iterate-plugin 3.5.1 → 3.5.2

package/dist/tools/context.js

@@ -1,10 +1,40 @@
-import { readFileSync, existsSync, statSync } from 'node:fs';
-import { join, dirname, resolve } from 'node:path';
+import { readFileSync, existsSync, realpathSync, statSync } from 'node:fs';
+import { join, dirname, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { defineTool } from '@deepseek-ai/dsh-tools';
 import { resolveProjectRootForExec } from "../config-loader.js";
 /** How many ancestor directories we walk up looking for a SKILL.md. */
 const MAX_SKILL_DIR_LOOKUP_DEPTH = 12;
+/**
+ * Whether a model-supplied `skillDir` may be used as a SKILL.md search root.
+ *
+ * `skillDir` is model-controlled, so it is only honored when it is an existing
+ * directory whose REAL path (symlinks resolved) sits inside one of the allowed
+ * roots (the project root or the plugin directory). Anything else — a path
+ * outside the allowed roots, a nonexistent dir, or a symlink pointing outside
+ * (e.g. at `/etc`) — is rejected so arbitrary file contents can never be
+ * injected wholesale into the review context.
+ */
+export function isAllowedSkillDir(skillDir, allowedRoots) {
+    if (typeof skillDir !== 'string' || skillDir.trim().length === 0)
+        return false;
+    try {
+        const dir = resolve(skillDir);
+        if (!existsSync(dir) || !statSync(dir).isDirectory())
+            return false;
+        return allowedRoots.some((root) => {
+            if (typeof root !== 'string' || root.length === 0)
+                return false;
+            const rootReal = realpathSync(root);
+            const rootPrefix = rootReal.endsWith(sep) ? rootReal : rootReal + sep;
+            const real = realpathSync(dir);
+            return real === rootReal || real.startsWith(rootPrefix);
+        });
+    }
+    catch {
+        return false;
+    }
+}
 /** Maximum number of image attachments relayed into the context in one call. */
 const MAX_ATTACHMENTS = 8;
 /** Maximum intrinsic width/height (px) accepted for an attached image. */
@@ -271,9 +301,13 @@ export function registerContextTool(ctx) {
                 // the auto-detected root / project root.
                 if (typeof args.skillDir === 'string' && args.skillDir.trim()) {
                     try {
-                        const dir = resolve(args.skillDir);
-                        if (existsSync(dir) && statSync(dir).isDirectory())
-                            candidates.push(dir);
+                        // Model-controlled path: only honor it when its REAL path stays
+                        // inside the project root or the plugin directory — never let a
+                        // skillDir point at arbitrary filesystem locations (e.g. /etc)
+                        // whose contents would be injected wholesale into the context.
+                        if (isAllowedSkillDir(args.skillDir, [projectRoot, PLUGIN_SRC_DIR])) {
+                            candidates.push(resolve(args.skillDir));
+                        }
                     }
                     catch {
                         // unreadable/invalid skillDir — skip it

package/dist/tools/decision-log.js

@@ -94,7 +94,14 @@ export function readDecisionLogDetailed(projectRoot) {
         if (trimmed.length === 0)
             continue;
         try {
-            entries.push(JSON.parse(trimmed));
+            const parsed = JSON.parse(trimmed);
+            if (parsed === null || typeof parsed !== 'object' ||
+                typeof parsed.timestamp !== 'string' ||
+                typeof parsed.type !== 'string') {
+                invalidLines += 1;
+                continue;
+            }
+            entries.push(parsed);
         }
         catch {
             invalidLines += 1;

