minovative-mind-cli 2.11.4 → 2.12.0

package/dist/services/workspaceRegistry.js

@@ -1,12 +1,29 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { debugLog } from '../utils/logger.js';
+import * as os from 'os';
 /** Regex for valid alias names: lowercase alphanumeric, hyphens, underscores, 1–30 chars. */
 const ALIAS_PATTERN = /^[a-z0-9][a-z0-9_-]{0,29}$/;
-/** Global config directory for cross-project persistence. */
-const GLOBAL_CONFIG_DIR = path.join(process.env.HOME || process.env.USERPROFILE || '~', '.minovative-mind-cli');
-/** Path to the global workspace registry file. */
-const REGISTRY_FILE = path.join(GLOBAL_CONFIG_DIR, 'workspaces.json');
+/**
+ * Returns the global configuration directory for Minovative Mind CLI.
+ * During automated tests, returns an isolated temporary directory to prevent test runs
+ * from modifying the developer's live workspace configurations.
+ */
+export function getGlobalConfigDir() {
+    if (process.env.MINO_CONFIG_DIR) {
+        return process.env.MINO_CONFIG_DIR;
+    }
+    if (process.env.NODE_ENV === 'test' || typeof global.describe === 'function') {
+        return path.join(os.tmpdir(), '.minovative-mind-cli-test');
+    }
+    return path.join(process.env.HOME || process.env.USERPROFILE || '~', '.minovative-mind-cli');
+}
+/**
+ * Returns the active path to the workspace registry JSON file.
+ */
+export function getRegistryFile() {
+    return path.join(getGlobalConfigDir(), 'workspaces.json');
+}
 /**
  * Service that manages a global registry of external workspace roots.
  *
@@ -28,6 +45,7 @@ class WorkspaceRegistry {
     profiles = new Map();
     /** Whether the registry has been loaded from disk. */
     initialized = false;
+    primarySubPath = null;
     /**
      * Initializes the registry by loading persisted workspace entries from disk.
      * Safe to call multiple times — subsequent calls are no-ops.
@@ -38,6 +56,14 @@ class WorkspaceRegistry {
         this.initialized = true;
         this.loadFromDisk();
     }
+    /**
+     * Internal guard to guarantee the registry is loaded before any read or write operation.
+     */
+    ensureInitialized() {
+        if (!this.initialized) {
+            this.init();
+        }
+    }
     /**
      * Registers a new external workspace root with the given alias under a profile.
      *
@@ -50,6 +76,7 @@ class WorkspaceRegistry {
      * @throws Error if the alias is invalid, the path doesn't exist, or the alias is already taken.
      */
     register(profile, alias, absolutePath) {
+        this.ensureInitialized();
         const normalizedProfile = profile.toLowerCase().trim();
         const normalizedAlias = alias.toLowerCase().trim();
         // Ensure profile exists
@@ -110,6 +137,7 @@ class WorkspaceRegistry {
      * @returns `true` if the workspace was found and removed, `false` otherwise.
      */
     unregister(alias) {
+        this.ensureInitialized();
         const normalizedAlias = alias.toLowerCase().trim();
         const existed = this.workspaces.delete(normalizedAlias);
         if (existed) {
@@ -125,6 +153,7 @@ class WorkspaceRegistry {
      * @returns `true` if the profile was found and removed, `false` otherwise.
      */
     unregisterProfile(profileName) {
+        this.ensureInitialized();
         const normalizedProfile = profileName.toLowerCase().trim();
         const existed = this.profiles.delete(normalizedProfile);
         if (existed) {
@@ -144,30 +173,35 @@ class WorkspaceRegistry {
      * Returns all registered workspaces as an array, sorted by alias.
      */
     list() {
+        this.ensureInitialized();
         return Array.from(this.workspaces.values()).sort((a, b) => a.alias.localeCompare(b.alias));
     }
     /**
      * Returns all profiles (main workspaces).
      */
     listProfiles() {
+        this.ensureInitialized();
         return Array.from(this.profiles.values()).sort((a, b) => a.name.localeCompare(b.name));
     }
     /**
      * Checks whether any profiles (main workspaces) exist.
      */
     hasProfiles() {
+        this.ensureInitialized();
         return this.profiles.size > 0;
     }
     /**
      * Checks whether any workspaces exist.
