConfigHash, () => store.getAppConfig(app)) : null;
@@ -55924,7 +55997,7 @@ ${releaseId}`;
     return new Response(body, { status: 200, headers: { "content-type": JSON_CT2, etag, "cache-control": cache, ...vary } });
   }
   async function authorizePinnedRead(request, url, app, releaseId, screenId) {
-    const denied = await checkPinnedRead({
+    const denied2 = await checkPinnedRead({
       secret: opts.previewTokenSecret,
       token: resolvePreviewToken(request, url),
       app,
@@ -55934,7 +56007,7 @@ ${releaseId}`;
       authorizePreview: opts.authorizePreview,
       authorizeFollow: opts.authorizeFollow
     });
-    return denied && json4(denied.status, denied.body);
+    return denied2 && json4(denied2.status, denied2.body);
   }
   async function honourRingPin(request) {
     const kept = { request, dropped: false };
@@ -56385,8 +56458,8 @@ ${releaseId}`;
       const app = cfgMatch?.[1] ?? resolveApp(request, url);
       const pin = resolvePin(request, url);
       if (app && pin) {
-        const denied = await authorizePinnedRead(request, url, app, pin);
-        if (denied) return denied;
+        const denied2 = await authorizePinnedRead(request, url, app, pin);
+        if (denied2) return denied2;
       }
       if (path2 === "/v1/template-source") {
         if (!app) return json4(400, { error: "missing_app" });
@@ -56469,8 +56542,8 @@ ${releaseId}`;
         if (!app) return json4(400, { error: "missing_app" });
         let m;
         if (pin) {
-          const denied = await authorizePinnedRead(request, url, app, pin);
-          if (denied) return denied;
+          const denied2 = await authorizePinnedRead(request, url, app, pin);
+          if (denied2) return denied2;
           m = await pinnedManifest(app, pin);
           if (!m) return json4(404, { error: "release_not_found", app, releaseId: pin });
         } else {
@@ -56656,8 +56729,8 @@ ${releaseId}`;
         const screenId = screenMatch[1];
         if (!app || !isSafeSegment(screenId)) return json4(404, { error: "screen_not_found", screenId });
         if (pin) {
-          const denied = await authorizePinnedRead(request, url, app, pin, screenId);
-          if (denied) return denied;
+          const denied2 = await authorizePinnedRead(request, url, app, pin, screenId);
+          if (denied2) return denied2;
           const m2 = await pinnedManifest(app, pin);
           if (!m2) return json4(404, { error: "release_not_found", app, releaseId: pin });
           const meta2 = m2.screens[screenId];
@@ -57450,7 +57523,7 @@ __export(run_watch_exports, {
   watchedContentDir: () => watchedContentDir,
   writeRunRecord: () => writeRunRecord
 });
-import { closeSync as closeSync4, constants, existsSync as existsSync60, fstatSync, lstatSync as lstatSync13, statSync as statSync16, mkdirSync as mkdirSync29, openSync as openSync3, readFileSync as readFileSync67, realpathSync as realpathSync9, renameSync as renameSync6, rmSync as rmSync15, writeFileSync as writeFileSync24, watch as fsWatch } from "node:fs";
+import { closeSync as closeSync5, constants as constants2, existsSync as existsSync60, fstatSync, lstatSync as lstatSync13, statSync as statSync16, mkdirSync as mkdirSync29, openSync as openSync4, readFileSync as readFileSync67, realpathSync as realpathSync9, renameSync as renameSync7, rmSync as rmSync15, writeFileSync as writeFileSync23, watch as fsWatch } from "node:fs";
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { extname as extname4, join as join59, resolve as resolve47, sep as sep16 } from "node:path";
 function diffReleases(prev, next) {
@@ -57585,9 +57658,9 @@ function writeRunRecord(dir, record2) {
   if (!root) return false;
   const tmp = join59(root, `.run.json.${process.pid}.${randomUUID4()}.tmp`);
   try {
-    writeFileSync24(tmp, `${JSON.stringify(record2, null, 2)}
+    writeFileSync23(tmp, `${JSON.stringify(record2, null, 2)}
 `, { flag: "wx" });
