eminiar 0.13.1 → 0.13.3

package/dist/{hook-async-J3UKDO62.js → hook-async-3TLK23ZY.js}

@@ -4,12 +4,12 @@ import {
   parseJob,
   runAsyncJob,
   spawnAsyncJob
-} from "./hook-chunk-RYZAFUTT.js";
-import "./hook-chunk-BECSRJFD.js";
+} from "./hook-chunk-MVSMFCKL.js";
+import "./hook-chunk-ETYHCPPH.js";
 export {
   ASYNC_JOB_MAX_MS,
   parseJob,
   runAsyncJob,
   spawnAsyncJob
 };
-//# sourceMappingURL=hook-async-J3UKDO62.js.map
+//# sourceMappingURL=hook-async-3TLK23ZY.js.map

package/dist/{hook-chunk-BECSRJFD.js → hook-chunk-ETYHCPPH.js}

@@ -20217,8 +20217,11 @@ var BaseConfigSchema = external_exports.object({
     backend: external_exports.enum(["tree-sitter"]).default("tree-sitter")
   }).prefault({}),
   memories: external_exports.object({
-    /** Project-relative directory of markdown memory files (`<topic>/<name>.md`); commit it. */
-    dir: external_exports.string().default(".eminiar/memories")
+    /**
+     * Project-relative directory of markdown memory files (`<topic>/<name>.md`); commit it.
+     * Absolute paths and `..` segments are refused: reconcile repairs the headers of files there.
+     */
+    dir: external_exports.string().regex(PROJECT_RELATIVE_PATH_RE, "must be a path inside the project (no leading / or ..)").default(".eminiar/memories")
   }).prefault({}),
   recall: external_exports.object({
     /** Inject the memories and doc pages that match each prompt (UserPromptSubmit). */
@@ -20525,29 +20528,37 @@ function projectLayer(raw) {
   for (const k of Object.keys(adj)) if (projectKeeps(adj, k)) kept[k] = adj[k];
   return { ...ownJson(raw), adjudicator: kept };
 }
-function withoutUnsafeDocsManifest(raw, source) {
-  const docs = raw.docs;
-  if (!isPlainObject2(docs) || !Object.hasOwn(docs, "manifest")) return raw;
-  const m = docs.manifest;
-  if (typeof m === "string" && PROJECT_RELATIVE_PATH_RE.test(m)) return raw;
-  process.stderr.write(
-    `eminiar: ignoring docs.manifest ${JSON.stringify(m)} in ${source}: it must be a path inside the project
+var PROJECT_PATH_KEYS = [
+  ["docs", "manifest"],
+  ["memories", "dir"]
+];
+function withoutUnsafePaths(raw, source) {
+  let out = raw;
+  for (const [section, key] of PROJECT_PATH_KEYS) {
+    const sec = out[section];
+    if (!isPlainObject2(sec) || !Object.hasOwn(sec, key)) continue;
+    const v = sec[key];
+    if (typeof v === "string" && PROJECT_RELATIVE_PATH_RE.test(v)) continue;
+    process.stderr.write(
+      `eminiar: ignoring ${section}.${key} ${JSON.stringify(v)} in ${source}: it must be a path inside the project
 `
-  );
-  const { manifest: _dropped, ...rest } = ownJson(docs);
-  return { ...ownJson(raw), docs: rest };
+    );
+    const { [key]: _dropped, ...rest } = ownJson(sec);
+    out = { ...ownJson(out), [section]: rest };
+  }
+  return out;
 }
 function personalLayer(projectRoot) {
   const file2 = paths().configFile;
   const raw = readJson(file2);
   const layer = !droppedProjectAdjudicatorKeys(raw).length || personalConfigTrusted(projectRoot, file2) ? raw : projectLayer(raw);
-  return withoutUnsafeDocsManifest(layer, file2);
+  return withoutUnsafePaths(layer, file2);
 }
 function loadConfig(projectRoot) {
   const merged = deepMerge(
     deepMerge(
       personalLayer(projectRoot),
-      withoutUnsafeDocsManifest(
+      withoutUnsafePaths(
         projectLayer(readJson(join2(projectRoot, "eminiar.config.json"))),
         "eminiar.config.json"
       )
@@ -24093,6 +24104,7 @@ export {
   paths,
   ensureDirs,
   projectDir,
+  PROJECT_RELATIVE_PATH_RE,
   AdjudicatorConfigSchema,
   loadConfig,
   findProjectRoot,
@@ -24111,4 +24123,4 @@ export {
   classifyToolCall,
   classifyAssistant
 };
-//# sourceMappingURL=hook-chunk-BECSRJFD.js.map
+//# sourceMappingURL=hook-chunk-ETYHCPPH.js.map