package/dist/tools/fix.js

@@ -18,7 +18,7 @@
  */
 import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync } from 'node:fs';
 import { writeJsonAtomic, writeTextAtomic } from "../atomic-fs.js";
-import { join, sep } from 'node:path';
+import { dirname, join, sep } from 'node:path';
 import { defineTool } from '@deepseek-ai/dsh-tools';
 import { loadEffectiveConfig, resolveProjectRootForExec } from "../config-loader.js";
 import { runWithJob } from "../jobs.js";
@@ -198,15 +198,26 @@ export function resolveProjectFile(projectRoot, file) {
         return { ok: false, reason: 'file resolves outside the project root' };
     }
     // Symlink containment: the lexical prefix check above does not resolve
-    // symlinks. If the target exists, verify its REAL path stays inside the REAL
-    // project root so a symlinked directory/file inside the repo can never route
-    // a fix (write/rollback/diff) outside the project.
-    if (existsSync(resolved)) {
+    // symlinks. Verify the REAL path of the target (when it exists) AND of its
+    // nearest existing ancestor directory (when it does not — e.g. a fix that
+    // creates a new file) stays inside the REAL project root, so a symlinked
+    // directory inside the repo can never route a fix (write/rollback/diff)
+    // outside the project. The probe stops at the project root itself: the root
+    // is harness-provided (not model-controlled), and a path with no existing
+    // entry inside the repo cannot hide a symlink.
+    let probe = resolved;
+    while (!existsSync(probe) && probe !== projectRoot) {
+        const parent = dirname(probe);
+        if (parent === probe)
+            break;
+        probe = parent;
+    }
+    if (existsSync(probe)) {
         let rootReal;
         let real;
         try {
             rootReal = realpathSync(projectRoot);
-            real = realpathSync(resolved);
+            real = realpathSync(probe);
         }
         catch {
             return { ok: false, reason: 'failed to resolve real path for containment check' };
@@ -485,9 +496,9 @@ export function registerFixTool(ctx) {
                     // Registry write failed → the file was already modified but no record
                     // exists, so a later rollback/diff could never see it and a retry would
                     // back up the already-fixed content as "original". Restore the file
-                    // from the backup to leave the tree exactly as it was.
+                    // from the backup atomically to leave the tree exactly as it was.
                     try {
-                        copyFileSync(backupPath, target.resolved);
+                        writeTextAtomic(target.resolved, readFileSync(backupPath, 'utf-8'));
                     }
                     catch (restoreErr) {
                         return {
@@ -691,7 +702,9 @@ export function registerRollbackTool(ctx) {
             if (!target.ok)
                 return { ok: false, error: target.reason };
             try {
-                copyFileSync(record.backupPath, target.resolved);
+                // Atomic restore: never leave a truncated source file if we crash
+                // mid-restore (matches the writeTextAtomic guarantee used by apply).
+                writeTextAtomic(target.resolved, readFileSync(record.backupPath, 'utf-8'));
             }
             catch (err) {
                 return { ok: false, error: `failed to restore backup: ${String(err)}` };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iterate-plugin",
-  "version": "3.5.1",
+  "version": "3.5.2",
   "description": "dsh plugin that turns the iterate skill into an autonomous closed-loop harness with quality command center and experience bank (v3.3). Features: plan -> parallel review xN -> atomic fixes -> validate -> loop -> auto-stop, plus dry-run pure-review mode, quality gate compute/persist, writable experience bank, defense events stream (record + bilingual labels), and native command buttons — with a live quality command center (F8/F9/F10 render real session data), §8 assign-fix instruction, and task_mode indicator wired end to end.",
   "type": "module",
   "license": "MIT",
@@ -36,7 +36,8 @@
         "0.1.3-alpha.1": "compatible",
         "0.1.5-alpha.1": "compatible",
         "0.1.5-alpha.2": "compatible",
-        "0.1.5-rc.1": "compatible"
+        "0.1.5-rc.1": "compatible",
+        "0.1.5-rc.2": "compatible"
       }
     },
     "client": {
@@ -74,13 +75,13 @@
   },
   "dependencies": {
     "@deepseek-ai/cordis": "4.0.2",
-    "@deepseek-ai/dsh-tools": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-util-values": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-tools": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-util-values": "0.1.5-rc.2",
     "js-yaml": "4.3.1"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-jobs": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-session": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-jobs": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-session": "0.1.5-rc.2",
     "@types/js-yaml": "4.0.9",
     "@types/node": "22.15.0",
     "@types/react": "19.2.2",

package/src/tools/context.ts

@@ -1,5 +1,5 @@
-import { readFileSync, existsSync, statSync } from 'node:fs'
-import { join, dirname, resolve } from 'node:path'
+import { readFileSync, existsSync, realpathSync, statSync } from 'node:fs'
+import { join, dirname, resolve, sep } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import { resolveProjectRootForExec } from '../config-loader.ts'
@@ -7,6 +7,33 @@ import { resolveProjectRootForExec } from '../config-loader.ts'
 /** How many ancestor directories we walk up looking for a SKILL.md. */
 const MAX_SKILL_DIR_LOOKUP_DEPTH = 12
 
+/**
+ * Whether a model-supplied `skillDir` may be used as a SKILL.md search root.
+ *
+ * `skillDir` is model-controlled, so it is only honored when it is an existing
+ * directory whose REAL path (symlinks resolved) sits inside one of the allowed
+ * roots (the project root or the plugin directory). Anything else — a path
+ * outside the allowed roots, a nonexistent dir, or a symlink pointing outside
+ * (e.g. at `/etc`) — is rejected so arbitrary file contents can never be
+ * injected wholesale into the review context.
+ */
+export function isAllowedSkillDir(skillDir: string, allowedRoots: readonly string[]): boolean {
+  if (typeof skillDir !== 'string' || skillDir.trim().length === 0) return false
+  try {
+    const dir = resolve(skillDir)
+    if (!existsSync(dir) || !statSync(dir).isDirectory()) return false
+    return allowedRoots.some((root) => {
+      if (typeof root !== 'string' || root.length === 0) return false
+      const rootReal = realpathSync(root)
+      const rootPrefix = rootReal.endsWith(sep) ? rootReal : rootReal + sep
+      const real = realpathSync(dir)
+      return real === rootReal || real.startsWith(rootPrefix)
+    })
+  } catch {
+    return false
+  }
+}
+
 /** Maximum number of image attachments relayed into the context in one call. */
 const MAX_ATTACHMENTS = 8
 
