opencode-swarm 7.164.6 → 7.164.7

package/dist/cli/{index-ty3vtqe2.js → index-c4j9sjcs.js}

@@ -2,7 +2,7 @@
 import {
   _internals,
   resolveWorktreeIsolationConfig
-} from "./index-hdapetg1.js";
+} from "./index-46yrz972.js";
 import {
   ApprovalEvidenceSchema,
   BaseEvidenceSchema,
@@ -44,7 +44,7 @@ import {
   loadPluginConfigWithMeta,
   loadPluginConfigWithMetaAsync,
   resetConfigAdvisoryDedup
-} from "./index-ew99d4y6.js";
+} from "./index-xy59dnvq.js";
 import {
   AUTO_REVIEW_V8_BURN_IN_DECISION,
   AgentOverrideConfigSchema,
@@ -68,7 +68,7 @@ import {
   TurboConfigSchema,
   WorktreeIsolationConfigSchema,
   resolveAutoReviewConfig
-} from "./index-5p1tzpwh.js";
+} from "./index-8ck1jkhd.js";
 import"./index-9e6fdz2h.js";
 import"./index-4rhhvd1a.js";
 import {
@@ -80,7 +80,7 @@ import {
   QA_AGENTS,
   isQAAgent,
   isSubagent
-} from "./index-m1nrd3yd.js";
+} from "./index-8psybzzf.js";
 import"./index-zjygnfay.js";
 import"./index-bk5tah7q.js";
 import"./index-bpmtbmy9.js";

