@wrongstack/sdd 1.0.2 → 1.0.3

package/dist/index.js

@@ -521,7 +521,7 @@ function assertTaskGraphExecutionIntegrity(graph) {
   const indegree = new Map(Array.from(graph.nodes.keys(), (id) => [id, 0]));
   const outgoing = /* @__PURE__ */ new Map();
   for (const edge of dependencies) {
-    indegree.set(edge.to, (indegree.get(edge.to) ?? 0) + 1);
+    indegree.set(edge.to, indegree.get(edge.to) + 1);
     outgoing.set(edge.from, [...outgoing.get(edge.from) ?? [], edge.to]);
   }
   const ready = Array.from(indegree.entries()).filter(([, degree]) => degree === 0).map(([id]) => id);
@@ -530,7 +530,7 @@ function assertTaskGraphExecutionIntegrity(graph) {
     const id = ready.shift();
     visited += 1;
     for (const dependent of outgoing.get(id) ?? []) {
-      const next = (indegree.get(dependent) ?? 0) - 1;
+      const next = indegree.get(dependent) - 1;
       indegree.set(dependent, next);
       if (next === 0) ready.push(dependent);
     }
@@ -757,8 +757,9 @@ var SpecStore = class {
     await this.updateIndex(spec);
   }
   async load(id) {
+    const filePath = this.filePath(id);
     try {
-      const raw = await fsp.readFile(this.filePath(id), "utf8");
+      const raw = await fsp.readFile(filePath, "utf8");
       return JSON.parse(raw);
     } catch {
       return null;
@@ -769,8 +770,9 @@ var SpecStore = class {
     return index.entries.sort((a, b) => b.updatedAt - a.updatedAt);
   }
   async delete(id) {
+    const filePath = this.filePath(id);
     try {
-      await fsp.unlink(this.filePath(id));
+      await fsp.unlink(filePath);
       await this.removeFromIndex(id);
       return true;
     } catch {
@@ -816,8 +818,25 @@ var SpecStore = class {
     await this.save(updated);
     return updated;
   }
+  /**
+   * Resolve a spec id to its file, refusing anything that escapes `baseDir`.
+   * `id` arrives from a WebSocket frame (`specs-ws-handler.ts:96-97,152`,
+   * raw `as string` casts) and from any persisted spec JSON. A bare
+   * `path.join` was the traversal primitive: `id = "../../../secret"`
+   * resolved outside the store and `load()` returned its contents. Mirrors
+   * the same containment `task-graph-store.ts:134-145` applies to its ids.
+   */
   filePath(id) {
-    return path.join(this.baseDir, `${id}.json`);
+    if (typeof id !== "string" || id.length === 0 || id.length > 200 || /[\0/\\]/.test(id)) {
+      throw new Error(`Invalid spec id: ${JSON.stringify(id)}`);
+    }
+    const dir = path.resolve(this.baseDir);
+    const resolved = path.resolve(dir, `${id}.json`);
+    const rel = path.relative(dir, resolved);
+    if (rel.startsWith("..") || path.isAbsolute(rel) || rel.includes(path.sep)) {
+      throw new Error(`Invalid spec id: ${JSON.stringify(id)}`);
+    }
+    return resolved;
   }
   async readIndex() {
     try {
@@ -3328,7 +3347,7 @@ var SddParallelRun = class {
     const sessionId = this.currentSessionId();
     this.events?.emit(
       event,
-      sessionId ? { ...payload, sessionId } : payload
+      { ...payload, sessionId }
     );
   }
   currentSessionId() {
@@ -3342,7 +3361,7 @@ var SddParallelRun = class {
   /** Resolvers for tasks parked in `waitWhilePaused`, woken on resume/stop. */
   pausedWaiters = /* @__PURE__ */ new Set();
   notifyPausedWaiters() {
-    for (const resolve2 of this.pausedWaiters) resolve2();
+    for (const resolve3 of this.pausedWaiters) resolve3();
     this.pausedWaiters.clear();
   }
   /** Trigger stop — causes run() to abort after the current wave. */
@@ -3515,10 +3534,10 @@ var SddParallelRun = class {
   }
   async waitWhilePaused() {
     while (this.paused && !this.stopRequested) {
-      await new Promise((resolve2) => {
-        this.pausedWaiters.add(resolve2);
+      await new Promise((resolve3) => {
+        this.pausedWaiters.add(resolve3);
         const safety = setTimeout(() => {
-          if (this.pausedWaiters.delete(resolve2)) resolve2();
