@evandu/super-pi 0.1.63 → 0.1.64

package/dist/server/http-server.js

@@ -382,16 +382,14 @@ export function createHttpServer(options) {
                 json(403, { error: result.message });
                 return;
             }
-            // Validate cwd is a known workspace. Path comparison is normalized so Windows case
-            // differences or trailing separators do not produce a false "unknown workspace" failure
-            // when the extension hands back the same directory the server handed to it at spawn.
-            const normalized = (value) => value.replace(/[\\/]+/g, "/").replace(/\/+$/, "").toLowerCase();
-            const normalizedCwd = normalized(cwd);
-            const workspace = store.snapshot().workspaces.find((w) => normalized(w.path) === normalizedCwd);
-            if (!workspace) {
-                json(400, { error: `cwd is not a known workspace: ${cwd} (known: ${store.snapshot().workspaces.map((w) => w.path).join(" | ")})` });
-                return;
-            }
+            // The `cwd` here is the directory the Pi child was launched in - which is the conversation's
+            // workspace, already authenticated by the per-conversation capability check above. Validating it
+            // against the workspace list looked cheap, but Windows path normalization (8.3 short names, UNC
+            // prefixes, drive-letter case, separator styles) routinely produces the same path in two different
+            // strings and a strict equality check refused valid calls; a relaxed comparison is no longer
+            // providing a security boundary that the capability check is not already providing. The trust
+            // decision is the one above; this stays as a no-op.
+            void cwd;
             // Set up the background task record BEFORE spawning, so the UI shows it immediately
             const { randomUUID } = await import("node:crypto");
             const sessionId = `exec_${randomUUID()}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evandu/super-pi",
-  "version": "0.1.63",
+  "version": "0.1.64",
   "description": "Web control plane and companion for Pi",
   "license": "MIT",
   "type": "module",