      */
     hasWorkspaces() {
+        this.ensureInitialized();
         return this.workspaces.size > 0;
     }
     /**
      * Returns all registered workspaces for a given profile.
      */
     getWorkspacesByProfile(profile) {
+        this.ensureInitialized();
         return this.list().filter((ws) => ws.profile === profile.toLowerCase().trim());
     }
     /**
@@ -177,6 +211,7 @@ class WorkspaceRegistry {
      * @returns The registered workspace, or `undefined` if not found.
      */
     get(alias) {
+        this.ensureInitialized();
         return this.workspaces.get(alias.toLowerCase().trim());
     }
     /**
@@ -187,6 +222,7 @@ class WorkspaceRegistry {
      *   The primary workspace has `alias: null`.
      */
     getAllRoots(primaryRoot) {
+        this.ensureInitialized();
         const roots = [{ alias: null, root: primaryRoot }];
         for (const ws of this.workspaces.values()) {
             // Skip if a registered workspace happens to be the same as the primary
@@ -197,36 +233,182 @@ class WorkspaceRegistry {
         return roots;
     }
     /**
-     * Resolves an `@alias/relative/path` string into its constituent parts.
+     * Sets the active primary sub-path for auto-focusing relative file queries.
+     *
+     * @param subPath - The relative directory path within the primary workspace (e.g., "src/services"), or null to clear.
+     */
+    setPrimarySubPath(subPath) {
+        if (!subPath || subPath.trim() === '' || subPath.trim() === '.') {
+            this.primarySubPath = null;
+            return;
+        }
+        const trimmed = subPath.trim();
+        if (trimmed.includes('\0')) {
+            throw new Error(`Invalid primary sub-path containing null bytes: "${trimmed}"`);
+        }
+        if (path.isAbsolute(trimmed) || trimmed.startsWith('/') || trimmed.startsWith('\\')) {
+            throw new Error(`Primary sub-path traversal detected: "${subPath}" is an absolute path. Primary sub-paths must be relative.`);
+        }
+        const normalized = path.normalize(trimmed).replace(/[/\\]+$/, '');
+        if (normalized.startsWith('..') || path.isAbsolute(normalized)) {
+            throw new Error(`Primary sub-path traversal detected: "${subPath}" escapes primary workspace root.`);
+        }
+        this.primarySubPath = normalized;
+        debugLog(`[WorkspaceRegistry] Primary sub-path set to: "${this.primarySubPath}"`);
+    }
+    /**
+     * Returns the currently active primary sub-path, or null if none is set.
+     */
+    getPrimarySubPath() {
+        return this.primarySubPath;
+    }
+    /**
+     * Returns whether a primary sub-path is currently active.
+     */
+    hasPrimarySubPath() {
+        return this.primarySubPath !== null;
+    }
+    /**
+     * Clears the active primary sub-path.
+     */
+    clearPrimarySubPath() {
+        this.primarySubPath = null;
+        debugLog('[WorkspaceRegistry] Primary sub-path cleared.');
+    }
+    /**
+     * Gets the focused root directory for the given primary workspace root.
+     * If a primary sub-path is active, returns the resolved sub-path directory;
+     * otherwise returns the primary root.
+     *
+     * @param primaryRoot - The base primary workspace root directory.
+     */
+    getFocusedRoot(primaryRoot) {
+        if (!this.primarySubPath) {
+            return path.resolve(primaryRoot);
+        }
+        return path.resolve(primaryRoot, this.primarySubPath);
+    }
+    /**
+     * Checks whether a target path is securely contained within a given boundary root.
+     *
+     * @param targetPath - The absolute or relative target path.
+     * @param boundaryRoot - The boundary root directory.
+     */
+    isPathWithinBoundary(targetPath, boundaryRoot) {
+        const absBoundary = path.resolve(boundaryRoot);
+        const absTarget = path.resolve(absBoundary, targetPath);
+        const rel = path.relative(absBoundary, absTarget);
+        return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+    }
+    /**
+     * Finds a registered workspace that contains the given file or directory path.
+     *
+     * @param targetPath - The file or directory path to check.
+     * @returns The matching `RegisteredWorkspace` or null if not found.