-    renameSync6(tmp, join59(root, "run.json"));
+    renameSync7(tmp, join59(root, "run.json"));
   } catch (e) {
     rmSync15(tmp, { force: true });
     throw e;
@@ -57644,12 +57717,12 @@ function readConfined(root, rel) {
     }
     const canonicalRoot = realpathSync9(root);
     if (!realpathSync9(at2).startsWith(canonicalRoot + sep16)) return null;
-    const fd = openSync3(at2, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    const fd = openSync4(at2, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
     try {
       if (!fstatSync(fd).isFile()) return null;
       return readFileSync67(fd);
     } finally {
-      closeSync4(fd);
+      closeSync5(fd);
     }
   } catch {
     return null;
@@ -58871,7 +58944,7 @@ __export(version_exports, {
   setAndroidVersion: () => setAndroidVersion,
   setIosVersion: () => setIosVersion
 });
-import { readFileSync as readFileSync72, writeFileSync as writeFileSync25 } from "node:fs";
+import { readFileSync as readFileSync72, writeFileSync as writeFileSync24 } from "node:fs";
 function readIosVersion(projectYml) {
   const marketing = matchScalar(projectYml, "CFBundleShortVersionString");
   const build2 = matchScalar(projectYml, "CFBundleVersion");
@@ -58936,8 +59009,8 @@ function bumpVersion(app, opts) {
     marketing: opts.marketing ?? current.marketing,
     build: opts.build === "increment" || opts.build === void 0 ? current.build + (opts.build === "increment" ? 1 : 0) : opts.build
   };
-  writeFileSync25(iosPath, setIosVersion(iosYml, next));
-  writeFileSync25(gradlePath, setAndroidVersion(gradle, next));
+  writeFileSync24(iosPath, setIosVersion(iosYml, next));
+  writeFileSync24(gradlePath, setAndroidVersion(gradle, next));
   return next;
 }
 var init_version = __esm({
@@ -59080,7 +59153,7 @@ var init_asc_status = __esm({
 });
 
 // ../../core/functions-secrets/src/vault.ts
-import { createCipheriv, createDecipheriv, randomBytes as randomBytes5 } from "node:crypto";
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes6 } from "node:crypto";
 import { mkdir, readFile as readFile2, rename, writeFile as writeFile2 } from "node:fs/promises";
 import { dirname as dirname34 } from "node:path";
 function createJsonSecretStore(filePath) {
@@ -59138,7 +59211,7 @@ function createSecretVault(options) {
       environment: input.environment,
       name: input.name,
       version: input.version,
-      iv: randomBytes5(12).toString("base64url"),
+      iv: randomBytes6(12).toString("base64url"),
       ciphertext: "",
       authTag: ""
     };
@@ -59500,7 +59573,7 @@ __export(notify_exports, {
   runNotify: () => runNotify,
   saveAdminSession: () => saveAdminSession
 });
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync30, readFileSync as readFileSync76, writeFileSync as writeFileSync26 } from "node:fs";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync30, readFileSync as readFileSync76, writeFileSync as writeFileSync25 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 import { dirname as dirname35, join as join62 } from "node:path";
 function defaultSessionsPath() {
@@ -59517,7 +59590,7 @@ function saveAdminSession(adminUrl, session, path2 = defaultSessionsPath()) {
   const file = loadSessionsFile(path2);
   file.sessions = { ...file.sessions, [adminUrl]: session };
   mkdirSync30(dirname35(path2), { recursive: true, mode: 448 });
-  writeFileSync26(path2, JSON.stringify(file, null, 2) + "\n", { mode: 384 });
+  writeFileSync25(path2, JSON.stringify(file, null, 2) + "\n", { mode: 384 });
   try {
     chmodSync3(dirname35(path2), 448);
     chmodSync3(path2, 384);
@@ -63276,7 +63349,7 @@ var init_brand_font = __esm({
 });
 
 // src/site-analyze/write-artifacts.ts
-import { mkdirSync as mkdirSync31, writeFileSync as writeFileSync27 } from "node:fs";
+import { mkdirSync as mkdirSync31, writeFileSync as writeFileSync26 } from "node:fs";
 import { join as join63 } from "node:path";
 function attachVeloSources(book, sources, put) {
