super-opencode 1.1.1 → 1.1.2

package/dist/cli.js

@@ -21,8 +21,11 @@ const FALLBACK_FILENAME = "mcp_settings.json";
 function resolveSafePath(baseDir, targetPath) {
     const resolvedBase = path.resolve(baseDir);
     const resolvedTarget = path.resolve(targetPath);
-    if (!resolvedTarget.startsWith(resolvedBase + path.sep) &&
-        resolvedTarget !== resolvedBase) {
+    // Normalize paths for cross-platform comparison
+    const normalizedBase = path.normalize(resolvedBase).toLowerCase();
+    const normalizedTarget = path.normalize(resolvedTarget).toLowerCase();
+    if (!normalizedTarget.startsWith(normalizedBase + path.sep) &&
+        normalizedTarget !== normalizedBase) {
         throw new Error(`Path traversal detected: ${resolvedTarget} is outside ${resolvedBase}`);
     }
     return resolvedTarget;
@@ -275,7 +278,7 @@ async function collectMcpServerConfigs(selectedServers, targetDir) {
 async function writeMcpConfiguration(mcpServers, scope, targetDir) {
     const configPath = scope === "global"
         ? path.join(os.homedir(), ".config", "opencode", CONFIG_FILENAME)
-        : path.join(process.cwd(), CONFIG_FILENAME);
+        : path.join(targetDir, CONFIG_FILENAME);
     let finalSettings = {};
     let writeTarget = configPath;
     if (scope === "global") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "super-opencode",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "Super-OpenCode Framework Installer",
   "type": "module",
   "main": "dist/cli.js",