replen 1.5.4 → 1.5.5

package/dist/commands.js

@@ -568,7 +568,7 @@ async function fetchInventoryStatus(cfg, repo) {
 // (one source of truth) and writes them locally; you own and can open them.
 export async function runAtlas(argv) {
     const { mkdirSync, writeFileSync, rmSync } = await import("node:fs");
-    const { join, dirname } = await import("node:path");
+    const { join, dirname, resolve, sep } = await import("node:path");
     const { homedir } = await import("node:os");
     const cfg = await loadConfigOrExit();
     const dir = getFlag(argv, "--out") ?? join(homedir(), ".replen", "atlas");
@@ -584,8 +584,13 @@ export async function runAtlas(argv) {
         }
         catch { /* */ }
     }
+    // f.path is server-controlled: refuse any path that escapes the atlas dir
+    // (e.g. "../../.zshrc"). Mirrors the guard in mcp/src/atlas-sync.ts.
+    const root = resolve(dir);
     for (const f of data.files) {
-        const full = join(dir, f.path);
+        const full = resolve(dir, f.path);
+        if (full !== root && !full.startsWith(root + sep))
+            continue; // path traversal guard
         mkdirSync(dirname(full), { recursive: true });
         writeFileSync(full, f.content);
     }

package/dist/immerse.js

@@ -15,7 +15,7 @@
 // Self-host installs don't need this — they default on via REPLEN_SELF_HOST and
 // the pipeline reads local disk directly.
 import { readFileSync, statSync } from "node:fs";
-import { join } from "node:path";
+import { resolve, sep } from "node:path";
 import { loadConfigOrExit, apiGet, apiPost } from "./api.js";
 import { resolveAndWalk } from "./sync-projects.js";
 const MAX_FILE_BYTES = 1_000_000; // mirror the server per-file cap
@@ -75,10 +75,20 @@ async function send(cfg) {
             continue;
         withPaths++;
         // Read exactly the grounded files the server asked for (size-capped).
+        // The server sanitizes its manifest paths, but the client must not trust a
+        // server-supplied path either: reject `..` traversal and anything that
+        // resolves outside this repo so a compromised/hostile manifest can't make
+        // `immerse` read files elsewhere on disk. "Your code never leaves except
+        // these exact repo files" is only true if we enforce it here too.
+        const root = resolve(repo.localPath);
         const files = [];
         for (const rel of manifest.paths) {
             try {
-                const abs = join(repo.localPath, rel);
+                if (typeof rel !== "string" || rel.split(/[\\/]/).includes(".."))
+                    continue;
+                const abs = resolve(root, rel);
+                if (abs !== root && !abs.startsWith(root + sep))
+                    continue;
                 const st = statSync(abs);
                 if (!st.isFile() || st.size > MAX_FILE_BYTES)
                     continue;

package/dist/index.js

@@ -12,11 +12,12 @@ Usage:
   npx replen mcp setup       Re-wire MCP using saved auth
   npx replen project-init    Print a prompt your AI coding tool uses to draft
                              a CLAUDE.md tuned for replen
-  npx replen inject [-y]     Append the "## Replen integration" section to
-                             every CLAUDE.md + AGENTS.md (Claude Code +
-                             Codex) under ~/github/, ~/code/, ~/projects/
-                             so the agent auto-surfaces matches on session
-                             start. Idempotent. Asks for consent unless -y.
+  npx replen inject [-y]     Add the "## Replen integration" section to
+                             CLAUDE.md + AGENTS.md + GEMINI.md (Claude Code +
+                             Codex + Gemini CLI), creating any that are
+                             missing, in every repo under ~/github/, ~/code/,
+                             ~/projects/ so the agent auto-surfaces matches on
+                             session start. Idempotent. Consent unless -y.
   npx replen sync-projects   Re-scan local repos for new GitHub remotes
        [--root PATH ...]     and register them with Replen. Run after
                              cloning a new repo, or pass --root to point

