liteagents 2.8.2 → 2.8.3

package/CHANGELOG.md

@@ -17,6 +17,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [2.8.3] - 2026-05-24
+
+### Security
+- **Path containment uses a boundary match.** `installer/path-manager.js` confined installs to the home directory via `startsWith(homeDir)`, which would also accept a sibling like `${homeDir}-evil`. Now matches on a path separator (`=== homeDir || startsWith(homeDir + path.sep)`), and likewise for the temp dir. Defense-in-depth for a local installer; verified install/backup/uninstall still work.
+
+### Changed
+- **`docs/INSTALLER_GUIDE.md` custom-path docs now match the installer.** It advertised `/opt/...`, `/mnt/...`, and team/external locations, but the installer confines paths to the home directory (or temp dir). Documented the real rule and corrected the examples.
+- Removed decorative emoji from `README.md` headings (kept the friction traffic-light indicators).
+- CI: bumped `actions/checkout` and `actions/setup-node` to v6 (Node 24) ahead of the June 2026 Node 20 deprecation.
+
+---
+
 ## [2.8.2] - 2026-05-24
 
 Maintenance release: removes the last of the legacy 3-variant system, fixes the broken `liteag` alias and post-install message, and trims the shipped documentation down to the README plus an accurate installer guide. No changes to the installed agents/commands/skills.

package/README.md

@@ -28,7 +28,7 @@ Specialized AI agents and workflow commands for product management, agile develo
 
 ---
 
-## 🚀 Quick Start
+## Quick Start
 
 ```bash
 # Option 1: NPX (recommended)
@@ -71,7 +71,7 @@ liteagents
 
 ---
 
-## 🧠 Hot Memory — project-local learning from your own sessions
+## Hot Memory — project-local learning from your own sessions
 
 Liteagents ships a three-command pipeline that turns Claude Code's session logs into project-local memory. No databases, no external services, just markdown files the assistant reads via `@MEMORY.md`.
 
@@ -95,7 +95,7 @@ Per-Project:
 WORST: my-app/0203-1630-11eb903a  peak=225  turns=127
 BEST:  web-client/0202-2121-8d8608e1  peak=0  turns=4
 
-Verdict: ✓ USEFUL    Intervention predictability: 93%
+Verdict: USEFUL    Intervention predictability: 93%
 ```
 
 Results land in `.claude/friction/antigen_review.md` with projects, error patterns, and offending tool sequences called out per cluster — so `/remember` can pick them up and encode them as rules the next session sees.
@@ -104,7 +104,7 @@ Results land in `.claude/friction/antigen_review.md` with projects, error patter
 
 ---
 
-## 🤖 What's Included
+## What's Included
 
 ### 11 Agents
 
@@ -132,7 +132,7 @@ Results land in `.claude/friction/antigen_review.md` with projects, error patter
 
 **Manual Skills/Commands (20):**
 
-*Hot Memory Pipeline (3)* — see the [🧠 Hot Memory](#-hot-memory--project-local-learning-from-your-own-sessions) section above for the full walkthrough:
+*Hot Memory Pipeline (3)* — see the [Hot Memory](#hot-memory--project-local-learning-from-your-own-sessions) section above for the full walkthrough:
 - **stash** - Snapshot session context to `.claude/stash/` before compaction, handoff, or ending complex work
 - **friction** - Analyze all JSONL sessions for frustration signals, cluster failures per project, surface antigens
 - **remember** - Consolidate stashes + friction antigens into `.claude/memory/MEMORY.md`; auto-injected via `@MEMORY.md`
@@ -162,7 +162,7 @@ Results land in `.claude/friction/antigen_review.md` with projects, error patter
 
 ---
 
-## 📖 Documentation
+## Documentation
 
 | Document | Description |
 |----------|-------------|
@@ -171,7 +171,7 @@ Results land in `.claude/friction/antigen_review.md` with projects, error patter
 
 ---
 
-## 💡 Example Workflows
+## Example Workflows
 
 **Feature Development:**
 ```
@@ -198,7 +198,7 @@ Results land in `.claude/friction/antigen_review.md` with projects, error patter
 
 ---
 
-## 📊 Stats
+## Stats
 
 - **11** Specialized Agents
 - **22** Workflow Commands & Skills
@@ -207,7 +207,7 @@ Results land in `.claude/friction/antigen_review.md` with projects, error patter
 
 ---
 
-## 🔗 Links
+## Links
 
 - **npm:** https://www.npmjs.com/package/liteagents
 - **GitHub:** https://github.com/hamr0/liteagents
@@ -215,7 +215,7 @@ Results land in `.claude/friction/antigen_review.md` with projects, error patter
 
 ---
 
-## 📄 License
+## License
 
 Apache-2.0 © 2026 hamr0 — see [LICENSE](LICENSE).
 

package/installer/path-manager.js

@@ -58,8 +58,9 @@ class PathManager {
       const homeDir = this.homeDir;
       const tmpDir = os.tmpdir();
 
-      const isInHome = sanitized.startsWith(homeDir);
-      const isInTmp = sanitized.startsWith(tmpDir);
+      // Match on a path boundary so a sibling like `${homeDir}-evil` can't pass.
+      const isInHome = sanitized === homeDir || sanitized.startsWith(homeDir + path.sep);
+      const isInTmp = sanitized === tmpDir || sanitized.startsWith(tmpDir + path.sep);
 
       if (!isInHome && !isInTmp) {
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "liteagents",
-  "version": "2.8.2",
+  "version": "2.8.3",
   "description": "AI development toolkit with 11 specialized agents and 23 commands including live-canvas UI design with click-to-annotate feedback. Simple one-question installer for Claude, Opencode, Ampcode, and Droid.",
   "main": "index.js",
   "bin": {