@@ -304,8 +331,13 @@ export function registerContextTool(ctx: { tools: { register: (def: ReturnType<t
           // the auto-detected root / project root.
           if (typeof args.skillDir === 'string' && args.skillDir.trim()) {
             try {
-              const dir = resolve(args.skillDir)
-              if (existsSync(dir) && statSync(dir).isDirectory()) candidates.push(dir)
+              // Model-controlled path: only honor it when its REAL path stays
+              // inside the project root or the plugin directory — never let a
+              // skillDir point at arbitrary filesystem locations (e.g. /etc)
+              // whose contents would be injected wholesale into the context.
+              if (isAllowedSkillDir(args.skillDir, [projectRoot, PLUGIN_SRC_DIR])) {
+                candidates.push(resolve(args.skillDir))
+              }
             } catch {
               // unreadable/invalid skillDir — skip it
             }

package/src/tools/decision-log.ts

@@ -106,7 +106,16 @@ export function readDecisionLogDetailed(projectRoot: string): DecisionLogRead {
     const trimmed = line.trim()
     if (trimmed.length === 0) continue
     try {
-      entries.push(JSON.parse(trimmed) as DecisionLogEntry)
+      const parsed: unknown = JSON.parse(trimmed)
+      if (
+        parsed === null || typeof parsed !== 'object' ||
+        typeof (parsed as { timestamp?: unknown }).timestamp !== 'string' ||
+        typeof (parsed as { type?: unknown }).type !== 'string'
+      ) {
+        invalidLines += 1
+        continue
+      }
+      entries.push(parsed as DecisionLogEntry)
     } catch {
       invalidLines += 1
     }

package/src/tools/fix.ts

@@ -19,7 +19,7 @@
 
 import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync } from 'node:fs'
 import { writeJsonAtomic, writeTextAtomic } from '../atomic-fs.ts'
-import { join, sep } from 'node:path'
+import { dirname, join, sep } from 'node:path'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import type { JsonValue } from '@deepseek-ai/dsh-util-values'
 import { loadEffectiveConfig, resolveProjectRootForExec } from '../config-loader.ts'
@@ -207,15 +207,25 @@ export function resolveProjectFile(projectRoot: string, file: string): { ok: tru
     return { ok: false, reason: 'file resolves outside the project root' }
   }
   // Symlink containment: the lexical prefix check above does not resolve
-  // symlinks. If the target exists, verify its REAL path stays inside the REAL
-  // project root so a symlinked directory/file inside the repo can never route
-  // a fix (write/rollback/diff) outside the project.
-  if (existsSync(resolved)) {
+  // symlinks. Verify the REAL path of the target (when it exists) AND of its
+  // nearest existing ancestor directory (when it does not — e.g. a fix that
+  // creates a new file) stays inside the REAL project root, so a symlinked
+  // directory inside the repo can never route a fix (write/rollback/diff)
+  // outside the project. The probe stops at the project root itself: the root
+  // is harness-provided (not model-controlled), and a path with no existing
+  // entry inside the repo cannot hide a symlink.
+  let probe = resolved
+  while (!existsSync(probe) && probe !== projectRoot) {
+    const parent = dirname(probe)
+    if (parent === probe) break
+    probe = parent
+  }
+  if (existsSync(probe)) {
     let rootReal: string
     let real: string
     try {
       rootReal = realpathSync(projectRoot)
-      real = realpathSync(resolved)
+      real = realpathSync(probe)
     } catch {
       return { ok: false, reason: 'failed to resolve real path for containment check' }
     }
@@ -492,9 +502,9 @@ export function registerFixTool(ctx: { tools: { register: (def: ReturnType<typeo
           // Registry write failed → the file was already modified but no record
           // exists, so a later rollback/diff could never see it and a retry would
           // back up the already-fixed content as "original". Restore the file
-          // from the backup to leave the tree exactly as it was.
+          // from the backup atomically to leave the tree exactly as it was.
           try {
-            copyFileSync(backupPath, target.resolved)
+            writeTextAtomic(target.resolved, readFileSync(backupPath, 'utf-8'))
           } catch (restoreErr) {
             return {
               ok: false,
@@ -705,7 +715,9 @@ export function registerRollbackTool(ctx: { tools: { register: (def: ReturnType<
         const target = resolveProjectFile(projectRoot, record.finding.file)
         if (!target.ok) return { ok: false, error: target.reason }
         try {
-          copyFileSync(record.backupPath, target.resolved)
+          // Atomic restore: never leave a truncated source file if we crash
+          // mid-restore (matches the writeTextAtomic guarantee used by apply).
+          writeTextAtomic(target.resolved, readFileSync(record.backupPath, 'utf-8'))
         } catch (err) {
           return { ok: false, error: `failed to restore backup: ${String(err)}` }
         }