aicodeman 1.46.0 → 1.47.0

package/dist/web/public/sw.js

@@ -26,7 +26,7 @@
 // not the current one, so the old constant key meant that cleanup never deleted
 // anything — hashed assets from every release ever deployed accumulated in one
 // bucket until the origin hit its storage quota.
-const BUILD_ID = '86c261a69d9f';
+const BUILD_ID = 'fada7ad2af00';
 const CACHE_NAME = `codeman-${BUILD_ID}`;
 
 // Reverse-proxy base path: the worker is served at `<base>/sw.js`, so its own
@@ -48,7 +48,7 @@ const B = (p) => (p && p[0] === '/' ? SW_BASE + p : p);
 // handler caches every successful GET at runtime, but the precache warmed
 // nothing while looking like it did. Deriving it from the same manifest that
 // renames the files is the only thing that keeps the two from drifting again.
-const HASHED_ASSETS = ["styles.7238eae8.css", "mobile.1bbd2d67.css", "constants.affcdde6.js", "i18n.70265257.js", "mobile-handlers.f7c3f692.js", "voice-input.2342c37b.js", "notification-manager.feb82c04.js", "keyboard-accessory.4e8b20ac.js", "input-cjk.8bc46081.js", "mobile-ime-preview.2dbaf262.js", "terminal-keycode229-recovery.af09f99a.js", "sanitize-html.e7147e76.js", "tab-layout-browser.2d6189f7.js", "app.3093527f.js", "tab-rail-resize.b5cdceaf.js", "header-divider.eb2d2463.js", "terminal-ui.7e787829.js", "respawn-ui.d7adcf6a.js", "ralph-panel.b350e2ef.js", "settings-ui.a191154e.js", "panels-ui.4a56ee63.js", "session-ui.186f9419.js", "ralph-wizard.b6c0dd19.js", "api-client.c9b1cddc.js", "subagent-windows.07277a58.js", "image-input.941386e7.js", "spreadsheet-preview.75c751de.js", "vendor/xterm-zerolag-input.1be42307.js", "vendor/xterm-predictive-echo.276b11d9.js"];
+const HASHED_ASSETS = ["styles.4f0c67a0.css", "mobile.1bbd2d67.css", "constants.affcdde6.js", "i18n.a618ef4e.js", "mobile-handlers.f7c3f692.js", "voice-input.2342c37b.js", "notification-manager.feb82c04.js", "keyboard-accessory.ff64fafc.js", "input-cjk.8bc46081.js", "mobile-ime-preview.2dbaf262.js", "terminal-keycode229-recovery.98843069.js", "sanitize-html.e7147e76.js", "tab-layout-browser.2d6189f7.js", "app.fe8a6b4c.js", "tab-rail-resize.b5cdceaf.js", "header-divider.eb2d2463.js", "terminal-ui.7e787829.js", "respawn-ui.d7adcf6a.js", "ralph-panel.b350e2ef.js", "settings-ui.a191154e.js", "panels-ui.4a56ee63.js", "session-ui.426fb671.js", "ralph-wizard.b6c0dd19.js", "api-client.c9b1cddc.js", "subagent-windows.07277a58.js", "image-input.a5d0f8f3.js", "spreadsheet-preview.75c751de.js", "vendor/xterm-zerolag-input.1be42307.js", "vendor/xterm-predictive-echo.276b11d9.js"];
 
