monomind 2.0.3 → 2.1.0

package/packages/@monomind/cli/dist/src/utils/input-guards.d.ts

@@ -18,6 +18,15 @@ export interface ValidateInputOpts {
     maxLength?: number;
     required?: boolean;
 }
+/** Resolve symlinks so the containment check below can't be bypassed by a
+ * link that lexically resolves inside cwd but physically points outside it
+ * (e.g. `./link -> /etc`). `realpathSync` requires the full path to exist,
+ * which a not-yet-created file (or a symlinked *directory* holding a
+ * not-yet-created file) would fail — so walk up to the longest existing
+ * ancestor, realpath *that* (resolving any symlink components in it), and
+ * re-append the non-existent tail. Falls back to the lexical path only when
+ * no ancestor at all can be resolved. */
+export declare function realOrResolved(p: string): string;
 /**
  * Validate and sanitize an input value.
  *

package/packages/@monomind/cli/dist/src/utils/input-guards.js

@@ -8,8 +8,9 @@
  *
  * @module @monomind/cli/utils/input-guards
  */
-import { resolve, isAbsolute } from 'node:path';
+import { resolve, isAbsolute, relative, dirname, basename } from 'node:path';
 import { cwd } from 'node:process';
+import { realpathSync } from 'node:fs';
 /**
  * Strip C0 and C1 control characters (U+0000–U+001F, U+007F–U+009F)
  * but preserve printable ASCII and extended Unicode.
@@ -52,6 +53,33 @@ function validateNumber(value, opts) {
     }
     return { valid: true, sanitized: String(parsed) };
 }
+/** Resolve symlinks so the containment check below can't be bypassed by a
+ * link that lexically resolves inside cwd but physically points outside it
+ * (e.g. `./link -> /etc`). `realpathSync` requires the full path to exist,
+ * which a not-yet-created file (or a symlinked *directory* holding a
+ * not-yet-created file) would fail — so walk up to the longest existing
+ * ancestor, realpath *that* (resolving any symlink components in it), and
+ * re-append the non-existent tail. Falls back to the lexical path only when
+ * no ancestor at all can be resolved. */
+export function realOrResolved(p) {
+    let cur = p;
+    const tail = [];
+    // eslint-disable-next-line no-constant-condition
+    for (let i = 0; i < 64; i++) {
+        try {
+            const real = realpathSync(cur);
+            return tail.length ? resolve(real, ...tail.reverse()) : real;
+        }
+        catch {
+            const parent = dirname(cur);
+            if (parent === cur)
+                return p; // reached filesystem root, nothing resolvable
+            tail.push(basename(cur));
+            cur = parent;
+        }
+    }
+    return p;
+}
 function validatePath(value, opts) {
     if (typeof value !== 'string') {
         return { valid: false, error: 'Path must be a string' };
@@ -63,11 +91,17 @@ function validatePath(value, opts) {
     if (/(^|[\\/])\.\.($|[\\/])/.test(value)) {
         return { valid: false, error: 'Path must not contain directory traversal (..)' };
     }
-    // Reject absolute paths that escape cwd
+    // Reject absolute paths that escape cwd. Uses path.relative (platform-correct
+    // separator handling — the previous `startsWith(cwd + '/')` hardcoded POSIX
+    // '/' and rejected every legitimate path on Windows) plus realpathSync on
+    // both sides so a symlink that's lexically inside cwd but physically points
+    // outside it is caught too. Mirrors the pattern in
+    // src/memory/memory-bridge.ts's getDbPath().
     if (isAbsolute(value)) {
-        const cwdPath = cwd();
-        const resolved = resolve(value);
-        if (!resolved.startsWith(cwdPath + '/') && resolved !== cwdPath) {
+        const cwdPath = realOrResolved(cwd());
+        const resolved = realOrResolved(resolve(value));
+        const rel = relative(cwdPath, resolved);
+        if (rel.startsWith('..') || isAbsolute(rel)) {
             return { valid: false, error: 'Absolute path must not escape the current working directory' };
         }
     }

package/packages/@monomind/cli/package.json

@@ -1,11 +1,14 @@
 {
   "name": "@monoes/monomindcli",
-  "version": "2.0.3",
+  "version": "2.1.0",
   "type": "module",
   "description": "Monomind CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",
   "sideEffects": false,
+  "engines": {
+    "node": ">=20.0.0"
+  },
   "bin": {
     "cli": "./bin/cli.js",
     "monomind": "./bin/cli.js",
@@ -80,7 +83,8 @@
     "README.md"
   ],
   "scripts": {
-    "build": "tsc --noEmitOnError false || true && mkdir -p dist/src/browser/dashboard && cp src/browser/dashboard/ui.html dist/src/browser/dashboard/ui.html && mkdir -p dist/src/orgrt && cp src/orgrt/live.html dist/src/orgrt/",
+    "build": "tsc && mkdir -p dist/src/browser/dashboard && cp src/browser/dashboard/ui.html dist/src/browser/dashboard/ui.html && mkdir -p dist/src/orgrt && cp src/orgrt/live.html dist/src/orgrt/",
+    "build:loose": "tsc --noEmitOnError false || true && mkdir -p dist/src/browser/dashboard && cp src/browser/dashboard/ui.html dist/src/browser/dashboard/ui.html && mkdir -p dist/src/orgrt && cp src/orgrt/live.html dist/src/orgrt/",
     "test": "vitest run",
     "test:pattern-store": "npx tsx src/transfer/store/tests/standalone-test.ts",
     "prepublishOnly": "cp ../../../README.md ./README.md",