Function assertNotInternalPath

packages/server/src/routes/files.ts:109–124

(...candidates: Array<string | null | undefined>)

}

async function assertNotInternalPath(...candidates: Array<string | null | undefined>) {
  const roots = await getProtectedInternalRoots();

  for (const candidate of candidates) {
    if (!candidate) continue;
    const resolved = path.resolve(candidate);
    const real = await resolveExistingPath(resolved);
    const paths = real && real !== resolved ? [resolved, real] : [resolved];

    if (paths.some((item) => roots.some((root) => isSameOrChildPath(item, root)))) {
      const err: any = new Error('Internal Agent Tower files are not accessible');
      err.code = 'INTERNAL_PATH_FORBIDDEN';
      throw err;
    }
  }
}

async function resolveInWorkingDir(workingDir: string, userPath: string | undefined) {
  const baseReal = await fs.realpath(workingDir);