project-librarian 0.5.3 → 0.5.5

package/dist/workspace.js

@@ -51,31 +51,105 @@ exports.normalizePath = normalizePath;
 exports.commandOk = commandOk;
 exports.isGitRepository = isGitRepository;
 exports.makeExecutable = makeExecutable;
+exports.containedProjectFileStat = containedProjectFileStat;
+exports.containedProjectDirectoryStat = containedProjectDirectoryStat;
+exports.requireContainedProjectFile = requireContainedProjectFile;
 exports.walkFilesUnder = walkFilesUnder;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const childProcess = __importStar(require("node:child_process"));
 exports.root = process.cwd();
 exports.today = new Date().toISOString().slice(0, 10);
+const projectRoot = path.resolve(exports.root);
 function abs(relativePath) {
     return path.join(exports.root, relativePath);
 }
+function isInsideProject(absolutePath) {
+    const resolved = path.resolve(absolutePath);
+    return resolved === projectRoot || resolved.startsWith(`${projectRoot}${path.sep}`);
+}
+function resolveProjectPath(relativePath, label = "path") {
+    const resolved = path.isAbsolute(relativePath) ? path.resolve(relativePath) : path.resolve(exports.root, relativePath);
+    if (!isInsideProject(resolved)) {
+        throw new Error(`${label} must stay inside the project root: ${relativePath}`);
+    }
+    return resolved;
+}
+function assertNoSymlinkInProjectPath(relativePath, includeLeaf, label = "path") {
+    const target = resolveProjectPath(relativePath, label);
+    const relative = path.relative(projectRoot, target);
+    if (!relative)
+        return target;
+    const parts = relative.split(path.sep).filter(Boolean);
+    const checkedParts = includeLeaf ? parts : parts.slice(0, -1);
+    let current = projectRoot;
+    for (const part of checkedParts) {
+        current = path.join(current, part);
+        if (!fs.existsSync(current))
+            continue;
+        const stat = fs.lstatSync(current);
+        if (stat.isSymbolicLink()) {
+            throw new Error(`${label} refuses to follow symlink: ${normalizePath(path.relative(projectRoot, current))}`);
+        }
+        if (current !== target && !stat.isDirectory()) {
+            throw new Error(`${label} has a non-directory path component: ${normalizePath(path.relative(projectRoot, current))}`);
+        }
+    }
+    return target;
+}
+function mkdirpAbsolute(target, label = "path") {
+    if (!isInsideProject(target)) {
+        throw new Error(`${label} must stay inside the project root: ${target}`);
+    }
+    const relative = path.relative(projectRoot, target);
+    if (!relative)
+        return;
+    let current = projectRoot;
+    for (const part of relative.split(path.sep).filter(Boolean)) {
+        current = path.join(current, part);
+        if (fs.existsSync(current)) {
+            const stat = fs.lstatSync(current);
+            if (stat.isSymbolicLink()) {
+                throw new Error(`${label} refuses to follow symlink: ${normalizePath(path.relative(projectRoot, current))}`);
+            }
+            if (!stat.isDirectory()) {
+                throw new Error(`${label} has a non-directory path component: ${normalizePath(path.relative(projectRoot, current))}`);
+            }
+            continue;
+        }
+        fs.mkdirSync(current);
+    }
+}
+function writeFileNoFollow(filePath, content) {
+    const noFollow = typeof fs.constants.O_NOFOLLOW === "number" ? fs.constants.O_NOFOLLOW : 0;
+    const fd = fs.openSync(filePath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_TRUNC | noFollow, 0o666);
+    try {
+        fs.writeFileSync(fd, content);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
 function exists(relativePath) {
     return fs.existsSync(abs(relativePath));
 }
 function read(relativePath) {
-    return fs.readFileSync(abs(relativePath), "utf8");
+    const filePath = assertNoSymlinkInProjectPath(relativePath, true, "managed read");
+    return fs.readFileSync(filePath, "utf8");
 }
 function write(relativePath, content) {
-    const filePath = abs(relativePath);
-    fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    fs.writeFileSync(filePath, content);
+    const filePath = assertNoSymlinkInProjectPath(relativePath, true, "managed write");
+    mkdirpAbsolute(path.dirname(filePath), "managed write");
+    writeFileNoFollow(filePath, content);
 }
 function mkdirp(relativePath) {
-    fs.mkdirSync(abs(relativePath), { recursive: true });
+    const dirPath = assertNoSymlinkInProjectPath(relativePath, true, "managed directory");
+    mkdirpAbsolute(dirPath, "managed directory");
 }
 function writeManaged(relativePath, content) {
-    const previous = exists(relativePath) ? read(relativePath) : "";
+    const previous = exists(relativePath)
+        ? (assertNoSymlinkInProjectPath(relativePath, true, "managed read"), read(relativePath))
+        : "";
     if (previous === content)
         return "exists";
     write(relativePath, content);
@@ -86,6 +160,7 @@ function writeStarter(relativePath, content) {
         write(relativePath, content);
         return "created";
     }
+    assertNoSymlinkInProjectPath(relativePath, true, "managed read");
     const current = read(relativePath);
     if (current === content)
         return "exists";