+          if (this.pausedWaiters.delete(resolve3)) resolve3();
         }, 1e3);
         safety.unref?.();
       });
@@ -4049,6 +4068,7 @@ function startSddRun(opts) {
   });
   const workflowId = kanbanWorkflowId("sdd", run.runId);
   const legacyControl = opts.controlTransport === "legacy-file";
+  const controlTransportName = legacyControl ? "legacy-file" : "kanban";
   const legacyBoardState = opts.boardStateTransport === "legacy-file" || opts.boardStateTransport === void 0 && legacyControl;
   const boardPersistence = legacyBoardState ? opts.boardStore : {
     saveSnapshot: async (snapshot) => {
@@ -4110,7 +4130,7 @@ function startSddRun(opts) {
           event: "sdd.control_drain_failed",
           runId: run.runId,
           workflowId,
-          transport: legacyControl ? "legacy-file" : "kanban",
+          transport: controlTransportName,
           message,
           timestamp: (/* @__PURE__ */ new Date()).toISOString()
         })
@@ -4121,12 +4141,12 @@ function startSddRun(opts) {
   };
   if (!legacyControl) {
     void subscribeKanbanWorkflowCommands(opts.projectRoot, workflowId, () => {
-      void drainControl().catch(() => void 0);
+      void drainControl();
     }).then((unsubscribe) => {
       if (controlDisposed) unsubscribe();
       else {
         unsubscribeControl = unsubscribe;
-        void drainControl().catch(() => void 0);
+        void drainControl();
       }
     }).catch((error) => {
       console.warn(
@@ -4159,7 +4179,7 @@ function startSddRun(opts) {
   }
   const drainMs = opts.controlDrainMs ?? 500;
   const controlTimer = setInterval(() => {
-    void drainControl().catch(() => void 0);
+    void drainControl();
   }, drainMs);
   controlTimer.unref?.();
   const completion = (async () => {
@@ -4522,7 +4542,7 @@ async function gatherProjectContext(projectRoot) {
 function deriveTitle(value) {
   const firstLine = value.split("\n").map((line) => line.trim()).find(Boolean);
   if (!firstLine) return "New SDD Project";
-  const sentence = firstLine.split(/(?<=[.!?])\s/)[0] ?? firstLine;
+  const sentence = firstLine.split(/(?<=[.!?])\s/)[0];
   return sentence.length <= 64 ? sentence : `${sentence.slice(0, 63).trimEnd()}\u2026`;
 }
 function intakeToInterviewKickoff(record) {
@@ -5495,8 +5515,8 @@ function tokenizeCommand(command) {
     hasToken = true;
   }
   if (inSingle || inDouble) return void 0;
-  if (hasToken) argv.push(current);
-  return argv.length > 0 ? argv : void 0;
+  argv.push(current);
+  return argv;
 }
 function makeCompositeVerifier(parts) {
   return async function verifyTask(info) {
@@ -5569,7 +5589,7 @@ function makeCommandVerifier(options = {}) {
       return { ok: false, reason: `verification command is malformed: ${rawCommand}` };
     }
     const [executable, ...args] = argv;
-    return await new Promise((resolve2) => {
+    return await new Promise((resolve3) => {
       const child = spawn(executable, args, {
         cwd: info.cwd,
         shell: false,
@@ -5580,18 +5600,18 @@ function makeCommandVerifier(options = {}) {
       const timer = setTimeout(() => {
         timedOut = true;
         child.kill();
-        resolve2({ ok: false, reason: `verification timed out: ${rawCommand}` });
+        resolve3({ ok: false, reason: `verification timed out: ${rawCommand}` });
       }, timeoutMs);
       child.on("exit", (code) => {
         clearTimeout(timer);
         if (timedOut) return;
-        resolve2(
+        resolve3(
           code === 0 ? { ok: true } : { ok: false, reason: `verification failed (exit ${code}): ${rawCommand}` }
         );
       });
       child.on("error", (err) => {
         clearTimeout(timer);
-        resolve2({ ok: false, reason: `verification spawn error: ${String(err)}` });
+        resolve3({ ok: false, reason: `verification spawn error: ${String(err)}` });
       });
     });
   };
@@ -5750,7 +5770,7 @@ async function decomposeNonAtomicTasks(opts) {
 