   const byPath = new Map((sources ?? []).map((s) => [s.path, s.text]));
@@ -63438,7 +63511,7 @@ async function writeBusinessBook(result, opts) {
   const put = (rel, body) => {
     const p = join63(out2, rel);
     mkdirSync31(join63(p, ".."), { recursive: true });
-    writeFileSync27(p, body);
+    writeFileSync26(p, body);
     files.push(rel);
   };
   const book = result.book;
@@ -63531,7 +63604,7 @@ var init_customer_build = __esm({
 });
 
 // src/site-analyze/apply.ts
-import { existsSync as existsSync65, readFileSync as readFileSync77, writeFileSync as writeFileSync28, copyFileSync as copyFileSync3, mkdirSync as mkdirSync32, realpathSync as realpathSync10, statSync as statSync18 } from "node:fs";
+import { existsSync as existsSync65, readFileSync as readFileSync77, writeFileSync as writeFileSync27, copyFileSync as copyFileSync3, mkdirSync as mkdirSync32, realpathSync as realpathSync10, statSync as statSync18 } from "node:fs";
 import { dirname as dirname36, isAbsolute as isAbsolute7, join as join64, resolve as resolve51, sep as sep17 } from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function unpairedRedirectNote(overlay) {
@@ -63683,10 +63756,10 @@ function buildMergedContract(options) {
   const body = `${JSON.stringify(merged, null, 2)}
 `;
   const path2 = join64(packageDir, "provisioning.contract.json");
-  writeFileSync28(path2, body);
+  writeFileSync27(path2, body);
   const localPath = join64(appDir3, LOCAL_CONTRACT_REL);
   mkdirSync32(dirname36(localPath), { recursive: true });
-  writeFileSync28(localPath, body);
+  writeFileSync27(localPath, body);
   staged.push(localPath);
   return { path: path2, staged };
 }
@@ -63785,10 +63858,10 @@ async function applyOverlays(input) {
     const cur = JSON.parse(readFileSync77(pkgProv, "utf8"));
     const merged = deepMerge4(cur, overlay);
     packageFaq = merged.faq;
-    writeFileSync28(pkgProv, JSON.stringify(merged, null, 2) + "\n");
+    writeFileSync27(pkgProv, JSON.stringify(merged, null, 2) + "\n");
     wrote.push(pkgProv);
   } else {
-    writeFileSync28(pkgProv, JSON.stringify(overlay, null, 2) + "\n");
+    writeFileSync27(pkgProv, JSON.stringify(overlay, null, 2) + "\n");
     wrote.push(pkgProv);
   }
   const pkgTokens = join64(cwd, "tokens.json");
@@ -63814,7 +63887,7 @@ async function applyOverlays(input) {
       if (primary && glow && typeof glow.color === "string") glow.color = primary;
       stripBrandFromIdiom(merged);
     }
-    writeFileSync28(pkgTokens, JSON.stringify(merged, null, 2) + "\n");
+    writeFileSync27(pkgTokens, JSON.stringify(merged, null, 2) + "\n");
     wrote.push(pkgTokens);
   }
   const homeAction = homeRefreshActionId(shell);
@@ -63844,7 +63917,7 @@ async function applyOverlays(input) {
       }
     }
     if (next !== prev) {
-      writeFileSync28(homeSrc, next);
+      writeFileSync27(homeSrc, next);
       wrote.push(homeSrc);
     }
     if (patched.unparsed) {
@@ -68600,7 +68673,7 @@ __export(site_create_exports, {
   runSiteList: () => runSiteList,
   writeProvisioningBinding: () => writeProvisioningBinding
 });
-import { existsSync as existsSync66, readFileSync as readFileSync79, writeFileSync as writeFileSync29 } from "node:fs";
+import { existsSync as existsSync66, readFileSync as readFileSync79, writeFileSync as writeFileSync28 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 function oauthClientName(projectName) {
   return `${projectName} client`;
@@ -68749,7 +68822,7 @@ async function runSiteCreate(opts) {
   if (!wantOauthApp) return { ...base, nextSteps: nextSteps(metaSiteId) };
   return { ...base, clientId, redirectUri, nextSteps: nextSteps(metaSiteId, clientId) };
 }
-function writeProvisioningBinding(target, binding2, fs = { existsSync: existsSync66, readFileSync: readFileSync79, writeFileSync: writeFileSync29 }) {
+function writeProvisioningBinding(target, binding2, fs = { existsSync: existsSync66, readFileSync: readFileSync79, writeFileSync: writeFileSync28 }) {
