shumengya/sproutclaw
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(coding-agent): make trust input traversal portable

Browse Source
This commit is contained in:
Mario Zechner
2026-06-06 22:32:35 +02:00
parent 89a92207f1
commit ff3e9df5f5
1 changed files with 3 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
packages/coding-agent/src/core/trust-manager.ts
View File

@@ -1,5 +1,5 @@
import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
import { dirname, join, resolve } from "node:path"; import { dirname, join } from "node:path";
import lockfile from "proper-lockfile"; import lockfile from "proper-lockfile";
import { CONFIG_DIR_NAME } from "../config.ts"; import { CONFIG_DIR_NAME } from "../config.ts";
import { canonicalizePath, resolvePath } from "../utils/paths.ts"; import { canonicalizePath, resolvePath } from "../utils/paths.ts";
@@ -95,12 +95,11 @@ function withTrustFileLock<T>(path: string, fn: () => T): T {
} }
export function hasProjectTrustInputs(cwd: string): boolean { export function hasProjectTrustInputs(cwd: string): boolean {
let currentDir = resolvePath(cwd); let currentDir = canonicalizePath(resolvePath(cwd));
if (existsSync(join(currentDir, CONFIG_DIR_NAME))) { if (existsSync(join(currentDir, CONFIG_DIR_NAME))) {
return true; return true;
} }
const root = resolve("/");
while (true) { while (true) {
for (const filename of CONTEXT_FILE_NAMES) { for (const filename of CONTEXT_FILE_NAMES) {
if (existsSync(join(currentDir, filename))) { if (existsSync(join(currentDir, filename))) {
@@ -111,11 +110,7 @@ export function hasProjectTrustInputs(cwd: string): boolean {
return true; return true;
} }
if (currentDir === root) { const parentDir = dirname(currentDir);
return false;
}
const parentDir = resolve(currentDir, "..");
if (parentDir === currentDir) { if (parentDir === currentDir) {
return false; return false;
} }