Merge branch 'main' into feature/shared-packages

apps/server/src/routes/templates/routes/clone.ts

@@ -6,7 +6,7 @@ import type { Request, Response } from "express";
 import { spawn } from "child_process";
 import path from "path";
 import fs from "fs/promises";
-import { addAllowedPath } from "@automaker/platform";
+import { isPathAllowed } from "@automaker/platform";
 import { logger, getErrorMessage, logError } from "../common.js";
 
 export function createCloneHandler() {
@@ -63,6 +63,24 @@ export function createCloneHandler() {
         return;
       }
 
+      // Validate that parent directory is within allowed root directory
+      if (!isPathAllowed(resolvedParent)) {
+        res.status(403).json({
+          success: false,
+          error: `Parent directory not allowed: ${parentDir}. Must be within ALLOWED_ROOT_DIRECTORY.`,
+        });
+        return;
+      }
+
+      // Validate that project path will be within allowed root directory
+      if (!isPathAllowed(resolvedProject)) {
+        res.status(403).json({
+          success: false,
+          error: `Project path not allowed: ${projectPath}. Must be within ALLOWED_ROOT_DIRECTORY.`,
+        });
+        return;
+      }
+
       // Check if directory already exists
       try {
         await fs.access(projectPath);
@@ -186,9 +204,6 @@ export function createCloneHandler() {
         });
       });
 
-      // Add to allowed paths
-      addAllowedPath(projectPath);
-
       logger.info(`[Templates] Successfully cloned template to ${projectPath}`);
 
       res.json({