akm-cli 0.0.21 → 0.0.22

package/dist/walker.js

@@ -5,7 +5,6 @@
  * (stash.ts) and the indexer (indexer.ts) to walk type-specific asset
  * directories and group files by parent directory.
  */
-import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { isRelevantAssetFile } from "./asset-spec";
@@ -77,17 +76,16 @@ function walkStashGit(stashRoot) {
     if (!isInsideGitRepo(stashRoot))
         return null;
     // Get tracked + untracked (non-ignored) files
-    const result = spawnSync("git", ["ls-files", "--cached", "--others", "--exclude-standard", "-z", "--", "."], {
+    const result = Bun.spawnSync(["git", "ls-files", "--cached", "--others", "--exclude-standard", "-z", "--", "."], {
         cwd: stashRoot,
-        encoding: "utf8",
-        timeout: 30_000,
-        maxBuffer: 10 * 1024 * 1024, // 10MB
     });
-    if (result.status !== 0)
+    // result.success is false if the process exited non-zero OR git was not found
+    if (!result.success)
         return null;
     const SKIP_DIRS = new Set([".git", "node_modules", "bin", ".cache"]);
     const SKIP_FILES = new Set([".stash.json", ".gitignore", ".gitattributes"]);
-    const files = result.stdout
+    const stdout = Buffer.isBuffer(result.stdout) ? result.stdout.toString("utf8") : String(result.stdout ?? "");
+    const files = stdout
         .split("\0")
         .filter((f) => f.length > 0)
         .filter((f) => !f.startsWith("..") && !path.isAbsolute(f))
@@ -98,8 +96,7 @@ function walkStashGit(stashRoot) {
             .filter(Boolean);
         return !dirParts.some((part) => SKIP_DIRS.has(part) || part.startsWith("."));
     })
-        .filter((f) => !SKIP_FILES.has(path.basename(f)))
-        .filter((f) => !f.includes("/.") && !f.startsWith(".")); // skip dot-dirs/files
+        .filter((f) => !SKIP_FILES.has(path.basename(f)));
     const results = [];
     for (const relFile of files) {
         const absPath = path.join(stashRoot, relFile);
@@ -114,7 +111,11 @@ function walkStashGit(stashRoot) {
     }
     return results;
 }
-/** Check if a directory is inside a git repository by walking up to find .git. */
+/**
+ * Check if a directory is inside a git repository by walking up to find .git.
+ * Intentionally walks above stashRoot so that parent repo .gitignore rules
+ * apply when the stash is nested inside a larger git repository.
+ */
 function isInsideGitRepo(dir) {
     let current = path.resolve(dir);
     const root = path.parse(current).root;
@@ -149,6 +150,10 @@ function walkStashManual(stashRoot) {
             if (entry.name === ".stash.json")
                 continue;
             const fullPath = path.join(current, entry.name);
+            if (entry.isSymbolicLink()) {
+                // Skip symlinks entirely to prevent potential path traversal outside stashRoot
+                continue;
+            }
             if (entry.isDirectory()) {
                 if (SKIP_DIRS.has(entry.name) || entry.name.startsWith("."))
                     continue;

package/dist/warn.js

@@ -6,6 +6,13 @@ let quiet = false;
 export function setQuiet(value) {
     quiet = value;
 }
+/**
+ * Reset the quiet flag to false.
+ * Intended for test teardown to prevent quiet state from leaking between tests.
+ */
+export function resetQuiet() {
+    quiet = false;
+}
 export function isQuiet() {
     return quiet;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akm-cli",
-  "version": "0.0.21",
+  "version": "0.0.22",
   "type": "module",
   "description": "CLI tool to search, open, and run extension assets from an akm stash directory.",
   "keywords": [

package/dist/provider-registry.js

@@ -1,8 +0,0 @@
-// ── Factory map ─────────────────────────────────────────────────────────────
-const providers = new Map();
-export function registerProvider(type, factory) {
-    providers.set(type, factory);
-}
-export function resolveProviderFactory(type) {
-    return providers.get(type) ?? null;
-}