   const msid = binding2.siteId;
   const path2 = resolvePath2(target);
   const committed = committedShellProvisioning(path2);
@@ -69422,7 +69495,7 @@ var init_context = __esm({
 });
 
 // src/cli.ts
-import { mkdtempSync as mkdtempSync4, readFileSync as readFileSync80, mkdirSync as mkdirSync33, writeFileSync as writeFileSync30, existsSync as existsSync67, rmSync as rmSync16, readdirSync as readdirSync31, statSync as statSync19, lstatSync as lstatSync14, accessSync, constants as constants2, renameSync as renameSync7, cpSync as cpSync3 } from "node:fs";
+import { mkdtempSync as mkdtempSync4, readFileSync as readFileSync80, mkdirSync as mkdirSync33, writeFileSync as writeFileSync29, existsSync as existsSync67, rmSync as rmSync16, readdirSync as readdirSync31, statSync as statSync19, lstatSync as lstatSync14, accessSync, constants as constants3, renameSync as renameSync8, cpSync as cpSync3 } from "node:fs";
 import { execFile, execFileSync as execFileSync7, spawnSync as spawnSync5, spawn as spawn7 } from "node:child_process";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash as createHash31, randomUUID as randomUUID7 } from "node:crypto";
@@ -71872,9 +71945,12 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                            file is not the plane's per-release archive.
   himi share --file <package.himi> [--expires-at <ISO>] | revoke --app <app> <shareId>
                                            publish a content-addressed package link for a released app
-  himi mcp [plugin --out <dir>]            the himi tools as a local MCP server over stdio, for coding
+  himi mcp [plugin --out <dir>] [--with-files]
+                                           the himi tools as a local MCP server over stdio, for coding
                                            agents (Claude Code, Cursor, Codex, VS Code). \`himi init\`
-                                           configures each; see \`himi docs himi-mcp\`.
+                                           configures each; see \`himi docs himi-mcp\`. --with-files
+                                           adds file tools confined to the workspace, for a host that
+                                           cannot edit files (Claude Desktop chat).
   himi run [<package.himi|dir|url>] [--browser] [--watch [--idle-exit <min>]] [--lan] [--port <n>] [--chrome preview|app] [--screen <id>] [--surface <id>] [--no-open]
                                            serve a package on localhost + open it in a browser. No serve
                                            plane, no dev-server. With no argument it packs the current
@@ -72475,7 +72551,7 @@ function readUpdateCache(path2) {
 function writeUpdateCache(path2, cache) {
   try {
     mkdirSync33(dirname37(path2), { recursive: true, mode: 448 });
-    writeFileSync30(path2, JSON.stringify(cache, null, 2) + "\n", { mode: 384 });
+    writeFileSync29(path2, JSON.stringify(cache, null, 2) + "\n", { mode: 384 });
   } catch {
   }
 }
@@ -72506,7 +72582,7 @@ function globalPrefixWritable() {
   const root = globalNodeModulesRoot();
   if (!root) return false;
   try {
-    accessSync(root, constants2.W_OK);
+    accessSync(root, constants3.W_OK);
     return true;
   } catch {
     return false;
@@ -72617,7 +72693,7 @@ function acquireUpdateLock(cachePath, now, hooks = {}) {
   };
   const tryCreate = (path2) => {
     try {
-      writeFileSync30(path2, mine, { flag: "wx", mode: 384 });
+      writeFileSync29(path2, mine, { flag: "wx", mode: 384 });
       return true;
     } catch {
       return false;
@@ -73205,7 +73281,7 @@ function executableOnPath(name, env = process.env) {
       const candidate = join65(dir, `${name}${suffix}`);
       try {
         if (!statSync19(candidate).isFile()) continue;
-        if (process.platform !== "win32") accessSync(candidate, constants2.X_OK);
+        if (process.platform !== "win32") accessSync(candidate, constants3.X_OK);
