fix: prevent path traversal in memory_read daily date

index.ts

@@ -96,7 +96,19 @@ export function readFileSafe(filePath: string): string | null {
 	}
 }
 
+const DAILY_DATE_REGEX = /^\d{4}-\d{2}-\d{2}$/;
+
+export function isValidDailyDate(date: string): boolean {
+	if (!DAILY_DATE_REGEX.test(date)) return false;
+	const [year, month, day] = date.split("-").map(Number);
+	const parsed = new Date(Date.UTC(year, month - 1, day));
+	return parsed.getUTCFullYear() === year && parsed.getUTCMonth() === month - 1 && parsed.getUTCDate() === day;
+}
+
 export function dailyPath(date: string): string {
+	if (!isValidDailyDate(date)) {
+		throw new Error(`Invalid daily date: ${date}. Expected YYYY-MM-DD.`);
+	}
 	return path.join(DAILY_DIR, `${date}.md`);
 }
 
@@ -1322,6 +1334,13 @@ export default function (pi: ExtensionAPI) {
 
 			if (target === "daily") {
 				const d = date ?? todayStr();
+				if (!isValidDailyDate(d)) {
+					return {
+						content: [{ type: "text", text: `Invalid date format: ${d}. Use YYYY-MM-DD.` }],
+						isError: true,
+						details: { date: d },
+					};
+				}
 				const filePath = dailyPath(d);
 				const content = readFileSafe(filePath);
 				if (!content) {

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-memory",
-	"version": "0.3.6",
+	"version": "0.3.7",
 	"description": "Pi coding agent extension for memory with qmd-powered semantic search across daily logs, long-term memory, and scratchpad",
 	"main": "index.ts",
 	"type": "module",

test/unit.test.ts

@@ -185,6 +185,10 @@ describe("dailyPath", () => {
 		const result = dailyPath("2026-02-15");
 		expect(result).toContain(path.join("daily", "2026-02-15.md"));
 	});
+
+	test("rejects invalid date input", () => {
+		expect(() => dailyPath("../../outside")).toThrow("Invalid daily date");
+	});
 });
 
 describe("ensureDirs", () => {
@@ -821,6 +825,29 @@ describe("memory_read tool", () => {
 		expect(result.content[0].text).toContain("No daily log for 1999-01-01");
 	});
 
+	test("read daily rejects path traversal in date", async () => {
+		const outsideBase = path.join(
+			os.tmpdir(),
+			`pi-memory-outside-${Date.now()}-${Math.random().toString(16).slice(2)}`,
+		);
+		const outsideFile = `${outsideBase}.md`;
+		fs.writeFileSync(outsideFile, "TOP SECRET", "utf-8");
+
+		try {
+			const result = await tools.memory_read.execute(
+				"c1",
+				{ target: "daily", date: `../../${path.basename(outsideBase)}` },
+				null,
+				null,
+				{},
+			);
+			expect(result.isError).toBe(true);
+			expect(result.content[0].text).toContain("Invalid date format");
+		} finally {
+			fs.rmSync(outsideFile, { force: true });
+		}
+	});
+
 	// -- list --
 
 	test("list daily logs when multiple exist", async () => {