fundamentum-cli 0.5.0 → 0.6.0

package/README.md

@@ -102,6 +102,12 @@ Built for solo devs and small teams who want their repos to feel like they were
 
 A GitHub token with `repo` scope (classic) or Contents + Metadata + Administration (fine-grained) — via `GITHUB_TOKEN` or `--token`.
 
+## Agent use
+
+`fundamentum mcp` runs a Model Context Protocol server over stdio so a coding agent can drive the same commands (`plan`, `audit`, `apply`). `apply` is mutating — run `plan` first and confirm with the operator. See the [repo README](https://github.com/jpvelasco/fundamentum#agent-use-fundamentum-mcp).
+
+> **Disclaimer.** fundamentum is free open-source software, provided **as-is** with no warranty of any kind. It changes your repository's configuration. Whether you run it yourself or have an agent run it for you, **you are responsible for every change made to your repos.**
+
 ## License
 
 MIT — see [LICENSE](https://github.com/jpvelasco/fundamentum/blob/main/LICENSE).

package/install.js

@@ -202,8 +202,17 @@ function extract(buffer, archiveName, binDir) {
   }
 }
 
+// A single-letter drive prefix (C: or C:evil) is a Windows drive-relative or
+// absolute path, so it is rejected on every host, not only on win32.
+const driveLetterPrefix = /^[A-Za-z]:/;
+
 function isPathEscape(name) {
-  return path.isAbsolute(name) || name.split(/[\\/]/).includes("..");
+  return (
+    path.isAbsolute(name) ||
+    path.win32.isAbsolute(name) ||
+    driveLetterPrefix.test(name) ||
+    name.split(/[\\/]/).includes("..")
+  );
 }
 
 function listMembers(archivePath, isZip) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fundamentum-cli",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Bootstrap and harden GitHub repos for OSS collaboration — community files, branch protection, security features, and starter workflows in one command.",
   "license": "MIT",
   "repository": {
@@ -58,10 +58,10 @@
     "bin/"
   ],
   "binaryChecksums": {
-    "fundamentum_0.5.0_darwin_amd64.tar.gz": "ffdaa906e25271a494e5bb0dca12e8c5752cc31c059ef7c58791c407e655d6a9",
-    "fundamentum_0.5.0_darwin_arm64.tar.gz": "06b02b92edfa48fc1f79e4160cd829ec902bfe965d34a92ff3bb783cf1377dba",
-    "fundamentum_0.5.0_linux_amd64.tar.gz": "ae10a326c76514ace3218d2855987019907a49b3048ee55da078c4c425d28991",
-    "fundamentum_0.5.0_linux_arm64.tar.gz": "70d94c1d55f08c015ae3a9fcc23c57dc18a5855fb33a1e8e4a30194a6660e7e4",
-    "fundamentum_0.5.0_windows_amd64.zip": "569832f3666d804a8aac4415ed870700eb263795e869a9bfcc3f1c725746a877"
+    "fundamentum_0.6.0_darwin_amd64.tar.gz": "f15df4b25eb475747ca32d84b6bc77222ed6681a0e399f24c37803f156c46f70",
+    "fundamentum_0.6.0_darwin_arm64.tar.gz": "e169758383767bf51508d315e7e3906af7b742714aa61897d6aa4001cd30fc60",
+    "fundamentum_0.6.0_linux_amd64.tar.gz": "2d7315965e82a04bee2ddeb06fec1047c8326441efd8d1340756dd52a8c25fc5",
+    "fundamentum_0.6.0_linux_arm64.tar.gz": "5ab0196b5f6044ffa66cd05801d85f4e0e2002a68eb29bada8c8dc87f49ecf27",
+    "fundamentum_0.6.0_windows_amd64.zip": "28a4d32baa4915c4e11d0c9bd20e27cb9a309b8a4f588448472f8b9853381ec8"
   }
 }