autosnippet 3.1.2 → 3.1.4

package/lib/cli/SetupService.js

@@ -60,8 +60,6 @@ const __dirname = dirname(__filename);
 
 /** AutoSnippet 源码仓库根目录（定位 templates/ 等资源） */
 const REPO_ROOT = resolve(__dirname, '..', '..');
-/** V2 子项目根目录（定位 bin/mcp-server.js 等） */
-const V2_ROOT = resolve(__dirname, '..', '..');
 
 // ─────────────────────────────────────────────────────
 
@@ -434,10 +432,8 @@ export class SetupService {
   /* ═══ Step 3: IDE 集成 ═══════════════════════════════ */
 
   stepIDE() {
-    const mcpServerPath = join(V2_ROOT, 'bin', 'mcp-server.js');
-
-    this._configureVSCodeMCP(mcpServerPath);
-    this._configureCursorMCP(mcpServerPath);
+    this._configureVSCodeMCP();
+    this._configureCursorMCP();
     this._copyCopilotInstructions();
     this._generateAgentInstructionFiles();
     this._copyCursorRules();
@@ -649,7 +645,7 @@ export class SetupService {
   }
 
   /** @private .vscode/mcp.json → VSCode MCP (新标准格式) */
-  _configureVSCodeMCP(mcpServerPath) {
+  _configureVSCodeMCP() {
     const vscodeDir = join(this.projectRoot, '.vscode');
     const mcpConfigPath = join(vscodeDir, 'mcp.json');
     mkdirSync(vscodeDir, { recursive: true });
@@ -668,11 +664,9 @@ export class SetupService {
     }
     config.servers.autosnippet = {
       type: 'stdio',
-      command: 'node',
-      args: [mcpServerPath],
+      command: 'asd-mcp',
       env: {
         ASD_PROJECT_DIR: this.projectRoot,
-        NODE_PATH: join(V2_ROOT, 'node_modules'),
       },
     };
 
@@ -680,7 +674,7 @@ export class SetupService {
   }
 
   /** @private .cursor/mcp.json */
-  _configureCursorMCP(mcpServerPath) {
+  _configureCursorMCP() {
     const cursorDir = join(this.projectRoot, '.cursor');
     const configPath = join(cursorDir, 'mcp.json');
     mkdirSync(cursorDir, { recursive: true });
@@ -698,11 +692,9 @@ export class SetupService {
       existing.mcpServers = {};
     }
     existing.mcpServers.autosnippet = {
-      command: 'node',
-      args: [mcpServerPath],
+      command: 'asd-mcp',
       env: {
         ASD_PROJECT_DIR: this.projectRoot,
-        NODE_PATH: join(V2_ROOT, 'node_modules'),
       },
     };
 

package/lib/cli/UpgradeService.js

@@ -63,16 +63,13 @@ export class UpgradeService {
   /* ═══ MCP 配置 ══════════════════════════════════════ */
 
   _upgradeMCP() {
-    const mcpServerPath = join(REPO_ROOT, 'bin', 'mcp-server.js');
-    const nodePath = join(REPO_ROOT, 'node_modules');
-
     // Cursor
-    this._updateCursorMCP(mcpServerPath, nodePath);
+    this._updateCursorMCP();
     // VSCode
-    this._updateVSCodeMCP(mcpServerPath, nodePath);
+    this._updateVSCodeMCP();
   }
 
-  _updateCursorMCP(mcpServerPath, nodePath) {
+  _updateCursorMCP() {
     const configPath = join(this.projectRoot, '.cursor', 'mcp.json');
     if (!existsSync(configPath)) {
       return;
@@ -89,18 +86,16 @@ export class UpgradeService {
     }
 
     config.mcpServers.autosnippet = {
-      command: 'node',
-      args: [mcpServerPath],
+      command: 'asd-mcp',
       env: {
         ASD_PROJECT_DIR: this.projectRoot,
-        NODE_PATH: nodePath,
       },
     };
 
     writeFileSync(configPath, JSON.stringify(config, null, 2));
   }
 
-  _updateVSCodeMCP(mcpServerPath, nodePath) {
+  _updateVSCodeMCP() {
     const vscodeDir = join(this.projectRoot, '.vscode');
     const mcpConfigPath = join(vscodeDir, 'mcp.json');
 
