@wrongstack/tools 0.276.2 → 0.276.4

package/dist/index.js

@@ -807,13 +807,13 @@ async function globFiles(pattern, base, extraGlob) {
   return await globNative(pattern, base, extraGlob);
 }
 function checkRg() {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     try {
       const p = spawn("rg", ["--version"], { env: buildChildEnv(), stdio: "ignore", windowsHide: true });
-      p.on("error", () => resolve6(false));
-      p.on("close", (code) => resolve6(code === 0));
+      p.on("error", () => resolve7(false));
+      p.on("close", (code) => resolve7(code === 0));
     } catch {
-      resolve6(false);
+      resolve7(false);
     }
   });
 }
@@ -830,10 +830,10 @@ function spawnRgFind(pattern, base) {
     buf += chunk.toString();
   });
   return {
-    promise: new Promise((resolve6, reject) => {
+    promise: new Promise((resolve7, reject) => {
       child.on("error", reject);
       child.on("close", () => {
-        resolve6(buf.split("\n").filter(Boolean));
+        resolve7(buf.split("\n").filter(Boolean));
       });
     })
   };
@@ -1106,13 +1106,13 @@ var grepTool = {
   }
 };
 async function detectRg(signal) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     try {
       const p = spawn("rg", ["--version"], { env: buildChildEnv(), stdio: "ignore", signal, windowsHide: true });
-      p.on("error", () => resolve6(false));
-      p.on("close", (code) => resolve6(code === 0));
+      p.on("error", () => resolve7(false));
+      p.on("close", (code) => resolve7(code === 0));
     } catch {
-      resolve6(false);
+      resolve7(false);
     }
   });
 }
@@ -3081,10 +3081,10 @@ var bashTool = {
         queue.push(c);
       }
     };
-    const next = () => new Promise((resolve6) => {
+    const next = () => new Promise((resolve7) => {
       const c = queue.shift();
-      if (c) resolve6(c);
-      else resolveNext = resolve6;
+      if (c) resolve7(c);
+      else resolveNext = resolve7;
     });
     let lastFlush = Date.now();
     const flush = () => {
@@ -3545,7 +3545,7 @@ var execTool = {
   }
 };
 function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let stdout = "";
     let stderr = "";
     let killed = false;
@@ -3553,7 +3553,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
     const finish = (result) => {
       if (resolvedOnce.value) return;
       resolvedOnce.value = true;
-      resolve6(result);
+      resolve7(result);
     };
     const startedAt = Date.now();
     const spool = createOutputSpool({ tool: `exec-${cmd}`, thresholdBytes: MAX_OUTPUT2 });
@@ -4916,7 +4916,7 @@ function buildArgs(input) {
   }
 }
 function runGit(args, cwd, signal) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let stdout = "";
     let stderr = "";
     const child = spawn("git", args, {
@@ -4937,7 +4937,7 @@ function runGit(args, cwd, signal) {
       }
     });
     child.on("error", (err) => {
-      resolve6({
+      resolve7({
         command: args[0],
         stdout: normalizeCommandOutput(stdout),
         stderr: err.message,
@@ -4946,7 +4946,7 @@ function runGit(args, cwd, signal) {
       });
     });
     child.on("close", (code) => {
-      resolve6({
+      resolve7({
         command: args[0],
         stdout: normalizeCommandOutput(stdout),
         stderr: normalizeCommandOutput(stderr),
@@ -5046,7 +5046,7 @@ function stripPathComponents(p, strip) {
   return parts.slice(strip).join("/");
 }
 function runPatch(args, cwd, signal) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let stdout = "";
     let stderr = "";
     const env = { ...buildChildEnv(), LANG: "C", LC_ALL: "C" };
@@ -5057,8 +5057,8 @@ function runPatch(args, cwd, signal) {
     child.stderr?.on("data", (c) => {
       stderr += c.toString();
     });
-    child.on("close", (code) => resolve6({ exitCode: code ?? 1, stdout, stderr }));
-    child.on("error", (e) => resolve6({ exitCode: 1, stdout: "", stderr: e.message }));
+    child.on("close", (code) => resolve7({ exitCode: code ?? 1, stdout, stderr }));
+    child.on("error", (e) => resolve7({ exitCode: 1, stdout: "", stderr: e.message }));
   });
 }
 function extractPatchedFiles(output) {
@@ -5120,30 +5120,30 @@ var jsonTool = {
