2 Commits

Include renames

Author	SHA1	Message	Date
Martin Oehlert	399d78b938	security: path validation, ReDoS prevention, picomatch, PID-based file lock ... - Add validateProjectPath() to reject sensitive system directories - Add isPathWithinRoot/isPathWithinRootReal for symlink-aware path checks - Replace hand-rolled glob-to-regex with picomatch to prevent ReDoS - Add isSafeRegex() to reject custom patterns with nested quantifiers - Replace FileLock with PID-tracking version that detects stale locks - Add symlink detection in removeDirectory/listDirectoryContents - Add subdirectory name validation in ensureSubdirectory - Add atomicWriteFileSync and corrupted file backup in config-writer - Add MCP input validation (validateString) for all tool handlers - Fix CLAUDE.md section replacement to handle ### subsections correctly	2026-02-10 11:22:04 +01:00
Colby McHenryandClaude Opus 4.6	41c49ce83d	Add security hardening test suite (28 tests) ... Tests cover all security utilities introduced in the previous commit: - validatePathWithinRoot: path traversal prevention (7 tests) - safeJsonParse: corrupted JSON fallback handling (6 tests) - clamp: input range clamping (5 tests) - FileLock: cross-process file locking (7 tests) - Atomic config writes: temp file + rename pattern (3 tests) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-09 23:21:36 -06:00