replen 1.5.3 → 1.5.5

package/dist/commands.js

@@ -568,7 +568,7 @@ async function fetchInventoryStatus(cfg, repo) {
 // (one source of truth) and writes them locally; you own and can open them.
 export async function runAtlas(argv) {
     const { mkdirSync, writeFileSync, rmSync } = await import("node:fs");
-    const { join, dirname } = await import("node:path");
+    const { join, dirname, resolve, sep } = await import("node:path");
     const { homedir } = await import("node:os");
     const cfg = await loadConfigOrExit();
     const dir = getFlag(argv, "--out") ?? join(homedir(), ".replen", "atlas");
@@ -584,8 +584,13 @@ export async function runAtlas(argv) {
         }
         catch { /* */ }
     }
+    // f.path is server-controlled: refuse any path that escapes the atlas dir
+    // (e.g. "../../.zshrc"). Mirrors the guard in mcp/src/atlas-sync.ts.
+    const root = resolve(dir);
     for (const f of data.files) {
-        const full = join(dir, f.path);
+        const full = resolve(dir, f.path);
+        if (full !== root && !full.startsWith(root + sep))
+            continue; // path traversal guard
         mkdirSync(dirname(full), { recursive: true });
         writeFileSync(full, f.content);
     }

package/dist/discover-projects.js

@@ -4,7 +4,7 @@
 // finds every git repo, and for each one extracts:
 //   - The repo's `owner/name` from `git remote get-url origin`
 //   - A slug derived from the GITHUB repo name (so a local folder named
-//     "drone" whose remote is acme/aegis registers with slug "aegis",
+//     "drone" whose remote is acme/acme registers with slug "acme",
 //     matching what shows on GitHub). Falls back to dirname for repos
 //     without a GitHub remote.
 //   - A name (from package.json's `name` field if present, else slug)

package/dist/immerse.js

@@ -15,7 +15,7 @@
 // Self-host installs don't need this — they default on via REPLEN_SELF_HOST and
 // the pipeline reads local disk directly.
 import { readFileSync, statSync } from "node:fs";
-import { join } from "node:path";
+import { resolve, sep } from "node:path";
 import { loadConfigOrExit, apiGet, apiPost } from "./api.js";
 import { resolveAndWalk } from "./sync-projects.js";
 const MAX_FILE_BYTES = 1_000_000; // mirror the server per-file cap
@@ -75,10 +75,20 @@ async function send(cfg) {
             continue;
         withPaths++;
         // Read exactly the grounded files the server asked for (size-capped).
+        // The server sanitizes its manifest paths, but the client must not trust a
+        // server-supplied path either: reject `..` traversal and anything that
+        // resolves outside this repo so a compromised/hostile manifest can't make
+        // `immerse` read files elsewhere on disk. "Your code never leaves except
+        // these exact repo files" is only true if we enforce it here too.
+        const root = resolve(repo.localPath);
         const files = [];
         for (const rel of manifest.paths) {
             try {
-                const abs = join(repo.localPath, rel);
+                if (typeof rel !== "string" || rel.split(/[\\/]/).includes(".."))
+                    continue;
+                const abs = resolve(root, rel);
+                if (abs !== root && !abs.startsWith(root + sep))
+                    continue;
                 const st = statSync(abs);
                 if (!st.isFile() || st.size > MAX_FILE_BYTES)
                     continue;

package/dist/index.js

@@ -12,11 +12,12 @@ Usage:
   npx replen mcp setup       Re-wire MCP using saved auth
   npx replen project-init    Print a prompt your AI coding tool uses to draft
                              a CLAUDE.md tuned for replen
-  npx replen inject [-y]     Append the "## Replen integration" section to
-                             every CLAUDE.md + AGENTS.md (Claude Code +
-                             Codex) under ~/github/, ~/code/, ~/projects/
-                             so the agent auto-surfaces matches on session
-                             start. Idempotent. Asks for consent unless -y.
+  npx replen inject [-y]     Add the "## Replen integration" section to
+                             CLAUDE.md + AGENTS.md + GEMINI.md (Claude Code +
+                             Codex + Gemini CLI), creating any that are
+                             missing, in every repo under ~/github/, ~/code/,
+                             ~/projects/ so the agent auto-surfaces matches on
+                             session start. Idempotent. Consent unless -y.
   npx replen sync-projects   Re-scan local repos for new GitHub remotes
        [--root PATH ...]     and register them with Replen. Run after
                              cloning a new repo, or pass --root to point

