catalyst-core 0.1.0-beta.2 → 0.1.0-beta.4

package/mcp_v2/lib/helpers.js

@@ -101,21 +101,33 @@ function findCatalystRoot() {
  * File-system helpers scoped to a project root.
  */
 function makeProjectHelpers(root) {
+    function safeProjectPath(rel) {
+        if (typeof rel !== "string" || path.isAbsolute(rel)) return null
+        const normalized = path.normalize(rel)
+        if (normalized === ".." || normalized.startsWith(`..${path.sep}`)) return null
+        return `${root}${path.sep}${normalized}`
+    }
+
     function fileExists(rel) {
-        return fs.existsSync(path.join(root, rel))
+        const filePath = safeProjectPath(rel)
+        return Boolean(filePath && fs.existsSync(filePath))
     }
 
     function readJson(rel) {
+        const filePath = safeProjectPath(rel)
+        if (!filePath) return null
         try {
-            return JSON.parse(fs.readFileSync(path.join(root, rel), "utf8"))
+            return JSON.parse(fs.readFileSync(filePath, "utf8"))
         } catch {
             return null
         }
     }
 
     function readText(rel) {
+        const filePath = safeProjectPath(rel)
+        if (!filePath) return null
         try {
-            return fs.readFileSync(path.join(root, rel), "utf8")
+            return fs.readFileSync(filePath, "utf8")
         } catch {
             return null
         }
@@ -125,7 +137,6 @@ function makeProjectHelpers(root) {
      * Walk src/**\/*.{js,jsx,ts,tsx} and return relative paths that match pattern.
      */
     function grepSrc(pattern) {
-        const re = new RegExp(pattern)
         const matches = []
         function walk(dir) {
             let entries
@@ -136,12 +147,13 @@ function makeProjectHelpers(root) {
             }
             for (const e of entries) {
                 if (e.name === "node_modules" || e.name === ".git") continue
-                const full = path.join(dir, e.name)
+                const full = `${dir}${path.sep}${e.name}`
                 if (e.isDirectory()) {
                     walk(full)
                 } else if (/\.(js|jsx|ts|tsx)$/.test(e.name)) {
                     try {
-                        if (re.test(fs.readFileSync(full, "utf8"))) {
+                        const content = fs.readFileSync(full, "utf8")
+                        if (pattern.test(content)) {
                             matches.push(path.relative(root, full))
                         }
                     } catch {
@@ -150,7 +162,7 @@ function makeProjectHelpers(root) {
                 }
             }
         }
-        walk(path.join(root, "src"))
+        walk(`${root}${path.sep}src`)
         return matches
     }
 

package/mcp_v2/tools/build.js

@@ -658,7 +658,7 @@ function handle_get_architecture_diagram({ feature, symptom } = {}) {
 
     if (diagram_key === "routing") {
         const { grepSrc } = makeProjectHelpers(catalystRoot.dir)
-        const routeFiles = grepSrc("RouterDataProvider|createBrowserRouter|<Route")
+        const routeFiles = grepSrc(/RouterDataProvider|createBrowserRouter|<Route/)
         project_context.push(
             `RouterDataProvider found in: ${routeFiles.length ? routeFiles.slice(0, 3).join(", ") : "not detected"}`
         )

package/mcp_v2/tools/config.js

@@ -8,6 +8,14 @@ function init(projectInfo) {
     _projectInfo = projectInfo
 }
 
+function projectPath(root, rel) {
+    const normalized = path.normalize(rel)
+    if (path.isAbsolute(normalized) || normalized === ".." || normalized.startsWith(`..${path.sep}`)) {
+        return null
+    }
+    return `${root}${path.sep}${normalized}`
+}
+
 function handle_check_config({ project_path, platform = "both" } = {}) {
     const root = project_path || _projectInfo.dir
     const configPath = path.join(root, "config", "config.json")
@@ -390,7 +398,10 @@ function handle_check_config({ project_path, platform = "both" } = {}) {
         })
     } else {
         const missingSplash = ["public/android/splashscreen.png", "public/ios/splashscreen.png"].filter(
-            (f) => !fs.existsSync(path.join(root, f))
+            (f) => {
+                const filePath = projectPath(root, f)
+                return !filePath || !fs.existsSync(filePath)
+            }
         )
         if (missingSplash.length) {
             issues.push({
@@ -405,9 +416,10 @@ function handle_check_config({ project_path, platform = "both" } = {}) {
 
     // ── notifications (optional, validate if present) ─────────────────────────
     if (wc.notifications && wc.notifications.enabled) {
-        const missingFirebase = ["google-services.json", "GoogleService-Info.plist"].filter(
-            (f) => !fs.existsSync(path.join(root, f))
-        )
+        const missingFirebase = ["google-services.json", "GoogleService-Info.plist"].filter((f) => {
+            const filePath = projectPath(root, f)
+            return !filePath || !fs.existsSync(filePath)
+        })
         if (missingFirebase.length) {
             issues.push({
                 field: "WEBVIEW_CONFIG.notifications",

package/mcp_v2/tools/conversion.js

@@ -113,9 +113,9 @@ function handle_get_conversion_status({ project_path, include_not_applicable = f
 
