dep-brain 0.5.0 → 0.5.2

package/dist/cli.js

@@ -48,7 +48,8 @@ async function main() {
                 return;
             }
             try {
-                const raw = await fs.readFile(fromPath, "utf8");
+                const resolvedFrom = resolveUserPath(fromPath);
+                const raw = await fs.readFile(resolvedFrom, "utf8");
                 const reportData = JSON.parse(raw);
                 const output = flags.has("--json")
                     ? JSON.stringify(reportData, null, 2)
@@ -65,7 +66,7 @@ async function main() {
         }
         if (command === "config") {
             if (!(await hasPackageJson(targetPath))) {
-                console.error(`No package.json found at ${targetPath}`);
+                console.error(`No package.json found at ${sanitizeForLog(targetPath)}`);
                 process.exitCode = 1;
                 return;
             }
@@ -85,13 +86,13 @@ async function main() {
                 return;
             }
         }
-        console.error(`Unknown command: ${command}`);
+        console.error(`Unknown command: ${sanitizeForLog(command)}`);
         printHelp();
         process.exitCode = 1;
         return;
     }
     if (!(await hasPackageJson(targetPath))) {
-        console.error(`No package.json found at ${targetPath}`);
+        console.error(`No package.json found at ${sanitizeForLog(targetPath)}`);
         process.exitCode = 1;
         return;
     }
@@ -205,8 +206,15 @@ async function loadPackageVersion() {
 }
 async function writeOutput(output, outPath) {
     if (outPath) {
-        await fs.writeFile(outPath, `${output}\n`, "utf8");
+        const resolved = resolveUserPath(outPath);
+        await fs.writeFile(resolved, `${output}\n`, "utf8");
         return;
     }
     process.stdout.write(`${output}\n`);
 }
+function sanitizeForLog(value) {
+    return value.replace(/[\r\n]+/g, " ").trim();
+}
+function resolveUserPath(value) {
+    return path.resolve(process.cwd(), value);
+}

package/dist/core/context.js

@@ -1,18 +1,20 @@
 import path from "node:path";
 import { buildDependencyGraph } from "./graph-builder.js";
 import { collectProjectFiles, readTextFile } from "../utils/file-parser.js";
+import { resolveWithinRoot } from "../utils/path.js";
 const SOURCE_FILE_PATTERN = /\.(c|m)?(t|j)sx?$/;
 export async function buildAnalysisContext(rootDir, config) {
-    const graph = await buildDependencyGraph(rootDir);
-    const projectFiles = await collectProjectFiles(rootDir, SOURCE_FILE_PATTERN, config.scan.excludePaths);
+    const resolvedRoot = path.resolve(rootDir);
+    const graph = await buildDependencyGraph(resolvedRoot);
+    const projectFiles = await collectProjectFiles(resolvedRoot, SOURCE_FILE_PATTERN, config.scan.excludePaths);
     const fileEntries = await Promise.all(projectFiles.map(async (filePath) => ({
         path: filePath,
         content: await readTextFile(filePath)
     })));
     const sourceText = fileEntries.map((entry) => entry.content).join("\n");
-    const hasTypeScriptConfig = await hasFile(rootDir, "tsconfig.json");
+    const hasTypeScriptConfig = await hasFile(resolvedRoot, "tsconfig.json");
     return {
-        rootDir,
+        rootDir: resolvedRoot,
         graph,
         sourceText,
         projectFiles,
@@ -22,7 +24,8 @@ export async function buildAnalysisContext(rootDir, config) {
 }
 async function hasFile(rootDir, fileName) {
     try {
-        await readTextFile(path.join(rootDir, fileName));
+        const resolved = resolveWithinRoot(rootDir, fileName);
+        await readTextFile(resolved);
         return true;
     }
     catch {

package/dist/utils/config.js

@@ -1,5 +1,5 @@
-import path from "node:path";
 import { readJsonFile } from "./file-parser.js";
+import { resolveWithinRoot } from "./path.js";
 export const defaultConfig = {
     ignore: {
         dependencies: [],
@@ -32,7 +32,7 @@ export const defaultConfig = {
     }
 };
 export async function loadDepBrainConfig(rootDir, configPath) {
-    const resolvedPath = path.resolve(rootDir, configPath ?? "depbrain.config.json");
+    const resolvedPath = resolveWithinRoot(rootDir, configPath ?? "depbrain.config.json");
     try {
         const loaded = await readJsonFile(resolvedPath);
         return normalizeConfig(loaded);

package/dist/utils/file-parser.js

@@ -1,5 +1,6 @@
 import { promises as fs } from "node:fs";
 import path from "node:path";
+import { isWithinRoot } from "./path.js";
 export async function readJsonFile(filePath) {
     const content = await fs.readFile(filePath, "utf8");
     return JSON.parse(content);
@@ -11,6 +12,9 @@ export async function collectProjectFiles(rootDir, pattern, excludePaths = []) {
     return collectProjectFilesInternal(rootDir, rootDir, pattern, excludePaths);
 }
 async function collectProjectFilesInternal(currentDir, baseDir, pattern, excludePaths) {
+    if (!isWithinRoot(baseDir, currentDir)) {
+        return [];
+    }
     const entries = await fs.readdir(currentDir, { withFileTypes: true });
     const files = [];
     for (const entry of entries) {

package/dist/utils/path.d.ts

@@ -0,0 +1,2 @@
+export declare function resolveWithinRoot(rootDir: string, targetPath: string): string;
+export declare function isWithinRoot(rootDir: string, targetPath: string): boolean;

package/dist/utils/path.js

@@ -0,0 +1,16 @@
+import path from "node:path";
+export function resolveWithinRoot(rootDir, targetPath) {
+    const resolvedRoot = path.resolve(rootDir);
+    const resolvedTarget = path.resolve(resolvedRoot, targetPath);
+    if (!isWithinRoot(resolvedRoot, resolvedTarget)) {
+        throw new Error(`Path is outside root: ${resolvedTarget}`);
+    }
+    return resolvedTarget;
+}
+export function isWithinRoot(rootDir, targetPath) {
+    const relative = path.relative(rootDir, targetPath);
+    if (!relative || relative === ".") {
+        return true;
+    }
+    return !relative.startsWith("..") && !path.isAbsolute(relative);
+}

package/dist/utils/workspaces.js

@@ -1,6 +1,7 @@
 import { promises as fs } from "node:fs";
 import path from "node:path";
 import { readJsonFile } from "./file-parser.js";
+import { isWithinRoot, resolveWithinRoot } from "./path.js";
 export async function findWorkspacePackages(rootDir) {
     const rootPackageJsonPath = path.join(rootDir, "package.json");
     const rootPackage = await readJsonFile(rootPackageJsonPath).catch(() => null);
@@ -37,12 +38,21 @@ async function collectPackageJsonFiles(rootDir) {
             continue;
         }
         const fullPath = path.join(rootDir, entry.name);
+        if (!isWithinRoot(rootDir, fullPath)) {
+            continue;
+        }
         if (entry.isDirectory()) {
             files.push(...(await collectPackageJsonFiles(fullPath)));
             continue;
         }
         if (entry.isFile() && entry.name === "package.json") {
-            files.push(fullPath);
+            try {
+                const resolved = resolveWithinRoot(rootDir, fullPath);
+                files.push(resolved);
+            }
+            catch {
+                continue;
+            }
         }
     }
     return files;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dep-brain",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "CLI and library for dependency health analysis",
   "type": "module",
   "main": "dist/index.js",