trackqa 0.1.2 → 0.1.3

package/README.md

@@ -7,17 +7,19 @@ credentials. The connector does not install or authenticate the AI client itself
 
 ## Package status and installation
 
-**trackqa@0.1.1** was published and independently verified on November 5, 2026.
-The local **v0.1.2 candidate** fixes Codex launches from the Windows user home:
-the standard profile and application-data directories are no longer incorrectly
-rejected as workspace-local configuration. Workspace and package boundaries
-remain enforced. **v0.1.2 is not published; publication requires separate approval.**
-The published v0.1.0 and v0.1.1 artifacts are retained unchanged.
+**trackqa@0.1.2** was published and independently verified on November 5, 2026.
+It corrected default Codex profile and application-data validation, but separate
+executable checks still reject user-installed clients when launched from the home.
+The local **v0.1.3 candidate** corrects those executable checks and Gemini's default
+home validation, and recognizes Gemini's bundled npm entry alongside its older
+layout. Existing installation allowlists, workspace boundaries and compatibility
+checks remain enforced. **v0.1.3 is not published.** Existing published artifacts
+are retained unchanged; experimental client validation limits are unchanged.
 
 To verify an approved local tarball in a disposable directory:
 
 ```powershell
-npm install --ignore-scripts --no-audit --no-fund <absolute-path-to-trackqa-0.1.2.tgz>
+npm install --ignore-scripts --no-audit --no-fund <absolute-path-to-trackqa-0.1.3.tgz>
 npm exec --offline -- trackqa --help
 ```
 