         T4_DATA_FETCHING: () => {
             const useEffectFiles = grepSrc(
-                "useEffect.*fetch|useEffect.*axios|useEffect.*\\.get\\(|useEffect.*\\.post\\("
+                /useEffect.*fetch|useEffect.*axios|useEffect.*\.get\(|useEffect.*\.post\(/
             )
-            const fetcherFiles = grepSrc("\\.serverFetcher\\s*=|\\.clientFetcher\\s*=")
+            const fetcherFiles = grepSrc(/\.serverFetcher\s*=|\.clientFetcher\s*=/)
             if (useEffectFiles.length === 0) return { status: "completed" }
             return {
                 status: "needs_review",
@@ -368,13 +368,13 @@ function handle_get_conversion_status({ project_path, include_not_applicable = f
         // ── Tier 3: Enhancements (feature-presence gated) ───────────────────────
 
         T17a_USE_FILEPICKER: () => {
-            const oldPatternFiles = grepSrc("<input[^>]*type=['\"]file['\"]")
+            const oldPatternFiles = grepSrc(/<input[^>]*type=['"]file['"]/)
             if (oldPatternFiles.length === 0)
                 return {
                     status: "not_applicable",
                     reason: 'No <input type="file"> found in project — file upload feature not used.',
                 }
-            const hookUsageFiles = grepSrc("useFilePicker")
+            const hookUsageFiles = grepSrc(/useFilePicker/)
             return {
                 status: "needs_review",
                 native_risk:
@@ -396,13 +396,13 @@ function handle_get_conversion_status({ project_path, include_not_applicable = f
         },
 
         T17b_USE_CAMERA: () => {
-            const oldPatternFiles = grepSrc("accept=['\"]image[^>]*capture|<input[^>]+capture")
+            const oldPatternFiles = grepSrc(/accept=['"]image[^>]*capture|<input[^>]+capture/)
             if (oldPatternFiles.length === 0)
                 return {
                     status: "not_applicable",
                     reason: "No camera capture inputs (<input capture>) found — camera feature not used.",
                 }
-            const hookUsageFiles = grepSrc("useCamera")
+            const hookUsageFiles = grepSrc(/useCamera/)
             return {
                 status: "needs_review",
                 native_risk:
@@ -424,13 +424,13 @@ function handle_get_conversion_status({ project_path, include_not_applicable = f
         },
 
         T18_USE_HAPTIC: () => {
-            const oldPatternFiles = grepSrc("navigator\\.vibrate")
+            const oldPatternFiles = grepSrc(/navigator\.vibrate/)
             if (oldPatternFiles.length === 0)
                 return {
                     status: "not_applicable",
                     reason: "No navigator.vibrate() calls found — haptic feedback not used.",
                 }
-            const hookUsageFiles = grepSrc("useHapticFeedback")
+            const hookUsageFiles = grepSrc(/useHapticFeedback/)
             return {
                 status: "needs_review",
                 native_risk:
@@ -453,7 +453,7 @@ function handle_get_conversion_status({ project_path, include_not_applicable = f
 
         T19_USE_NOTIFICATIONS: () => {
             if (!webviewConfig || !webviewConfig.notifications || !webviewConfig.notifications.enabled) {
-                const pushFiles = grepSrc("firebase|FCM|pushNotif|useNotification")
+                const pushFiles = grepSrc(/firebase|FCM|pushNotif|useNotification/)
                 if (pushFiles.length === 0)
                     return {
                         status: "not_applicable",
@@ -480,7 +480,7 @@ function handle_get_conversion_status({ project_path, include_not_applicable = f
 
         T20_USE_DEVICE_INFO: () => {
             const oldPatternFiles = grepSrc(
-                "navigator\\.userAgent|/Android/i\\.test|/iPhone/i\\.test|/iPad/i\\.test"
+                /navigator\.userAgent|\/Android\/i\.test|\/iPhone\/i\.test|\/iPad\/i\.test/
             )
             if (oldPatternFiles.length === 0)
                 return {
@@ -488,7 +488,7 @@ function handle_get_conversion_status({ project_path, include_not_applicable = f
                     reason: "No navigator.userAgent / UA-sniffing found — platform detection not used.",
                 }
             const correctPatternFiles = grepSrc(
-                "isNative|window\\.NativeBridge|nativeBridge\\.isAndroid|nativeBridge\\.isIOS"
+                /isNative|window\.NativeBridge|nativeBridge\.isAndroid|nativeBridge\.isIOS/
             )
             return {
                 status: "needs_review",

