opencode-self-improvement 0.3.0 → 0.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-self-improvement",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Durable memory for opencode: remember facts, decisions, and commands across sessions, plus a one-command per-repo setup (/repo-init).",
   "main": "index.ts",
   "exports": {

package/src/undo.ts

@@ -9,7 +9,7 @@
 // must survive" — that call belongs to the caller, so the default mode CHECK
 // refuses and lists the divergent rows; MERGE replays them on top of the
 // snapshot; FORCE is the old exact rollback.
-import { join, basename } from "node:path";
+import { basename, join, resolve, sep } from "node:path";
 import { snapshotDir } from "./config.ts";
 import { ensureDir } from "./logfmt.ts";
 
@@ -78,7 +78,14 @@ export async function restoreSnapshot(
   if (!(await f.exists())) throw new Error(`snapshot not found: ${snapshot}`);
 
   const original = name.replace(/^\d+-/, "");
-  const target = join(memoryRootDir, original);
+  // Defense in depth (issue #21): `name` is basenamed above, so `original`
+  // carries no separators — but a restore must never write outside the memory
+  // root no matter what a future caller passes.
+  const rootAbs = resolve(memoryRootDir);
+  const target = resolve(rootAbs, original);
+  if (!target.startsWith(rootAbs + sep)) {
+    throw new Error(`snapshot target escapes the memory root: ${original}`);
+  }
   const snapLines = rows(await f.text());
   const cur = Bun.file(target);
   const curLines = (await cur.exists()) ? rows(await cur.text()) : [];

package/src/viewer/server.ts

@@ -4,7 +4,7 @@
 // through the same loadAll() used by recall/inject (so blocked entries are
 // hidden), and all mutations are non-destructive (snapshot + audit + supersede).
 // I2: serves only file data; never writes into any repo.
-import { join } from "node:path";
+import { basename, join } from "node:path";
 import { serve, type Server } from "bun";
 import { deletionsFile, memoryRoot, snapshotDir } from "../config.ts";
 import { blockedEntries } from "../blocklist.ts";
@@ -213,7 +213,14 @@ async function restoreEntryRoute(body: Record<string, unknown>): Promise<Respons
 }
 
 async function restoreRoute(body: Record<string, unknown>): Promise<Response> {
-  const name = String(body.name ?? "");
+  // Path containment (issue #21): name arrives raw from the wire. Basename it,
+  // then pin it to the real snapshot-name grammar — `<epoch-ms>-<YYYY-MM-DD>.logfmt`
+  // — so neither path join below can be steered outside snapshots/ and the
+  // store root with a `..` or absolute name.
+  const name = basename(String(body.name ?? ""));
+  if (!/^\d+-\d{4}-\d{2}-\d{2}\.logfmt$/.test(name)) {
+    return error("invalid snapshot name", 400);
+  }
   const original = name.replace(/^\d+-/, "");
   // Explicit human admin action: exact rollback — but the rollback is itself
   // rollback-able. Snapshot the current file first so concurrent-session rows