claudecode-linter 2.1.148 → 2.1.150

package/dist/utils/safe-write.js

@@ -0,0 +1,36 @@
+import { lstatSync, realpathSync } from "node:fs";
+import { sep } from "node:path";
+/**
+ * Decide whether writing to `filePath` (a fix/format target) is safe.
+ *
+ * The linter may write fixes back to artifact paths supplied by a plugin.
+ * A malicious plugin can ship an artifact path that is actually a symlink
+ * pointing outside the target tree (`~/.bashrc`, an SSH key, a CI secret);
+ * a bare `writeFileSync` would then clobber the symlink's target.
+ *
+ * Returns a human-readable reason to REFUSE the write, or `null` if the
+ * write is safe. The check fails closed: if anything throws (path missing,
+ * permission error, etc.) a refusal reason is returned.
+ *
+ * Refuses when:
+ *  - `filePath` itself is a symbolic link, or
+ *  - the real path of `filePath` is not `rootDir` itself and not located
+ *    under `rootDir + path.sep`.
+ */
+export function writeBlockedReason(filePath, rootDir) {
+    try {
+        if (lstatSync(filePath).isSymbolicLink()) {
+            return "path is a symlink";
+        }
+        const realRoot = realpathSync(rootDir);
+        const realPath = realpathSync(filePath);
+        if (realPath !== realRoot && !realPath.startsWith(realRoot + sep)) {
+            return "path resolves outside the target directory";
+        }
+        return null;
+    }
+    catch {
+        return "path could not be safely resolved";
+    }
+}
+//# sourceMappingURL=safe-write.js.map

package/dist/utils/terminal.js

@@ -0,0 +1,18 @@
+/**
+ * Strip C0 control characters and DEL from a string before it is written to
+ * a terminal, while preserving tab and newline.
+ *
+ * Diagnostic messages, file paths and `--fix-dry-run` diffs embed untrusted
+ * strings (rule content, field values, file content, plugin-controlled file
+ * and directory names). Without sanitization an attacker-supplied artifact
+ * could smuggle ANSI/control sequences into the user's terminal.
+ *
+ * Strips U+0000-U+0008, U+000B-U+001F and U+007F (DEL) - every C0 control
+ * char and DEL except U+0009 (tab) and U+000A (newline), which are kept.
+ * The stripped set includes U+000D (CR) and U+001B (ESC) by design.
+ */
+export function sanitizeForTerminal(s) {
+    // eslint-disable-next-line no-control-regex
+    return s.replace(/[\u0000-\u0008\u000B-\u001F\u007F]/g, "");
+}
+//# sourceMappingURL=terminal.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "claudecode-linter",
-	"version": "2.1.148",
+	"version": "2.1.150",
 	"description": "Standalone linter for Claude Code plugins and configuration files",
 	"type": "module",
 	"bin": {
@@ -30,6 +30,8 @@
 		"contracts/skill-frontmatter.schema.json",
 		"contracts/agent-frontmatter.schema.json",
 		"contracts/command-frontmatter.schema.json",
+		"contracts/mcp.schema.json",
+		"contracts/hooks.schema.json",
 		".claudecode-lint.defaults.yaml",
 		"README.md"
 	],