i18ntk 2.3.4 → 2.3.6

package/README.md

@@ -1,4 +1,4 @@
-# i18ntk v2.3.4
+# i18ntk v2.3.6
 
 Zero-dependency internationalization toolkit for setup, scanning, analysis, validation, usage tracking, and translation completion.
 
@@ -9,15 +9,12 @@ Zero-dependency internationalization toolkit for setup, scanning, analysis, vali
 [![node](https://img.shields.io/badge/node-%3E%3D16-339933)](https://nodejs.org)
 [![dependencies](https://img.shields.io/badge/dependencies-0-success)](https://www.npmjs.com/package/i18ntk)
 [![license](https://img.shields.io/badge/license-MIT-yellow.svg)](LICENSE)
-[![socket](https://socket.dev/api/badge/npm/package/i18ntk/2.3.4)](https://socket.dev/npm/package/i18ntk/overview/2.3.4)
+[![socket](https://socket.dev/api/badge/npm/package/i18ntk/2.3.6)](https://socket.dev/npm/package/i18ntk/overview/2.3.6)
 
 ## Upgrade Notice
 
-Versions earlier than `2.3.4` may contain known stability and security issues.
-They are considered unsupported for production use. Upgrade to `2.3.4` or newer.
-The CLI now checks npm registry metadata at startup and warns when your installed version is out of date.
-Set `I18NTK_DISABLE_UPDATE_CHECK=true` to disable this warning in restricted/offline environments.
-Set `I18NTK_DISABLE_AUTOSAVE=1` in server/runtime environments to keep config in memory and skip disk writes.
+Versions earlier than `2.3.6` may contain known stability and security issues.
+They are considered unsupported for production use. Upgrade to `2.3.6` or newer.
 
 ## What i18ntk Does
 
@@ -154,7 +151,7 @@ Example `.i18ntk-config`:
 
 ```json
 {
-  "version": "2.3.4",
+  "version": "2.3.6",
   "sourceDir": "./locales",
   "i18nDir": "./locales",
   "outputDir": "./i18ntk-reports",
@@ -177,7 +174,7 @@ See [docs/api/CONFIGURATION.md](docs/api/CONFIGURATION.md) for the full configur
 - [Runtime API Guide](docs/runtime.md)
 - [Scanner Guide](docs/scanner-guide.md)
 - [Environment Variables](docs/environment-variables.md)
-- [Migration Guide v2.3.4](docs/migration-guide-v2.3.4.md)
+- [Migration Guide v2.3.5](docs/migration-guide-v2.3.6.md)
 - [Optimization Prompt](docs/development/package-optimization-prompt.md)
 
 ## License

package/main/i18ntk-backup-class.js

@@ -15,12 +15,20 @@ const SecurityUtils = require('../utils/security');
  *
  * Class-based implementation of backup functionality for use with CommandRouter
  */
-class I18nBackup {
+class I18nBackup {
     constructor(config = {}) {
         this.config = config;
         this.backupDir = path.join(process.cwd(), 'i18ntk-backups');
         this.maxBackups = Math.min(Math.max(parseInt(config.backup?.maxBackups, 10) || 1, 1), 3);
-    }
+    }
+
+    validateInProject(targetPath, label = 'path') {
+        const validated = SecurityUtils.validatePath(targetPath, process.cwd());
+        if (!validated) {
+            throw new Error(`Invalid ${label}: ${targetPath}`);
+        }
+        return validated;
+    }
 
     /**
      * Main run method for the backup command
@@ -79,13 +87,15 @@ Options:
     }
 
     // Command handlers
-    async handleCreate(options = {}) {
-        // Use absolute path for the locales directory
-        const dir = (options._ && options._[1]) || options.dir || path.join(__dirname, '..', 'locales');
-        const outputDir = options.output || this.backupDir;
-        const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
-        const backupName = `backup-${timestamp}.json`;
-        const backupPath = path.join(outputDir, backupName);
+    async handleCreate(options = {}) {
+        // Use absolute path for the locales directory
+        const requestedDir = (options._ && options._[1]) || options.dir || path.join(process.cwd(), 'locales');
+        const requestedOutputDir = options.output || this.backupDir;
+        const dir = this.validateInProject(path.resolve(process.cwd(), requestedDir), 'source directory');
+        const outputDir = this.validateInProject(path.resolve(process.cwd(), requestedOutputDir), 'backup directory');
+        const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+        const backupName = `backup-${timestamp}.json`;
+        const backupPath = this.validateInProject(path.join(outputDir, backupName), 'backup file');
 
         // Log the paths for debugging
         logger.debug(`Source directory: ${dir}`);
@@ -104,7 +114,7 @@ Options:
         }
 
         // Validate directory
-        const sourceDir = path.resolve(dir);
+        const sourceDir = dir;
         try {
             const stats = await fsp.stat(sourceDir);
             if (!stats.isDirectory()) {
@@ -163,16 +173,17 @@ Options:
         };
     }
 
-    async handleRestore(options = {}) {
-        const backupFile = options._ && options._[1];
-        if (!backupFile) {
-            throw new Error('Backup file path is required');
-        }
-
-        const backupPath = path.resolve(process.cwd(), backupFile);
-        const outputDir = options.output
-            ? path.resolve(process.cwd(), options.output)
-            : path.join(process.cwd(), 'restored');
+    async handleRestore(options = {}) {
+        const backupFile = options._ && options._[1];
+        if (!backupFile) {
+            throw new Error('Backup file path is required');
+        }
+
+        const backupPath = this.validateInProject(path.resolve(process.cwd(), backupFile), 'backup file');
+        const outputDir = this.validateInProject(
+            options.output ? path.resolve(process.cwd(), options.output) : path.join(process.cwd(), 'restored'),
+            'restore output directory'
+        );
 
         // Validate backup file
         if (!SecurityUtils.safeExistsSync(backupPath, process.cwd())) {
@@ -183,21 +194,21 @@ Options:
 
         try {
             // Read the backup file
-            const backupData = await fs.readFile(backupPath, 'utf8');
-            const translations = JSON.parse(backupData);
+            const backupData = await fsp.readFile(backupPath, 'utf8');
+            const translations = JSON.parse(backupData);
 
             // Create output directory if it doesn't exist
             try {
-                await fs.mkdir(outputDir, { recursive: true });
-            } catch (err) {
-                if (err.code !== 'EEXIST') throw err;
-            }
+                await fsp.mkdir(outputDir, { recursive: true });
+            } catch (err) {
+                if (err.code !== 'EEXIST') throw err;
+            }
 
             // Write the restored files
-            for (const [file, content] of Object.entries(translations)) {
-                const filePath = path.join(outputDir, file);
-                await fs.writeFile(filePath, JSON.stringify(content, null, 2));
-            }
+            for (const [file, content] of Object.entries(translations)) {
+                const filePath = this.validateInProject(path.join(outputDir, file), 'restore file');
+                await fsp.writeFile(filePath, JSON.stringify(content, null, 2), 'utf8');
+            }
 
             logger.success('Backup restored successfully');
             logger.info(`  Restored ${Object.keys(translations).length} files to: ${outputDir}`);
@@ -214,12 +225,13 @@ Options:
         }
     }
 
-    async handleList() {
-        try {
-            // Ensure backup directory exists
-            try {
-                await fsp.access(this.backupDir);
-            } catch (err) {
+    async handleList() {
+        const backupDir = this.validateInProject(this.backupDir, 'backup directory');
+        try {
