@yamo/cli 1.3.1 → 1.3.4

package/dist/index.js

@@ -97,7 +97,7 @@ program
     .description("Submit a YAMO block to the blockchain")
     .argument("<file>", "Path to the YAMO file")
     .requiredOption("--id <blockId>", "Unique Block ID")
-    .option("--prev <previousBlock>", "Previous Block Hash", "0")
+    .option("--prev <previousBlock>", "Previous Block Hash (omits to auto-fetch from chain)")
     .option("--consensus <type>", "Consensus Type", "cli_manual")
     .option("--ledger <name>", "Ledger Name", "yamo_cli")
     .option("--ipfs", "Upload content to IPFS before submitting")
@@ -134,10 +134,20 @@ program
             const files = [{ name: "block.yamo", content }];
             if (outputMatch) {
                 const artifactName = outputMatch[1].trim();
+                // Security: Check for path traversal patterns in artifact name (Part 3: Security Fixes)
+                if (artifactName.includes('..') || artifactName.startsWith('/')) {
+                    throw new Error(`Invalid artifact name: ${artifactName} (path-like names are not allowed)`);
+                }
                 const artifactPath = path_1.default.join(path_1.default.dirname(file), artifactName);
-                if (fs_1.default.existsSync(artifactPath)) {
+                // Security: Resolve to absolute path and restrict to input file directory
+                const resolvedPath = path_1.default.resolve(artifactPath);
+                const inputDir = path_1.default.resolve(path_1.default.dirname(file));
+                if (!resolvedPath.startsWith(inputDir)) {
+                    throw new Error(`Artifact path outside allowed directory: ${artifactName}`);
+                }
+                if (fs_1.default.existsSync(resolvedPath)) {
                     console.log(chalk_1.default.cyan(`Bundling output: ${artifactName}`));
-                    files.push({ name: artifactName, content: fs_1.default.readFileSync(artifactPath, "utf8") });
+                    files.push({ name: artifactName, content: fs_1.default.readFileSync(resolvedPath, "utf8") });
                 }
             }
             let encryptionKey = undefined;
@@ -151,7 +161,22 @@ program
             ipfsCID = await ipfsManager.upload({ content, files, encryptionKey });
             console.log(chalk_1.default.cyan(`IPFS Bundle CID: ${ipfsCID}`));
         }
-        await chainClient.submitBlock(options.id, options.prev, contentHash, options.consensus, options.ledger, ipfsCID);
+        // Auto-fetch previousBlock if not provided (chain continuation)
+        let resolvedPreviousBlock = options.prev;
+        if (!resolvedPreviousBlock) {
+            console.log(chalk_1.default.blue(`[INFO] No previousBlock provided, fetching latest block from chain...`));
+            const latestBlock = await chainClient.getLatestBlock();
+            if (latestBlock) {
+                resolvedPreviousBlock = latestBlock.contentHash;
+                console.log(chalk_1.default.green(`[INFO] Using latest block's contentHash: ${resolvedPreviousBlock}`));
+            }
+            else {
+                // No blocks exist yet, use genesis
+                resolvedPreviousBlock = "0x0000000000000000000000000000000000000000000000000000000000000000";
+                console.log(chalk_1.default.yellow(`[INFO] No existing blocks found, using genesis`));
+            }
+        }
+        await chainClient.submitBlock(options.id, resolvedPreviousBlock, contentHash, options.consensus, options.ledger, ipfsCID);
     }
     catch (error) {
         console.error(chalk_1.default.red(`Error: ${error.message}`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yamo/cli",
-  "version": "1.3.1",
+  "version": "1.3.4",
   "description": "YAMO Protocol v0.4 - Command-line tools for blockchain integration",
   "main": "dist/index.js",
   "type": "commonjs",
@@ -16,7 +16,9 @@
   "scripts": {
     "build": "tsc && chmod +x dist/index.js",
     "prepublishOnly": "npm run build",
-    "start": "node dist/index.js"
+    "start": "node dist/index.js",
+    "test": "node --test test/**/*.test.js",
+    "test:security": "node --test test/security.test.js"
   },
   "keywords": [
     "yamo",
@@ -41,7 +43,7 @@
     "typescript": "^5.9.3"
   },
   "dependencies": {
-    "@yamo/core": "^1.1.0",
+    "@yamo/core": "^1.2.7",
     "axios": "^1.13.2",
     "chalk": "^4.1.2",
     "commander": "^12.0.0",