triflux 7.1.3 → 7.2.1

package/hub/quality/deslop.mjs

@@ -6,8 +6,8 @@
 import { readdir, readFile, writeFile, stat } from 'node:fs/promises';
 import { join, relative } from 'node:path';
 
-/** @type {Array<{type: string, pattern: RegExp, severity: string, autoFixable: boolean, multiline: boolean}>} */
-export const SLOP_PATTERNS = [
+/** @type {ReadonlyArray<{type: string, pattern: RegExp, severity: string, autoFixable: boolean, multiline: boolean}>} */
+export const SLOP_PATTERNS = Object.freeze([
   {
     type: 'trivial_comment',
     pattern: /^\s*\/\/\s*(import|define|set|get|return|export)\s/i,
@@ -57,7 +57,7 @@ export const SLOP_PATTERNS = [
     autoFixable: true,
     multiline: false,
   },
-];
+]);
 
 const SEVERITY_WEIGHT = { low: 2, med: 5 };
 
@@ -82,6 +82,7 @@ export function detectSlop(content, filePath = '') {
           suggestion: `${sp.type} 패턴 감지`,
           text: lines[i].trim(),
           autoFixable: sp.autoFixable,
+          file: filePath,
         });
       }
     }
@@ -100,6 +101,7 @@ export function detectSlop(content, filePath = '') {
         suggestion: `${sp.type} 패턴 감지`,
         text: match[0].split('\n')[0].trim(),
         autoFixable: sp.autoFixable,
+        file: filePath,
       });
     }
   }

package/hub/reflexion.mjs

@@ -68,13 +68,17 @@ export function learnFromError(store, { error, solution, context = {}, success =
     return store.updateReflexionHit(existing[0].id, success);
   }
 
-  return store.addReflexion({
+  const newEntry = store.addReflexion({
     error_pattern: pattern,
     error_message: error,
     context,
     solution,
     solution_code: null,
   });
+  if (success && newEntry) {
+    return store.updateReflexionHit(newEntry.id, true);
+  }
+  return newEntry;
 }
 
 /**

package/hub/research.mjs

@@ -2,7 +2,7 @@
 // 검색 쿼리 생성 → 결과 정규화 → 보고서 빌드 → 저장
 
 import { mkdirSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
 import { TFX_REPORTS_DIR } from './paths.mjs';
 
 /**
@@ -103,6 +103,11 @@ ${sourcesSection || '_출처 없음_'}
  */
 export function saveReport(topic, content, baseDir = process.cwd()) {
   const dir = join(baseDir, TFX_REPORTS_DIR);
+  const resolvedDir = resolve(dir);
+  const expectedBase = resolve(baseDir || TFX_REPORTS_DIR);
+  if (!resolvedDir.startsWith(expectedBase)) {
+    throw new Error('Invalid report directory: path traversal detected');
+  }
   mkdirSync(dir, { recursive: true });
 
   const ts = new Date().toISOString().replace(/[:.]/g, '-').replace('T', '_').slice(0, 19);