package/dist/init.js

@@ -13,11 +13,14 @@ function pickPort() {
     return PORT_MIN + Math.floor(Math.random() * (PORT_MAX - PORT_MIN));
 }
 function openBrowser(url) {
-    const cmd = platform() === "darwin" ? "open"
-        : platform() === "win32" ? "start"
-            : "xdg-open";
+    // On Windows `start` is a cmd.exe builtin, not an executable — spawning it
+    // directly fails, so route through `cmd /c start "" <url>` (the "" is the
+    // required title arg). darwin/linux have real `open`/`xdg-open` binaries.
+    const [cmd, args] = platform() === "darwin" ? ["open", [url]]
+        : platform() === "win32" ? ["cmd", ["/c", "start", "", url]]
+            : ["xdg-open", [url]];
     // Detach. We don't care about its exit.
-    const proc = spawn(cmd, [url], { stdio: "ignore", detached: true });
+    const proc = spawn(cmd, args, { stdio: "ignore", detached: true });
     proc.on("error", () => {
         // Fail silently. We print the URL anyway as fallback.
     });
@@ -118,10 +121,15 @@ export async function runInit() {
     console.log("");
     console.log("  (Waiting for browser callback on http://127.0.0.1:" + port + "…)");
     console.log("");
+    // Bind the loopback listener BEFORE opening the browser (waitForCallback's
+    // server.listen runs synchronously in the Promise executor). Otherwise a
+    // local port-squatter could grab the port between open and listen and
+    // capture the code+state from the callback, then exchange them for the token.
+    const cbPromise = waitForCallback(port, state);
     openBrowser(authUrl);
     let cb;
     try {
-        cb = await waitForCallback(port, state);
+        cb = await cbPromise;
     }
     catch (e) {
         console.error("  ✗ " + (e?.message ?? String(e)));

package/dist/inject-instruction.js

@@ -262,7 +262,7 @@ function replaceSection(claudeMd) {
 }
 async function promptYes(question) {
     if (!process.stdin.isTTY)
-        return true; // non-interactive → assume yes
+        return false; // non-interactive + no --yes ⇒ refuse (mirrors uninstall)
     const rl = createInterface({ input: process.stdin, output: process.stdout });
     return new Promise((resolve) => {
         rl.question(question, (answer) => {
@@ -287,13 +287,21 @@ export async function injectInstructions(opts = {}) {
         console.log("  · no git repos with GitHub remotes found — skipping CLAUDE.md inject. Pass --root <path> if your code lives somewhere non-conventional.");
         return outcome;
     }
-    // First-run consent. Shows the count + an example path so the user
-    // knows the blast radius. --yes (or non-TTY) bypasses.
+    // First-run consent. Shows the count + an example path so the user knows the
+    // blast radius, and names every file we touch (three per repo, created if
+    // missing). --yes bypasses; non-interactive without --yes is a safe no-op.
     if (!opts.yes) {
+        if (!process.stdin.isTTY) {
+            outcome.declined = true;
+            console.log(`\n  · non-interactive shell — skipping CLAUDE.md/AGENTS.md/GEMINI.md inject.`);
+            console.log(`    Re-run with \`npx replen inject -y\` to apply without a prompt.`);
+            return outcome;
+        }
         console.log(`\n  Found ${repos.length} git repo(s) with GitHub remotes.`);
-        console.log(`  Append a "## Replen integration" section to each CLAUDE.md so Claude Code`);
-        console.log(`  surfaces today's matches at session start. Idempotent; edit freely above`);
-        console.log(`  the section. First 3:`);
+        console.log(`  Add a "## Replen integration" section to CLAUDE.md, AGENTS.md and GEMINI.md`);
+        console.log(`  in each (creating any that don't exist) so Claude Code / Codex / Gemini CLI`);
+        console.log(`  surface today's matches at session start. Idempotent; edit freely above the`);
+        console.log(`  section. First 3:`);
         for (const r of repos.slice(0, 3))
             console.log(`    • ${r}`);
         if (repos.length > 3)