package/dist/{hook-chunk-RYZAFUTT.js → hook-chunk-MVSMFCKL.js}

@@ -13,7 +13,7 @@ import {
   init_esm_shims,
   loadConfig,
   paths
-} from "./hook-chunk-BECSRJFD.js";
+} from "./hook-chunk-ETYHCPPH.js";
 
 // src/adjudicator/async.ts
 init_esm_shims();
@@ -3777,4 +3777,4 @@ export {
   parseJob,
   runAsyncJob
 };
-//# sourceMappingURL=hook-chunk-RYZAFUTT.js.map
+//# sourceMappingURL=hook-chunk-MVSMFCKL.js.map

package/dist/{hook-chunk-DSLVDGOB.js → hook-chunk-ZLRLOPLR.js}

@@ -1,5 +1,6 @@
 import { createRequire as __emCreateRequire } from "node:module"; const require = __emCreateRequire(import.meta.url);
 import {
+  PROJECT_RELATIVE_PATH_RE,
   TIERS,
   __commonJS,
   __require,
@@ -13,7 +14,7 @@ import {
   paths,
   resolveProjectRoot,
   tierOf
-} from "./hook-chunk-BECSRJFD.js";
+} from "./hook-chunk-ETYHCPPH.js";
 
 // node_modules/fast-glob/out/utils/array.js
 var require_array = __commonJS({
@@ -5884,9 +5885,10 @@ function empty() {
   return { version: 1, sources: [] };
 }
 function normalize(raw) {
-  if (!raw || typeof raw !== "object") return { manifest: empty(), dropped: 0 };
+  if (!raw || typeof raw !== "object") return { manifest: empty(), dropped: 0, outside: [] };
   const sources = Array.isArray(raw.sources) ? raw.sources : [];
   const out = [];
+  const outside = [];
   const seen = /* @__PURE__ */ new Set();
   for (const s of sources) {
     if (!s || typeof s !== "object" || typeof s.name !== "string") continue;
@@ -5894,22 +5896,37 @@ function normalize(raw) {
     if (s.kind !== "url" && s.kind !== "path") continue;
     if (s.kind === "url" && !(Array.isArray(s.urls) && s.urls.length)) continue;
     if (s.kind === "path" && typeof s.path !== "string") continue;
+    if (s.kind === "path" && !PROJECT_RELATIVE_PATH_RE.test(s.path)) {
+      process.stderr.write(
+        `eminiar: ignoring docs source ${JSON.stringify(s.name)}: its path ${JSON.stringify(s.path)} must be inside the project
+`
+      );
+      outside.push(s.name);
+      continue;
+    }
     seen.add(s.name);
     out.push({
       ...s,
       addedAt: typeof s.addedAt === "string" ? s.addedAt : (/* @__PURE__ */ new Date(0)).toISOString()
     });
   }
-  return { manifest: { version: 1, sources: out }, dropped: sources.length - out.length };
+  return {
+    manifest: { version: 1, sources: out },
+    dropped: sources.length - out.length,
+    outside
+  };
 }
-function lossyReason(raw, dropped) {
+function lossyReason(raw, dropped, outside, removing) {
   if (raw.version !== 1)
     return raw.version === void 0 ? "it has no version (this eminiar writes version 1)" : `it has version ${JSON.stringify(raw.version)}, and this eminiar only writes version 1`;
   const extra = Object.keys(raw).filter((k) => k !== "version" && k !== "sources");
   if (extra.length) return `it has keys this eminiar does not know (${extra.sort().join(", ")})`;
   if (Object.hasOwn(raw, "sources") && !Array.isArray(raw.sources))
     return "its sources is not an array";
-  if (dropped) return `${dropped} of its sources ${dropped === 1 ? "is" : "are"} not valid entries`;
+  const rest = outside.filter((n) => n !== removing);
+  const lost = dropped - (outside.length - rest.length);
+  if (lost)
+    return `${lost} of its sources ${lost === 1 ? "is" : "are"} not valid entries${rest.length ? ` (${rest.join(", ")}: path outside the project)` : ""}`;
   return void 0;
 }
 var MANIFEST_MAX_BYTES = 1024 * 1024;
@@ -5986,12 +6003,12 @@ function probeManifestAt(file, opts = {}) {
     }
     if (!raw || typeof raw !== "object" || Array.isArray(raw))
       return { state: "refused", reason: "it is not a JSON object" };
-    const { manifest, dropped } = normalize(raw);
+    const { manifest, dropped, outside } = normalize(raw);
     if (opts.write) {
-      const lossy = lossyReason(raw, dropped);
+      const lossy = lossyReason(raw, dropped, outside, opts.removing);
       if (lossy) return { state: "refused", reason: lossy };
     }
-    return { state: "ok", manifest };
+    return { state: "ok", manifest, ...outside.length ? { outside } : {} };
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") return { state: "missing" };
@@ -6019,7 +6036,7 @@ function readManifest(ctx) {
 // src/swarm/hooks.ts
 init_esm_shims();
 import { execFileSync } from "child_process";
-import { readFileSync as readFileSync7, realpathSync as realpathSync3, statSync as statSync5 } from "fs";
+import { readFileSync as readFileSync7, realpathSync as realpathSync5, statSync as statSync5 } from "fs";
 import { basename as basename2, dirname as dirname3, join as join8, resolve as resolve3 } from "path";
 