       }
     }
   },
-  async execute(input) {
+  async execute(input, ctx) {
     const action = input.action ?? "parse";
     switch (action) {
       case "query":
-        return executeQuery(input);
+        return executeQuery(input, ctx);
       case "validate":
-        return executeValidate(input);
+        return executeValidate(input, ctx);
       case "transform":
-        return executeTransform(input);
+        return executeTransform(input, ctx);
       case "merge":
         return executeMerge(input);
       case "parse":
       default:
-        return executeParse(input);
+        return executeParse(input, ctx);
     }
   }
 };
-async function executeParse(input) {
+async function executeParse(input, ctx) {
   const format = input.format ?? "json";
   let parsed;
   let raw;
   if (input.file) {
     try {
-      raw = await fs7.readFile(input.file, "utf8");
+      raw = await fs7.readFile(await safeResolveReal(input.file, ctx), "utf8");
     } catch {
       return { data: null, formatted: "", type: "unknown", action: "parse", error: "Could not read file" };
     }
@@ -5194,14 +5194,14 @@ async function executeParse(input) {
     keys: typeof parsed === "object" && parsed !== null ? Object.keys(parsed) : void 0
   };
 }
-async function executeQuery(input) {
+async function executeQuery(input, ctx) {
   if (!input.query) {
     return { data: null, formatted: "", type: "unknown", action: "query", error: "query is required for action: query" };
   }
   let parsed;
   if (input.file) {
     try {
-      const raw = await fs7.readFile(input.file, "utf8");
+      const raw = await fs7.readFile(await safeResolveReal(input.file, ctx), "utf8");
       parsed = JSON.parse(raw);
     } catch {
       return { data: null, formatted: "", type: "unknown", action: "query", error: "Could not read/parse file" };
@@ -5236,14 +5236,14 @@ async function executeQuery(input) {
     };
   }
 }
-async function executeValidate(input) {
+async function executeValidate(input, ctx) {
   if (!input.schema) {
     return { data: null, formatted: "", type: "unknown", action: "validate", error: "schema is required for action: validate" };
   }
   let parsed;
   if (input.file) {
     try {
-      const raw = await fs7.readFile(input.file, "utf8");
+      const raw = await fs7.readFile(await safeResolveReal(input.file, ctx), "utf8");
       parsed = JSON.parse(raw);
     } catch {
       return { data: null, formatted: "", type: "unknown", action: "validate", error: "Could not read/parse file" };
@@ -5278,14 +5278,14 @@ async function executeValidate(input) {
     };
   }
 }
-async function executeTransform(input) {
+async function executeTransform(input, ctx) {
   if (!input.transforms || input.transforms.length === 0) {
     return { data: null, formatted: "", type: "unknown", action: "transform", error: "transforms array is required for action: transform" };
   }
   let parsed;
   if (input.file) {
     try {
-      const raw = await fs7.readFile(input.file, "utf8");
+      const raw = await fs7.readFile(await safeResolveReal(input.file, ctx), "utf8");
       parsed = JSON.parse(raw);
     } catch {
       return { data: null, formatted: "", type: "unknown", action: "transform", error: "Could not read/parse file" };
@@ -5637,7 +5637,7 @@ function findGitDir2(cwd) {
   return null;
 }
 function runGit2(args, cwd, signal) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let stdout = "";
     let stderr = "";
     const child = spawn("git", args, {
@@ -5653,8 +5653,8 @@ function runGit2(args, cwd, signal) {
     child.stderr?.on("data", (c) => {
       stderr += c.toString();
     });
-    child.on("close", (code) => resolve6({ stdout, stderr, exitCode: code ?? 0 }));
-    child.on("error", (e) => resolve6({ stdout: "", stderr: e.message, exitCode: 1 }));
+    child.on("close", (code) => resolve7({ stdout, stderr, exitCode: code ?? 0 }));
+    child.on("error", (e) => resolve7({ stdout: "", stderr: e.message, exitCode: 1 }));
   });
 }
 async function fileDiff(input, ctx, _signal) {
@@ -5975,8 +5975,8 @@ async function* spawnStream(opts) {
   try {
     for (; ; ) {
       while (queue.length === 0) {
