mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-09-15 23:32:46 +00:00
111e737d53
The pre-resolution containment check in the version bundler was a no-op: ManifestPath::from_absolute happily returns a `..`-prefixed path for locations outside the package root, so an escaping stack.child_workflow reference reached WorkflowLocation resolution, which probes and parses config files on the host before the real containment check in read_package_file ran. The request still failed, but the TOML parser's diagnostic quoted the host file. Check that the normalized reference stays under the package root before resolving it, and extend the supplied-workflow test to plant malformed host files that any parser would quote. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| fabro-acp | ||
| fabro-automation | ||
| fabro-checkpoint | ||
| fabro-dump | ||
| fabro-environment | ||
| fabro-github | ||
| fabro-graphviz | ||
| fabro-hooks | ||
| fabro-install | ||
| fabro-interview | ||
| fabro-llm | ||
| fabro-manifest | ||
| fabro-mcp | ||
| fabro-mcp-store | ||
| fabro-sandbox | ||
| fabro-slack | ||
| fabro-store | ||
| fabro-tool | ||
| fabro-tracker | ||
| fabro-validate | ||
| fabro-variable | ||
| fabro-workflow | ||
| fabro-workflow-version | ||