package/mcp_v2/tools/knowledge.js

@@ -55,11 +55,20 @@ function fetchRaw(url) {
     })
 }
 
+// Only allow known tag shapes or "main" — guards against a tampered/malformed
+// installed version string being interpolated into the GitHub fetch URL.
+// Covers all observed formats:
+//   v0.1.0, v0.1.0-canary.8, v0.0.3-canary-18, v0.1.0-beta.2
+function sanitizeGithubTag(version) {
+    if (!version) return "main"
+    return /^v\d+\.\d+\.\d+(-[a-zA-Z0-9]+([.\-]\d+)?)?$/.test(version) ? version : "main"
+}
+
 // Fetch first available file — used for KB-miss GitHub fallback
 async function fetchFromGithub(files, installedVersion) {
     if (!files || files.length === 0) return null
 
-    const tag = installedVersion || "main"
+    const tag = sanitizeGithubTag(installedVersion)
     const base = `https://raw.githubusercontent.com/tata1mg/catalyst-core/${tag}`
 
     for (const file of files) {
@@ -88,9 +97,13 @@ async function fetchFromGithub(files, installedVersion) {
     return null
 }
 
-// Build FTS5 query string from keywords array — each term ORed, quoted for safety
+// Build FTS5 query string from keywords array — each term ORed, quoted for safety.
+// Strip all FTS5 special characters before quoting so keywords are treated as literals.
 function buildFtsQuery(keywords) {
-    return keywords.map((k) => `"${k.replace(/"/g, "")}"`).join(" OR ")
+    return keywords
+        .map((k) => `"${k.replace(/[^a-zA-Z0-9 _\-]/g, " ").trim()}"`)
+        .filter((k) => k.length > 2) // drop empty/whitespace-only terms after stripping
+        .join(" OR ")
 }
 
 function stripGithubFiles(rows) {

package/mcp_v2/tools/tasks.js

@@ -26,6 +26,14 @@ function now() {
     return new Date().toISOString().replace("T", " ").slice(0, 19)
 }
 
+function projectPath(projectRoot, rel) {
+    const normalized = path.normalize(rel)
+    if (path.isAbsolute(normalized) || normalized === ".." || normalized.startsWith(`..${path.sep}`)) {
+        return null
+    }
+    return `${projectRoot}${path.sep}${normalized}`
+}
+
 // ─── Improvement 1: Resolve needs_review inline before plan write ─────────────
 //
 // Reads signal_files from disk for each needs_review task.
@@ -67,7 +75,8 @@ function resolveNeedsReview(task, projectRoot) {
         let nativeBranchFound = false
         for (const f of samplesToCheck) {
             try {
-                const absPath = path.isAbsolute(f) ? f : path.join(projectRoot, f)
+                const absPath = path.isAbsolute(f) ? f : projectPath(projectRoot, f)
+                if (!absPath) continue
                 const content = fs.readFileSync(absPath, "utf8")
                 if (hookRegex && hookRegex.test(content)) {
                     nativeBranchFound = true
@@ -411,12 +420,12 @@ function summarisePlan(plan) {
 // ─── MD file helpers ─────────────────────────────────────────────────────────
 
 function getMdPath(projectRoot, slug) {
-    return path.join(projectRoot, ".mcp_tasks", `${slug}.md`)
+    return `${projectRoot}${path.sep}.mcp_tasks${path.sep}${slug}.md`
 }
 
 function buildUserReviewWarnings(projectRoot) {
     const warnings = []
-    const configPath = path.join(projectRoot, "config", "config.json")
+    const configPath = `${projectRoot}${path.sep}config${path.sep}config.json`
     let config = null
     try {
         config = JSON.parse(fs.readFileSync(configPath, "utf8"))
@@ -463,7 +472,7 @@ function buildUserReviewWarnings(projectRoot) {
 }
 
 function writeMdFile(projectRoot, slug, goal, steps, bareMinimum, userReviewWarnings) {
-    const dir = path.join(projectRoot, ".mcp_tasks")
+    const dir = `${projectRoot}${path.sep}.mcp_tasks`
     if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true })
 
     const mdPath = getMdPath(projectRoot, slug)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "catalyst-core",
-    "version": "0.1.0-beta.2",
+    "version": "0.1.0-beta.4",
     "main": "dist/index.js",
     "description": "Web framework that provides great performance out of the box",
     "bin": {
@@ -97,7 +97,7 @@
         "webpack": "^5.88.2",
         "webpack-bundle-analyzer": "^4.9.1",
         "webpack-cli": "^5.1.4",
-        "webpack-dev-server": "^4.15.2",
+        "webpack-dev-server": "^5.2.4",
         "webpack-merge": "^5.9.0",
         "webpack-node-externals": "^3.0.0",
         "winston": "^3.11.0",