-        await new Promise((resolve6) => {
-          waiter = resolve6;
+        await new Promise((resolve7) => {
+          waiter = resolve7;
         });
       }
       const chunk = queue.shift();
@@ -6782,7 +6782,7 @@ var outdatedTool = {
   }
 };
 function runOutdated(manager, args, cwd, signal) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let stdout = "";
     let stderr = "";
     const MAX = 1e5;
@@ -6799,10 +6799,10 @@ function runOutdated(manager, args, cwd, signal) {
     });
     child.on("close", (code) => {
       const result = parseOutdatedOutput(stdout, code ?? 0);
-      resolve6(result);
+      resolve7(result);
     });
     child.on("error", (e) => {
-      resolve6({
+      resolve7({
         exit_code: 1,
         packages: [],
         total: 0,
@@ -6928,7 +6928,7 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
     };
   }
   args.push("--timestamps", service);
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let stdout = "";
     let stderr = "";
     const MAX = 2e5;
@@ -6944,7 +6944,7 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve6(result);
+      resolve7(result);
     };
     const child = spawn("docker", args, { cwd, signal, env: buildChildEnv(), stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
     const timer = setTimeout(() => {
@@ -7538,7 +7538,14 @@ These win over kit tokens. Run \`design {action:"materialize"}\` to write them t
         kitId: active.kit,
         outPath: input.out
       });
-      const abs = path.join(ctx.projectRoot, result.path);
+      const root = path.resolve(ctx.projectRoot);
+      const abs = path.resolve(path.join(ctx.projectRoot, result.path));
+      const rel = path.relative(root, abs);
+      if (rel.startsWith("..") || path.isAbsolute(rel)) {
+        throw new Error(
+          `design: materialize path "${result.path}" would escape the project root`
+        );
+      }
       let exists = false;
       try {
         await fs7.access(abs);
@@ -10139,8 +10146,8 @@ async function syncGoParse(filePath, content, lang) {
     proc.stdin?.write(content);
     proc.stdin?.end();
     const { code } = await Promise.race([
-      new Promise((resolve6) => {
-        proc.on("close", (c) => resolve6({ code: c }));
+      new Promise((resolve7) => {
+        proc.on("close", (c) => resolve7({ code: c }));
       }),
       new Promise(
         (_, reject) => setTimeout(() => {
@@ -10402,8 +10409,8 @@ async function syncPyParse(filePath, content, lang) {
       stdout += chunk.toString();
     });
     const { code } = await Promise.race([
-      new Promise((resolve6) => {
-        proc.on("close", (c) => resolve6({ code: c }));
+      new Promise((resolve7) => {
+        proc.on("close", (c) => resolve7({ code: c }));
       }),
       new Promise(
         (_, reject) => setTimeout(() => {
@@ -10488,8 +10495,8 @@ async function tryNativeParse(file, content) {
       stdout += chunk.toString();
     });
     const { code } = await Promise.race([
-      new Promise((resolve6) => {
-        proc.on("close", (c) => resolve6({ code: c }));
+      new Promise((resolve7) => {
+        proc.on("close", (c) => resolve7({ code: c }));
       }),
       new Promise(
         (_, reject) => setTimeout(() => {
@@ -10979,7 +10986,7 @@ async function loadGitignoreMatcher(projectRoot) {
 var YIELD_EVERY_N = 50;
 var PARALLEL_BATCH = 20;
 function yieldEventLoop() {
-  return new Promise((resolve6) => setImmediate(resolve6));
+  return new Promise((resolve7) => setImmediate(resolve7));
 }
 function throwIfAborted(signal) {
   if (!signal?.aborted) return;
@@ -11472,7 +11479,7 @@ function shutdownCodebaseIndexHost() {
 function callIndexOp(op, args, opts) {
   const w = ensureWorker();
   if (!w) return callInline(op, args, opts);
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     const id = nextRpcId++;
     const timer = setTimeout(() => {
       pending.delete(id);
@@ -11495,7 +11502,7 @@ function callIndexOp(op, args, opts) {
     pending.set(id, {
       resolve: (v) => {
         cleanup();
-        resolve6(v);
+        resolve7(v);
       },
       reject: (e) => {
         cleanup();