fundamentum-cli 0.5.1 → 0.6.0

package/README.md

@@ -102,6 +102,12 @@ Built for solo devs and small teams who want their repos to feel like they were
 
 A GitHub token with `repo` scope (classic) or Contents + Metadata + Administration (fine-grained) — via `GITHUB_TOKEN` or `--token`.
 
+## Agent use
+
+`fundamentum mcp` runs a Model Context Protocol server over stdio so a coding agent can drive the same commands (`plan`, `audit`, `apply`). `apply` is mutating — run `plan` first and confirm with the operator. See the [repo README](https://github.com/jpvelasco/fundamentum#agent-use-fundamentum-mcp).
+
+> **Disclaimer.** fundamentum is free open-source software, provided **as-is** with no warranty of any kind. It changes your repository's configuration. Whether you run it yourself or have an agent run it for you, **you are responsible for every change made to your repos.**
+
 ## License
 
 MIT — see [LICENSE](https://github.com/jpvelasco/fundamentum/blob/main/LICENSE).

package/install.js

@@ -202,8 +202,17 @@ function extract(buffer, archiveName, binDir) {
   }
 }
 
+// A single-letter drive prefix (C: or C:evil) is a Windows drive-relative or
+// absolute path, so it is rejected on every host, not only on win32.
+const driveLetterPrefix = /^[A-Za-z]:/;
+
 function isPathEscape(name) {
-  return path.isAbsolute(name) || name.split(/[\\/]/).includes("..");
+  return (
+    path.isAbsolute(name) ||
+    path.win32.isAbsolute(name) ||
+    driveLetterPrefix.test(name) ||
+    name.split(/[\\/]/).includes("..")
+  );
 }
 
 function listMembers(archivePath, isZip) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fundamentum-cli",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "Bootstrap and harden GitHub repos for OSS collaboration — community files, branch protection, security features, and starter workflows in one command.",
   "license": "MIT",
   "repository": {
@@ -58,10 +58,10 @@
     "bin/"
   ],
   "binaryChecksums": {
-    "fundamentum_0.5.1_darwin_amd64.tar.gz": "424f1ccfaffb199dfda8fc602eb969e140477cfca38a864b4ca474b876797ebf",
-    "fundamentum_0.5.1_darwin_arm64.tar.gz": "b24e77071e2ea827c1fb5a5793a912b23747763e6f787fbc705890d8bd674ea2",
-    "fundamentum_0.5.1_linux_amd64.tar.gz": "bfbc2d6db4dfe30d1394c1444a3713092a39ded210a9318dfa3e1a8017c8ec32",
-    "fundamentum_0.5.1_linux_arm64.tar.gz": "3c2ab90a18a77962330aa5e6a0f509adc13edf01da45af4c3a9db9a97471421b",
-    "fundamentum_0.5.1_windows_amd64.zip": "457733e6d58438c47e5127c7ee3b714938843dfff74649264472b99d17fc7f71"
+    "fundamentum_0.6.0_darwin_amd64.tar.gz": "f15df4b25eb475747ca32d84b6bc77222ed6681a0e399f24c37803f156c46f70",
+    "fundamentum_0.6.0_darwin_arm64.tar.gz": "e169758383767bf51508d315e7e3906af7b742714aa61897d6aa4001cd30fc60",
+    "fundamentum_0.6.0_linux_amd64.tar.gz": "2d7315965e82a04bee2ddeb06fec1047c8326441efd8d1340756dd52a8c25fc5",
+    "fundamentum_0.6.0_linux_arm64.tar.gz": "5ab0196b5f6044ffa66cd05801d85f4e0e2002a68eb29bada8c8dc87f49ecf27",
+    "fundamentum_0.6.0_windows_amd64.zip": "28a4d32baa4915c4e11d0c9bd20e27cb9a309b8a4f588448472f8b9853381ec8"
   }
 }