package/dist/init.js

@@ -13,11 +13,14 @@ function pickPort() {
     return PORT_MIN + Math.floor(Math.random() * (PORT_MAX - PORT_MIN));
 }
 function openBrowser(url) {
-    const cmd = platform() === "darwin" ? "open"
-        : platform() === "win32" ? "start"
-            : "xdg-open";
+    // On Windows `start` is a cmd.exe builtin, not an executable — spawning it
+    // directly fails, so route through `cmd /c start "" <url>` (the "" is the
+    // required title arg). darwin/linux have real `open`/`xdg-open` binaries.
+    const [cmd, args] = platform() === "darwin" ? ["open", [url]]
+        : platform() === "win32" ? ["cmd", ["/c", "start", "", url]]
+            : ["xdg-open", [url]];
     // Detach. We don't care about its exit.
-    const proc = spawn(cmd, [url], { stdio: "ignore", detached: true });
+    const proc = spawn(cmd, args, { stdio: "ignore", detached: true });
     proc.on("error", () => {
         // Fail silently. We print the URL anyway as fallback.
     });
@@ -118,10 +121,15 @@ export async function runInit() {
     console.log("");
     console.log("  (Waiting for browser callback on http://127.0.0.1:" + port + "…)");
     console.log("");
+    // Bind the loopback listener BEFORE opening the browser (waitForCallback's
+    // server.listen runs synchronously in the Promise executor). Otherwise a
+    // local port-squatter could grab the port between open and listen and
+    // capture the code+state from the callback, then exchange them for the token.
+    const cbPromise = waitForCallback(port, state);
     openBrowser(authUrl);
     let cb;
     try {
-        cb = await waitForCallback(port, state);
+        cb = await cbPromise;
     }
     catch (e) {
         console.error("  ✗ " + (e?.message ?? String(e)));

package/dist/inject-instruction.js

@@ -262,7 +262,7 @@ function replaceSection(claudeMd) {
 }
 async function promptYes(question) {
     if (!process.stdin.isTTY)
-        return true; // non-interactive → assume yes
+        return false; // non-interactive + no --yes ⇒ refuse (mirrors uninstall)
     const rl = createInterface({ input: process.stdin, output: process.stdout });
     return new Promise((resolve) => {
         rl.question(question, (answer) => {
@@ -287,13 +287,21 @@ export async function injectInstructions(opts = {}) {
         console.log("  · no git repos with GitHub remotes found — skipping CLAUDE.md inject. Pass --root <path> if your code lives somewhere non-conventional.");
         return outcome;
     }
-    // First-run consent. Shows the count + an example path so the user
-    // knows the blast radius. --yes (or non-TTY) bypasses.
+    // First-run consent. Shows the count + an example path so the user knows the
+    // blast radius, and names every file we touch (three per repo, created if
+    // missing). --yes bypasses; non-interactive without --yes is a safe no-op.
     if (!opts.yes) {
+        if (!process.stdin.isTTY) {
+            outcome.declined = true;
+            console.log(`\n  · non-interactive shell — skipping CLAUDE.md/AGENTS.md/GEMINI.md inject.`);
+            console.log(`    Re-run with \`npx replen inject -y\` to apply without a prompt.`);
+            return outcome;
+        }
         console.log(`\n  Found ${repos.length} git repo(s) with GitHub remotes.`);
-        console.log(`  Append a "## Replen integration" section to each CLAUDE.md so Claude Code`);
-        console.log(`  surfaces today's matches at session start. Idempotent; edit freely above`);
-        console.log(`  the section. First 3:`);
+        console.log(`  Add a "## Replen integration" section to CLAUDE.md, AGENTS.md and GEMINI.md`);
+        console.log(`  in each (creating any that don't exist) so Claude Code / Codex / Gemini CLI`);
+        console.log(`  surface today's matches at session start. Idempotent; edit freely above the`);
+        console.log(`  section. First 3:`);
         for (const r of repos.slice(0, 3))
             console.log(`    • ${r}`);
         if (repos.length > 3)

