a2967bfa24
`relPlanningPath(workstream)` previously called `posix.join('.planning',
'workstreams', workstream)` without validating the workstream argument.
Direct SDK callers — and `planningPaths` / `ContextEngine` which both
forward through `relPlanningPath` — could pass values like
`'../../../outside'`, `'foo/bar'`, or `'foo\\bar'` and route planning
operations outside the intended `.planning/workstreams/<name>` subtree.
The env-sourced workstream code path in `planningPaths` already validated
via `validateWorkstreamName` (line 444-445, pre-filtering to `null` on
failure per the #2791 silent-fallback contract). Explicit SDK arguments
had no equivalent gate.
Fix: validate inside `relPlanningPath` using the same shared
`validateWorkstreamName` policy. Every caller — direct SDK use,
`planningPaths`, `ContextEngine` — fails closed at the same seam.
Empty/undefined workstream still returns `.planning` for back-compat
(treated as "no workstream provided"); non-empty invalid names throw a
synchronous Error with the offending value in the message.
Env-sourced behaviour is unchanged: `planningPaths` continues to filter
invalid env values to `null` before they reach `relPlanningPath`, so the
silent-fallback path for malformed `GSD_WORKSTREAM` env still works.
Regression test
(sdk/src/bug-3589-planning-paths-validation.test.ts):
- 9 traversal/invalid cases (.., /, \\, spaces, .hidden, /abs,
-leading-hyphen) all throw with a `/workstream/i`-matching message.
- Valid names (`frontend`, `api_v2`, `alpha.beta-1`) continue to
produce the expected `.planning/workstreams/<name>` path.
- `planningPaths('/tmp', '../../../outside')` rejects before path
construction (proven via try/catch — resultPath stays null).
- Valid workstream + `planningPaths` produces the expected subtree
(`.planning/workstreams/frontend/STATE.md` etc.).
- Omitted workstream still returns root `.planning` with no `workstreams`
segment.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
37 lines
1.5 KiB
TypeScript
37 lines
1.5 KiB
TypeScript
/**
|
|
* Workstream utility functions for multi-workstream project support.
|
|
*
|
|
* When --ws <name> is provided, all .planning/ paths are routed to
|
|
* .planning/workstreams/<name>/ instead.
|
|
*/
|
|
|
|
import { posix } from 'node:path';
|
|
import { validateWorkstreamName } from './workstream-name-policy.js';
|
|
export { validateWorkstreamName, toWorkstreamSlug } from './workstream-name-policy.js';
|
|
|
|
/**
|
|
* Return the relative planning directory path.
|
|
*
|
|
* - Without workstream: `.planning`
|
|
* - With workstream: `.planning/workstreams/<name>`
|
|
*
|
|
* #3589 (security): validates the explicit workstream name against the
|
|
* shared `validateWorkstreamName` policy before path construction. Path
|
|
* traversal segments (`..`, `/`, `\\`) and other invalid identifiers throw
|
|
* synchronously, so every caller — direct SDK use, `planningPaths`,
|
|
* `ContextEngine` — fails closed at the same seam. Env-sourced workstreams
|
|
* are still pre-filtered to `null` by `planningPaths` (the #2791 silent
|
|
* fallback contract), so this guard does NOT change env-sourced behaviour.
|
|
*/
|
|
export function relPlanningPath(workstream?: string): string {
|
|
if (!workstream) return '.planning';
|
|
if (!validateWorkstreamName(workstream)) {
|
|
throw new Error(
|
|
`Invalid workstream name: ${JSON.stringify(workstream)}. ` +
|
|
`Workstream names must match /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/ and may not contain '..'.`,
|
|
);
|
|
}
|
|
// Use POSIX segments so the same logical path string is used on all platforms (Windows included).
|
|
return posix.join('.planning', 'workstreams', workstream);
|
|
}
|