         return true;
       } catch {
       }
@@ -73332,7 +73408,7 @@ function readConfigSource(dir) {
 }
 function writePngFile(path2, base64) {
   mkdirSync33(dirname37(path2), { recursive: true });
-  writeFileSync30(path2, Buffer.from(base64, "base64"));
+  writeFileSync29(path2, Buffer.from(base64, "base64"));
   return path2;
 }
 async function seedAgentFilesFor(dir, flags, mode = "init") {
@@ -74955,7 +75031,7 @@ ${doNow.map((l) => `  ${l}`).join("\n")}`);
           const files = himiPluginFiles2(skills.skillMd);
           for (const f of files) {
             mkdirSync33(dirname37(join65(dir, f.path)), { recursive: true });
-            writeFileSync30(join65(dir, f.path), f.text);
+            writeFileSync29(join65(dir, f.path), f.text);
           }
           print({ ok: true, dir, files: files.map((f) => f.path), next: [`claude plugin validate ${dir}`, `claude --plugin-dir ${dir}`] });
           return 0;
@@ -74981,7 +75057,7 @@ ${doNow.map((l) => `  ${l}`).join("\n")}`);
           const out2 = resolve53(str8(flags.out) ?? join65(dir, ".himi", "making-of.html"));
           const { html, plan } = buildReel2(dir);
           mkdirSync33(dirname37(out2), { recursive: true });
-          writeFileSync30(out2, html);
+          writeFileSync29(out2, html);
           const { pathToFileURL: pathToFileURL9 } = await import("node:url");
           const url2 = pathToFileURL9(out2).href;
           const open2 = flags["no-open"] !== true;
@@ -77201,9 +77277,9 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
                   const { describeChanges: describeChanges2, headline: headline2 } = await Promise.resolve().then(() => (init_build_changes(), build_changes_exports));
                   const changes = describeChanges2(live2, join65(next, running.app), diff);
                   const retired = `${live2}.retired-${Date.now()}`;
-                  renameSync7(live2, retired);
+                  renameSync8(live2, retired);
                   try {
-                    renameSync7(join65(next, running.app), live2);
+                    renameSync8(join65(next, running.app), live2);
                   } catch {
                     cpSync3(join65(next, running.app), live2, { recursive: true });
                   }

package/guides/himi-mcp.md

@@ -83,8 +83,13 @@ Each tool acts on the agent's workspace folder unless it is given a `dir`.
 **File tools, for hosts that cannot edit files.** `himi mcp --with-files` adds `himi_list_apps`,
 `himi_list_files`, `himi_read_file`, `himi_write_files` and `himi_delete_files`. The Claude Desktop
 Extension uses them, because Claude Desktop chat has no file editing of its own. They follow the
-hosted connector's shapes, act only inside the workspace folder (checked on the real path, so a
-symlink cannot lead out of it), and never touch `.git`, `node_modules` or `dist`. When the host names
+hosted connector's shapes and act only inside the workspace folder, on an app root (a folder with
+`himalaya.content.json`). They refuse any path through a symlink, dangling ones included, and write
+without following links. They judge the deny-list in every spelling, because macOS and Windows open
+`.ENV` as `.env`. They never list, read,
+write or delete anything the source deny-list keeps off the machine: `.env` files, the `.himi/`
+secret store, MCP host configs with their keys, key files, and `node_modules`, `dist` and `.git`
+at any depth. When the host names
 no workspace, `HIMI_WORKSPACE` sets the folder. Coding agents edit files themselves, so the flag is
 off by default.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1116.0",
+  "version": "0.1117.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -67,5 +67,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "6d8f58d4b9f65728efd1d2728c9c1567bbe8ea1cb014bda9ee1afc50"
+  "falconPackageHash": "fc5b0cacba000b4c6e6a4a5002e19ab4d37d0560e6bd98aed8b49b13"
 }