@ccpocket/bridge 1.32.0 → 1.33.1

package/dist/websocket.js

@@ -20,6 +20,7 @@ import { PushRelayClient } from "./push-relay.js";
 import { normalizePushLocale, t } from "./push-i18n.js";
 import { fetchAllUsage } from "./usage.js";
 import { getPackageVersion } from "./version.js";
+import { isPathWithinAllowedDirectory, resolvePlatformPath, } from "./path-utils.js";
 // ---- Available model lists (delivered to clients via session_list) ----
 const CLAUDE_MODELS = [
     "claude-opus-4-6",
@@ -151,8 +152,9 @@ export class BridgeWebSocketServer {
     tokenPrivacyMode = new Map();
     failSetPermissionMode = envFlagEnabled("BRIDGE_FAIL_SET_PERMISSION_MODE");
     failSetSandboxMode = envFlagEnabled("BRIDGE_FAIL_SET_SANDBOX_MODE");
+    platform;
     constructor(options) {
-        const { server, apiKey, allowedDirs, imageStore, galleryStore, projectHistory, debugTraceStore, recordingStore, firebaseAuth, promptHistoryBackup, } = options;
+        const { server, apiKey, allowedDirs, imageStore, galleryStore, projectHistory, debugTraceStore, recordingStore, firebaseAuth, promptHistoryBackup, platform, } = options;
         this.apiKey = apiKey ?? null;
         this.allowedDirs = allowedDirs ?? [];
         this.imageStore = imageStore ?? null;
@@ -163,6 +165,7 @@ export class BridgeWebSocketServer {
         this.worktreeStore = new WorktreeStore();
         this.pushRelay = new PushRelayClient({ firebaseAuth });
         this.promptHistoryBackup = promptHistoryBackup ?? null;
+        this.platform = platform ?? process.platform;
         this.archiveStore = new ArchiveStore();
         void this.debugTraceStore.init().catch((err) => {
             console.error("[ws] Failed to initialize debug trace store:", err);
@@ -218,8 +221,7 @@ export class BridgeWebSocketServer {
     isPathAllowed(path) {
         if (this.allowedDirs.length === 0)
             return true;
-        const resolved = resolve(path);
-        return this.allowedDirs.some((dir) => resolved === dir || resolved.startsWith(dir + "/"));
+        return this.allowedDirs.some((dir) => isPathWithinAllowedDirectory(path, dir, this.platform));
     }
     /** Build a user-friendly error for disallowed project paths. */
     buildPathNotAllowedError(projectPath) {
@@ -385,7 +387,8 @@ export class BridgeWebSocketServer {
         }
         switch (msg.type) {
             case "start": {
-                if (!this.isPathAllowed(msg.projectPath)) {
+                const projectPath = resolvePlatformPath(msg.projectPath, this.platform);
+                if (!this.isPathAllowed(projectPath)) {
                     this.send(ws, this.buildPathNotAllowedError(msg.projectPath));
                     break;
                 }
@@ -414,9 +417,9 @@ export class BridgeWebSocketServer {
                         console.log(`[ws] start(codex): execution=${executionMode} plan=${planMode}`);
                     }
                     const cached = provider === "claude"
-                        ? this.sessionManager.getCachedCommands(msg.projectPath)
+                        ? this.sessionManager.getCachedCommands(projectPath)
                         : undefined;
-                    const sessionId = this.sessionManager.create(msg.projectPath, {
+                    const sessionId = this.sessionManager.create(projectPath, {
                         sessionId: msg.sessionId,
                         continueMode: msg.continue,
                         permissionMode: legacyPermissionMode,
@@ -453,11 +456,11 @@ export class BridgeWebSocketServer {
                         : undefined);
                     const createdSession = this.sessionManager.get(sessionId);
                     // Load saved session name from CLI storage (for resumed sessions)
-                    void this.loadAndSetSessionName(createdSession, provider, msg.projectPath, msg.sessionId).then(() => {
+                    void this.loadAndSetSessionName(createdSession, provider, projectPath, msg.sessionId).then(() => {
                         this.send(ws, this.buildSessionCreatedMessage({
                             sessionId,
                             provider,
-                            projectPath: msg.projectPath,
+                            projectPath,
                             session: createdSession,
                             permissionMode: legacyPermissionMode,
                             executionMode,
@@ -491,14 +494,14 @@ export class BridgeWebSocketServer {
                         direction: "internal",
                         channel: "bridge",
                         type: "session_created",
-                        detail: `provider=${provider} projectPath=${msg.projectPath}`,
+                        detail: `provider=${provider} projectPath=${projectPath}`,
