claudekit-cli 4.3.0-dev.1 → 4.3.1-dev.1

package/cli-manifest.json

@@ -1,6 +1,6 @@
 {
-	"version": "4.3.0-dev.1",
-	"generatedAt": "2026-05-13T17:14:50.592Z",
+	"version": "4.3.1-dev.1",
+	"generatedAt": "2026-05-14T14:42:20.256Z",
 	"commands": {
 		"agents": {
 			"name": "agents",

package/dist/index.js

@@ -13843,7 +13843,7 @@ var init_merge_single_sections = __esm(() => {
 
 // src/commands/portable/portable-installer.ts
 import { existsSync as existsSync4 } from "node:fs";
-import { lstat, mkdir as mkdir3, readFile as readFile4, unlink as unlink3, writeFile as writeFile3 } from "node:fs/promises";
+import { lstat, mkdir as mkdir3, readFile as readFile4, realpath as realpath2, unlink as unlink3, writeFile as writeFile3 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
 import { basename as basename2, dirname as dirname3, join as join4, relative as relative2, resolve as resolve3, sep } from "node:path";
 function isSamePath(path1, path2) {
@@ -13913,20 +13913,49 @@ async function validateNoSymlinkComponents(targetPath, boundaryPath) {
   }
   const segments = relative2(resolvedBoundary, resolvedTarget).split(/[\\/]+/).filter(Boolean);
   let cursor = resolvedBoundary;
+  let deepestExisting = resolvedBoundary;
   for (const segment of segments) {
     cursor = join4(cursor, segment);
     try {
-      const stats = await lstat(cursor);
-      if (stats.isSymbolicLink()) {
-        return `Unsafe path: target path contains symlink (${cursor})`;
-      }
+      await lstat(cursor);
+      deepestExisting = cursor;
     } catch (error) {
       if (isErrnoCode3(error, "ENOENT")) {
         break;
       }
+      if (isErrnoCode3(error, "ELOOP")) {
+        return `Unsafe path: circular symlink detected at ${cursor}`;
+      }
+      throw error;
+    }
+  }
+  let realDeepest;
+  try {
+    realDeepest = await realpath2(deepestExisting);
+  } catch (error) {
+    if (isErrnoCode3(error, "ENOENT")) {
+      return null;
+    }
+    if (isErrnoCode3(error, "ELOOP")) {
+      return `Unsafe path: circular symlink detected at ${deepestExisting}`;
+    }
+    throw error;
+  }
+  let realBoundary;
+  try {
+    realBoundary = await realpath2(resolvedBoundary);
+  } catch (error) {
+    if (isErrnoCode3(error, "ENOENT")) {
+      realBoundary = resolvedBoundary;
+    } else if (isErrnoCode3(error, "ELOOP")) {
+      return `Unsafe path: circular symlink detected at boundary ${resolvedBoundary}`;
+    } else {
       throw error;
     }
   }
+  if (!isPathWithinBoundary2(realDeepest, realBoundary)) {
+    return `Unsafe path: target path contains symlink that escapes ${realBoundary} (${deepestExisting} -> ${realDeepest})`;
+  }
   return null;
 }
 async function validateWritableTargetPath(targetPath, options2) {
@@ -46296,7 +46325,7 @@ var init_config = __esm(() => {
 });
 
 // node_modules/readdirp/index.js
-import { lstat as lstat4, readdir as readdir5, realpath as realpath4, stat as stat2 } from "node:fs/promises";
+import { lstat as lstat4, readdir as readdir5, realpath as realpath5, stat as stat2 } from "node:fs/promises";
 import { join as pjoin, relative as prelative, resolve as presolve, sep as psep } from "node:path";
 import { Readable } from "node:stream";
 function readdirp(root, options2 = {}) {
@@ -46500,7 +46529,7 @@ var init_readdirp = __esm(() => {
       if (stats && stats.isSymbolicLink()) {
         const full = entry.fullPath;
         try {
-          const entryRealPath = await realpath4(full);
+          const entryRealPath = await realpath5(full);
           const entryRealPathStats = await lstat4(entryRealPath);
           if (entryRealPathStats.isFile()) {
             return "file";
@@ -46729,7 +46758,7 @@ class NodeFsHandler {
       });
     });
   }
-  async _handleDir(dir, stats, initialAdd, depth, target, wh, realpath5) {
+  async _handleDir(dir, stats, initialAdd, depth, target, wh, realpath6) {
     const parentDir = this.fsw._getWatchedDir(sp.dirname(dir));
     const tracked = parentDir.has(sp.basename(dir));
     if (!(initialAdd && this.fsw.options.ignoreInitial) && !target && !tracked) {
@@ -46740,7 +46769,7 @@ class NodeFsHandler {
     let throttler;
     let closer;
     const oDepth = this.fsw.options.depth;
-    if ((oDepth == null || depth <= oDepth) && !this.fsw._symlinkPaths.has(realpath5)) {
+    if ((oDepth == null || depth <= oDepth) && !this.fsw._symlinkPaths.has(realpath6)) {
       if (!target) {
         await this._handleRead(dir, initialAdd, wh, target, dir, depth, throttler);
         if (this.fsw.closed)
@@ -51663,18 +51692,18 @@ var init_migrate_provider_scopes = __esm(() => {
 