+            // Ensure backup directory exists
+            try {
+                await fsp.access(backupDir);
+            } catch (err) {
                 if (err.code === 'ENOENT') {
                     logger.warn('No backups found. The backup directory does not exist yet.');
                 } else {
@@ -228,13 +240,13 @@ Options:
                 return { success: true, backups: [] };
             }
 
-            const files = await fsp.readdir(this.backupDir);
+            const files = await fsp.readdir(backupDir);
             const backups = [];
 
             for (const file of files) {
                 if (file.startsWith('backup-') && file.endsWith('.json')) {
                     try {
-                        const filePath = path.join(this.backupDir, file);
+                        const filePath = this.validateInProject(path.join(backupDir, file), 'backup file');
                         const stats = await fsp.stat(filePath);
                         backups.push({
                             name: file,
@@ -288,7 +300,7 @@ Options:
             throw new Error('Backup file path is required');
         }
 
-        const backupPath = path.resolve(process.cwd(), backupFile);
+        const backupPath = this.validateInProject(path.resolve(process.cwd(), backupFile), 'backup file');
 
         // Validate backup file
         if (!SecurityUtils.safeExistsSync(backupPath, process.cwd())) {
@@ -328,21 +340,22 @@ Options:
         }
     }
 
-    async handleCleanup(options = {}) {
-        const keep = options.keep ? parseInt(options.keep, 10) : this.maxBackups;
+    async handleCleanup(options = {}) {
+        const keep = options.keep ? parseInt(options.keep, 10) : this.maxBackups;
+        const backupDir = this.validateInProject(this.backupDir, 'backup directory');
 
         logger.info('\nCleaning up old backups...');
 
         try {
-            const files = await fsp.readdir(this.backupDir);
-            const backupFiles = files
-                .filter(file => file.startsWith('backup-') && file.endsWith('.json'))
-                .map(file => ({
-                    name: file,
-                    path: path.join(this.backupDir, file),
-                    time: fs.statSync(path.join(this.backupDir, file)).mtime.getTime()
+            const files = await fsp.readdir(backupDir);
+            const backupFiles = files
+                .filter(file => file.startsWith('backup-') && file.endsWith('.json'))
+                .map(file => ({
+                    name: file,
+                    path: this.validateInProject(path.join(backupDir, file), 'backup file'),
+                    time: (SecurityUtils.safeStatSync(path.join(backupDir, file), process.cwd()) || { mtime: new Date(0) }).mtime.getTime()
                 }))
-                .sort((a, b) => b.time - a.time);
+                .sort((a, b) => b.time - a.time);
 
             // Keep only the most recent 'keep' files
             const toDelete = backupFiles.slice(keep);
@@ -379,27 +392,28 @@ Options:
         }
     }
 
-    async cleanupOldBackups(outputDir) {
-        try {
-            const files = await fs.readdir(outputDir);
-            const backupFiles = files
-                .filter(file => file.startsWith('backup-') && file.endsWith('.json'))
-                .map(file => ({
-                    name: file,
-                    path: path.join(outputDir, file),
-                    time: fs.statSync(path.join(outputDir, file)).mtime.getTime()
-                }))
-                .sort((a, b) => b.time - a.time);
+    async cleanupOldBackups(outputDir) {
+        try {
+            const safeOutputDir = this.validateInProject(outputDir, 'backup output directory');
+            const files = await fsp.readdir(safeOutputDir);
+            const backupFiles = files
+                .filter(file => file.startsWith('backup-') && file.endsWith('.json'))
+                .map(file => ({
+                    name: file,
+                    path: this.validateInProject(path.join(safeOutputDir, file), 'backup file'),
+                    time: (SecurityUtils.safeStatSync(path.join(safeOutputDir, file), process.cwd()) || { mtime: new Date(0) }).mtime.getTime()
+                }))
+                .sort((a, b) => b.time - a.time);
 
             // Keep only the most recent files
             const toDelete = backupFiles.slice(this.maxBackups);
 
-            for (const file of toDelete) {
-                try {
-                    await fs.unlink(file.path);
-                } catch (err) {
-                    // Ignore cleanup errors
-                }
+            for (const file of toDelete) {
+                try {
+                    await fsp.unlink(file.path);
+                } catch (err) {
+                    // Ignore cleanup errors
+                }
             }
         } catch (error) {
             // Ignore cleanup errors

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "i18ntk",
-  "version": "2.3.4",
+  "version": "2.3.6",
   "description": "🚀 The fastest internationalization toolkit with 97% performance boost! Zero-dependency, enterprise-grade internationalization for React, Vue, Angular, Python, Java, PHP & more. Features PIN protection, auto framework detection, 7+ UI languages, and comprehensive translation management. Perfect for startups to enterprises.",
   "keywords": [
     "i18n",
@@ -112,7 +112,7 @@
   },
   "license": "MIT",
   "author": {
-    "name": "Vladimir Noskov",
+    "name": "Vlad Noskov",
     "url": "https://github.com/vladnoskv"
   },
   "type": "commonjs",
@@ -213,10 +213,7 @@
     "languages:select": "node settings/settings-cli.js",
     "languages:list": "node settings/settings-cli.js --list-languages",
     "languages:status": "node settings/settings-cli.js --language-status",
-    "lint:locales": "node scripts/lint-locales.js",
-    "deprecate:versions": "node scripts/deprecate-versions.js",
-    "deprecate:dry-run": "node scripts/deprecate-versions.js --dry-run",
-    "deprecate:verify": "node scripts/verify-deprecations.js"
+    "lint:locales": "node scripts/lint-locales.js" 
   },
   "engines": {
     "node": ">=16.0.0",
@@ -227,7 +224,7 @@
   },
   "preferGlobal": true,
   "versionInfo": {
-    "version": "2.3.4",
+    "version": "2.3.5",
     "releaseDate": "12/04/2026",
     "lastUpdated": "12/04/2026",
     "maintainer": "Vlad Noskov",
@@ -238,9 +235,10 @@
       "HOTFIX: Removed deprecated package-path fallback that caused production build warnings for non-exported subpaths.",
       "CRITICAL FIX: Resolved sizing and usage-analysis regressions in v2 command flow.",
       "PACKAGING: Reduced publish footprint by removing internal development scripts and legacy fixed-file artifacts.",
-      "SECURITY: Hardened release checks and added explicit support guidance to update from pre-2.3.4 versions.",
+      "SECURITY: Hardened release checks and added explicit support guidance to update from pre-2.3.5 versions.",
       "CONFIG: Added cross-process file locking for .i18ntk-config writes to prevent production rename races.",
       "CONFIG: Made autosave runtime-safe with non-throwing save failures and I18NTK_DISABLE_AUTOSAVE support.",
+      "SECURITY: Hardened reset/backup path handling and made npm update checks explicit opt-in.",
       "CLI: Added npm registry version check with upgrade warning for out-of-date installs.",
       "I18N: Completed internal UI locale parity and actionable untranslated-key cleanup across supported languages."