 // src/conflict-resolver.ts
 import { readFile as readFile6, writeFile } from "node:fs/promises";
-import { isAbsolute as isAbsolute2, join as join6 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join6 } from "node:path";
 import { readBundledInstructionText as readBundledInstructionText2, renderInstructionTemplate as renderInstructionTemplate2 } from "@wrongstack/core/utils";
 var defaultFileIO = {
   read: (path6) => readFile6(path6, "utf8"),
@@ -5799,7 +5819,7 @@ function makePreferSideConflictResolver(side, io = defaultFileIO) {
   return async function conflictResolver(info) {
     if (info.conflictFiles.length === 0) return false;
     for (const rel of info.conflictFiles) {
-      const abs = isAbsolute2(rel) ? rel : join6(info.cwd, rel);
+      const abs = isAbsolute3(rel) ? rel : join6(info.cwd, rel);
       let content;
       try {
         content = await io.read(abs);
@@ -5833,7 +5853,7 @@ function makeLlmConflictResolver(opts) {
   return async function conflictResolver(info) {
     if (info.conflictFiles.length === 0) return false;
     for (const rel of info.conflictFiles) {
-      const abs = isAbsolute2(rel) ? rel : join6(info.cwd, rel);
+      const abs = isAbsolute3(rel) ? rel : join6(info.cwd, rel);
       let content;
       try {
         content = await io.read(abs);

package/dist/spec-store.d.ts

@@ -28,6 +28,14 @@ export declare class SpecStore {
     createDraft(title: string, overview?: string): Promise<Specification>;
     /** Update spec fields and persist. */
     update(id: string, patch: Partial<Omit<Specification, 'id' | 'createdAt'>>): Promise<Specification | null>;
+    /**
+     * Resolve a spec id to its file, refusing anything that escapes `baseDir`.
+     * `id` arrives from a WebSocket frame (`specs-ws-handler.ts:96-97,152`,
+     * raw `as string` casts) and from any persisted spec JSON. A bare
+     * `path.join` was the traversal primitive: `id = "../../../secret"`
+     * resolved outside the store and `load()` returned its contents. Mirrors
+     * the same containment `task-graph-store.ts:134-145` applies to its ids.
+     */
     private filePath;
     private readIndex;
     private updateIndex;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/sdd",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "license": "MIT",
   "description": "WrongStack Spec-Driven Development engine — standalone package extracted from @wrongstack/core. Task graph generation, tracking, execution, lifecycle management, and AI-driven spec building for SDD workflows.",
   "repository": {
@@ -27,10 +27,10 @@
     "!dist/**/*.map"
   ],
   "dependencies": {
-    "@wrongstack/core": "1.0.2",
-    "@wrongstack/kanban": "1.0.2",
-    "@wrongstack/primitives": "1.0.2",
-    "@wrongstack/requirement-intake": "1.0.2"
+    "@wrongstack/core": "1.0.3",
+    "@wrongstack/kanban": "1.0.3",
+    "@wrongstack/primitives": "1.0.3",
+    "@wrongstack/requirement-intake": "1.0.3"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",