heyspex 0.1.0 → 0.2.0

package/vendor/heyspex-mcp/capture-outbox.mjs

@@ -31,9 +31,11 @@ import {
   renameSync,
   rmSync,
 } from 'node:fs';
-import { basename, join } from 'node:path';
+import { basename, join, isAbsolute, resolve, sep } from 'node:path';
 
 import { buildCaptureBufferPatches } from './capture-buffer-patches.mjs';
+import { assertPathUnderRoot } from '../../scripts/lib/shared-path-helpers.mjs';
+
 
 /**
  * Capture args that carry content worth preserving, in chronological write order.
@@ -93,6 +95,7 @@ export function stashCaptureArgs(vaultRoot, args = {}) {
   if (entries.length === 0) return [];
 
   const dir = captureOutboxDir(vaultRoot);
+  assertPathUnderRoot(vaultRoot, dir, 'capture-outbox write');
   mkdirSync(dir, { recursive: true });
   const stampBase = new Date().toISOString().replace(/[:.]/g, '-');
   const written = [];
@@ -156,6 +159,7 @@ export function removeOutboxEntry(path) {
 export function quarantineOutboxEntry(vaultRoot, entryPath, metadata = {}) {
   try {
     const qdir = captureOutboxQuarantineDir(vaultRoot);
+    assertPathUnderRoot(vaultRoot, qdir, 'capture-outbox write');
     mkdirSync(qdir, { recursive: true });
     const name = basename(entryPath);
     const dest = join(qdir, name);