     ],
@@ -267,7 +265,7 @@
       "spring-boot": ">=2.5.0",
       "laravel": ">=8.0.0"
     },
-    "supportPolicy": "Versions earlier than 2.3.4 may be unstable or insecure. Upgrade to 2.3.4 or newer."
+    "supportPolicy": "Versions earlier than 2.3.6 may be unstable or insecure. Upgrade to 2.3.6 or newer."
   },
   "_comment": "This package is zero-dependency and uses only native Node.js modules"
 }

package/settings/settings-manager.js

@@ -6,14 +6,15 @@ const SecurityUtils = require('../utils/security');
 
 class SettingsManager {
     constructor() {
-        // Use centralized .i18ntk-settings file as single source of truth
-        this.configDir = path.resolve(__dirname, '..');
-        this.configFile = path.join(process.cwd(), '.i18ntk-settings');
-        this.backupDir = path.join(process.cwd(), 'i18ntk-backups');
+    // Use centralized .i18ntk-settings file as single source of truth
+    this.configDir = path.resolve(__dirname, '..');
+    const projectRoot = path.resolve(process.cwd());
+    this.configFile = SecurityUtils.safeJoin(projectRoot, '.i18ntk-settings') || path.join(projectRoot, '.i18ntk-settings');
+    this.backupDir = SecurityUtils.safeJoin(projectRoot, 'i18ntk-backups') || path.join(projectRoot, 'i18ntk-backups');
         this.saveTimeout = null;
         
         this.defaultConfig = {
-            "version": "1.10.1",
+            "version": "2.3.6",
             "language": "en",
             "uiLanguage": "en",
             "theme": "dark",
@@ -312,6 +313,18 @@ class SettingsManager {
         this.settings = this.loadSettings();
     }
 
+    resolveSafePath(targetPath, basePath = process.cwd()) {
+        return SecurityUtils.validatePath(path.resolve(targetPath), basePath);
+    }
+
+    safeDeleteFile(targetPath, basePath = process.cwd()) {
+        const validated = this.resolveSafePath(targetPath, basePath);
+        if (!validated) return false;
+        if (!SecurityUtils.safeExistsSync(validated, basePath)) return false;
+        fs.unlinkSync(validated);
+        return true;
+    }
+
     /**
      * Load settings from file or return default settings
      * @returns {object} Settings object
@@ -432,12 +445,18 @@ class SettingsManager {
      */
     _saveImmediately() {
         try {
-            if (!SecurityUtils.safeExistsSync(this.configDir)) {
-                fs.mkdirSync(this.configDir, { recursive: true });
+            const configDir = path.dirname(this.configFile);
+            const validatedConfigDir = this.resolveSafePath(configDir, process.cwd());
+            if (!validatedConfigDir) {
+                throw new Error('Invalid configuration directory');
+            }
+
+            if (!SecurityUtils.safeExistsSync(validatedConfigDir, process.cwd())) {
+                SecurityUtils.safeMkdirSync(validatedConfigDir, process.cwd(), { recursive: true });
             }
             
             const content = JSON.stringify(this.settings, null, 4);
-            SecurityUtils.safeWriteFileSync(this.configFile, content, path.dirname(this.configFile), 'utf8');
+            SecurityUtils.safeWriteFileSync(this.configFile, content, validatedConfigDir, 'utf8');
             
             // Create backup if enabled
             if (this.settings.backup?.enabled) {
@@ -466,13 +485,19 @@ class SettingsManager {
             }
 
             if (!SecurityUtils.safeExistsSync(validatedBackupDir, process.cwd())) {
-                fs.mkdirSync(validatedBackupDir, { recursive: true });
+                SecurityUtils.safeMkdirSync(validatedBackupDir, process.cwd(), { recursive: true });
             }
             
             const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
             const backupFile = path.join(validatedBackupDir, `config-${timestamp}.json`);
+            const validatedConfigFile = this.resolveSafePath(this.configFile, process.cwd());
+            const validatedBackupFile = this.resolveSafePath(backupFile, process.cwd());
+            if (!validatedConfigFile || !validatedBackupFile) {
+                console.error('Error creating backup: Invalid source or destination path');
+                return;
+            }
             
-            fs.copyFileSync(this.configFile, backupFile);
+            fs.copyFileSync(validatedConfigFile, validatedBackupFile);
             
             // Clean old backups
             this.cleanupOldBackups(validatedBackupDir);
@@ -486,17 +511,20 @@ class SettingsManager {
      */
     cleanupOldBackups(backupDirectory = null) {
         try {
-            const activeBackupDir = backupDirectory || this.backupDir;
+            const activeBackupDir = this.resolveSafePath(backupDirectory || this.backupDir, process.cwd());
+            if (!activeBackupDir) {
+                return;
+            }
             if (!SecurityUtils.safeExistsSync(activeBackupDir, process.cwd())) {
                 return;
             }
 
-            const files = fs.readdirSync(activeBackupDir)
+            const files = (SecurityUtils.safeReaddirSync(activeBackupDir, process.cwd()) || [])
                 .filter(file => file.startsWith('config-') && file.endsWith('.json'))
                 .map(file => ({
                     name: file,
                     path: path.join(activeBackupDir, file),
-                    mtime: fs.statSync(path.join(activeBackupDir, file)).mtime
+                    mtime: (SecurityUtils.safeStatSync(path.join(activeBackupDir, file), process.cwd()) || { mtime: new Date(0) }).mtime
                 }))
                 .sort((a, b) => b.mtime - a.mtime);
             
@@ -506,7 +534,7 @@ class SettingsManager {
                 : 1;
             if (files.length > maxBackups) {