+     */
+    findWorkspaceForPath(targetPath) {
+        this.ensureInitialized();
+        const absTarget = path.resolve(targetPath);
+        for (const ws of this.workspaces.values()) {
+            if (this.isPathWithinBoundary(absTarget, ws.absolutePath)) {
+                return ws;
+            }
+        }
+        return null;
+    }
+    /**
+     * Checks whether a path resides inside the primary workspace or any registered workspace.
+     *
+     * @param targetPath - The file or directory path to inspect.
+     * @param primaryRoot - Optional primary workspace root.
+     */
+    isInsideRegisteredWorkspace(targetPath, primaryRoot) {
+        this.ensureInitialized();
+        const absTarget = path.resolve(targetPath);
+        if (primaryRoot && this.isPathWithinBoundary(absTarget, primaryRoot)) {
+            return true;
+        }
+        return this.findWorkspaceForPath(absTarget) !== null;
+    }
+    /**
+     * Resolves an `@alias/relative/path` string or primary workspace path into constituent parts.
      *
      * @param filePath - A file path that may or may not start with `@alias/`.
-     * @returns A `ResolvedWorkspacePath` if the path has a valid `@alias/` prefix
-     *   and the alias is registered, or `null` if the path is a standard
-     *   workspace-relative path (no `@` prefix or unrecognized alias).
+     * @param options - Optional resolution options including primaryRoot and autoFocusSubPath.
+     * @returns A `ResolvedWorkspacePath` if resolved, or `null` if the path cannot be resolved.
      * @throws Error if the path has an `@` prefix but the alias is not registered.
      */
-    resolve(filePath) {
-        if (!filePath.startsWith('@')) {
-            return null;
+    resolve(filePath, options) {
+        this.ensureInitialized();
+        if (filePath.startsWith('@')) {
+            // Extract alias and relative path from "@alias/relative/path"
+            const withoutAt = filePath.substring(1);
+            const slashIndex = withoutAt.indexOf('/');
+            const alias = slashIndex === -1 ? withoutAt : withoutAt.substring(0, slashIndex);
+            const relativePath = slashIndex === -1 ? '.' : withoutAt.substring(slashIndex + 1);
+            const workspace = this.workspaces.get(alias.toLowerCase());
+            if (!workspace) {
+                throw new Error(`Unknown workspace alias "@${alias}". ` +
+                    `Registered workspaces: ${this.list().map((w) => `@${w.alias}`).join(', ') || '(none)'}. ` +
+                    `Use /workspaces to add one.`);
+            }
+            const absolutePath = path.resolve(workspace.absolutePath, relativePath);
+            return {
+                alias: workspace.alias,
+                workspaceRoot: workspace.absolutePath,
+                relativePath,
+                absolutePath,
+            };
         }
-        // Extract alias and relative path from "@alias/relative/path"
-        const withoutAt = filePath.substring(1);
-        const slashIndex = withoutAt.indexOf('/');
-        const alias = slashIndex === -1 ? withoutAt : withoutAt.substring(0, slashIndex);
-        const relativePath = slashIndex === -1 ? '.' : withoutAt.substring(slashIndex + 1);
-        const workspace = this.workspaces.get(alias.toLowerCase());
-        if (!workspace) {
-            throw new Error(`Unknown workspace alias "@${alias}". ` +
-                `Registered workspaces: ${this.list().map((w) => `@${w.alias}`).join(', ') || '(none)'}. ` +
-                `Use /workspaces to add one.`);
+        // Non-aliased path resolution
+        if (options?.primaryRoot) {
+            const primaryRoot = path.resolve(options.primaryRoot);
+            const shouldAutoFocus = options.autoFocusSubPath ?? true;
+            if (shouldAutoFocus && this.primarySubPath) {
+                const focusedRoot = this.getFocusedRoot(primaryRoot);
+                const focusedCandidate = path.resolve(focusedRoot, filePath);
+                // If candidate exists under focused subpath, auto-focus it
+                if (this.isPathWithinBoundary(focusedCandidate, primaryRoot) && fs.existsSync(focusedCandidate)) {
+                    return {
+                        alias: null,
+                        workspaceRoot: primaryRoot,
+                        relativePath: path.relative(primaryRoot, focusedCandidate),
+                        absolutePath: focusedCandidate,
+                        isAutoFocused: true,
+                    };
+                }
+            }
+            // Default primary resolution
+            const defaultResolved = path.resolve(primaryRoot, filePath);
+            return {
+                alias: null,
+                workspaceRoot: primaryRoot,
+                relativePath: path.relative(primaryRoot, defaultResolved),
+                absolutePath: defaultResolved,
+                isAutoFocused: false,
+            };
         }
-        const absolutePath = path.resolve(workspace.absolutePath, relativePath);
-        return {
-            alias: workspace.alias,
-            workspaceRoot: workspace.absolutePath,
-            relativePath,
-            absolutePath,
-        };
+        return null;
+    }
+    /**
+     * Resolves a relative path against the primary root with automatic sub-path focusing.