 // src/swarm/agents.ts
@@ -6354,7 +6371,7 @@ init_esm_shims();
 // src/index/indexer.ts
 init_esm_shims();
 var import_fast_glob = __toESM(require_out4(), 1);
-import { readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { existsSync, readFileSync as readFileSync2, realpathSync as realpathSync3, statSync as statSync2 } from "fs";
 import { relative as relative3, resolve } from "path";
 
 // src/chunker/index.ts
@@ -6735,7 +6752,7 @@ function readFileRisk(db) {
 
 // src/session/brief.ts
 init_esm_shims();
-import { existsSync as existsSync2, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
 import { join as join4 } from "path";
 
 // src/memory/frontmatter.ts
@@ -6770,9 +6787,12 @@ function parseMemoryFile(text) {
 init_esm_shims();
 var import_fast_glob2 = __toESM(require_out4(), 1);
 import {
-  existsSync,
+  existsSync as existsSync2,
+  lstatSync as lstatSync3,
   mkdirSync as mkdirSync3,
+  readdirSync as readdirSync2,
   readFileSync as readFileSync3,
+  realpathSync as realpathSync4,
   renameSync as renameSync3,
   statSync as statSync3,
   unlinkSync as unlinkSync2,
@@ -6848,7 +6868,7 @@ function historyLine(db) {
 }
 function overviewParagraph(ctx) {
   const file = join4(memoriesDir(ctx), "onboarding", "overview.md");
-  if (!existsSync2(file)) return void 0;
+  if (!existsSync3(file)) return void 0;
   try {
     const body = parseMemoryFile(readFileSync4(file, "utf8")).body.trim();
     const para = body.split(/\n\s*\n/).map(
@@ -7722,13 +7742,13 @@ init_esm_shims();
 // src/swarm/runtime.ts
 init_esm_shims();
 import { randomBytes as randomBytes2 } from "crypto";
-import { existsSync as existsSync4, statSync as statSync4 } from "fs";
+import { existsSync as existsSync5, statSync as statSync4 } from "fs";
 import { isAbsolute as isAbsolute2, join as join6, relative as relative5 } from "path";
 