package/dist/mcp-setup.js

@@ -189,6 +189,15 @@ function setupCodex(token, base) {
     const path = CODEX_CONFIG;
     try {
         backupIfExists(path);
+        // smol-toml preserves values but not comments, blank lines, or table order.
+        // If the user's config carries comments, warn (a .bak was already taken) so
+        // the loss isn't silent — the only faithful alternative is hand-editing.
+        if (existsSync(path)) {
+            const raw = readFileSync(path, "utf8");
+            if (/^\s*#/m.test(raw)) {
+                console.warn(`  ⚠ ${path}: comments/formatting in this TOML aren't preserved when Replen edits it (a .bak was saved next to it).`);
+            }
+        }
         const config = readToml(path);
         const mcpServers = config.mcp_servers ?? {};
         const existed = !!mcpServers[SERVER_NAME];
@@ -254,7 +263,9 @@ function backupIfExists(path) {
     // previous backup. Each run preserves the prior state.
     const ts = new Date().toISOString().replace(/[:.]/g, "-");
     const backup = `${path}.bak.${ts}`;
-    writeFileSync(backup, readFileSync(path));
+    // The backed-up config can carry the ingest token; keep it 0600 like the
+    // atomic write above, not the umask default (typically world-readable 0644).
+    writeFileSync(backup, readFileSync(path), { mode: 0o600 });
 }
 // ============================================================================
 // Claude SessionStart hook

package/dist/sync-projects.js

@@ -31,6 +31,18 @@ export async function syncDiscoveredProjects({ token, base, explicitRoots = [],
     if (prompted) {
         await persistRoots(result.scannedRoots);
     }
+    // The absolute local checkout path carries the OS username; it is only useful
+    // to a server running ON this machine (self-host at localhost) for Immersion.
+    // A remote/hosted server can't read it, so don't leak it there.
+    const isLocalBase = (() => {
+        try {
+            const h = new URL(base).hostname;
+            return h === "localhost" || h === "127.0.0.1" || h === "::1";
+        }
+        catch {
+            return false;
+        }
+    })();
     const payload = {
         projects: result.projects.map((p) => ({
             slug: p.slug,
@@ -38,11 +50,9 @@ export async function syncDiscoveredProjects({ token, base, explicitRoots = [],
             name: p.name,
             tags: p.tags,
             primaryLanguage: p.primaryLanguage ?? undefined,
-            // Absolute local checkout path. Used by Immersion on a self-host install
-            // (server == this machine) to ground on the actual source; inert on the
-            // hosted server, which can't read it. Always sent — it's identity, not
-            // code; nothing is read unless the operator enables Immersion.
-            localPath: p.localPath,
+            // Only sent to a local (self-host) server; omitted for a remote host so
+            // the username-bearing absolute path never leaves the machine.
+            localPath: isLocalBase ? p.localPath : undefined,
         })),
     };
     let res;

package/dist/uninstall.js

@@ -345,6 +345,11 @@ function stripTomlServer(path) {
     if (Object.keys(servers).length === 0)
         delete next.mcp_servers;
     backupIfExists(path);
+    // smol-toml doesn't preserve comments/formatting on re-serialise; warn if the
+    // file had comments so their loss on uninstall isn't silent (a .bak is taken).
+    if (existsSync(path) && /^\s*#/m.test(readFileSync(path, "utf8"))) {
+        console.warn(`  ⚠ ${path}: comments/formatting in this TOML aren't preserved (a .bak was saved next to it).`);
+    }
     writeTomlAtomic(path, next);
 }
 // ============================================================================

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replen",
-  "version": "1.5.4",
+  "version": "1.5.5",
   "description": "Make your AI coding tools smarter. One command, no API keys, free. Replen watches what your projects actually do and surfaces a few things worth bringing in each month. Use one as is, port a piece of another, cherry pick an idea, or build it clean room. The match happens inside your AI tool's session. A few actionable matches a month, by design.",
   "type": "module",
   "bin": {