ca8447304f
Add a path-containment check to fn_task_attach so it can no longer read files outside the task's worktree via traversal or absolute paths. - Resolve the requested path and confine it to ctx.cwd (the task worktree) before any readFile call, rejecting "../" traversal, absolute paths, and other boundary-escaping inputs - Add regression tests in extension.test.ts covering traversal/absolute-path attack vectors - Add changeset (patch, category: security) documenting the fix Files changed: .changeset/fn-7619-attach-boundary.md | 7 ++ packages/cli/src/__tests__/extension.test.ts | 133 ++++++++++++++++++++++++++- packages/cli/src/extension.ts | 23 ++++- 3 files changed, 161 insertions(+), 2 deletions(-) Fusion-Task-Id: FN-7619 Fusion-Task-Lineage: d35d9218-d678-4989-945d-6c1e1a322c5c Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Changeset Format Guide
Each changeset file in this directory describes one user-facing change for release notes.
Required body format
---
"@runfusion/fusion": minor
---
summary: Add a Command Center productivity control for LOC backfills.
category: feature
dev: Uses the new `fn_backfill_loc` tool; settings key `commandCenter.locBackfill`.
Fields
| Field | Required | Description |
|---|---|---|
summary |
Yes | One line, user-facing, max 120 chars. Describe what changed for the operator. |
category |
Yes | One of: feature, fix, breaking, security, performance, internal. |
dev |
No | Developer or migration detail. Preserved in per-package CHANGELOGs but excluded from distilled release notes. |
Audience
The summary is the only content that appears in end-user release notes by default. Write for Fusion operators — describe behavior, fixes, and what changed. Avoid internal class names, file paths, and implementation detail.
Bump types
patch— bug fixes, internal changesminor— new features, CLI additions, toolsmajor— breaking changes
Validation
Run pnpm check:changesets to validate. The linter runs in the PR-check gate and test:gate. Legacy freeform changesets pass with a warning during the transition period.