SalesTeamToolbox e3a427252d fix: prevent path traversal via workstream name sanitization ...

Validates workstream name at all entry points — CLI --ws flag,
GSD_WORKSTREAM env var, active-workstream file, and cmdWorkstreamSet —
blocking names that don't match [a-zA-Z0-9_-]+. Also fixes
getActiveWorkstream to use planningRoot() consistently and validates
names read from the active-workstream file before using them in path
joins.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-21 15:21:13 -07:00

..

commands.cjs

feat: workstream namespacing for parallel milestone work

2026-03-21 15:21:13 -07:00

config.cjs

feat: workstream namespacing for parallel milestone work

2026-03-21 15:21:13 -07:00

core.cjs

fix: prevent path traversal via workstream name sanitization

2026-03-21 15:21:13 -07:00

frontmatter.cjs

security: add prompt injection guards, path traversal prevention, and input validation

2026-03-20 11:38:26 -04:00

init.cjs

feat: workstream namespacing for parallel milestone work

2026-03-21 15:21:13 -07:00

milestone.cjs

refactor: consolidate STATE.md field helpers, fix command injection in isGitIgnored

2026-03-19 15:05:20 -04:00

model-profiles.cjs

feat: Programmatic implementation of /gsd:set-profile command (#1007)

2026-03-15 11:45:14 -06:00

phase.cjs

feat: workstream namespacing for parallel milestone work

2026-03-21 15:21:13 -07:00

profile-output.cjs

feat(claude-md): add workflow enforcement guidance

2026-03-17 11:41:44 -04:00

profile-pipeline.cjs

fix: add temp file reaper to prevent unbounded /tmp accumulation

2026-03-20 15:46:06 -04:00

roadmap.cjs

fix(roadmap): handle 5-column progress tables with Milestone column

2026-03-19 21:30:41 +05:00

security.cjs

security: add prompt injection guards, path traversal prevention, and input validation

2026-03-20 11:38:26 -04:00

state.cjs

feat: workstream namespacing for parallel milestone work

2026-03-21 15:21:13 -07:00

template.cjs

feat: normalize generated markdown for markdownlint compliance (#1112)

2026-03-16 13:39:34 -06:00

uat.cjs

feat: workstream namespacing for parallel milestone work

2026-03-21 15:21:13 -07:00

verify.cjs

feat: workstream namespacing for parallel milestone work

2026-03-21 15:21:13 -07:00

workstream.cjs

fix: prevent path traversal via workstream name sanitization

2026-03-21 15:21:13 -07:00