codeam-cli 2.2.0 → 2.2.1

package/dist/index.js

@@ -179,7 +179,7 @@ var import_qrcode_terminal = __toESM(require("qrcode-terminal"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.2.0",
+  version: "2.2.1",
   description: "Remote control Claude Code (and other AI coding agents) from your mobile phone. Pair your device, send prompts, stream responses in real-time, and approve commands \u2014 from anywhere.",
   main: "dist/index.js",
   bin: {
@@ -2174,14 +2174,65 @@ function parsePayload(schema, raw) {
 var fs5 = __toESM(require("fs/promises"));
 var path5 = __toESM(require("path"));
 var MAX_FILE_BYTES = 5 * 1024 * 1024;
-function resolveSafe(rawPath) {
+var SUBDIR_IGNORE = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  ".next",
+  ".expo",
+  "dist",
+  "build",
+  "out",
+  ".cache",
+  "coverage",
+  ".turbo",
+  ".parcel-cache",
+  ".idea",
+  ".vscode",
+  "ios",
+  "android"
+  // expo-managed native dirs are huge and rarely interesting
+]);
+async function listSubdirs(dir) {
+  try {
+    const entries = await fs5.readdir(dir, { withFileTypes: true });
+    return entries.filter((e) => e.isDirectory() && !e.name.startsWith(".") ? true : !SUBDIR_IGNORE.has(e.name)).filter((e) => e.isDirectory() && !SUBDIR_IGNORE.has(e.name)).map((e) => path5.join(dir, e.name));
+  } catch {
+    return [];
+  }
+}
+function isUnder(parent, candidate) {
+  const rel = path5.relative(parent, candidate);
+  return !rel.startsWith("..") && !path5.isAbsolute(rel);
+}
+async function findFile(rawPath) {
   const cwd = process.cwd();
-  const absolute = path5.isAbsolute(rawPath) ? path5.normalize(rawPath) : path5.resolve(cwd, rawPath);
-  const relativeFromCwd = path5.relative(cwd, absolute);
-  if (relativeFromCwd.startsWith("..") || path5.isAbsolute(relativeFromCwd)) {
-    throw new Error(`Path escapes the project root: ${rawPath}`);
+  const candidates = [];
+  if (path5.isAbsolute(rawPath)) {
+    candidates.push(path5.normalize(rawPath));
+  } else {
+    candidates.push(path5.resolve(cwd, rawPath));
+    const subdirs = await listSubdirs(cwd);
+    for (const sub of subdirs) {
+      candidates.push(path5.resolve(sub, rawPath));
+    }
   }
-  return absolute;
+  for (const cand of candidates) {
+    if (!isUnder(cwd, cand)) continue;
+    try {
+      const stat2 = await fs5.stat(cand);
+      if (stat2.isFile()) return cand;
+    } catch {
+    }
+  }
+  return null;
+}
+async function findWriteTarget(rawPath) {
+  const found = await findFile(rawPath);
+  if (found) return found;
+  const cwd = process.cwd();
+  const fallback = path5.isAbsolute(rawPath) ? path5.normalize(rawPath) : path5.resolve(cwd, rawPath);
+  if (!isUnder(cwd, fallback)) return null;
+  return fallback;
 }
 function looksBinary(buf) {
   const sample = buf.subarray(0, Math.min(8192, buf.length));
@@ -2192,11 +2243,11 @@ function looksBinary(buf) {
 }
 async function readProjectFile(rawPath) {
   try {
-    const abs = resolveSafe(rawPath);
-    const stat2 = await fs5.stat(abs);
-    if (!stat2.isFile()) {
-      return { error: "Not a regular file." };
+    const abs = await findFile(rawPath);
+    if (!abs) {
+      return { error: `File not found in the project tree: ${rawPath}` };
     }
+    const stat2 = await fs5.stat(abs);
     if (stat2.size > MAX_FILE_BYTES) {
       return { error: `File too large (${(stat2.size / 1024 / 1024).toFixed(1)} MB > ${MAX_FILE_BYTES / 1024 / 1024} MB).` };
     }
@@ -2212,7 +2263,10 @@ async function readProjectFile(rawPath) {
 }
 async function writeProjectFile(rawPath, content) {
   try {
-    const abs = resolveSafe(rawPath);
+    const abs = await findWriteTarget(rawPath);
+    if (!abs) {
+      return { error: `Path escapes the project root: ${rawPath}` };
+    }
     if (Buffer.byteLength(content, "utf-8") > MAX_FILE_BYTES) {
       return { error: "Content too large." };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "description": "Remote control Claude Code (and other AI coding agents) from your mobile phone. Pair your device, send prompts, stream responses in real-time, and approve commands — from anywhere.",
   "main": "dist/index.js",
   "bin": {