+     *
+     * @param primaryRoot - The base primary workspace root directory.
+     * @param relativePath - The target relative path to resolve.
+     */
+    resolveWithAutoFocus(primaryRoot, relativePath) {
+        const res = this.resolve(relativePath, { primaryRoot, autoFocusSubPath: true });
+        if (!res) {
+            const abs = path.resolve(primaryRoot, relativePath);
+            return {
+                alias: null,
+                workspaceRoot: primaryRoot,
+                relativePath: path.relative(primaryRoot, abs),
+                absolutePath: abs,
+                isAutoFocused: false,
+            };
+        }
+        return res;
     }
     /**
      * Checks if a given file path uses the `@alias/` prefix syntax.
@@ -256,11 +438,12 @@ class WorkspaceRegistry {
      */
     loadFromDisk() {
         try {
-            if (!fs.existsSync(REGISTRY_FILE)) {
+            const registryFile = getRegistryFile();
+            if (!fs.existsSync(registryFile)) {
                 debugLog('Workspace registry file not found, starting fresh.');
                 return;
             }
-            const raw = fs.readFileSync(REGISTRY_FILE, 'utf-8');
+            const raw = fs.readFileSync(registryFile, 'utf-8');
             const data = JSON.parse(raw);
             if (!data || !Array.isArray(data.workspaces)) {
                 // Fallback for old schema
@@ -313,19 +496,24 @@ class WorkspaceRegistry {
      * Creates the config directory if it doesn't exist.
      */
     saveToDisk() {
+        if (!this.initialized) {
+            return;
+        }
         try {
+            const configDir = getGlobalConfigDir();
+            const registryFile = getRegistryFile();
             // Ensure the global config directory exists
-            if (!fs.existsSync(GLOBAL_CONFIG_DIR)) {
-                fs.mkdirSync(GLOBAL_CONFIG_DIR, { recursive: true });
+            if (!fs.existsSync(configDir)) {
+                fs.mkdirSync(configDir, { recursive: true });
             }
             const data = {
                 workspaces: Array.from(this.workspaces.values()),
                 profiles: Array.from(this.profiles.values()),
             };
-            const tempPath = `${REGISTRY_FILE}.${Date.now()}.tmp`;
+            const tempPath = `${registryFile}.${Date.now()}.tmp`;
             fs.writeFileSync(tempPath, JSON.stringify(data, null, 2), 'utf-8');
             // Atomic rename to prevent corruption
-            fs.renameSync(tempPath, REGISTRY_FILE);
+            fs.renameSync(tempPath, registryFile);
             debugLog(`Saved ${data.workspaces.length} workspace(s) and ${data.profiles.length} profile(s) to global registry.`);
         }
         catch (err) {

package/dist/utils/analysisRunner.js

@@ -250,7 +250,8 @@ export async function resolveScriptExtension(workspaceRoot, language, code) {
  */
 function buildTempPath(code, ext) {
     const hash = createHash('sha256').update(code).digest('hex').substring(0, 12);
-    return path.join(os.tmpdir(), `.mino-analysis-${hash}${ext}`);
+    const nonce = `${Date.now()}-${Math.random().toString(36).substring(2, 7)}`;
+    return path.join(os.tmpdir(), `.mino-analysis-${hash}-${nonce}${ext}`);
 }
 /**
  * Constructs the shell command for executing the given language runtime.

package/dist/utils/pathSecurity.d.ts

@@ -11,31 +11,73 @@ export interface ResolvedPath {
     relativePath: string;
     /** The workspace alias if an external workspace was matched, or `null` for the primary workspace. */
     alias: string | null;
+    /** Whether the path was resolved via primary sub-path auto-focusing. */
+    isAutoFocused?: boolean;
 }
+/**
+ * Options controlling path resolution and sub-path auto-focusing.