                     });
                     this.recordingStore?.saveMeta(sessionId, {
                         bridgeSessionId: sessionId,
-                        projectPath: msg.projectPath,
+                        projectPath,
                         createdAt: new Date().toISOString(),
                     });
-                    this.projectHistory?.addProject(msg.projectPath);
+                    this.projectHistory?.addProject(projectPath);
                 }
                 catch (err) {
                     console.error(`[ws] Failed to start session:`, err);
@@ -1481,7 +1484,8 @@ export class BridgeWebSocketServer {
             }
             case "resume_session": {
                 console.log(`[ws] resume_session: sessionId=${msg.sessionId} projectPath=${msg.projectPath} provider=${msg.provider ?? "claude"}`);
-                if (!this.isPathAllowed(msg.projectPath)) {
+                const resumeProjectPath = resolvePlatformPath(msg.projectPath, this.platform);
+                if (!this.isPathAllowed(resumeProjectPath)) {
                     this.send(ws, this.buildPathNotAllowedError(msg.projectPath));
                     break;
                 }
@@ -1510,7 +1514,7 @@ export class BridgeWebSocketServer {
                 // via get_history(sessionId) to avoid duplicate/missed replay races.
                 if (provider === "codex") {
                     const wtMapping = this.worktreeStore.get(sessionRefId);
-                    const effectiveProjectPath = wtMapping?.projectPath ?? msg.projectPath;
+                    const effectiveProjectPath = resolvePlatformPath(wtMapping?.projectPath ?? resumeProjectPath, this.platform);
                     let worktreeOpts;
                     if (wtMapping) {
                         if (worktreeExists(wtMapping.worktreePath)) {
@@ -1576,7 +1580,7 @@ export class BridgeWebSocketServer {
                     break;
                 }
                 const claudeSessionId = sessionRefId;
-                const cached = this.sessionManager.getCachedCommands(msg.projectPath);
+                const cached = this.sessionManager.getCachedCommands(resumeProjectPath);
                 // Look up worktree mapping for this Claude session
                 const wtMapping = this.worktreeStore.get(claudeSessionId);
                 let worktreeOpts;
@@ -1598,7 +1602,7 @@ export class BridgeWebSocketServer {
                 }
                 getSessionHistory(claudeSessionId)
                     .then((pastMessages) => {
-                    const sessionId = this.sessionManager.create(msg.projectPath, {
+                    const sessionId = this.sessionManager.create(resumeProjectPath, {
                         sessionId: claudeSessionId,
                         permissionMode: legacyPermissionMode,
                         model: msg.model,
@@ -1613,12 +1617,12 @@ export class BridgeWebSocketServer {
                             : {}),
                     }, pastMessages, worktreeOpts);
                     const createdSession = this.sessionManager.get(sessionId);
-                    void this.loadAndSetSessionName(createdSession, "claude", msg.projectPath, claudeSessionId).then(() => {
+                    void this.loadAndSetSessionName(createdSession, "claude", resumeProjectPath, claudeSessionId).then(() => {
                         this.send(ws, {
                             ...this.buildSessionCreatedMessage({
                                 sessionId,
                                 provider: "claude",
-                                projectPath: msg.projectPath,
+                                projectPath: resumeProjectPath,
                                 session: createdSession,
                                 permissionMode: legacyPermissionMode,
                                 executionMode,
@@ -1645,7 +1649,7 @@ export class BridgeWebSocketServer {
                         type: "session_resumed",
                         detail: `provider=claude session=${claudeSessionId}`,
                     });
-                    this.projectHistory?.addProject(msg.projectPath);
+                    this.projectHistory?.addProject(resumeProjectPath);
                 })
                     .catch((err) => {
                     this.send(ws, {
@@ -3333,7 +3337,7 @@ export class BridgeWebSocketServer {
             else {
                 const absPath = resolve(cwd, filePath);
                 // Verify resolved path stays within cwd
-                if (!absPath.startsWith(resolve(cwd) + "/")) {
+                if (!isPathWithinAllowedDirectory(absPath, cwd, this.platform)) {
                     return { error: "Invalid file path" };
                 }
                 buf = await readFile(absPath);