                 files.slice(maxBackups).forEach(file => {
-                    fs.unlinkSync(file.path);
+                    this.safeDeleteFile(file.path, process.cwd());
                 });
             }
         } catch (error) {
@@ -546,52 +574,49 @@ class SettingsManager {
             
             // 2. Remove actual configuration files used by the system
             const packageDir = path.resolve(__dirname, '..');
-            const settingsDir = path.join(packageDir, 'settings');
+            const projectRoot = path.resolve(process.cwd());
+            const settingsDir = SecurityUtils.safeJoin(packageDir, 'settings');
             
             // Main configuration file
             const mainConfigPath = path.join(settingsDir, 'i18ntk-config.json');
-            if (SecurityUtils.safeExistsSync(mainConfigPath)) {
-                fs.unlinkSync(mainConfigPath);
+            if (this.safeDeleteFile(mainConfigPath, packageDir)) {
                 console.log('✅ Main configuration file removed');
             }
             
             // Project configuration file
             const projectConfigPath = path.join(settingsDir, 'project-config.json');
-            if (SecurityUtils.safeExistsSync(projectConfigPath)) {
-                fs.unlinkSync(projectConfigPath);
+            if (this.safeDeleteFile(projectConfigPath, packageDir)) {
                 console.log('✅ Project configuration removed');
             }
             
             // Setup tracking file
             const setupFile = path.join(settingsDir, 'setup.json');
-            if (SecurityUtils.safeExistsSync(setupFile)) {
-                fs.unlinkSync(setupFile);
+            if (this.safeDeleteFile(setupFile, packageDir)) {
                 console.log('✅ Setup tracking cleared');
             }
             
             // 3. Clear all backup files from backups directory
             const backupsDir = path.join(packageDir, 'backups');
-            if (SecurityUtils.safeExistsSync(backupsDir)) {
-                const backupFiles = fs.readdirSync(backupsDir);
+            if (SecurityUtils.safeExistsSync(backupsDir, packageDir)) {
+                const backupFiles = SecurityUtils.safeReaddirSync(backupsDir, packageDir) || [];
                 for (const file of backupFiles) {
                     if (file.endsWith('.json') || file.endsWith('.bak')) {
-                        fs.unlinkSync(path.join(backupsDir, file));
+                        this.safeDeleteFile(path.join(backupsDir, file), packageDir);
                     }
                 }
                 console.log('✅ All backup files cleared');
             }
             
-            // 4. Clear admin PIN configuration (multiple possible locations including root)
+            // 4. Clear admin PIN configuration (package/project scope only)
             const adminConfigPaths = [
                 path.join(packageDir, '.i18n-admin-config.json'),
                 path.join(settingsDir, '.i18n-admin-config.json'),
                 path.join(settingsDir, 'admin-config.json'),
-                path.join(packageDir, '..', '.i18n-admin-config.json') // Root level
+                SecurityUtils.safeJoin(projectRoot, '.i18n-admin-config.json') || path.join(projectRoot, '.i18n-admin-config.json')
             ];
             
             for (const adminConfigPath of adminConfigPaths) {
-                if (SecurityUtils.safeExistsSync(adminConfigPath)) {
-                    fs.unlinkSync(adminConfigPath);
+                if (this.safeDeleteFile(adminConfigPath, projectRoot)) {
                     console.log('✅ Admin PIN configuration cleared');
                 }
             }
@@ -603,8 +628,7 @@ class SettingsManager {
             ];
             
             for (const initFile of initFiles) {
-                if (SecurityUtils.safeExistsSync(initFile)) {
-                    fs.unlinkSync(initFile);
+                if (this.safeDeleteFile(initFile, packageDir)) {
                     console.log('✅ Initialization tracking cleared');
                 }
             }
@@ -616,10 +640,10 @@ class SettingsManager {
             ];
             
             for (const cacheDir of cacheDirs) {
-                if (SecurityUtils.safeExistsSync(cacheDir)) {
-                    const cacheFiles = fs.readdirSync(cacheDir);
+                if (SecurityUtils.safeExistsSync(cacheDir, packageDir)) {
+                    const cacheFiles = SecurityUtils.safeReaddirSync(cacheDir, packageDir) || [];
                     for (const file of cacheFiles) {
-                        fs.unlinkSync(path.join(cacheDir, file));
+                        this.safeDeleteFile(path.join(cacheDir, file), packageDir);
                     }
                     console.log('✅ Cache cleared');
                 }
@@ -639,9 +663,7 @@ class SettingsManager {
             ];
             
             for (const tempFile of tempFiles) {
-                if (SecurityUtils.safeExistsSync(tempFile)) {
-                    fs.unlinkSync(tempFile);
-                }
+                this.safeDeleteFile(tempFile, packageDir);
             }
             console.log('✅ Temporary files cleared');
             
@@ -656,8 +678,7 @@ class SettingsManager {
             ];
             
             for (const file of additionalFiles) {
-                if (SecurityUtils.safeExistsSync(file)) {
-                    fs.unlinkSync(file);
+                if (this.safeDeleteFile(file, packageDir)) {
                     console.log(`✅ Removed ${path.basename(file)}`);
                 }
             }
@@ -982,4 +1003,4 @@ class SettingsManager {
 }
 
 module.exports = SettingsManager;
-
+

package/utils/config-manager.js

