agent-theatre 0.1.3 → 0.1.4

package/dist/cli.js

@@ -9,9 +9,9 @@ import pc from "picocolors";
 
 // src/server.ts
 import { createServer } from "http";
-import { existsSync, mkdirSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs";
+import { existsSync, mkdirSync, readFileSync as readFileSync2, rmSync, writeFileSync, realpathSync } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join2, basename as basename2 } from "path";
+import { join as join2, basename as basename2, resolve, sep } from "path";
 import { Hono } from "hono";
 import { getRequestListener } from "@hono/node-server";
 import { WebSocketServer } from "ws";
@@ -1206,6 +1206,8 @@ var Theatre = class {
       } catch {
         return c.body(null, 204);
       }
+      const cwd = typeof payload?.cwd === "string" ? payload.cwd : "";
+      if (cwd && !isWithin(cwd, this.opts.cwd)) return c.body(null, 204);
       const { events } = hookPayloadToEvents(payload, { home: homedir2() });
       if (events.length) this.ingest(events);
       return c.body(null, 204);
@@ -1306,6 +1308,17 @@ var Theatre = class {
     return basename2(this.opts.cwd);
   }
 };
+function isWithin(dir, root) {
+  const norm3 = (p) => {
+    try {
+      return realpathSync(p);
+    } catch {
+      return resolve(p);
+    }
+  };
+  const d = norm3(dir), r = norm3(root);
+  return d === r || d.startsWith(r.endsWith(sep) ? r : r + sep);
+}
 
 // src/scan.ts
 import { readdirSync as readdirSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";