 // src/swarm/config.ts
 init_esm_shims();
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
 import { createRequire as createRequire2 } from "module";
 import { join as join5 } from "path";
 
@@ -8106,7 +8126,7 @@ function roleRange(defaults, a, at, issue) {
 function swarmFile(root) {
   for (const rel of SWARM_FILES) {
     const file = join5(root, rel);
-    if (existsSync3(file)) return { file, rel, exists: true };
+    if (existsSync4(file)) return { file, rel, exists: true };
   }
   return { file: join5(root, SWARM_FILES[0]), rel: SWARM_FILES[0], exists: false };
 }
@@ -9100,7 +9120,7 @@ function coordinationRoot(root) {
     } catch {
       return root;
     }
-    if (basename2(common) === ".git") return realpathSync3(dirname3(common));
+    if (basename2(common) === ".git") return realpathSync5(dirname3(common));
     const out = execFileSync("git", ["worktree", "list", "--porcelain"], {
       cwd: root,
       encoding: "utf8",
@@ -9109,8 +9129,8 @@ function coordinationRoot(root) {
     });
     const first = /^worktree (.+)$/m.exec(out)?.[1];
     if (!first || /^bare$/m.test(out.split("\n\n")[0] ?? "")) return root;
-    const main = realpathSync3(first);
-    return main !== realpathSync3(common) && statSync5(join8(main, ".git"), { throwIfNoEntry: false }) ? main : root;
+    const main = realpathSync5(first);
+    return main !== realpathSync5(common) && statSync5(join8(main, ".git"), { throwIfNoEntry: false }) ? main : root;
   } catch {
     return root;
   }
@@ -9127,7 +9147,7 @@ function sessionRoot() {
     process.env.CLAUDE_PROJECT_DIR || process.env.EMINIAR_PROJECT_ROOT || process.cwd()
   );
   try {
-    return realpathSync3(root);
+    return realpathSync5(root);
   } catch {
     return root;
   }
@@ -9800,12 +9820,12 @@ var FALLBACK_MODEL = "claude-sonnet-5-5";
 export {
   hookLog,
   agentFileRange,
-  indexContent,
-  git,
   DOCS_PREFIX,
   manifestPath,
   readManifestAt,
   readManifest,
+  indexContent,
+  git,
   memoriesDir,
   renderProjectBrief,
   recordShown,
@@ -9885,4 +9905,4 @@ queue-microtask/index.js:
 run-parallel/index.js:
   (*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> *)
 */
-//# sourceMappingURL=hook-chunk-DSLVDGOB.js.map
+//# sourceMappingURL=hook-chunk-ZLRLOPLR.js.map

package/dist/{hook-hooks-IDTGXCFD.js → hook-hooks-5U2AI6W7.js}

@@ -8,7 +8,7 @@ import {
   manifestPath,
   readManifestAt,
   resolvePrice
-} from "./hook-chunk-DSLVDGOB.js";
+} from "./hook-chunk-ZLRLOPLR.js";
 import {
   adjudicateOne,
   briefUnitsOf,
@@ -18,7 +18,7 @@ import {
   resolveAdjudicator,
   spawnAsyncJob,
   topIntent
-} from "./hook-chunk-RYZAFUTT.js";
+} from "./hook-chunk-MVSMFCKL.js";
 import {
   AGENT_EFFORT_SINCE,
   KEPT_MODEL_FLAG,
@@ -30,7 +30,7 @@ import {
   init_esm_shims,
   keptModel,
   tierOf
-} from "./hook-chunk-BECSRJFD.js";
+} from "./hook-chunk-ETYHCPPH.js";
 
 // src/adjudicator/hooks.ts
 init_esm_shims();
@@ -1826,4 +1826,4 @@ export {
   withModel,
   withNote
 };
-//# sourceMappingURL=hook-hooks-IDTGXCFD.js.map
+//# sourceMappingURL=hook-hooks-5U2AI6W7.js.map