@@ -1,22 +1,25 @@
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
-const crypto = require('crypto');
-const SecurityUtils = require('./security');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const crypto = require('crypto');
+const SecurityUtils = require('./security');
 
 // Determine package directory and user project root
 const packageDir = path.resolve(__dirname, '..');
-const userProjectRoot = process.cwd();
+const userProjectRoot = path.resolve(process.cwd());
 
 // Always use current working directory for settings to support test environments
 // This ensures config works correctly when tests change the working directory
-const PROJECT_CONFIG_PATH = path.join(process.cwd(), '.i18ntk-config');
-const PROJECT_SETTINGS_DIR = path.dirname(PROJECT_CONFIG_PATH);
-const CONFIG_LOCK_PATH = `${PROJECT_CONFIG_PATH}.lock`;
-const CONFIG_LOCK_TIMEOUT_MS = 5000;
-const CONFIG_LOCK_STALE_MS = 15000;
-const CONFIG_LOCK_RETRY_MS = 50;
-let autosaveDisabledWarned = false;
+const PROJECT_CONFIG_PATH = SecurityUtils.safeJoin(userProjectRoot, '.i18ntk-config');
+if (!PROJECT_CONFIG_PATH) {
+throw new Error('Invalid project config path - potential path traversal attempt');
+}
+const PROJECT_SETTINGS_DIR = path.dirname(PROJECT_CONFIG_PATH);
+const CONFIG_LOCK_PATH = `${PROJECT_CONFIG_PATH}.lock`;
+const CONFIG_LOCK_TIMEOUT_MS = 5000;
+const CONFIG_LOCK_STALE_MS = 15000;
+const CONFIG_LOCK_RETRY_MS = 50;
+let autosaveDisabledWarned = false;
 
 // Setup tracking file
 const SETUP_COMPLETED_FILE = path.join(PROJECT_SETTINGS_DIR, 'setup.json');
@@ -175,14 +178,14 @@ const DEFAULT_CONFIG = {
     "memoryPooling": true,
     "stringInterning": true
   },
-  "backup": {
-    "enabled": false,
-    "location": "./i18ntk-backups",
-    "singleFileMode": false,
-    "singleBackupFile": "i18ntk-central-backup.json",
-    "retentionDays": 30,
-    "maxBackups": 1
-  },
+  "backup": {
+    "enabled": false,
+    "location": "./i18ntk-backups",
+    "singleFileMode": false,
+    "singleBackupFile": "i18ntk-central-backup.json",
+    "retentionDays": 30,
+    "maxBackups": 1
+  },
   "security": {
     "adminPinEnabled": false,
     "adminPinPromptOnInit": true,
@@ -250,69 +253,69 @@ const DEFAULT_CONFIG = {
 
 // Environment variable support has been removed in favor of exclusive .i18ntk-config configuration
 
-let currentConfig = null;
-let configLoadInProgress = false;
-let recursionDepth = 0;
-const MAX_RECURSION_DEPTH = 15; // Increased to handle legitimate sequential calls
-let configSaveQueue = Promise.resolve();
-
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-async function acquireConfigLock(timeoutMs = CONFIG_LOCK_TIMEOUT_MS) {
-  const start = Date.now();
-  let lockHandle = null;
-
-  while (!lockHandle) {
-    try {
-      lockHandle = await fs.promises.open(CONFIG_LOCK_PATH, 'wx');
-      await lockHandle.writeFile(String(process.pid), 'utf8');
-      break;
-    } catch (error) {
-      if (!error || error.code !== 'EEXIST') {
-        throw error;
-      }
-
-      // Recover from stale lock files left by crashed processes.
-      try {
-        const stats = await fs.promises.stat(CONFIG_LOCK_PATH);
-        if (Date.now() - stats.mtimeMs > CONFIG_LOCK_STALE_MS) {
-          await fs.promises.unlink(CONFIG_LOCK_PATH);
-          continue;
-        }
-      } catch (_) {
-        // Lock may have been released between exists check and stat/unlink.
-      }
-
-      if (Date.now() - start >= timeoutMs) {
-        throw new Error(`Timed out waiting for config lock after ${timeoutMs}ms`);
-      }
-
-      await sleep(CONFIG_LOCK_RETRY_MS);
-    }
-  }
-
-  return async function releaseConfigLock() {
-    try {
-      if (lockHandle) {
-        await lockHandle.close();
-      }
-    } catch (_) {
-      // Best-effort close only.
-    }
-    try {
-      await fs.promises.unlink(CONFIG_LOCK_PATH);
-    } catch (_) {
-      // Best-effort cleanup only.
-    }
-  };
-}
-
-function isAutosaveDisabled() {
-  const flag = String(process.env.I18NTK_DISABLE_AUTOSAVE || '').trim().toLowerCase();
-  return flag === '1' || flag === 'true' || flag === 'yes';
-}
+let currentConfig = null;
+let configLoadInProgress = false;
+let recursionDepth = 0;
+const MAX_RECURSION_DEPTH = 15; // Increased to handle legitimate sequential calls
+let configSaveQueue = Promise.resolve();
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function acquireConfigLock(timeoutMs = CONFIG_LOCK_TIMEOUT_MS) {
+  const start = Date.now();
+  let lockHandle = null;
+
+  while (!lockHandle) {
+    try {
+      lockHandle = await fs.promises.open(CONFIG_LOCK_PATH, 'wx');
+      await lockHandle.writeFile(String(process.pid), 'utf8');
+      break;
+    } catch (error) {
+      if (!error || error.code !== 'EEXIST') {
+        throw error;
+      }
+
+      // Recover from stale lock files left by crashed processes.
+      try {
+        const stats = await fs.promises.stat(CONFIG_LOCK_PATH);
+        if (Date.now() - stats.mtimeMs > CONFIG_LOCK_STALE_MS) {
+          await fs.promises.unlink(CONFIG_LOCK_PATH);
+          continue;
+        }
+      } catch (_) {
+        // Lock may have been released between exists check and stat/unlink.
+      }
+
+      if (Date.now() - start >= timeoutMs) {
+        throw new Error(`Timed out waiting for config lock after ${timeoutMs}ms`);
+      }
+
+      await sleep(CONFIG_LOCK_RETRY_MS);
+    }
+  }
+
+  return async function releaseConfigLock() {
+    try {
+      if (lockHandle) {
+        await lockHandle.close();
+      }
+    } catch (_) {
+      // Best-effort close only.
+    }
+    try {
+      await fs.promises.unlink(CONFIG_LOCK_PATH);
+    } catch (_) {
+      // Best-effort cleanup only.
