@yawlabs/ctxlint 0.9.15 → 0.9.16

package/dist/index.js

@@ -43854,7 +43854,7 @@ import { readFileSync as readFileSync4 } from "node:fs";
 import { resolve as resolve8, dirname as dirname3 } from "node:path";
 import { fileURLToPath } from "node:url";
 function loadVersion() {
-  if (true) return "0.9.15";
+  if (true) return "0.9.16";
   const __dir = dirname3(fileURLToPath(import.meta.url));
   const pkgPath = resolve8(__dir, "../package.json");
   const pkg = JSON.parse(readFileSync4(pkgPath, "utf-8"));
@@ -44771,7 +44771,23 @@ var init_fixer = __esm({
 // src/mcp/server.ts
 var server_exports = {};
 import * as path9 from "node:path";
-var contextCheckEnum, mcpCheckEnum, sessionCheckEnum, server, transport;
+function validateProjectPath(rawPath) {
+  if (!rawPath) return process.cwd();
+  if (PATH_DISALLOWED.test(rawPath)) {
+    throw new Error("projectPath contains disallowed characters");
+  }
+  const resolved = path9.resolve(rawPath);
+  if (!isDirectory(resolved)) {
+    throw new Error("projectPath is not an existing directory");
+  }
+  return resolved;
+}
+function validateFilePathInput(rawPath) {
+  if (PATH_DISALLOWED.test(rawPath)) {
+    throw new Error("path contains disallowed characters");
+  }
+}
+var contextCheckEnum, mcpCheckEnum, sessionCheckEnum, PATH_DISALLOWED, server, transport;
 var init_server3 = __esm({
   async "src/mcp/server.ts"() {
     "use strict";
@@ -44791,13 +44807,14 @@ var init_server3 = __esm({
     contextCheckEnum = external_exports3.enum(ALL_CHECKS);
     mcpCheckEnum = external_exports3.enum(ALL_MCP_CHECKS);
     sessionCheckEnum = external_exports3.enum(ALL_SESSION_CHECKS);
+    PATH_DISALLOWED = /[\n\r\t;`|]|\$\(|\$\{/;
     server = new McpServer({
       name: "ctxlint",
       version: VERSION
     });
     server.tool(
       "ctxlint_audit",
-      "Audit AI agent context files (CLAUDE.md, AGENTS.md, etc.) in the project. Checks for stale references, invalid commands, redundant content, contradictions, frontmatter issues, and token waste. Use ctxlint_mcp_audit for MCP configs or ctxlint_session_audit for session checks.",
+      "Audit AI agent context files (CLAUDE.md, AGENTS.md, etc.) in the project. Checks for stale references, invalid commands, redundant content, contradictions, frontmatter issues, and token waste. Scoped to context-file checks only; MCP-config and session-level checks are exposed as separate tools.",
       {
         projectPath: external_exports3.string().optional().describe("Path to the project root. Defaults to current working directory."),
         checks: external_exports3.array(contextCheckEnum).optional().describe("Which context-file checks to run. Defaults to all.")
@@ -44809,9 +44826,9 @@ var init_server3 = __esm({
         openWorldHint: false
       },
       async ({ projectPath, checks }) => {
-        const root = path9.resolve(projectPath || process.cwd());
-        const activeChecks = checks?.length ? checks : ALL_CHECKS;
         try {
+          const root = validateProjectPath(projectPath);
+          const activeChecks = checks?.length ? checks : ALL_CHECKS;
           const result = await runAudit(root, activeChecks);
           return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
         } catch (err) {
@@ -44843,7 +44860,8 @@ var init_server3 = __esm({
       },
       async ({ path: filePath, projectPath }) => {
         try {
-          const root = path9.resolve(projectPath || process.cwd());
+          validateFilePathInput(filePath);
+          const root = validateProjectPath(projectPath);
           const resolved = path9.resolve(root, filePath);
           const result = {
             path: filePath,
@@ -44885,8 +44903,8 @@ var init_server3 = __esm({
         openWorldHint: false
       },
       async ({ projectPath }) => {
-        const root = path9.resolve(projectPath || process.cwd());
         try {
+          const root = validateProjectPath(projectPath);
           const discovered = await scanForContextFiles(root);
           const parsed = discovered.map((f) => parseContextFile(f));
           const files = parsed.map((f) => ({
@@ -44936,9 +44954,9 @@ var init_server3 = __esm({
         openWorldHint: false
       },
       async ({ projectPath, checks }) => {
-        const root = path9.resolve(projectPath || process.cwd());
-        const activeChecks = checks?.length ? checks : ALL_CHECKS;
         try {
+          const root = validateProjectPath(projectPath);
+          const activeChecks = checks?.length ? checks : ALL_CHECKS;
           const result = await runAudit(root, activeChecks);
           const fixSummary = applyFixes(result, { quiet: true });
           return {
@@ -44986,9 +45004,9 @@ var init_server3 = __esm({
         openWorldHint: false
       },
       async ({ projectPath, checks, includeGlobal }) => {
-        const root = path9.resolve(projectPath || process.cwd());
-        const activeChecks = checks?.length ? checks : ALL_MCP_CHECKS;
         try {
+          const root = validateProjectPath(projectPath);
+          const activeChecks = checks?.length ? checks : ALL_MCP_CHECKS;
           const result = await runAudit(root, activeChecks, {
             mcp: true,
             mcpOnly: true,
@@ -45023,9 +45041,9 @@ var init_server3 = __esm({
         openWorldHint: true
       },
       async ({ projectPath, checks }) => {
-        const root = path9.resolve(projectPath || process.cwd());
-        const activeChecks = checks?.length ? checks : ALL_SESSION_CHECKS;
         try {
+          const root = validateProjectPath(projectPath);
+          const activeChecks = checks?.length ? checks : ALL_SESSION_CHECKS;
           const result = await runAudit(root, activeChecks, {
             session: true,
             sessionOnly: true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/ctxlint",
-  "version": "0.9.15",
+  "version": "0.9.16",
   "description": "Lint your AI agent context files, MCP server configs, and session data against your actual codebase",
   "bin": {
     "ctxlint": "dist/index.js"