@@ -119,11 +114,9 @@ export class UpgradeService {
 
     config.servers.autosnippet = {
       type: 'stdio',
-      command: 'node',
-      args: [mcpServerPath],
+      command: 'asd-mcp',
       env: {
         ASD_PROJECT_DIR: this.projectRoot,
-        NODE_PATH: nodePath,
       },
     };
 

package/lib/external/mcp/handlers/bootstrap/pipeline/checkpoint.js

@@ -9,6 +9,7 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import Logger from '../../../../../infrastructure/logging/Logger.js';
+import pathGuard from '../../../../../shared/PathGuard.js';
 
 const logger = Logger.getInstance();
 
@@ -79,8 +80,12 @@ export async function loadCheckpoints(projectRoot) {
 export async function clearCheckpoints(projectRoot) {
   try {
     const checkpointDir = path.join(projectRoot, '.autosnippet', 'bootstrap-checkpoint');
+    pathGuard.assertSafe(checkpointDir);
     await fs.rm(checkpointDir, { recursive: true, force: true });
-  } catch {
-    /* ignore */
+  } catch (err) {
+    if (err?.name === 'PathGuardError') {
+      throw err;
+    }
+    /* ignore other errors */
   }
 }

package/lib/service/knowledge/KnowledgeFileWriter.js

@@ -309,6 +309,7 @@ export class KnowledgeFileWriter {
     if (entry.sourceFile) {
       const fullPath = path.join(this.projectRoot, entry.sourceFile);
       if (fs.existsSync(fullPath)) {
+        pathGuard.assertSafe(fullPath);
         fs.unlinkSync(fullPath);
         this.logger.info('Knowledge entry file removed', {
           entryId: entry.id,
@@ -328,6 +329,7 @@ export class KnowledgeFileWriter {
     for (const dir of searchDirs) {
       const fp = path.join(dir, filename);
       if (fs.existsSync(fp)) {
+        pathGuard.assertSafe(fp);
         fs.unlinkSync(fp);
         this.logger.info('Knowledge entry file removed', { entryId: entry.id, path: fp });
         return true;
@@ -358,6 +360,7 @@ export class KnowledgeFileWriter {
 
     // 删除旧文件
     if (oldPath && fs.existsSync(oldPath)) {
+      pathGuard.assertSafe(oldPath);
       fs.unlinkSync(oldPath);
       this.logger.info('Removed old knowledge entry file on lifecycle change', {
         entryId: entry.id,
@@ -392,6 +395,7 @@ export class KnowledgeFileWriter {
     }
     const oldPath = path.join(this.projectRoot, entry.sourceFile);
     if (oldPath !== newPath && fs.existsSync(oldPath)) {
+      pathGuard.assertSafe(oldPath);
       fs.unlinkSync(oldPath);
       this.logger.info('Cleaned up old knowledge entry file', {
         entryId: entry.id,
@@ -675,6 +679,7 @@ function _walkAndRemoveById(dir, id) {
     } else if (entry.name.endsWith('.md') && !entry.name.startsWith('_')) {
       const head = fs.readFileSync(full, 'utf8').slice(0, 500);
       if (head.includes(`id: ${id}`)) {
+        pathGuard.assertSafe(full);
         fs.unlinkSync(full);
         return true;
       }

package/lib/service/wiki/WikiUtils.js

@@ -332,6 +332,10 @@ export function dedup(files, wikiDir, emit) {
       // 完全相同 hash → 移除后来的
       if (existing.hash === file.hash) {
         const fullPath = path.join(wikiDir, file.path);
+        if (!fullPath.startsWith(path.resolve(wikiDir) + path.sep)) {
+          logger.warn(`[WikiGenerator] Dedup: path escape blocked — ${file.path}`);
+          continue;
+        }
         try {
           fs.unlinkSync(fullPath);
         } catch {
@@ -361,6 +365,10 @@ export function dedup(files, wikiDir, emit) {
       if (isCurrentSynced && !isFirstSynced) {
         // 当前是 synced，first 是 codegen → 删除 synced
         const fullPath = path.join(wikiDir, file.path);
+        if (!fullPath.startsWith(path.resolve(wikiDir) + path.sep)) {
+          logger.warn(`[WikiGenerator] Dedup: path escape blocked — ${file.path}`);
+          continue;
+        }
         try {
           fs.unlinkSync(fullPath);
         } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "autosnippet",
-  "version": "3.1.2",
+  "version": "3.1.4",
   "description": "Extract code patterns into a knowledge base for AI coding assistants",
   "type": "module",
   "main": "lib/bootstrap.js",
@@ -40,7 +40,8 @@
   "author": "gaoxuefeng",
   "license": "MIT",
   "bin": {
-    "asd": "bin/cli.js"
+    "asd": "bin/cli.js",
+    "asd-mcp": "bin/mcp-server.js"
   },
   "keywords": [
     "snippet",