+    }
+  };
+}
+
+function isAutosaveDisabled() {
+  const flag = String(process.env.I18NTK_DISABLE_AUTOSAVE || '').trim().toLowerCase();
+  return flag === '1' || flag === 'true' || flag === 'yes';
+}
 
 function clone(obj) {
    return JSON.parse(JSON.stringify(obj));
@@ -382,21 +385,21 @@ function tryReadJson(filePath) {
       return null;
     }
 
-    const parsed = SecurityUtils.safeParseJSON(data);
-    if (parsed && typeof parsed === 'object') {
-      return parsed;
-    }
-
-    console.error(`[i18ntk] Error parsing JSON from ${filePath}: Invalid JSON content`);
-    // Create a backup of the corrupted file
-    const backupPath = `${filePath}.corrupted-${Date.now()}.bak`;
-    try {
-      SecurityUtils.safeWriteFileSync(backupPath, data, path.dirname(backupPath), 'utf8');
-      console.warn(`[i18ntk] Created backup of corrupted config at ${backupPath}`);
-    } catch (backupError) {
-      console.error(`[i18ntk] Failed to create backup of corrupted config: ${backupError.message}`);
-    }
-    return null;
+    const parsed = SecurityUtils.safeParseJSON(data);
+    if (parsed && typeof parsed === 'object') {
+      return parsed;
+    }
+
+    console.error(`[i18ntk] Error parsing JSON from ${filePath}: Invalid JSON content`);
+    // Create a backup of the corrupted file
+    const backupPath = `${filePath}.corrupted-${Date.now()}.bak`;
+    try {
+      SecurityUtils.safeWriteFileSync(backupPath, data, path.dirname(backupPath), 'utf8');
+      console.warn(`[i18ntk] Created backup of corrupted config at ${backupPath}`);
+    } catch (backupError) {
+      console.error(`[i18ntk] Failed to create backup of corrupted config: ${backupError.message}`);
+    }
+    return null;
   } catch (error) {
     console.error(`[i18ntk] Error reading config file at ${filePath}: ${error.message}`);
     return null;
@@ -417,13 +420,13 @@ async function migrateLegacyIfNeeded(baseCfg) {
         // Best-effort removal of legacy file to prevent future use
         try { fs.unlinkSync(LEGACY_CONFIG_PATH); } catch (_) {}
         // Deprecation notice
-        console.warn('[i18ntk] Deprecated config location detected (~/.i18ntk). Configuration was migrated to project .i18ntk-config.');
-        return merged;
-      } catch (_) {
-        // If write fails, fall back to in-memory config without deleting legacy
-        console.warn('[i18ntk] Deprecated config location detected (~/.i18ntk). Using migrated settings in memory; failed to persist to .i18ntk-config.');
-        return merged;
-      }
+        console.warn('[i18ntk] Deprecated config location detected (~/.i18ntk). Configuration was migrated to project .i18ntk-config.');
+        return merged;
+      } catch (_) {
+        // If write fails, fall back to in-memory config without deleting legacy
+        console.warn('[i18ntk] Deprecated config location detected (~/.i18ntk). Using migrated settings in memory; failed to persist to .i18ntk-config.');
+        return merged;
+      }
     }
   }
   return null;
@@ -487,73 +490,75 @@ function loadConfig() {
    }
 }
 
-async function saveConfig(cfg = currentConfig) {
-  if (!cfg || typeof cfg !== 'object') return;
-
-  // Runtime/server safety valve: allow disabling disk writes entirely.
-  if (isAutosaveDisabled()) {
-    currentConfig = cfg;
-    if (!autosaveDisabledWarned) {
-      autosaveDisabledWarned = true;
-      console.warn('[i18ntk] Autosave disabled by I18NTK_DISABLE_AUTOSAVE. Keeping configuration in memory only.');
-    }
-    return false;
-  }
-
-  configSaveQueue = configSaveQueue.then(async () => {
-    let tempPath = null;
-    let releaseLock = null;
-    try {
-      // Ensure settings directory exists before any lock/file operations.
-      await fs.promises.mkdir(PROJECT_SETTINGS_DIR, { recursive: true });
-
-      releaseLock = await acquireConfigLock();
-
-      const serialized = JSON.stringify(cfg, null, 2);
-      if (typeof serialized !== 'string' || serialized.length === 0) {
-        throw new Error('Cannot save empty configuration payload');
-      }
-
-      // Use a unique temp file to avoid concurrent writer races.
-      const nonce = `${process.pid}.${Date.now()}.${crypto.randomUUID()}`;
-      tempPath = `${PROJECT_CONFIG_PATH}.${nonce}.tmp`;
-      await fs.promises.writeFile(tempPath, serialized, 'utf8');
-
-      try {
-        await fs.promises.rename(tempPath, PROJECT_CONFIG_PATH);
-      } catch (renameError) {
-        // If destination dir disappeared between checks, recreate and retry once.
-        if (renameError && renameError.code === 'ENOENT') {
-          await fs.promises.mkdir(PROJECT_SETTINGS_DIR, { recursive: true });
-          await fs.promises.rename(tempPath, PROJECT_CONFIG_PATH);
-        } else {
-          throw renameError;
-        }
-      }
-
-      currentConfig = cfg;
-      return true;
-    } catch (error) {
-      console.error('[i18ntk] Error saving configuration:', error.message);
-      return false;
-    } finally {
-      if (releaseLock) {
-        await releaseLock();
-      }
-      if (tempPath) {
-        try {
-          if (SecurityUtils.safeExistsSync(tempPath, path.dirname(tempPath))) {
-            fs.unlinkSync(tempPath);
-          }
-        } catch (_) {
-          // Best-effort temp cleanup only.
-        }
-      }
-    }
-  });
-
-  return configSaveQueue;
-}
+async function saveConfig(cfg = currentConfig) {
+  if (!cfg || typeof cfg !== 'object') return;
+
+  // Runtime/server safety valve: allow disabling disk writes entirely.
+  if (isAutosaveDisabled()) {
+    currentConfig = cfg;
+    if (!autosaveDisabledWarned) {
+      autosaveDisabledWarned = true;
+      console.warn('[i18ntk] Autosave disabled by I18NTK_DISABLE_AUTOSAVE. Keeping configuration in memory only.');
+    }
+    return false;
+  }
+
+  configSaveQueue = configSaveQueue.then(async () => {
+    let tempPath = null;
+    let releaseLock = null;
+    try {
+      // Ensure settings directory exists before any lock/file operations.
+      await fs.promises.mkdir(PROJECT_SETTINGS_DIR, { recursive: true });
+
+      releaseLock = await acquireConfigLock();
+
+      const serialized = JSON.stringify(cfg, null, 2);
+      if (typeof serialized !== 'string' || serialized.length === 0) {
+        throw new Error('Cannot save empty configuration payload');
+      }
+
+      // Use a unique temp file to avoid concurrent writer races.
+      // Create temp files in the same directory as the config file to ensure they're safe
+      const nonce = `${process.pid}.${Date.now()}.${crypto.randomUUID()}`;
+      const tempFileName = `.i18ntk-config.${nonce}.tmp`;
+      tempPath = path.join(PROJECT_SETTINGS_DIR, tempFileName);
+      await fs.promises.writeFile(tempPath, serialized, 'utf8');
+
+      try {
+        await fs.promises.rename(tempPath, PROJECT_CONFIG_PATH);
+      } catch (renameError) {
+        // If destination dir disappeared between checks, recreate and retry once.