+ */
+export interface PathResolutionOptions {
+    /**
+     * Whether to attempt sub-path auto-focusing if a primary sub-path is configured
+     * in WorkspaceRegistry. Defaults to true.
+     */
+    autoFocusSubPath?: boolean;
+    /**
+     * Optional explicit sub-path to focus on for this resolution.
+     */
+    subPath?: string;
+}
+/**
+ * Checks whether a candidate path safely resides within a boundary root without throwing.
+ *
+ * @param boundaryRoot - The boundary root directory path.
+ * @param candidatePath - The absolute or relative path to test.
+ * @returns true if candidatePath is within boundaryRoot, false otherwise.
+ */
+export declare function isWithinWorkspaceBoundary(boundaryRoot: string, candidatePath: string): boolean;
+/**
+ * Validates that a candidate path resides strictly within the given boundary root.
+ *
+ * @param boundaryRoot - The boundary root directory path.
+ * @param candidatePath - The candidate path to validate.
+ * @param contextLabel - Optional label for descriptive error messages.
+ * @throws Error if the path escapes the boundary.
+ */
+export declare function validateWorkspaceBoundary(boundaryRoot: string, candidatePath: string, contextLabel?: string): void;
 /**
  * Resolves a file path against the workspace root and ensures it does not
  * break out of the workspace directory (path traversal defense).
  *
  * @param workspaceRoot The normalized absolute path to the workspace root
  * @param filePath The user or AI provided file path (relative or absolute)
+ * @param options Optional resolution options
  * @returns The validated absolute path
- * @throws Error if the resolved path is outside the workspace
+ * @throws Error if the resolved path is outside the workspace or invalid
  */
-export declare function resolveAndValidatePath(workspaceRoot: string, filePath: string): string;
+export declare function resolveAndValidatePath(workspaceRoot: string, filePath: string, options?: PathResolutionOptions): string;
 /**
- * Resolves a file path that may use the `@alias/path` multi-workspace prefix syntax.
+ * Resolves a file path that may start with `@alias/` to reference an external workspace,
+ * or resolves against the primary workspace with automatic sub-path focusing.
  *
- * If the path starts with `@`, it is resolved against the matching registered workspace.
- * Otherwise, it falls through to standard single-workspace resolution against `primaryRoot`.
+ * - If `filePath` starts with `@alias/relative/path`, it looks up the alias in the
+ *   `WorkspaceRegistry`, resolves the path within that workspace's root, and validates
+ *   that it does not escape that workspace boundary.
+ * - Otherwise, it validates and resolves against `primaryRoot`, applying active
+ *   primary sub-path auto-focusing if configured.
  *
- * Security guarantees are identical to `resolveAndValidatePath`:
- * - Path traversal via `..` is blocked (resolved path must remain within the matched root)
- * - Absolute paths (outside `@alias/` syntax) are rejected
- * - Only explicitly registered workspace roots are accessible
+ * @param primaryRoot The normalized absolute path to the primary (default) workspace root
+ * @param filePath A path that may be `@alias/sub/path` or a standard workspace-relative path
+ * @param options Optional path resolution options
+ * @returns A `ResolvedPath` with the absolute path, workspace root, relative path, and alias
+ * @throws Error if the alias is unknown or if a traversal attack is detected
+ */
+export declare function resolveAndValidateMultiWorkspacePath(primaryRoot: string, filePath: string, options?: PathResolutionOptions): ResolvedPath;
+/**
+ * Resolves a path explicitly focused on a specific primary sub-path.
  *
- * @param primaryRoot - The primary workspace root (from `process.cwd()`).
- * @param filePath - A file path that may or may not use `@alias/` prefix syntax.
- * @returns A `ResolvedPath` with the absolute path and workspace metadata.
- * @throws Error on path traversal, unknown alias, or invalid path.
+ * @param primaryRoot - The base primary workspace root directory.
+ * @param subPath - The relative sub-path to focus on.
+ * @param filePath - The target file path.
  */
-export declare function resolveAndValidateMultiWorkspacePath(primaryRoot: string, filePath: string): ResolvedPath;
+export declare function resolveFocusedPath(primaryRoot: string, subPath: string, filePath: string): ResolvedPath;