 // src/commands/migrate/skill-directory-installer.ts
 import { existsSync as existsSync22 } from "node:fs";
-import { cp, mkdir as mkdir10, realpath as realpath5, rename as rename6, rm as rm5 } from "node:fs/promises";
+import { cp, mkdir as mkdir10, realpath as realpath6, rename as rename6, rm as rm5 } from "node:fs/promises";
 import { dirname as dirname11, join as join40, resolve as resolve15 } from "node:path";
 async function canonicalize(path3) {
   try {
-    return await realpath5(path3);
+    return await realpath6(path3);
   } catch {
     const parent = dirname11(path3);
     if (parent === path3) {
       return resolve15(path3);
     }
     try {
-      const canonicalParent = await realpath5(parent);
+      const canonicalParent = await realpath6(parent);
       const absPath = resolve15(path3);
       const absParent = resolve15(parent);
       const basename13 = absPath.slice(absParent.length + 1) || "";
@@ -53923,7 +53952,7 @@ var init_codex_capabilities = __esm(() => {
 
 // src/commands/portable/codex-path-safety.ts
 import { existsSync as existsSync24 } from "node:fs";
-import { mkdir as mkdir12, realpath as realpath6 } from "node:fs/promises";
+import { mkdir as mkdir12, realpath as realpath7 } from "node:fs/promises";
 import { homedir as homedir25 } from "node:os";
 import { dirname as dirname12, join as join42, resolve as resolve17, sep as sep7 } from "node:path";
 function isPathWithinBoundary3(targetPath, boundaryPath) {
@@ -53933,7 +53962,7 @@ function isPathWithinBoundary3(targetPath, boundaryPath) {
 }
 async function resolveRealPathSafe2(path3) {
   try {
-    return await realpath6(path3);
+    return await realpath7(path3);
   } catch {
     return resolve17(path3);
   }
@@ -63258,7 +63287,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "claudekit-cli",
-    version: "4.3.0-dev.1",
+    version: "4.3.1-dev.1",
     description: "CLI tool for bootstrapping and updating ClaudeKit projects",
     type: "module",
     repository: {
@@ -89535,7 +89564,7 @@ init_github_client();
 init_config_version_checker();
 
 // src/domains/sync/sync-engine.ts
-import { lstat as lstat6, readFile as readFile46, readlink as readlink2, realpath as realpath7, stat as stat14 } from "node:fs/promises";
+import { lstat as lstat6, readFile as readFile46, readlink as readlink2, realpath as realpath8, stat as stat14 } from "node:fs/promises";
 import { isAbsolute as isAbsolute10, join as join88, normalize as normalize8, relative as relative18 } from "node:path";
 
 // src/services/file-operations/ownership-checker.ts
@@ -90794,8 +90823,8 @@ async function validateSyncPath(basePath, filePath) {
   }
   await validateSymlinkChain(fullPath, basePath);
   try {
-    const resolvedBase = await realpath7(basePath);
-    const resolvedFull = await realpath7(fullPath);
+    const resolvedBase = await realpath8(basePath);
+    const resolvedFull = await realpath8(fullPath);
     const resolvedRel = relative18(resolvedBase, resolvedFull);
     if (resolvedRel.startsWith("..") || isAbsolute10(resolvedRel)) {
       throw new Error(`Symlink escapes base directory: ${filePath}`);
@@ -90804,8 +90833,8 @@ async function validateSyncPath(basePath, filePath) {
     if (error.code === "ENOENT") {
       const parentPath = join88(fullPath, "..");
       try {
-        const resolvedBase = await realpath7(basePath);
-        const resolvedParent = await realpath7(parentPath);
+        const resolvedBase = await realpath8(basePath);
+        const resolvedParent = await realpath8(parentPath);
         const resolvedRel = relative18(resolvedBase, resolvedParent);
         if (resolvedRel.startsWith("..") || isAbsolute10(resolvedRel)) {
           throw new Error(`Parent symlink escapes base directory: ${filePath}`);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "claudekit-cli",
-	"version": "4.3.0-dev.1",
+	"version": "4.3.1-dev.1",
 	"description": "CLI tool for bootstrapping and updating ClaudeKit projects",
 	"type": "module",
 	"repository": {