depwire-cli 0.9.23 → 0.9.24

package/dist/{chunk-OBWFFD3M.js → chunk-ORGAO3HT.js}

@@ -445,6 +445,16 @@ async function connectToRepo(source, subdirectory, state) {
         }
       }
       projectRoot = subdirectory ? join3(cloneDir, subdirectory) : cloneDir;
+      if (subdirectory) {
+        const resolvedRoot = resolve(cloneDir);
+        const resolvedProject = resolve(projectRoot);
+        if (!resolvedProject.startsWith(resolvedRoot + "/") && resolvedProject !== resolvedRoot) {
+          return {
+            error: "Access denied",
+            message: "Subdirectory must be within the project root"
+          };
+        }
+      }
     } else {
       const validation2 = validateProjectPath(source);
       if (!validation2.valid) {
@@ -460,6 +470,16 @@ async function connectToRepo(source, subdirectory, state) {
         };
       }
       projectRoot = subdirectory ? join3(source, subdirectory) : source;
+      if (subdirectory) {
+        const resolvedRoot = resolve(source);
+        const resolvedProject = resolve(projectRoot);
+        if (!resolvedProject.startsWith(resolvedRoot + "/") && resolvedProject !== resolvedRoot) {
+          return {
+            error: "Access denied",
+            message: "Subdirectory must be within the project root"
+          };
+        }
+      }
       projectName = basename2(projectRoot);
     }
     const validation = validateProjectPath(projectRoot);

package/dist/index.js

@@ -17,7 +17,7 @@ import {
   stashChanges,
   updateFileInGraph,
   watchProject
-} from "./chunk-OBWFFD3M.js";
+} from "./chunk-ORGAO3HT.js";
 import {
   SimulationEngine,
   analyzeDeadCode,

package/dist/mcpb-entry.js

@@ -4,7 +4,7 @@ import {
   startMcpServer,
   updateFileInGraph,
   watchProject
-} from "./chunk-OBWFFD3M.js";
+} from "./chunk-ORGAO3HT.js";
 import {
   buildGraph,
   parseProject

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "depwire-cli",
-  "version": "0.9.23",
+  "version": "0.9.24",
   "description": "Dependency graph + 16 MCP tools for AI coding assistants. Impact analysis, health scoring, visualization.",
   "type": "module",
   "bin": {