+        if (renameError && renameError.code === 'ENOENT') {
+          await fs.promises.mkdir(PROJECT_SETTINGS_DIR, { recursive: true });
+          await fs.promises.rename(tempPath, PROJECT_CONFIG_PATH);
+        } else {
+          throw renameError;
+        }
+      }
+
+      currentConfig = cfg;
+      return true;
+    } catch (error) {
+      console.error('[i18ntk] Error saving configuration:', error.message);
+      return false;
+    } finally {
+      if (releaseLock) {
+        await releaseLock();
+      }
+      if (tempPath) {
+        try {
+          if (SecurityUtils.safeExistsSync(tempPath, path.dirname(tempPath))) {
+            fs.unlinkSync(tempPath);
+          }
+        } catch (_) {
+          // Best-effort temp cleanup only.
+        }
+      }
+    }
+  });
+
+  return configSaveQueue;
+}
 
 function getConfig() {
     // Check for recursion
@@ -575,28 +580,28 @@ function getConfig() {
      // No need to check here - handled by getUnifiedConfig
 
      // Check if config file exists
-     if (SecurityUtils.safeExistsSync(PROJECT_CONFIG_PATH)) {
-       const rawConfig = SecurityUtils.safeReadFileSync(PROJECT_CONFIG_PATH, path.dirname(PROJECT_CONFIG_PATH), 'utf8');
-       const config = SecurityUtils.safeParseJSON(rawConfig);
-       if (config && typeof config === 'object') {
-         currentConfig = config;
-         return resolvePaths(config);
-       }
-       throw new Error('Invalid project configuration JSON');
-     }
+     if (SecurityUtils.safeExistsSync(PROJECT_CONFIG_PATH)) {
+       const rawConfig = SecurityUtils.safeReadFileSync(PROJECT_CONFIG_PATH, path.dirname(PROJECT_CONFIG_PATH), 'utf8');
+       const config = SecurityUtils.safeParseJSON(rawConfig);
+       if (config && typeof config === 'object') {
+         currentConfig = config;
+         return resolvePaths(config);
+       }
+       throw new Error('Invalid project configuration JSON');
+     }
 
      // Check for legacy config for migration
      if (SecurityUtils.safeExistsSync(LEGACY_CONFIG_PATH)) {
        console.log('📦 Migrating legacy configuration...');
-       const legacyRaw = SecurityUtils.safeReadFileSync(LEGACY_CONFIG_PATH, path.dirname(LEGACY_CONFIG_PATH), 'utf8');
-       const legacyConfig = SecurityUtils.safeParseJSON(legacyRaw);
-       if (!legacyConfig || typeof legacyConfig !== 'object') {
-         throw new Error('Invalid legacy configuration JSON');
-       }
+       const legacyRaw = SecurityUtils.safeReadFileSync(LEGACY_CONFIG_PATH, path.dirname(LEGACY_CONFIG_PATH), 'utf8');
+       const legacyConfig = SecurityUtils.safeParseJSON(legacyRaw);
+       if (!legacyConfig || typeof legacyConfig !== 'object') {
+         throw new Error('Invalid legacy configuration JSON');
+       }
        const migratedConfig = { ...DEFAULT_CONFIG, ...legacyConfig };
-       saveConfig(migratedConfig).catch((err) => {
-         console.warn('[i18ntk] Warning: failed to persist migrated configuration:', err.message);
-       });
+       saveConfig(migratedConfig).catch((err) => {
+         console.warn('[i18ntk] Warning: failed to persist migrated configuration:', err.message);
+       });
        currentConfig = migratedConfig;
 
        // Clean up legacy config
@@ -614,9 +619,9 @@ function getConfig() {
 
      // Use package defaults for new installation
      console.log('📦 Initializing with default configuration...');
-     saveConfig(DEFAULT_CONFIG).catch((err) => {
-       console.warn('[i18ntk] Warning: failed to persist default configuration:', err.message);
-     });
+     saveConfig(DEFAULT_CONFIG).catch((err) => {
+       console.warn('[i18ntk] Warning: failed to persist default configuration:', err.message);
+     });
      currentConfig = DEFAULT_CONFIG;
      return resolvePaths(DEFAULT_CONFIG);
 
@@ -686,4 +691,4 @@ module.exports = {
   resolvePaths,
   toRelative,
   normalizePathValue,
-}
+}

package/utils/npm-version-warning.js

@@ -108,6 +108,11 @@ async function printUpgradeWarningIfOutdated({
   currentVersion,
   timeoutMs = DEFAULT_TIMEOUT_MS
 }) {
+  const enabled = String(process.env.I18NTK_ENABLE_UPDATE_CHECK || '').toLowerCase();
+  if (!(enabled === '1' || enabled === 'true' || enabled === 'yes')) {
+    return;
+  }
+
   if (process.env.I18NTK_DISABLE_UPDATE_CHECK === 'true') {
     return;
   }

package/utils/security.js

@@ -27,7 +27,7 @@ function getI18n() {
       i18n = require('./i18n-helper');
     } catch (error) {
       // Fallback to simple identity function if i18n fails to load
-      console.warn('i18n-helper not available, using fallback messages');
+      SecurityUtils.logSecurityEvent('i18n-helper not available, using fallback messages', 'warn');
       return { t: (key, params = {}) => key };
     }
   }
@@ -93,9 +93,12 @@ class SecurityUtils {
 
       return result;
     } catch (error) {
-      const i18n = getI18n();
-      console.warn(i18n.t('security.operation_error', { operation: operationName, error: error.message }));
-      return null;
+    const i18n = getI18n();
+    SecurityUtils.logSecurityEvent('Operation error', 'error', {
+    operation: operationName,
+    error: error.message
+    });
+    return null;
     } finally {
       SecurityUtils._operationStack.delete(operationName);
     }
@@ -108,17 +111,20 @@ class SecurityUtils {
    * @param {object} details - Additional details
    */
   static logSecurityEvent(event, level = 'info', details = {}) {
-    // Prevent recursive logging which can occur during configuration loading
-    if (SecurityUtils._logging) {
-      return;
-    }
-
-    SecurityUtils._logging = true;
-    try {
-      const cfg = getConfigManager()?.getConfig?.() || {};
-      const envLevel = (process.env.SECURITY_LOG_LEVEL || process.env.I18NTK_SECURITY_LOG_LEVEL || '').toLowerCase();
-      const configLevel = (cfg.security?.logLevel || cfg.security?.audit?.logLevel || '').toLowerCase();
