poe-code 3.0.350 → 3.0.352

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "poe-code",
-  "version": "3.0.350",
+  "version": "3.0.352",
   "description": "CLI tool to configure Poe API for developer workflows.",
   "type": "module",
   "main": "./dist/index.js",

package/packages/pipeline/dist/plan/parser.js

@@ -251,6 +251,9 @@ function parseTaskStatus(value, availableSteps, taskId) {
         throw new Error(`Invalid status for task "${taskId}": expected at least one step status.`);
     }
     for (const [stepName, stepStatus] of stepStatuses) {
+        if (stepName.length === 0) {
+            throw new Error(`Invalid status for task "${taskId}": step names must be non-empty.`);
+        }
         if (availableSteps && !Object.hasOwn(availableSteps, stepName)) {
             throw new Error(`Unknown step "${stepName}" referenced by task "${taskId}".`);
         }
@@ -442,11 +445,17 @@ export function parsePlan(planContent, options = {}) {
         "mcp"
     ]);
     const kind = getOwnEntry(document, "kind");
-    if (kind !== undefined && kind !== "pipeline") {
+    if (kind === undefined) {
+        throw new Error('Invalid plan YAML: missing required "kind".');
+    }
+    if (kind !== "pipeline") {
         throw new Error('Invalid plan YAML: "kind" must be "pipeline".');
     }
     const version = getOwnEntry(document, "version");
-    if (version !== undefined && version !== 1) {
+    if (version === undefined) {
+        throw new Error('Invalid plan YAML: missing required "version".');
+    }
+    if (version !== 1) {
         throw new Error('Invalid plan YAML: "version" must be 1.');
     }
     let extendsName = "default";
@@ -465,6 +474,9 @@ export function parsePlan(planContent, options = {}) {
         }
         stepOverrides = {};
         for (const [stepName, value] of Object.entries(stepsValue)) {
+            if (stepName.length === 0) {
+                throw new Error('Invalid plan YAML: step names must be non-empty.');
+            }
             defineRecordEntry(stepOverrides, stepName, parseStepOverride(value, `steps.${stepName}`));
         }
     }
@@ -477,6 +489,7 @@ export function parsePlan(planContent, options = {}) {
         if (!isRecord(value)) {
             throw new Error(`Invalid tasks[${index}]: expected an object.`);
         }
+        rejectUnknownProperties(value, ["id", "title", "prompt", "status"], `tasks[${index}].`);
         const id = asRequiredString(getOwnEntry(value, "id"), `tasks[${index}].id`);
         if (ids.has(id)) {
             throw new Error(`Duplicate task id "${id}".`);

package/packages/pipeline/dist/run/runner.js

@@ -5,7 +5,7 @@ function selectFromTask(task) {
         return task.status === "done" ? { kind: "completed" } : { kind: "run", task };
     }
     const stepName = Object.entries(task.status).find(([, value]) => value !== "done")?.[0];
-    return stepName ? { kind: "run", task, stepName } : { kind: "completed" };
+    return stepName !== undefined ? { kind: "run", task, stepName } : { kind: "completed" };
 }
 export function selectNextExecution(plan, taskId) {
     const tasks = taskId ? plan.tasks.filter((task) => task.id === taskId) : plan.tasks;

package/packages/pipeline/dist/vars/resolve.js

@@ -22,7 +22,13 @@ function looksLikeDocPath(value) {
 }
 async function resolveDocVarFromPath(options) {
     const trimmed = options.value.trim();
-    const absolutePath = path.isAbsolute(trimmed) ? trimmed : path.join(options.cwd, trimmed);
+    const absolutePath = path.resolve(options.cwd, trimmed);
+    const relativePath = path.relative(options.cwd, absolutePath);
+    if (relativePath === ".." ||
+        relativePath.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relativePath)) {
+        throw new Error(`Pipeline doc var "${options.key}" resolves outside the project root: ${trimmed}`);
+    }
     try {
         return await options.readFile(absolutePath, "utf8");
     }