RayPals/Claro
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

package: block init with unsafe entries

Browse Source
This commit is contained in:
Hermes Agent
2026-09-03 06:30:01 +00:00
parent f8089f0758
commit 98b8d311c3
6 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/V1_16_PACKAGES_PROJECTS.md
+1 -1
View File
@@ -101,7 +101,7 @@ folder/name
bad name
```
If an unsafe package name somehow gets into `claro.project`, package maintenance commands should not quietly continue. `claro package doctor` points out the bad name, `claro package lock` refuses to write lockfile data for it, and `claro package remove NAME` exits with an error if the lockfile refresh still sees an unsafe package name after the removal. Learners can still recover by removing the exact unsafe entry, such as `claro package remove ../bad`; Claro rewrites the project file and lockfile without using that unsafe name as a folder path.
If an unsafe package name somehow gets into `claro.project`, package maintenance commands should not quietly continue. `claro package doctor` points out the bad name, `claro package lock` refuses to write lockfile data for it, `claro package init` refuses to report the project ready while the unsafe entry remains, and `claro package remove NAME` exits with an error if the lockfile refresh still sees an unsafe package name after the removal. Learners can still recover by removing the exact unsafe entry, such as `claro package remove ../bad`; Claro rewrites the project file and lockfile without using that unsafe name as a folder path.
## Why this matters