@@ -111,6 +186,7 @@ function upsertMarkedSection(relativePath, startMarker, endMarker, section) {
         write(relativePath, `${section.trim()}\n`);
         return "created";
     }
+    assertNoSymlinkInProjectPath(relativePath, true, "managed read");
     const current = read(relativePath);
     const start = current.indexOf(startMarker);
     const end = current.indexOf(endMarker);
@@ -133,15 +209,17 @@ function upsertMarkedSection(relativePath, startMarker, endMarker, section) {
 function deleteIfGenerated(relativePath, sentinels) {
     if (!exists(relativePath))
         return "absent";
+    const filePath = assertNoSymlinkInProjectPath(relativePath, true, "managed delete");
     const current = read(relativePath);
     if (!sentinels.some((sentinel) => current.includes(sentinel)))
         return "manual-review";
-    fs.unlinkSync(abs(relativePath));
+    fs.unlinkSync(filePath);
     return "removed";
 }
 function parseJson(relativePath, fallback) {
     if (!exists(relativePath))
         return fallback;
+    assertNoSymlinkInProjectPath(relativePath, true, "managed read");
     try {
         return JSON.parse(read(relativePath));
     }
@@ -191,11 +269,60 @@ function isGitRepository() {
 function makeExecutable(relativePath) {
     if (!exists(relativePath))
         return;
-    const currentMode = fs.statSync(abs(relativePath)).mode;
-    fs.chmodSync(abs(relativePath), currentMode | 0o755);
+    const filePath = assertNoSymlinkInProjectPath(relativePath, true, "managed chmod");
+    const currentMode = fs.statSync(filePath).mode;
+    fs.chmodSync(filePath, currentMode | 0o755);
+}
+function containedProjectFileStat(relativePath) {
+    const filePath = resolveProjectPath(relativePath, "project file");
+    let stat;
+    try {
+        stat = fs.lstatSync(filePath);
+    }
+    catch {
+        return null;
+    }
+    if (stat.isSymbolicLink() || !stat.isFile())
+        return null;
+    let realPath = "";
+    try {
+        realPath = fs.realpathSync(filePath);
+    }
+    catch {
+        return null;
+    }
+    return isInsideProject(realPath) ? stat : null;
+}
+function containedProjectDirectoryStat(relativePath) {
+    const dirPath = resolveProjectPath(relativePath, "project directory");
+    let stat;
+    try {
+        stat = fs.lstatSync(dirPath);
+    }
+    catch {
+        return null;
+    }
+    if (stat.isSymbolicLink() || !stat.isDirectory())
+        return null;
+    let realPath = "";
+    try {
+        realPath = fs.realpathSync(dirPath);
+    }
+    catch {
+        return null;
+    }
+    return isInsideProject(realPath) ? stat : null;
+}
+function requireContainedProjectFile(relativePath, label = "project file") {
+    const filePath = resolveProjectPath(relativePath, label);
+    const stat = containedProjectFileStat(relativePath);
+    if (!stat) {
+        throw new Error(`${label} must be a regular file inside the project root and must not be a symlink: ${relativePath}`);
+    }
+    return { absolutePath: filePath, stat };
 }
 function walkFilesUnder(relativePath, predicate, acc = []) {
-    const dirPath = abs(relativePath);
+    const dirPath = assertNoSymlinkInProjectPath(relativePath, true, "managed walk");
     if (!fs.existsSync(dirPath))
         return acc;
     for (const entry of fs.readdirSync(dirPath, { withFileTypes: true })) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "project-librarian",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "description": "Create and maintain compact project context for humans and LLM coding agents.",
   "license": "MIT",
   "type": "commonjs",
@@ -49,6 +49,7 @@
     "benchmark:guidance": "npm run build && node benchmarks/tools/guidance-probe-runner.js",
     "benchmark:guidance:dry-run": "npm run build && node benchmarks/tools/guidance-probe-runner.js --dry-run --markdown",
     "benchmark:injection-sentinel": "node benchmarks/tools/injection-sentinel.js",
+    "benchmark:handoff-resume:preview": "node benchmarks/tools/session-handoff-resume-preview.js",
     "benchmark:agent-surface-smoke": "node benchmarks/tools/agent-surface-smoke.js",
     "benchmark:claim-ledger": "node benchmarks/tools/benchmark-claim-ledger.js benchmarks/llm/samples/codex-measured-report.json benchmarks/reports/llm/payload-preview.json",
     "benchmark:real-corpus:demo": "npm run build && node benchmarks/tools/real-corpus-offline-demo.js",
@@ -57,6 +58,7 @@
     "benchmark:release": "npm run benchmark:llm -- --sanitized-pack --full-matrix --runs 3 --warmup-runs 1 --min-runs-for-claim 3 --require-clean --require-claimable --model gpt-5.5 --out benchmarks/reports/llm/current.json --markdown benchmarks/reports/llm/current.md",
     "build": "tsc && chmod +x dist/init-project-wiki.js",
     "check:dist": "node benchmarks/tools/release-readiness.js --only-dist-parity",
+    "audit:supply-chain": "npm audit --omit=dev",
     "perf:code-efficiency": "node benchmarks/tools/code-performance-efficiency.js --full",
     "release:check": "node benchmarks/tools/release-readiness.js",
     "typecheck": "tsc --noEmit",
@@ -85,6 +87,6 @@
     "@sengac/tree-sitter-typescript": "^0.25.15"
   },
   "devDependencies": {
-    "@types/node": "^25.9.2"
+    "@types/node": "^22.20.0"
   }
 }