package/dist/mcp-setup.js

@@ -189,6 +189,15 @@ function setupCodex(token, base) {
     const path = CODEX_CONFIG;
     try {
         backupIfExists(path);
+        // smol-toml preserves values but not comments, blank lines, or table order.
+        // If the user's config carries comments, warn (a .bak was already taken) so
+        // the loss isn't silent — the only faithful alternative is hand-editing.
+        if (existsSync(path)) {
+            const raw = readFileSync(path, "utf8");
+            if (/^\s*#/m.test(raw)) {
+                console.warn(`  ⚠ ${path}: comments/formatting in this TOML aren't preserved when Replen edits it (a .bak was saved next to it).`);
+            }
+        }
         const config = readToml(path);
         const mcpServers = config.mcp_servers ?? {};
         const existed = !!mcpServers[SERVER_NAME];
@@ -254,7 +263,9 @@ function backupIfExists(path) {
     // previous backup. Each run preserves the prior state.
     const ts = new Date().toISOString().replace(/[:.]/g, "-");
     const backup = `${path}.bak.${ts}`;
-    writeFileSync(backup, readFileSync(path));
+    // The backed-up config can carry the ingest token; keep it 0600 like the
+    // atomic write above, not the umask default (typically world-readable 0644).
+    writeFileSync(backup, readFileSync(path), { mode: 0o600 });
 }
 // ============================================================================
 // Claude SessionStart hook

package/dist/sync-projects.js

@@ -31,6 +31,18 @@ export async function syncDiscoveredProjects({ token, base, explicitRoots = [],
     if (prompted) {
         await persistRoots(result.scannedRoots);
     }
+    // The absolute local checkout path carries the OS username; it is only useful
+    // to a server running ON this machine (self-host at localhost) for Immersion.
+    // A remote/hosted server can't read it, so don't leak it there.
+    const isLocalBase = (() => {
+        try {
+            const h = new URL(base).hostname;
+            return h === "localhost" || h === "127.0.0.1" || h === "::1";
+        }
+        catch {
+            return false;
+        }
+    })();
     const payload = {
         projects: result.projects.map((p) => ({
             slug: p.slug,
@@ -38,11 +50,9 @@ export async function syncDiscoveredProjects({ token, base, explicitRoots = [],
             name: p.name,
             tags: p.tags,
             primaryLanguage: p.primaryLanguage ?? undefined,
-            // Absolute local checkout path. Used by Immersion on a self-host install
-            // (server == this machine) to ground on the actual source; inert on the
-            // hosted server, which can't read it. Always sent — it's identity, not
-            // code; nothing is read unless the operator enables Immersion.
-            localPath: p.localPath,
+            // Only sent to a local (self-host) server; omitted for a remote host so
+            // the username-bearing absolute path never leaves the machine.
+            localPath: isLocalBase ? p.localPath : undefined,
         })),
     };
     let res;

package/dist/uninstall.js

@@ -345,6 +345,11 @@ function stripTomlServer(path) {
     if (Object.keys(servers).length === 0)
         delete next.mcp_servers;
     backupIfExists(path);
+    // smol-toml doesn't preserve comments/formatting on re-serialise; warn if the
+    // file had comments so their loss on uninstall isn't silent (a .bak is taken).
+    if (existsSync(path) && /^\s*#/m.test(readFileSync(path, "utf8"))) {
+        console.warn(`  ⚠ ${path}: comments/formatting in this TOML aren't preserved (a .bak was saved next to it).`);
+    }
     writeTomlAtomic(path, next);
 }
 // ============================================================================

