waypoint-codex 0.1.3 → 0.1.5

package/dist/src/cli.js

@@ -5,7 +5,7 @@ import { fileURLToPath } from "node:url";
 import path from "node:path";
 import process from "node:process";
 import { doctorRepository, importLegacyRepo, initRepository, syncRepository } from "./core.js";
-const VERSION = JSON.parse(readFileSync(path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../package.json"), "utf8")).version;
+const VERSION = JSON.parse(readFileSync(path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../package.json"), "utf8")).version;
 function resolveRepo(input) {
     return path.resolve(input ?? ".");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "waypoint-codex",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Codex-native repository operating system: scaffolding, docs routing, repo-local skills, doctor, and sync.",
   "license": "MIT",
   "type": "module",

package/templates/.waypoint/scripts/prepare-context.mjs

@@ -55,8 +55,21 @@ function redactSecrets(text) {
   return SECRET_PATTERNS.reduce((current, pattern) => current.replace(pattern, "[REDACTED]"), text);
 }
 
+function safeRealpath(targetPath) {
+  try {
+    return realpathSync(targetPath);
+  } catch {
+    return null;
+  }
+}
+
 function isWithinPath(childPath, parentPath) {
-  const rel = path.relative(realpathSync(parentPath), realpathSync(childPath));
+  const resolvedParent = safeRealpath(parentPath);
+  const resolvedChild = safeRealpath(childPath);
+  if (!resolvedParent || !resolvedChild) {
+    return false;
+  }
+  const rel = path.relative(resolvedParent, resolvedChild);
   return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
 }