v0.0.2 — Security Fix for Dangling Symlink Escape (CWE-59)

What's Changed

• Security Fix: Hardened resolveSafePath() against dangling-symlink write escapes (CWE-59) by validating unresolved paths with fs.lstatSync() and enforcing fail-closed ancestor verification.
• Filesystem Handling: Added nearest-existing-ancestor resolution to support legitimate nested new file/directory creation for write_file.
• Documentation: Added clear configuration placeholders for Claude Desktop and Qwen Studio in README.md.

---

Special thanks to @0xRomSec for discovering, responsibly reporting, and helping verify this security fix!

v0.0.1

cli-bridge — Release Notes

v1.1.0

🔒 Dev Mode (renamed from Safe Mode)

• Renamed "Safe Mode" to Dev Mode — clearer, no double-negative naming.
• Now OFF by default; shell execution stays blocked until explicitly enabled via toggle_dev_mode.
• Resets to OFF on every restart (session-only, in-memory).

🐛 Fixed: Audit/Journal Log Drift

• .cli-bridge-audit.log, PROJECT_LOG.md, and .gitignore no longer drift into nested subfolders — they now consistently land at the active workspace root.

⚙️ Configurable Workspace Root

• Added cli-bridge.config.json (with example template) so users can set their workspace path once instead of hardcoding it into claude_desktop_config.json.

📖 Documentation

• README redesign with badges, security architecture diagram, and a Compatibility section (Windows tested; macOS/Linux untested).
• Clear Dev Mode warning: enabling shell execution is entirely the user's responsibility — no allowlist, no undo, developer not liable.
• PowerShell one-liner added to help Windows users locate claude_desktop_config.json across both standard and MSIX install types.

⚠️ Known Issues

• There is a known bug in folder scoping currently under investigation — scoped operations don't yet behave fully as intended in all nested-directory cases. Use caution when running tools against deeply nested project structures until this is resolved in a follow-up patch.