package/extras/skills/replen-onboard/SKILL.md

@@ -56,8 +56,8 @@ Find the user's local repositories and filter to the ones worth onboarding.
    - Has a git remote (so Replen can scope by `owner/name`). Note any local-only
      repos and skip them.
 3. **Present the list and get ONE green light.** Show the in-scope repos and ask
-   the user to confirm or trim — e.g. *"Found 8 active repos to onboard: aegis-web,
-   aegis-api, … — go, or want me to drop any?"* This is the **only** question you
+   the user to confirm or trim — e.g. *"Found 8 active repos to onboard: acme-web,
+   acme-api, … — go, or want me to drop any?"* This is the **only** question you
    ask. Once confirmed, run the rest autonomously.
 
 ## Step 1.5 — Pre-flight: decide the MINIMUM work per repo (do NOT skip this)
@@ -291,7 +291,7 @@ sanitize titles, no codenames.
 
 **Also capture architectural PRACTICES as capabilities.** Beyond what the code
 *does*, note the distinctive structural *moves* it makes — these are what let
-Replen suggest a pattern to your OTHER projects ("Aegis made its domain model
+Replen suggest a pattern to your OTHER projects ("Acme made its domain model
 data-driven; this data-heavy project should consider it"). Include a capability
 for any deliberate practice you find: a **data-driven domain ontology** (entity
 types/relationships stored as DATA/rows, not hardcoded — configurable without a
@@ -353,7 +353,7 @@ typed properties, computed properties as rows", never the entity names).
    it (e.g. `{tag: "computer vision", …, paths: ["src/cv/transformations.py"]}`).
    Paths only, never code. You just read these files; recording WHERE each
    capability lives lets Replen point another of the user's projects straight
-   at the implementation worth porting ("aegis solved this — see src/cv/…").
+   at the implementation worth porting ("acme solved this — see src/cv/…").
    **If you grounded from a vault, also pass the `concepts` array from 2d** —
    concept titles + their `[[wikilinks]]` only (never file/symbol notes, never
    bodies). Replen turns these into graph nodes + your-own-graph leaps. Omit it
@@ -369,7 +369,7 @@ typed properties, computed properties as rows", never the entity names).
 
 ## Step 3 — Group multi-repo products
 
-If several repos are one product (e.g. `aegis-web`/`aegis-api`/`aegis-cv`), group
+If several repos are one product (e.g. `acme-web`/`acme-api`/`acme-cv`), group
 them with `replen_set_product` so Replen unions the whole product's capabilities
 when the user is in any one of them.
 
@@ -383,7 +383,7 @@ when the user is in any one of them.
 ```
 Replen onboarding done — 8 repos grounded.
   · docs: 2 created, 1 augmented, 5 already good (untouched)
-  · capabilities + report set for all 8; aegis-* grouped as one product
+  · capabilities + report set for all 8; acme-* grouped as one product
   · doc changes are on branch `replen/onboarding-docs` for your review
 Replen will now surface genuinely relevant tools for these repos.
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replen",
-  "version": "1.5.3",
+  "version": "1.5.5",
   "description": "Make your AI coding tools smarter. One command, no API keys, free. Replen watches what your projects actually do and surfaces a few things worth bringing in each month. Use one as is, port a piece of another, cherry pick an idea, or build it clean room. The match happens inside your AI tool's session. A few actionable matches a month, by design.",
   "type": "module",
   "bin": {
@@ -10,7 +10,7 @@
     "build": "tsc && chmod +x dist/index.js",
     "dev": "tsx src/index.ts",
     "check:skill-sync": "node scripts/check-skill-sync.mjs",
-    "prepublishOnly": "npm run build && npm run check:skill-sync"
+    "prepublishOnly": "npm run build && npm run check:skill-sync && node ../scripts/check-no-private-slugs.mjs"
   },
   "files": [
     "dist",