fix: ajuste no workflow para dist no npm

Author: cleberhensel

apps/cli/src/commands/install.ts

@@ -158,6 +158,23 @@ export async function installCommand(
     source: string,
     options: { conflict?: string; agent?: string; dryRun?: boolean } = {}
 ): Promise<void> {
+    const projectRoot = path.resolve(process.cwd());
+    const criticalPaths = [
+        '/', '/usr', '/etc', '/var', '/System', '/Library', '/bin', '/sbin', '/opt', '/boot',
+        '/private/etc', '/private/var', '/private/tmp'
+    ];
+    
+    const isCriticalDir = criticalPaths.some(critical => {
+        const resolvedCritical = path.resolve(critical);
+        return projectRoot === resolvedCritical || projectRoot.startsWith(resolvedCritical + path.sep);
+    });
+    
+    if (isCriticalDir) {
+        console.error(chalk.red(`❌ Cannot install in critical system directory: ${projectRoot}`));
+        console.error(chalk.yellow('Please run from a safe project directory.'));
+        throw new Error(`Installation blocked: critical system directory`);
+    }
+    
     const spinner = ora('Installing vibe...').start();
 
     try {
@@ -197,7 +214,6 @@ export async function installCommand(
 
         spinner.text = 'Detecting agents...';
 
-        const projectRoot = process.cwd();
         const adapters = AdapterRegistry.getAllAdapters();
         const detector = new AgentDetector(adapters);
         let detectedAgents = await detector.detectAll();

apps/cli/src/commands/update.ts

@@ -63,6 +63,23 @@ export async function updateCommand(
         dryRun?: boolean;
     } = {}
 ): Promise<void> {
+    const projectRoot = path.resolve(process.cwd());
+    const criticalPaths = [
+        '/', '/usr', '/etc', '/var', '/System', '/Library', '/bin', '/sbin', '/opt', '/boot',
+        '/private/etc', '/private/var', '/private/tmp'
+    ];
+    
+    const isCriticalDir = criticalPaths.some(critical => {
+        const resolvedCritical = path.resolve(critical);
+        return projectRoot === resolvedCritical || projectRoot.startsWith(resolvedCritical + path.sep);
+    });
+    
+    if (isCriticalDir) {
+        console.error(chalk.red(`❌ Cannot update in critical system directory: ${projectRoot}`));
+        console.error(chalk.yellow('Please run from a safe project directory.'));
+        throw new Error(`Update blocked: critical system directory`);
+    }
+    
     const spinner = ora('Updating vibe...').start();
 
     try {
@@ -92,7 +109,6 @@ export async function updateCommand(
             vibeManifest = result.manifest;
         }
 
-        const projectRoot = process.cwd();
         const vibeDir = getVibePackageDir(vibeManifest.name, vibeManifest.version);
 
         if (!vibeManifest.symlinks) {

apps/cli/src/stash/conflict-detector.ts

@@ -1,5 +1,6 @@
 import { existsSync, statSync } from 'node:fs';
 import path from 'node:path';
+import crypto from 'node:crypto';
 import { HashCalculator } from './hash-calculator.js';
 
 export interface Conflict {
@@ -68,7 +69,9 @@ export class ConflictDetector {
         if (stats.isDirectory()) {
             const hashes = await this.hashCalculator.calculateDirectory(filePath);
             const allHashes = Array.from(hashes.values()).join('');
-            return this.hashCalculator.calculateFile(Buffer.from(allHashes) as any) || allHashes.substring(0, 64);
+            const hash = crypto.createHash('sha256');
+            hash.update(allHashes);
+            return hash.digest('hex');
         }
 
         return this.hashCalculator.calculateFile(filePath);