package/dist/cli/index-cw912re7.js

@@ -0,0 +1,200 @@
+// @bun
+import {
+  canonicalExistingFilesystemPath
+} from "./index-ry16d01s.js";
+
+// src/utils/path-security.ts
+import * as fs from "fs";
+import * as path from "path";
+function containsPathTraversal(str) {
+  if (/\.\.[/\\]/.test(str))
+    return true;
+  if (/(?:^|[/\\])\.\.(?:[/\\]|$)/.test(str))
+    return true;
+  if (/%2e%2e/i.test(str))
+    return true;
+  if (/%2e\./i.test(str))
+    return true;
+  if (/%2e/i.test(str) && /\.\./.test(str))
+    return true;
+  if (/%252e%252e/i.test(str))
+    return true;
+  if (/\uff0e/.test(str))
+    return true;
+  if (/\u3002/.test(str))
+    return true;
+  if (/\uff65/.test(str))
+    return true;
+  if (/%2f/i.test(str))
+    return true;
+  if (/%5c/i.test(str))
+    return true;
+  return false;
+}
+function containsControlChars(str) {
+  for (const ch of str) {
+    const code = ch.codePointAt(0);
+    if (code === undefined)
+      continue;
+    if (code <= 31 || code >= 127 && code <= 159)
+      return true;
+    if (code >= 8234 && code <= 8238)
+      return true;
+    if (code >= 8294 && code <= 8297)
+      return true;
+  }
+  return false;
+}
+function validateWorkspaceRoot(directory) {
+  validateProjectDirectory(directory);
+}
+function validateDirectory(directory) {
+  if (!directory || directory.trim() === "") {
+    throw new Error("Invalid directory: empty");
+  }
+  if (containsPathTraversal(directory)) {
+    throw new Error("Invalid directory: path traversal detected");
+  }
+  if (containsControlChars(directory)) {
+    throw new Error("Invalid directory: control characters detected");
+  }
+  if (directory.startsWith("/") || directory.startsWith("\\")) {
+    throw new Error("Invalid directory: absolute path");
+  }
+  if (/^[A-Za-z]:[/\\]/.test(directory)) {
+    throw new Error("Invalid directory: Windows absolute path");
+  }
+}
+function validateProjectDirectory(directory) {
+  if (!directory || directory.trim() === "") {
+    throw new Error("Invalid project directory: empty");
+  }
+  if (containsPathTraversal(directory)) {
+    throw new Error("Invalid project directory: path traversal detected");
+  }
+  if (containsControlChars(directory)) {
+    throw new Error("Invalid project directory: control characters detected");
+  }
+  if (!path.isAbsolute(directory) && !/^[A-Za-z]:[/\\]/.test(directory)) {
+    throw new Error("Invalid project directory: must be an absolute path");
+  }
+  assertNotSystemLocation(directory);
+}
+var DENIED_ROOT_SUBTREES = new Set([
+  "etc",
+  "usr",
+  "bin",
+  "sbin",
+  "lib",
+  "lib64",
+  "boot",
+  "dev",
+  "proc",
+  "sys",
+  "windows",
+  "winnt",
+  "program files",
+  "program files (x86)",
+  "programdata",
+  "system volume information"
+]);
+var DENIED_EXACT_ROOT_CHILDREN = new Set(["users", "home", "root"]);
+function assertNotSystemLocation(directory) {
+  for (const parser of [path.win32, path.posix]) {
+    if (!parser.isAbsolute(directory))
+      continue;
+    const normalized = parser.normalize(directory);
+    const { root } = parser.parse(normalized);
+    const segments = normalized.slice(root.length).split(/[/\\]/).filter((segment) => segment.length > 0);
+    if (segments.length === 0) {
+      throw new Error(`Invalid project directory: filesystem root is not a project root (${directory})`);
+    }
+    const first = (segments[0] ?? "").toLowerCase();
+    if (DENIED_ROOT_SUBTREES.has(first) || segments.length === 1 && DENIED_EXACT_ROOT_CHILDREN.has(first)) {
+      throw new Error(`Invalid project directory: system location is not a project root (${directory})`);
+    }
+  }
+}
+function resolveNearestExistingCanonical(inputPath, resolver) {
+  try {
+    return resolver(inputPath);
+  } catch {}
+  const lexicallyResolved = path.resolve(inputPath);
+  let probe = lexicallyResolved;
+  const tail = [];
+  for (let i = 0;i < 4096; i++) {
+    const parent = path.dirname(probe);
+    if (parent === probe) {
+      return lexicallyResolved;
+    }
+    tail.unshift(path.basename(probe));
+    probe = parent;
+    try {
+      const canonicalAncestor = resolver(probe);
+      return path.normalize(path.join(canonicalAncestor, ...tail));
+    } catch {}
+  }
+  return lexicallyResolved;
+}
+function validateSymlinkBoundary(targetPath, rootPath) {
+  const realTarget = resolveNearestExistingCanonical(targetPath, _internals.realpathSync);
+  const realRoot = resolveNearestExistingCanonical(rootPath, _internals.realpathSync);
+  const normalizedTarget = path.normalize(realTarget);
+  const normalizedRoot = path.normalize(realRoot);
+  if (!normalizedTarget.startsWith(normalizedRoot + path.sep) && normalizedTarget !== normalizedRoot) {
+    throw new Error(`Symlink resolution escaped boundary: ${realTarget} is not within ${realRoot}`);
+  }
+}
+function isCanonicalPathWithinRoot(targetPath, rootPath) {
+  const canonicalRoot = canonicalExistingFilesystemPath(rootPath);
+  if (canonicalRoot === null)
+    return false;
+  const rootPrefix = canonicalRoot.endsWith("/") ? canonicalRoot : `${canonicalRoot}/`;
+  let probe = path.resolve(targetPath);
+  for (let i = 0;i < 4096; i++) {
+    const canonicalProbe = canonicalExistingFilesystemPath(probe);
+    if (canonicalProbe !== null) {
+      return canonicalProbe === canonicalRoot || canonicalProbe.startsWith(rootPrefix);
+    }
+    const parent = path.dirname(probe);
+    if (parent === probe)
+      return false;
+    probe = parent;
+  }
+  return false;
+}
+function validateTargetWithinRoot(filePath, root) {
+  if (!filePath || filePath.trim() === "") {
+    return "Empty path";
+  }
+  if (path.isAbsolute(filePath) || /^[A-Za-z]:[/\\]/.test(filePath)) {
+    return `Absolute path rejected: ${filePath}`;
+  }
+  if (containsPathTraversal(filePath)) {
+    return `Path traversal detected: ${filePath}`;
+  }
+  if (containsControlChars(filePath)) {
+    return `Control characters detected in path: ${filePath}`;
+  }
+  const resolved = path.resolve(root, filePath);
+  const relative2 = path.relative(root, resolved);
+  if (relative2.startsWith("..") || path.isAbsolute(relative2)) {
+    return `Path escapes root: ${filePath}`;
+  }
+  if (!isCanonicalPathWithinRoot(resolved, root)) {
+    return `Path escapes root via symlink/junction: ${filePath}`;
+  }
+  return null;
+}
+var _internals = {
+  realpathSync: fs.realpathSync,
+  containsPathTraversal,
+  containsControlChars,
+  validateDirectory,
+  validateProjectDirectory,
+  validateSymlinkBoundary,
+  isCanonicalPathWithinRoot,
+  validateTargetWithinRoot
+};
+
+export { containsPathTraversal, containsControlChars, validateWorkspaceRoot, validateSymlinkBoundary, isCanonicalPathWithinRoot, validateTargetWithinRoot };