@kya-os/cli
Version:
CLI for MCP-I setup and management
27 lines • 1.09 kB
JavaScript
import { homedir } from "os";
import { join, resolve } from "path";
/**
* Slugs come from .mcpi/agent.json, AGENT_SLUG, or an interactive prompt.
* The file-based sources are attacker-influenceable in a cloned repo, and the
* slug becomes a filename under the keys directory, so every source must pass
* the same shape check the interactive prompt enforces.
*/
export const SLUG_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
export function isValidSlug(slug) {
return SLUG_PATTERN.test(slug);
}
/** Directory holding converted SSH signing keys, always absolute. */
export function keysDir() {
return resolve(process.env.MCPI_KEYS_DIR || join(homedir(), ".mcpi", "keys"));
}
/**
* Path for a slug's private key. Throws on slugs that fail validation so a
* crafted slug can never traverse outside the keys directory.
*/
export function signingKeyPath(slug) {
if (!isValidSlug(slug)) {
throw new Error(`Invalid agent slug "${slug}": must match ${SLUG_PATTERN} (lowercase letters, numbers, dashes)`);
}
return join(keysDir(), slug);
}
//# sourceMappingURL=paths.js.map