token-goat 2.6.34 → 2.6.35

package/dist/{token-goat-hook-chunk-KGLMNOGD.mjs → token-goat-hook-chunk-NXVT4F3S.mjs}

@@ -50,7 +50,7 @@ import {
   walkProject,
   yamlLineClosesQuote,
   yamlOpenQuoteAfter
-} from "./token-goat-hook-chunk-6QTWMSRO.mjs";
+} from "./token-goat-hook-chunk-XM4W3WCO.mjs";
 import {
   PER_FILE_COUNTERFACTUAL_CEILING,
   _detectOpenQuote,
@@ -100,7 +100,7 @@ import {
   unsupportedLanguageName,
   windowsCmdQuoteArg,
   withExtension
-} from "./token-goat-hook-chunk-CNLMPHXT.mjs";
+} from "./token-goat-hook-chunk-2O7P4Z6Q.mjs";
 import {
   registerReset
 } from "./token-goat-hook-chunk-BUOCULAM.mjs";
@@ -7644,10 +7644,16 @@ function buildChangedRefHint(cwd, ref) {
   const commitWord = commitCount === 1 ? "1 commit" : `${commitCount} commits`;
   return `Hint: this repo has only ${commitWord}; '${ref}' does not exist. Try: token-goat changed --since ${suggestedRef}`;
 }
+function refIsSafe(ref) {
+  return !ref.startsWith("-");
+}
+function emitUnsafeRef(ref) {
+  emitErr(`Refusing a git ref that starts with '-': ${ref}`);
+}
 function runChanged(opts = {}) {
   const ref = opts.ref ?? "HEAD~5";
-  if (ref.startsWith("-")) {
-    emitErr(`Refusing a git ref that starts with '-': ${ref}`);
+  if (!refIsSafe(ref)) {
+    emitUnsafeRef(ref);
     return 1;
   }
   const cwd = opts.projectRoot ?? process.cwd();
@@ -7824,6 +7830,10 @@ function resolveSymbolSpecOrEmitError(commandName, spec, projectRoot) {
   return resolution.entry;
 }
 function runDiff(opts) {
+  if (opts.ref !== void 0 && !refIsSafe(opts.ref)) {
+    emitUnsafeRef(opts.ref);
+    return 1;
+  }
   const match = resolveSymbolSpecOrEmitError("diff", opts.spec, opts.projectRoot);
   if (match === null) return 1;
   const cwd = opts.projectRoot ?? process.cwd();
@@ -7911,6 +7921,10 @@ function parseLogDashLOutput(stdout) {
   return entries;
 }
 function runLog(opts) {
+  if (opts.ref !== void 0 && !refIsSafe(opts.ref)) {
+    emitUnsafeRef(opts.ref);
+    return 1;
+  }
   const match = resolveSymbolSpecOrEmitError("log", opts.spec, opts.projectRoot);
   if (match === null) return 1;
   const cwd = opts.projectRoot ?? process.cwd();

package/dist/{token-goat-hook-chunk-OQML5EMA.mjs → token-goat-hook-chunk-VU6VGZBM.mjs}

@@ -25,7 +25,7 @@ import {
   runSkeleton,
   runSymbol,
   withPinnedReads
-} from "./token-goat-hook-chunk-KGLMNOGD.mjs";
+} from "./token-goat-hook-chunk-NXVT4F3S.mjs";
 import {
   buildProjectMap,
   embeddingsDepsAvailable,
@@ -34,7 +34,7 @@ import {
   getProjectIndexCounts,
   isWorkerRunning,
   mapLookupBytesSaved
-} from "./token-goat-hook-chunk-6QTWMSRO.mjs";
+} from "./token-goat-hook-chunk-XM4W3WCO.mjs";
 import {
   VERSION,
   dataDir,
@@ -45,7 +45,7 @@ import {
   normalizePath,
   recordStat,
   resolveProjectRoot
-} from "./token-goat-hook-chunk-CNLMPHXT.mjs";
+} from "./token-goat-hook-chunk-2O7P4Z6Q.mjs";
 import "./token-goat-hook-chunk-BUOCULAM.mjs";
 import "./token-goat-hook-chunk-RFRLWOQH.mjs";
 
@@ -126,7 +126,19 @@ function forCompare(p) {
   return process.platform === "win32" ? p.toLowerCase() : p;
 }
 function resolveToolRoot(projectRoot) {
-  return resolveProjectRoot(projectRoot !== void 0 ? { project: projectRoot } : {});
+  const resolved = resolveProjectRoot(projectRoot !== void 0 ? { project: projectRoot } : {});
+  assertRootAllowed(resolved);
+  return resolved;
+}
+var RootNotAllowedError = class extends Error {
+};
+function assertRootAllowed(resolvedRoot) {
+  const allowedRoots = loadConfig().mcp.allowed_roots;
+  if (allowedRoots.length === 0) return;
+  if (allowedRoots.some((allowed) => checkWithinProjectRoot(resolvedRoot, allowed).inside)) return;
+  throw new RootNotAllowedError(
+    `refused: "${resolvedRoot}" is not inside any root listed in mcp.allowed_roots. A caller-supplied projectRoot is untrusted input, so this deployment pins which roots may be named; add the root to mcp.allowed_roots (or TOKEN_GOAT_MCP_ALLOWED_ROOTS) to permit it.`
+  );
 }
 function checkWithinProjectRoot(target, resolvedRoot) {
   const root = forCompare(normalizePath(realPathOrSelf(resolvedRoot)));
@@ -150,16 +162,6 @@ function specFilePart(spec) {
 var NO_PINS = /* @__PURE__ */ new Map();
 function confineTargets(targets, resolvedRoot, splitCommas = true) {
   if (!loadConfig(resolvedRoot).mcp.confine_reads_to_project_root) return { ok: true, targets, pins: NO_PINS };
-  const allowedRoots = loadConfig().mcp.allowed_roots;
-  if (allowedRoots.length > 0 && !allowedRoots.some((allowed) => checkWithinProjectRoot(resolvedRoot, allowed).inside)) {
-    return {
-      ok: false,
-      refusal: toCallToolResult({
-        text: `refused: "${resolvedRoot}" is not inside any root listed in mcp.allowed_roots. A caller-supplied projectRoot is untrusted input, so this deployment pins which roots may be named; add the root to mcp.allowed_roots (or TOKEN_GOAT_MCP_ALLOWED_ROOTS) to permit it.`,
-        code: 1
-      })
-    };
-  }
   const checked = [];
   const pins = /* @__PURE__ */ new Map();
   for (const raw of targets) {