agentgui 1.0.792 → 1.0.794
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/routes-util.js +5 -1
- package/package.json +1 -1
- package/server.js +1 -1
package/lib/routes-util.js
CHANGED
|
@@ -57,7 +57,11 @@ export function register(deps) {
|
|
|
57
57
|
const body = await parseBody(req);
|
|
58
58
|
const folderPath = body.path || STARTUP_CWD;
|
|
59
59
|
try {
|
|
60
|
-
const expandedPath = folderPath.startsWith('~') ? folderPath.replace('~', os.homedir()) : folderPath;
|
|
60
|
+
const expandedPath = path.resolve(folderPath.startsWith('~') ? folderPath.replace('~', os.homedir()) : folderPath);
|
|
61
|
+
if (!expandedPath.startsWith(os.homedir()) && !expandedPath.startsWith(STARTUP_CWD) && expandedPath !== '/') {
|
|
62
|
+
sendJSON(req, res, 403, { error: 'Path outside allowed directories' });
|
|
63
|
+
return;
|
|
64
|
+
}
|
|
61
65
|
const entries = fs.readdirSync(expandedPath, { withFileTypes: true });
|
|
62
66
|
const folders = entries
|
|
63
67
|
.filter(e => e.isDirectory() && !e.name.startsWith('.'))
|
package/package.json
CHANGED
package/server.js
CHANGED
|
@@ -2543,7 +2543,7 @@ wss.on('connection', (ws, req) => {
|
|
|
2543
2543
|
|
|
2544
2544
|
const BROADCAST_TYPES = new Set([
|
|
2545
2545
|
'message_created', 'conversation_created', 'conversation_updated',
|
|
2546
|
-
'conversations_updated', 'conversation_deleted', 'all_conversations_deleted', 'queue_status', 'queue_updated',
|
|
2546
|
+
'conversations_updated', 'conversation_deleted', 'all_conversations_deleted', 'queue_status', 'queue_updated', 'queue_item_dequeued',
|
|
2547
2547
|
'rate_limit_hit', 'rate_limit_clear',
|
|
2548
2548
|
'script_started', 'script_stopped', 'script_output',
|
|
2549
2549
|
'model_download_progress', 'stt_progress', 'tts_setup_progress', 'voice_list',
|