open-wiki-spec 0.2.3 → 0.3.0

package/dist/utils/path-safety.js

@@ -1,15 +1,66 @@
 import { resolve } from 'node:path';
+import * as fs from 'node:fs';
 /**
  * Assert that a file path resolves to a location inside the vault root.
- * Prevents symlink-based path traversal attacks.
+ * Uses fs.realpathSync.native() to follow symlinks and detect traversal.
+ * Also rejects paths that are themselves symlinks pointing outside the vault.
  *
  * @throws Error if the resolved path is outside vaultRoot
  */
 export function assertInsideVault(filePath, vaultRoot) {
-    const resolvedPath = resolve(filePath);
-    const resolvedRoot = resolve(vaultRoot);
+    // Resolve vault root — follow symlinks if it exists on disk
+    let resolvedRoot;
+    try {
+        resolvedRoot = fs.realpathSync.native(vaultRoot);
+    }
+    catch {
+        resolvedRoot = resolve(vaultRoot);
+    }
+    // Resolve file path — follow symlinks if it exists on disk
+    let resolvedPath;
+    if (fs.existsSync(filePath)) {
+        // Reject if the path itself is a symlink pointing outside vault
+        const stat = fs.lstatSync(filePath);
+        if (stat.isSymbolicLink()) {
+            const linkTarget = fs.realpathSync.native(filePath);
+            if (!linkTarget.startsWith(resolvedRoot + '/') && linkTarget !== resolvedRoot) {
+                throw new Error(`Path traversal blocked: symlink "${filePath}" points to "${linkTarget}" outside vault root "${resolvedRoot}"`);
+            }
+        }
+        resolvedPath = fs.realpathSync.native(filePath);
+    }
+    else {
+        // For non-existent files, resolve the parent directory through symlinks
+        // and combine with the filename
+        const parent = resolve(filePath, '..');
+        try {
+            const resolvedParent = fs.realpathSync.native(parent);
+            const basename = resolve(filePath).slice(resolve(parent).length);
+            resolvedPath = resolvedParent + basename;
+        }
+        catch {
+            // Parent doesn't exist either — use logical resolve as fallback
+            resolvedPath = resolve(filePath);
+        }
+    }
     if (!resolvedPath.startsWith(resolvedRoot + '/') && resolvedPath !== resolvedRoot) {
         throw new Error(`Path traversal blocked: "${resolvedPath}" is outside vault root "${resolvedRoot}"`);
     }
 }
+/**
+ * Safely write a file after asserting it is inside the vault root.
+ * Resolves symlinks before writing to prevent symlink-based path traversal.
+ */
+export function safeWriteFile(filePath, content, vaultRoot) {
+    assertInsideVault(filePath, vaultRoot);
+    fs.writeFileSync(filePath, content, 'utf-8');
+}
+/**
+ * Safely read a file after asserting it is inside the vault root.
+ * Resolves symlinks before reading to prevent symlink-based path traversal.
+ */
+export function safeReadFile(filePath, vaultRoot) {
+    assertInsideVault(filePath, vaultRoot);
+    return fs.readFileSync(filePath, 'utf-8');
+}
 //# sourceMappingURL=path-safety.js.map

package/dist/utils/path-safety.js.map

@@ -1 +1 @@
-{"version":3,"file":"path-safety.js","sourceRoot":"","sources":["../../src/utils/path-safety.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,SAAiB;IACnE,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAExC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CACb,4BAA4B,YAAY,4BAA4B,YAAY,GAAG,CACpF,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"path-safety.js","sourceRoot":"","sources":["../../src/utils/path-safety.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,SAAiB;IACnE,4DAA4D;IAC5D,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,2DAA2D;IAC3D,IAAI,YAAoB,CAAC;IACzB,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,gEAAgE;QAChE,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBAC9E,MAAM,IAAI,KAAK,CACb,oCAAoC,QAAQ,gBAAgB,UAAU,yBAAyB,YAAY,GAAG,CAC/G,CAAC;YACJ,CAAC;QACH,CAAC;QACD,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,wEAAwE;QACxE,gCAAgC;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;YACjE,YAAY,GAAG,cAAc,GAAG,QAAQ,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;YAChE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CACb,4BAA4B,YAAY,4BAA4B,YAAY,GAAG,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,OAAe,EAAE,SAAiB;IAChF,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvC,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,SAAiB;IAC9D,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvC,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-wiki-spec",
-  "version": "0.2.3",
+  "version": "0.3.0",
   "description": "Obsidian-first wiki workflow engine for specification management",
   "type": "module",
   "bin": {
@@ -13,7 +13,7 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run typecheck && npm run test && npm run build"
   },
   "dependencies": {
     "@huggingface/transformers": "^3.0.0",
@@ -35,6 +35,7 @@
     "dist/",
     "bin/",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "keywords": [