oh-my-adhd 0.2.26 → 0.2.28

package/dist/mcp/lib/brain.js

@@ -14,6 +14,12 @@ export const SCHEMA_VERSION = 1;
 export const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 export const SENSITIVE_DIRS = [".ssh", ".aws", ".gnupg", ".kube", ".docker",
     path.join(".config", "git"), path.join(".config", "gh")];
+// Absolute system paths that are sensitive regardless of home dir location
+const SYSTEM_SENSITIVE_DIRS = [
+    "/root/.ssh", "/root/.aws", "/root/.gnupg", "/root/.kube", "/root/.docker",
+    "/etc/ssh", "/etc/ssl", "/etc/shadow", "/etc/sudoers",
+    "/private/etc/ssh", "/private/etc/ssl", // macOS canonical paths
+];
 export async function isSensitivePath(filePath) {
     const homeDir = os.homedir();
     let realDir = path.dirname(filePath);
@@ -23,7 +29,14 @@ export async function isSensitivePath(filePath) {
     catch { /* dir may not exist yet */ }
     const realHome = await fs.realpath(homeDir).catch(() => homeDir);
     const rel = path.relative(realHome, realDir).toLowerCase();
-    return SENSITIVE_DIRS.some(d => rel === d.toLowerCase() || rel.startsWith(d.toLowerCase() + path.sep));
+    // Home-relative denylist
+    if (SENSITIVE_DIRS.some(d => rel === d.toLowerCase() || rel.startsWith(d.toLowerCase() + path.sep)))
+        return true;
+    // Absolute denylist for paths outside home — case-folded for macOS APFS compatibility
+    const realDirLower = realDir.toLowerCase();
+    if (SYSTEM_SENSITIVE_DIRS.some(d => realDirLower === d || realDirLower.startsWith(d + "/")))
+        return true;
+    return false;
 }
 async function appendLog(level, msg) {
     try {

package/dist/mcp/mcp/tools/wiki-import.js

@@ -25,25 +25,23 @@ export function registerWikiImport(server) {
                     isError: true,
                 };
             }
-            // Check file size before reading into memory
-            try {
-                const stat = await fs.stat(resolved);
-                if (stat.size > 100 * 1024 * 1024) {
-                    return {
-                        content: [{ type: "text", text: "오류: 파일이 너무 큽니다 (100MB 초과)." }],
-                        isError: true,
-                    };
-                }
-            }
-            catch {
-                return {
-                    content: [{ type: "text", text: `오류: 파일을 읽을 수 없습니다: ${resolved}` }],
-                    isError: true,
-                };
-            }
+            // Open once so stat + read refer to the same inode (closes TOCTOU window)
             let raw;
             try {
-                raw = await fs.readFile(resolved, "utf-8");
+                const handle = await fs.open(resolved, "r");
+                try {
+                    const stat = await handle.stat();
+                    if (stat.size > 100 * 1024 * 1024) {
+                        return {
+                            content: [{ type: "text", text: "오류: 파일이 너무 큽니다 (100MB 초과)." }],
+                            isError: true,
+                        };
+                    }
+                    raw = await handle.readFile({ encoding: "utf-8" });
+                }
+                finally {
+                    await handle.close();
+                }
             }
             catch {
                 return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oh-my-adhd",
-  "version": "0.2.26",
+  "version": "0.2.28",
   "description": "ADHD second brain — zero-friction capture, auto context restore, unstick. MCP-native Claude Code plugin.",
   "author": "Haechan Jeong",
   "repository": {