-      const currentLevel = envLevel || configLevel || 'warn';
+  // Prevent recursive logging which can occur during configuration loading
+  if (SecurityUtils._logging) {
+  return;
+  }
+  
+  SecurityUtils._logging = true;
+  try {
+  const cfg = getConfigManager()?.getConfig?.() || {};
+  const envLevel = (process.env.SECURITY_LOG_LEVEL || process.env.I18NTK_SECURITY_LOG_LEVEL || '').toLowerCase();
+  const configLevel = (cfg.security?.logLevel || cfg.security?.audit?.logLevel || '').toLowerCase();
+  
+  // Check for debug mode
+  const debugMode = process.env.I18N_DEBUG === 'true' || process.env.DEBUG === 'true';
+  const currentLevel = debugMode ? 'info' : (envLevel || configLevel || 'warn');
 
       const levels = { error: 0, warn: 1, warning: 1, info: 2 };
       const messageLevel = levels[level.toLowerCase()] ?? 2;
@@ -263,14 +269,14 @@ class SecurityUtils {
       // Read file with size limit (10MB max)
       const stats = fs.statSync(validatedPath);
       if (stats.size > 10 * 1024 * 1024) {
-        console.warn(i18n.t('security.file_too_large', { filePath: validatedPath }));
-        return null;
+      SecurityUtils.logSecurityEvent('File too large', 'warn', { filePath: validatedPath });
+      return null;
       }
 
       return fs.readFileSync(validatedPath, encoding);
     } catch (error) {
-      console.warn(i18n.t('security.file_read_error', { errorMessage: error.message }));
-      return null;
+    SecurityUtils.logSecurityEvent('File read error', 'error', { errorMessage: error.message });
+    return null;
     }
   }
 
@@ -284,7 +290,7 @@ class SecurityUtils {
       // Validate content is a string or Buffer
       if (typeof content !== 'string' && !Buffer.isBuffer(content)) {
         const i18n = getI18n();
-        console.warn(i18n.t('security.file_write_error', { errorMessage: 'Content must be a string or Buffer' }));
+        SecurityUtils.logSecurityEvent('File write error: Content must be a string or Buffer', 'error');
         return false;
       }
 
@@ -292,7 +298,7 @@ class SecurityUtils {
       const contentSize = typeof content === 'string' ? content.length : content.length;
       if (contentSize > 10 * 1024 * 1024) {
         const i18n = getI18n();
-        console.warn(i18n.t('security.content_too_large_for_file', { filePath: validatedPath }));
+        SecurityUtils.logSecurityEvent('Content too large for file', 'warn', { filePath: validatedPath });
         return false;
       }
 
@@ -305,7 +311,7 @@ class SecurityUtils {
       return true;
     } catch (error) {
       const i18n = getI18n();
-      console.warn(i18n.t('security.file_write_error', { errorMessage: error.message }));
+      SecurityUtils.logSecurityEvent('File write error', 'error', { errorMessage: error.message });
       return false;
     }
   }
@@ -399,8 +405,8 @@ class SecurityUtils {
       const normalized = trimmed.charCodeAt(0) === 0xFEFF ? trimmed.slice(1) : trimmed;
       return JSON.parse(normalized);
     } catch (error) {
-      console.warn(`Invalid JSON content: ${error.message}`);
-      return fallback;
+    SecurityUtils.logSecurityEvent('Invalid JSON content', 'error', { error: error.message });
+    return fallback;
     }
   }
 
@@ -443,7 +449,7 @@ class SecurityUtils {
       const isCommonContent = sanitized.length < 1000 && !sanitized.includes('<script');
       if (!isFilePath && !isCommonContent) {
         const i18n = getI18n();
-        console.warn(i18n.t('security.inputDisallowedCharacters'));
+        SecurityUtils.logSecurityEvent('Input contains disallowed characters', 'warn');
       }
       // Allow more characters for file paths and content
       sanitized = sanitized.replace(/[^a-zA-Z0-9\s\-_\.\,\!\?\(\)\[\]\{\}\:\;"'\/\\]/g, '');
@@ -456,10 +462,39 @@ class SecurityUtils {
     return crypto.createHash('sha256').update(content).digest('hex');
   }
 
+  static safeJoin(basePath, ...paths) {
+  if (!basePath || typeof basePath !== 'string') {
+  return false;
+  }
+  try {
+  const resolvedBase = path.resolve(basePath);
+  const joinedPath = path.join(resolvedBase, ...paths);
+  const resolvedPath = path.resolve(joinedPath);
+  
+  // Ensure the final path is within the base directory
+  if (!resolvedPath.startsWith(resolvedBase)) {
+  SecurityUtils.logSecurityEvent('Path traversal attempt detected in safeJoin', 'error', {
+  basePath,
+  paths,
+  resolvedPath
+  });
+  return false;
+  }
+  return resolvedPath;
+  } catch (error) {
+  SecurityUtils.logSecurityEvent('Error in safeJoin', 'error', {
+  basePath,
+  paths,
+  error: error.message
+  });
+  return false;
+  }
+  }
+  
   static isSafePath(filePath) {
-    if (!filePath || typeof filePath !== 'string') {
-      return false;
-    }
+  if (!filePath || typeof filePath !== 'string') {
+  return false;
+  }
 
     // Allow legitimate Windows drive letter paths
     if (filePath.match(/^[A-Z]:[\/\\]/)) {
@@ -531,12 +566,12 @@ class SecurityUtils {
       'theme', 'ui', 'setup', 'reports', 'display', 'interface',
       // Security and settings
       'security', 'settings', 'preferences', 'config', 'configuration',
-      // Additional common properties
-      'autoSave', 'autoBackup', 'validateOnSave', 'showWarnings', 'verbose',
-      'timeout', 'retries', 'batchSize', 'maxConcurrency', 'cacheEnabled',
-      // Date and reporting options used by existing settings
-      'dateFormat', 'timeFormat', 'timezone', 'reportLanguage', 'dateTime'
-    ]);
+      // Additional common properties
+      'autoSave', 'autoBackup', 'validateOnSave', 'showWarnings', 'verbose',
+      'timeout', 'retries', 'batchSize', 'maxConcurrency', 'cacheEnabled',
+      // Date and reporting options used by existing settings
+      'dateFormat', 'timeFormat', 'timezone', 'reportLanguage', 'dateTime'
+    ]);
 
     // Remove unknown properties
     Object.keys(sanitized).forEach(key => {