@wrongstack/tools 0.297.0 → 0.298.1

package/dist/edit.js

@@ -348,12 +348,13 @@ function ensureInsideRoot(absPath, ctx) {
 function safeResolve(input, ctx) {
   return ensureInsideRoot(resolvePath(input, ctx), ctx);
 }
-async function assertRealInsideRoot(absPath, ctx) {
-  if (ctx.allowOutsideProjectRoot) return;
+async function resolveRealInsideRoot(absPath, ctx) {
+  if (ctx.allowOutsideProjectRoot) return absPath;
   const realRoots = await Promise.all(
     allowedRoots(ctx).map((r) => fsp.realpath(r).catch(() => path2.resolve(r)))
   );
   let probe = absPath;
+  const pendingTail = [];
   for (; ; ) {
     let real;
     try {
@@ -361,13 +362,16 @@ async function assertRealInsideRoot(absPath, ctx) {
     } catch (err) {
       if (err.code === "ENOENT") {
         const parent = path2.dirname(probe);
-        if (parent === probe) return;
+        if (parent === probe) return absPath;
+        pendingTail.unshift(path2.basename(probe));
         probe = parent;
         continue;
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) return;
+    if (isInsideAny(real, realRoots)) {
+      return pendingTail.length > 0 ? path2.join(real, ...pendingTail) : real;
+    }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
     );
@@ -375,8 +379,7 @@ async function assertRealInsideRoot(absPath, ctx) {
 }
 async function safeResolveReal(input, ctx) {
   const abs = safeResolve(input, ctx);
-  await assertRealInsideRoot(abs, ctx);
-  return abs;
+  return await resolveRealInsideRoot(abs, ctx);
 }
 
 // src/edit.ts

package/dist/exec-allowlist.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Default allowlist of command NAMES the `exec` tool may run.
+ *
+ * Extracted from exec.ts for auditability. Only the command name is gated
+ * (per-arg safety is the BLOCKED_ARG_PATTERNS denylist in exec.ts + the
+ * per-call `confirm` permission). A prior version mapped each command to an
+ * allowed-args array, but those arrays were never enforced (dead code) — a
+ * plain Set is the honest shape.
+ *
+ * Extend/trim at runtime via `configureExecPolicy()` (wired from
+ * `config.tools.exec.{allow,deny}` at boot). `allow` is trusted-config-only;
+ * see the security note on ExecToolConfig.
+ */
+export declare const DEFAULT_ALLOWED_COMMANDS: ReadonlySet<string>;
+//# sourceMappingURL=exec-allowlist.d.ts.map