depwire-cli 0.9.22 → 0.9.24

package/dist/{chunk-XBCQPU63.js → chunk-ORGAO3HT.js}

@@ -445,6 +445,16 @@ async function connectToRepo(source, subdirectory, state) {
         }
       }
       projectRoot = subdirectory ? join3(cloneDir, subdirectory) : cloneDir;
+      if (subdirectory) {
+        const resolvedRoot = resolve(cloneDir);
+        const resolvedProject = resolve(projectRoot);
+        if (!resolvedProject.startsWith(resolvedRoot + "/") && resolvedProject !== resolvedRoot) {
+          return {
+            error: "Access denied",
+            message: "Subdirectory must be within the project root"
+          };
+        }
+      }
     } else {
       const validation2 = validateProjectPath(source);
       if (!validation2.valid) {
@@ -460,6 +470,16 @@ async function connectToRepo(source, subdirectory, state) {
         };
       }
       projectRoot = subdirectory ? join3(source, subdirectory) : source;
+      if (subdirectory) {
+        const resolvedRoot = resolve(source);
+        const resolvedProject = resolve(projectRoot);
+        if (!resolvedProject.startsWith(resolvedRoot + "/") && resolvedProject !== resolvedRoot) {
+          return {
+            error: "Access denied",
+            message: "Subdirectory must be within the project root"
+          };
+        }
+      }
       projectName = basename2(projectRoot);
     }
     const validation = validateProjectPath(projectRoot);
@@ -575,6 +595,9 @@ async function connectToRepo(source, subdirectory, state) {
 import { execSync } from "child_process";
 async function getCommitLog(dir, limit) {
   try {
+    if (limit !== void 0 && (!Number.isInteger(limit) || limit < 1)) {
+      throw new Error(`Invalid git log limit: ${limit}`);
+    }
     const limitArg = limit ? `-n ${limit}` : "";
     const output = execSync(
       `git log ${limitArg} --pretty=format:"%H|%aI|%s|%an"`,
@@ -602,6 +625,9 @@ async function getCurrentBranch(dir) {
   }
 }
 async function checkoutCommit(dir, hash) {
+  if (!/^[a-zA-Z0-9_.\-\/]+$/.test(hash)) {
+    throw new Error(`Invalid git ref: ${hash}`);
+  }
   try {
     execSync(`git checkout -q ${hash}`, { cwd: dir, stdio: "ignore" });
   } catch (error) {
@@ -609,6 +635,9 @@ async function checkoutCommit(dir, hash) {
   }
 }
 async function restoreOriginal(dir, originalBranch) {
+  if (!/^[a-zA-Z0-9_.\-\/]+$/.test(originalBranch)) {
+    throw new Error(`Invalid git ref: ${originalBranch}`);
+  }
   try {
     execSync(`git checkout -q ${originalBranch}`, {
       cwd: dir,

package/dist/index.js

@@ -17,7 +17,7 @@ import {
   stashChanges,
   updateFileInGraph,
   watchProject
-} from "./chunk-XBCQPU63.js";
+} from "./chunk-ORGAO3HT.js";
 import {
   SimulationEngine,
   analyzeDeadCode,

package/dist/mcpb-entry.js

@@ -4,7 +4,7 @@ import {
   startMcpServer,
   updateFileInGraph,
   watchProject
-} from "./chunk-XBCQPU63.js";
+} from "./chunk-ORGAO3HT.js";
 import {
   buildGraph,
   parseProject

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "depwire-cli",
-  "version": "0.9.22",
-  "description": "The missing context layer for AI coding assistants. Dependency graph, MCP server, architecture health, dead code detection.",
+  "version": "0.9.24",
+  "description": "Dependency graph + 16 MCP tools for AI coding assistants. Impact analysis, health scoring, visualization.",
   "type": "module",
   "bin": {
     "depwire": "dist/index.js"