codecartographer-pi 0.12.9 → 0.12.10

package/dist/core/utils.d.ts

@@ -3,6 +3,15 @@ export declare function pathExists(path: string): Promise<boolean>;
 export declare function canonicalPath(path: string): Promise<string>;
 export declare function normalizeForComparison(path: string): string;
 export declare function isWithinPath(path: string, root: string): boolean;
+/**
+ * Symlink-aware version of isWithinPath. Resolves symlinks on both the path
+ * and root before comparing, preventing bypass via symlinks inside the
+ * allowed root that point outside it.
+ *
+ * Falls back to lexical isWithinPath if realpath fails (e.g., path does not
+ * exist yet), which is safe for write targets that haven't been created.
+ */
+export declare function isWithinPathResolved(path: string, root: string): Promise<boolean>;
 export declare function isPlainObject(value: unknown): value is Record<string, unknown>;
 export declare function uniqueStrings(items: string[]): string[];
 export declare function dateOnly(timestamp: string): string;

package/dist/core/utils.js

@@ -36,6 +36,27 @@ export function isWithinPath(path, root) {
         return true;
     return normalizedPath.startsWith(`${normalizedRoot}${process.platform === "win32" ? "\\" : "/"}`);
 }
+/**
+ * Symlink-aware version of isWithinPath. Resolves symlinks on both the path
+ * and root before comparing, preventing bypass via symlinks inside the
+ * allowed root that point outside it.
+ *
+ * Falls back to lexical isWithinPath if realpath fails (e.g., path does not
+ * exist yet), which is safe for write targets that haven't been created.
+ */
+export async function isWithinPathResolved(path, root) {
+    try {
+        const resolvedPath = await realpath(path);
+        const resolvedRoot = await realpath(root);
+        return isWithinPath(resolvedPath, resolvedRoot);
+    }
+    catch {
+        // If realpath fails (path doesn't exist yet, broken symlink, etc.),
+        // fall back to lexical check. For write targets this is safe because
+        // the parent directory should already be within the root.
+        return isWithinPath(path, root);
+    }
+}
 export function isPlainObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }

package/dist/extensions/codecarto/index.js

@@ -8,7 +8,7 @@ import { narrateDashboard } from "./dashboard-narrator.js";
 import { writeDashboard } from "./dashboard-writer.js";
 import { parseNextFlags } from "./next-flags.js";
 import { phaseCompactionExtension } from "./phase-compaction.js";
-import { buildPhasePrompt, buildSkillPrompt, buildValidationSummary, canonicalPath, computePerPhaseTotals, computeTotals, createEmptyStatus, DEFAULT_PIPELINE_PATH, deriveSlug, discoverLibrary, getNextEligiblePhase, getPipelineLabel, getWorkspaceState, isWithinPath, listSkillNames, loadCodecartoConfig, loadUsage, loadYamlFile, normalizeForComparison, packagedWorkspaceDir, pathExists, PACKAGE_VERSION, PhasePreflightError, PIPELINE_ALIASES, publishEntry, resolvePhase, resolvePipelineChoice, runPhasePreflight, stringifySimpleYaml, switchPipeline, validatePhaseOutput, writeLibraryConfig, } from "../../core/index.js";
+import { buildPhasePrompt, buildSkillPrompt, buildValidationSummary, canonicalPath, computePerPhaseTotals, computeTotals, createEmptyStatus, DEFAULT_PIPELINE_PATH, deriveSlug, discoverLibrary, getNextEligiblePhase, getPipelineLabel, getWorkspaceState, isWithinPathResolved, listSkillNames, loadCodecartoConfig, loadUsage, loadYamlFile, normalizeForComparison, packagedWorkspaceDir, pathExists, PACKAGE_VERSION, PhasePreflightError, PIPELINE_ALIASES, publishEntry, resolvePhase, resolvePipelineChoice, runPhasePreflight, stringifySimpleYaml, switchPipeline, validatePhaseOutput, writeLibraryConfig, } from "../../core/index.js";
 import { initLibrary } from "../../core/library.js";
 import { resolveUserConfigPath } from "../../core/orchestrator-config.js";
 const STATUS_WIDGET_ID = "codecarto-widget";
@@ -167,7 +167,8 @@ export default function codeCartographerExtension(pi) {
             if (config.library.path && await discoverLibrary(config.library.path)) {
                 allowedRoots.push(await canonicalPath(config.library.path));
             }
-            if (!allowedRoots.some((allowedRoot) => isWithinPath(targetPath, allowedRoot))) {
+            const withinAllowed = await Promise.all(allowedRoots.map((allowedRoot) => isWithinPathResolved(targetPath, allowedRoot)));
+            if (!withinAllowed.some((result) => result)) {
                 if (ctx.hasUI) {
                     ctx.ui.notify(`Blocked ${event.toolName} outside .codecarto/ or configured library: ${inputPath}`, "warning");
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codecartographer-pi",
-  "version": "0.12.9",
+  "version": "0.12.10",
   "mcpName": "io.github.HuginnIndustries/codecartographer",
   "description": "Evidence-backed reverse engineering and human-gated software planning for Pi and MCP coding agents.",
   "type": "module",