@@ -31,10 +33,9 @@ npx trackqa status --client codex
 npx trackqa disconnect --client codex --project <project-UUID>
 ```
 
-Until v0.1.2 is published, the bare registry command still resolves to v0.1.1.
-With v0.1.1, launch from your coding project folder rather than the user home to
-avoid `configuration_location_untrusted`. Validate the v0.1.2 candidate through
-a local tarball installation and `npm exec --offline -- trackqa ...`.
+The published version is v0.1.2. Until v0.1.3 is published, run from your coding
+project folder instead of the user home to avoid these location rejections.
+Validate v0.1.3 through a disposable local tarball installation.
 Bare `connect` prompts for a client; `--client codex` is optional. No client is
 selected by default.
 

package/dist/tools/trackqa-connect/src/cli.js

@@ -16,7 +16,7 @@ import { adapterLabel } from "./clients/adapter.js";
 import { ConnectorError, display, parseArgs, requireValue } from "./core.js";
 import { Store } from "./state.js";
 import { connect, disconnect, status } from "./workflow.js";
-export const help = `TrackQA Connect 0.1.2 - Windows, Owner-operated MVP release candidate
+export const help = `TrackQA Connect 0.1.3 - Windows, Owner-operated MVP release candidate
 Usage after installing the approved package or local tarball:
   trackqa connect --client codex
   trackqa status --client codex
@@ -69,7 +69,7 @@ export async function locations(env = process.env, client = 'codex') {
     const geminiHome = env.GEMINI_CLI_HOME ?? os.homedir();
     const geminiCanonical = await realpath(geminiHome).catch(() => path.resolve(geminiHome));
     if (client === 'gemini') {
-        requireValue(path.isAbsolute(geminiHome) && !under(geminiCanonical, repo) && !under(geminiCanonical, process.cwd()), 'configuration_location_untrusted');
+        requireValue(path.isAbsolute(geminiHome) && isSafeConfigurationRoot(geminiCanonical, cwd, repo, home, home), 'configuration_location_untrusted');
         const config = path.join(geminiCanonical, '.gemini');
         const resolved = await realpath(config).catch(() => config);
         requireValue(resolved.toLowerCase() === config.toLowerCase(), 'configuration_location_untrusted');
@@ -233,7 +233,7 @@ export async function main(args = process.argv.slice(2)) {
         if (code === 'configuration_write_failed' || code === 'configuration_write_uncertain')
             process.stdout.write('Settings replacement failed or its outcome is uncertain. Do not retry automatically. Inspect settings.json and any .trackqa-settings-recovery-*.bak in the selected Gemini home; preserve recovery metadata and compare/merge before restoring anything.\n');
         if (code === 'client_not_found')
-            process.stdout.write('Selected client was not found in supported installation locations. No installation was attempted. For Gemini supply the existing @google/gemini-cli bin with --gemini-path; agy.exe is not Gemini CLI.\n');
+            process.stdout.write('Selected AI client was not found in supported installation locations. Install it independently or use the matching --codex-path, --gemini-path, --claude-path or --vscode-path option for an existing supported installation. No installation or login was attempted.\n');
         if (code === 'client_not_found' && args.includes('claude'))
             process.stdout.write('Claude Code requires an independently installed native Windows claude.exe; npm shims and Desktop are not selected. Use --claude-path for an existing supported native installation. No login or installation was attempted.\n');
         if (code === 'gemini_compatibility_unverified')

package/dist/tools/trackqa-connect/src/clients/claude.js

@@ -12,7 +12,9 @@ export function trustedClaudeLocation(file, home = os.homedir(), platform = proc
     if (!paths.isAbsolute(file) || paths.basename(file).toLowerCase() !== 'claude.exe' || platform !== 'win32')
         return false;
     const within = (root) => paths.resolve(file).toLowerCase().startsWith(paths.resolve(root).toLowerCase() + paths.sep);
-    if (within(cwd) || paths.resolve(file).toLowerCase() === paths.resolve(cwd).toLowerCase())
+    const workspace = paths.resolve(cwd).toLowerCase(), relative = paths.relative(workspace, paths.resolve(file).toLowerCase());
+    const inWorkspace = relative === '' || (relative !== '..' && !relative.startsWith('..' + paths.sep) && !paths.isAbsolute(relative));
+    if (inWorkspace && workspace !== paths.resolve(home).toLowerCase())
         return false;
     const programFiles = process.env.ProgramFiles ?? 'C:\\Program Files';
     return [paths.join(home, '.local', 'bin'), paths.join(home, '.local', 'share', 'claude', 'versions'),

package/dist/tools/trackqa-connect/src/clients/codex-verify.js

@@ -63,7 +63,7 @@ export async function verifyCodex(executable, codexHome, setup, token, signal, s
         child.stdin.write(JSON.stringify({ id, method, params }) + '\n');
     });
     try {
-        await rpc('initialize', { clientInfo: { name: 'trackqa_connect', version: '0.1.2' } });
+        await rpc('initialize', { clientInfo: { name: 'trackqa_connect', version: '0.1.3' } });
         child.stdin.write(JSON.stringify({ method: 'initialized', params: {} }) + '\n');
         const config = await rpc('config/read');
         const servers = config?.config?.mcp_servers;

package/dist/tools/trackqa-connect/src/clients/codex.js

@@ -9,7 +9,9 @@ export function trustedLocation(file, home = os.homedir(), platform = process.pl
     const paths = platform === 'win32' ? path.win32 : path.posix;
     const normalized = paths.resolve(file).toLowerCase();
     const within = (root) => normalized.startsWith(paths.resolve(root).toLowerCase() + paths.sep);
-    if (!paths.isAbsolute(file) || within(cwd) || normalized === paths.resolve(cwd).toLowerCase())
+    const workspace = paths.resolve(cwd).toLowerCase(), relative = paths.relative(workspace, normalized);
+    const inWorkspace = relative === '' || (relative !== '..' && !relative.startsWith('..' + paths.sep) && !paths.isAbsolute(relative));
+    if (!paths.isAbsolute(file) || (inWorkspace && workspace !== paths.resolve(home).toLowerCase()))
         return false;
     if (platform === 'win32') {
         if (paths.basename(file).toLowerCase() !== 'codex.exe')

package/dist/tools/trackqa-connect/src/clients/gemini.js

@@ -16,7 +16,9 @@ export function trustedGeminiLocation(file, home = os.homedir(), platform = proc
         return false;
     const normalized = paths.resolve(file).toLowerCase();
     const inside = (root) => normalized.startsWith(paths.resolve(root).toLowerCase() + paths.sep);
-    if (inside(cwd) || normalized === paths.resolve(cwd).toLowerCase())
+    const workspace = paths.resolve(cwd).toLowerCase(), relative = paths.relative(workspace, normalized);
+    const inWorkspace = relative === '' || (relative !== '..' && !relative.startsWith('..' + paths.sep) && !paths.isAbsolute(relative));
+    if (inWorkspace && workspace !== paths.resolve(home).toLowerCase())
         return false;
     const roots = platform === 'win32' ? [paths.join(home, 'AppData', 'Roaming', 'npm', 'node_modules', '@google', 'gemini-cli'),
         paths.join(process.env.ProgramFiles ?? 'C:\\Program Files', 'nodejs', 'node_modules', '@google', 'gemini-cli')]
@@ -187,7 +189,8 @@ export async function probeGemini(exe, run = capture) {
 }
 export async function detectGemini(explicit, source = process.env, run = capture, inspect = checkGeminiInstallation) {
     const prefixes = [...new Set([...(source.PATH ?? '').split(path.delimiter), source.APPDATA ? path.join(source.APPDATA, 'npm') : '', path.join(source.ProgramFiles ?? 'C:\\Program Files', 'nodejs')])].filter(folder => path.isAbsolute(folder));
-    const candidates = explicit ? [explicit] : prefixes.map(folder => path.join(folder, 'node_modules', '@google', 'gemini-cli', 'dist', 'index.js'));
+    const candidates = explicit ? [explicit] : prefixes.flatMap(folder => ['dist/index.js', 'bundle/gemini.js']
+        .map(bin => path.join(folder, 'node_modules', '@google', 'gemini-cli', bin)));
     let incompatible = false;
     for (const file of candidates) {
         let exe;

package/dist/tools/trackqa-connect/src/clients/vscode.js

@@ -10,7 +10,9 @@ export function trustedVSCodeLocation(file, home = os.homedir(), platform = proc
     if (platform !== 'win32')
         return false;
     const paths = path.win32, resolved = paths.resolve(file).toLowerCase();
-    if (!paths.isAbsolute(file) || paths.basename(file).toLowerCase() !== 'code.exe' || resolved.startsWith(paths.resolve(cwd).toLowerCase() + paths.sep))
+    const workspace = paths.resolve(cwd).toLowerCase(), relative = paths.relative(workspace, resolved);
+    const inWorkspace = relative === '' || (relative !== '..' && !relative.startsWith('..' + paths.sep) && !paths.isAbsolute(relative));
+    if (!paths.isAbsolute(file) || paths.basename(file).toLowerCase() !== 'code.exe' || (inWorkspace && workspace !== paths.resolve(home).toLowerCase()))
         return false;
     return [paths.join(home, 'AppData', 'Local', 'Programs', 'Microsoft VS Code', 'Code.exe'),
         paths.join(process.env.ProgramFiles ?? 'C:\\Program Files', 'Microsoft VS Code', 'Code.exe')].some(candidate => paths.resolve(candidate).toLowerCase() === resolved);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trackqa",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Owner-operated TrackQA MCP connector for Windows",
   "type": "module",
   "bin": { "trackqa": "dist/tools/trackqa-connect/src/cli.js" },