* Canonicalize a path for workspace-root containment checks. Resolves * symlinks via realpath so a symlink such as `/safe/out -> /etc` cannot * be used to escape the configured root with a lexical-only check. * * If the path doesn't exist (e.g. a session is being spawned in a
(path: string)
| 228 | * intermediate symlink in the parent chain has been resolved. |
| 229 | */ |
| 230 | private async resolveForWorkspaceCheck(path: string): Promise<string> { |
| 231 | const absolute = resolvePath(path) |
| 232 | try { |
| 233 | return await realpath(absolute) |
| 234 | } catch { |
| 235 | const missing: string[] = [] |
| 236 | let cursor = absolute |
| 237 | while (cursor !== dirname(cursor)) { |
| 238 | missing.unshift(basename(cursor)) |
| 239 | cursor = dirname(cursor) |
| 240 | try { |
| 241 | return join(await realpath(cursor), ...missing) |
| 242 | } catch { |
| 243 | // keep walking to the nearest existing parent |
| 244 | } |
| 245 | } |
| 246 | return absolute |
| 247 | } |
| 248 | } |
| 249 | |
| 250 | setRPCHandlers({ spawnSession, stopSession, requestShutdown }: MachineRpcHandlers): void { |
| 251 | this.rpcHandlerManager.registerHandler(RPC_METHODS.SpawnHappySession, async (params: any) => { |
no test coverage detected