RayPals/Claro
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

package: block list with unsafe entries

Browse Source
This commit is contained in:
Hermes Agent
2026-09-03 08:34:02 +00:00
parent 98b8d311c3
commit 011a60f140
7 changed files with 16 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/V1_16_PACKAGES_PROJECTS.md
+1 -1
View File
@@ -101,7 +101,7 @@ folder/name
bad name
```
If an unsafe package name somehow gets into `claro.project`, package maintenance commands should not quietly continue. `claro package doctor` points out the bad name, `claro package lock` refuses to write lockfile data for it, `claro package init` refuses to report the project ready while the unsafe entry remains, and `claro package remove NAME` exits with an error if the lockfile refresh still sees an unsafe package name after the removal. Learners can still recover by removing the exact unsafe entry, such as `claro package remove ../bad`; Claro rewrites the project file and lockfile without using that unsafe name as a folder path.
If an unsafe package name somehow gets into `claro.project`, package maintenance commands should not quietly continue. `claro package doctor` points out the bad name, `claro package lock` refuses to write lockfile data for it, `claro package list` refuses to display it as a normal package, `claro package init` refuses to report the project ready while the unsafe entry remains, and `claro package remove NAME` exits with an error if the lockfile refresh still sees an unsafe package name after the removal. Learners can still recover by removing the exact unsafe entry, such as `claro package remove ../bad`; Claro rewrites the project file and lockfile without using that unsafe name as a folder path.
## Why this matters