fix(init): confine pack writes to .mdsmith/ at the write boundary

Enforce the pack contract where pack paths are consumed: validatePackPath
rejects any pack.File whose path is absolute or escapes .mdsmith/ with
"..", and writeScaffolds refuses a symlinked .mdsmith directory up front.
Together these stop a buggy or hostile pack from diverting init's
MkdirAll/WriteFile outside the workspace. Covered by TestValidatePackPath,
TestWriteScaffolds_RejectsEscapingPath, and
TestWriteScaffolds_RefusesSymlinkedMdsmithDir.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012fET55utKej7P3VWhiNnLW

Author: claude

cmd/mdsmith/main.go

@@ -459,9 +459,20 @@ func applyPacks(names []string, w io.Writer) error {
 // untouched and noted, so a re-run never clobbers a project's edits.
 // Existence is checked with statTarget, which refuses a symlinked target
 // rather than following it — a planted link must not divert the write
-// outside the pack directory. Progress lines go to w.
+// outside the pack directory. Each path is validated against the pack
+// contract (relative, under .mdsmith/) first, and a symlinked .mdsmith
+// directory is refused up front, so a buggy or hostile pack cannot write
+// out of tree. Progress lines go to w.
 func writeScaffolds(files []pack.File, w io.Writer) error {
+	// A symlinked .mdsmith directory would let MkdirAll/WriteFile follow it
+	// and land pack files wherever it points; refuse it before any write.
+	if info, err := os.Lstat(mdsmithDir); err == nil && info.Mode()&fs.ModeSymlink != 0 {
+		return fmt.Errorf("%s is a symlink; refusing to write pack files through it", mdsmithDir)
+	}
 	for _, f := range files {
+		if err := validatePackPath(f.Path); err != nil {
+			return err
+		}
 		if dir := filepath.Dir(f.Path); dir != "." {
 			if err := os.MkdirAll(dir, 0o755); err != nil {
 				return fmt.Errorf("creating %s: %w", dir, err)
@@ -483,6 +494,29 @@ func writeScaffolds(files []pack.File, w io.Writer) error {
 	return nil
 }
 
+// mdsmithDir is the workspace subdirectory every additive pack writes
+// under; validatePackPath keeps pack files confined to it.
+const mdsmithDir = ".mdsmith"
+
+// validatePackPath enforces the pack contract at the write boundary: a
+// pack file must be a relative path under .mdsmith/. A pack that returns
+// an absolute path, or one that escapes the workspace with "..", is
+// rejected before any directory is created or file written, so init's
+// writes cannot be diverted out of tree. A "../" that stays within
+// .mdsmith after cleaning is harmless and allowed; any escape leaves a
+// first component other than .mdsmith and is refused.
+func validatePackPath(p string) error {
+	clean := filepath.Clean(p)
+	if filepath.IsAbs(clean) {
+		return fmt.Errorf("pack file path %q must be relative", p)
+	}
+	first, _, _ := strings.Cut(clean, string(filepath.Separator))
+	if first != mdsmithDir {
+		return fmt.Errorf("pack file path %q must be under %s/", p, mdsmithDir)
+	}
+	return nil
+}
+
 // statTarget reports whether path already exists as a regular file — the
 // only kind of entry init treats as "already there, leave it alone". It
 // uses Lstat so a symlink is never followed: a symlink, even a dangling

cmd/mdsmith/main_unit_test.go

@@ -1439,6 +1439,49 @@ func TestNormalizePackNames(t *testing.T) {
 	assert.Empty(t, normalizePackNames([]string{"  ", ""}))
 }
 
+func TestValidatePackPath(t *testing.T) {
+	// Under .mdsmith/ is the contract; an internal ".." that stays inside
+	// is harmless and allowed.
+	require.NoError(t, validatePackPath(filepath.Join(".mdsmith", "wordlists", "a.yaml")))
+	require.NoError(t, validatePackPath(filepath.Join(".mdsmith", "kinds", "..", "a.yaml")))
+
+	// Absolute paths and any escape out of .mdsmith/ are refused.
+	assert.Error(t, validatePackPath(filepath.FromSlash("/etc/passwd")))
+	assert.Error(t, validatePackPath(filepath.Join("..", "evil.yaml")))
+	assert.Error(t, validatePackPath(filepath.Join(".mdsmith", "..", "..", "evil.yaml")))
+	assert.Error(t, validatePackPath(filepath.Join("other", "a.yaml")))
+}
+
+func TestWriteScaffolds_RejectsEscapingPath(t *testing.T) {
+	dir := t.TempDir()
+	t.Chdir(dir)
+	// A pack that returns a path escaping .mdsmith/ is refused before any
+	// write, so nothing lands outside the workspace.
+	files := []pack.File{{Path: filepath.Join("..", "escape.yaml"), Data: []byte("x")}}
+	err := writeScaffolds(files, io.Discard)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "under .mdsmith/")
+	_, statErr := os.Stat(filepath.Join(filepath.Dir(dir), "escape.yaml"))
+	assert.True(t, os.IsNotExist(statErr), "nothing written outside the workspace")
+}
+
+func TestWriteScaffolds_RefusesSymlinkedMdsmithDir(t *testing.T) {
+	dir := t.TempDir()
+	t.Chdir(dir)
+	// .mdsmith itself is a symlink to another directory; pack writes must
+	// not be redirected through it.
+	target := filepath.Join(dir, "elsewhere")
+	require.NoError(t, os.Mkdir(target, 0o755))
+	require.NoError(t, os.Symlink(target, ".mdsmith"))
+
+	files := []pack.File{{Path: filepath.Join(".mdsmith", "wordlists", "a.yaml"), Data: []byte("x")}}
+	err := writeScaffolds(files, io.Discard)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "symlink")
+	_, statErr := os.Stat(filepath.Join(target, "wordlists", "a.yaml"))
+	assert.True(t, os.IsNotExist(statErr), "nothing written through the symlinked .mdsmith")
+}
+
 // --- runHelp ---
 
 func TestRunHelp_NoArgs_ExitsZero(t *testing.T) {