 // Core app shell -- cached on install for instant startup
 const APP_SHELL = [

package/dist/web/public/terminal-keycode229-recovery.98843069.js

@@ -0,0 +1 @@
+"use strict";(function(c){"use strict";function T(o,t){const u=Array.from(o),d=Array.from(t);let r=0;const y=Math.min(u.length,d.length);for(;r<y&&u[r]===d[r];)r+=1;return{deleted:u.length-r,inserted:d.slice(r).join("")}}function D(){try{return/Android/i.test(c.navigator?.userAgent||"")?!0:c.matchMedia?.("(pointer: coarse)")?.matches===!0}catch{return!1}}function M(o){if(!D())return null;const t=o?.textarea,u=o?.emitRecovered;if(!t?.addEventListener||!t?.removeEventListener||typeof u!="function")return null;const d=o.isScreenReaderMode,r=o.setTimer||c.setTimeout.bind(c),y=o.clearTimer||c.clearTimeout.bind(c);let i=!1,p=0,x=0,v=!1;const m=[];let g=()=>{};function j(){for(const e of m.splice(0)){if(e.timer!==null){try{y(e.timer)}catch{}e.timer=null}S(e)}}function C(){for(const e of m.splice(0))if(e.active=!1,e.timer!==null){try{y(e.timer)}catch{}e.timer=null}}function S(e){const n=m.indexOf(e);if(n!==-1&&m.splice(n,1),e.timer=null,!(!e.active||i)&&(e.active=!1,!(p>e.snapshot)))try{u(e.data)}catch{}}function k(){p+=1}function K(e){i||e?.type!=="keydown"||(g(e),j(),x=p)}function w(e){if(i||v||e?.isComposing||e.inputType!=="insertText")return;const n=e.data;if(typeof n!="string"||n==="")return;try{if(d?.())return}catch{return}const a={data:n,snapshot:x??p,active:!0,timer:null};m.push(a);try{a.timer=r(()=>S(a),0)}catch{C()}}function O(){let e;try{e=o.getCompositionHelper?.()}catch{return null}const n=e?._handleAnyTextareaChanges,a=e?._coreService;if(typeof n!="function"||typeof a?.triggerDataEvent!="function")return null;let h=t.value;const f=new Set;function R(){if(i||e._isComposing)return;const l=t.value;if(l===h)return;const{deleted:s,inserted:E}=T(h,l);h=l;try{for(let z=0;z<s;z+=1)a.triggerDataEvent("\x7F",!0);E&&(e._dataAlreadySent=E,a.triggerDataEvent(E,!0))}catch{}}return e._handleAnyTextareaChanges=function(){if(i)return n.call(this);f.size===0&&h!==t.value&&(h=t.value);const s={id:null};f.add(s),s.id=r(()=>{f.delete(s),R()},0)},g=l=>{if(f.size!==0){for(const s of f)try{y(s.id)}catch{}f.clear(),!(e._isSendingComposition&&![229,20,16,17,18].includes(l?.keyCode))&&R()}},()=>{g=()=>{},e._handleAnyTextareaChanges!==n&&(e._handleAnyTextareaChanges=n)}}const P=O();function A(){i||(v=!0,C())}function L(){i||(v=!1)}function _(){if(!i){i=!0,C();try{P?.()}catch{}try{t.removeEventListener("input",w,!0),t.removeEventListener("compositionstart",A,!0),t.removeEventListener("compositionend",L,!0)}catch{}}}try{t.addEventListener("input",w,!0),t.addEventListener("compositionstart",A,!0),t.addEventListener("compositionend",L,!0)}catch{return _(),null}return Object.freeze({handleKeyEvent:K,notifyCanonicalData:k,destroy:_})}c.CodemanKeyCode229Recovery=Object.freeze({create:M,editBetween:T})})(typeof window<"u"?window:globalThis);

package/dist/web/public/terminal-tile.js

@@ -344,9 +344,10 @@
         if (global.app?.tileShortcutFor?.(ev)) return false;
         // Ctrl+V / Cmd+V: the primary pane's paste trap, aimed at THIS pane, so
         // a pasted image uploads to this pane's session and its path is typed
-        // here, and pasted text goes into this xterm with its bracketed-paste
-        // markers intact. Mirrors terminal-ui.js's own Ctrl+V gate; without it
-        // xterm's default only ever pasted text.
+        // here. Plain text goes to this pane's session as a Codeman-built
+        // bracketed-paste frame; this terminal is only refocused and receives
+        // input(framed), which onData delivers. Mirrors terminal-ui.js's own
+        // Ctrl+V gate; without it xterm's default only ever pasted text.
         if ((ev.ctrlKey || ev.metaKey) && ev.key === 'v' && ev.type === 'keydown') {
           global.app?._handleImagePaste?.({ terminal: this.terminal, sessionId: this.sessionId });
           return false;
@@ -646,9 +647,10 @@
     // Recovered text goes straight to _onTerminalData(), never through xterm's
     // onData, so it is not counted as xterm's own (see connect()'s onData).
     // Created after terminal.open(): xterm's capture `input` listener on the
-    // textarea is registered there, and must run before the controller's. No
-    // device or mode gate, as in the primary pane: with a hardware keyboard it
-    // costs one assignment per keydown. A failure leaves xterm's own handling.
+    // textarea is registered there, and must run before the controller's.
+    // create() returns null on a fine pointer (#716): the recovery is for soft
+    // keyboards, and on a desktop it delivers a dead-key character twice.
+    // A failure leaves xterm's own handling.
     _createKeyCode229Recovery() {
       this._destroyKeyCode229Recovery();
       if (!this.terminal) return;

package/dist/web/public/whats-new.json

@@ -1,13 +1,12 @@
 {
-  "version": "1.46.0",
+  "version": "1.47.0",
   "highlights": [
-    "Fetch from the Git status window (#714)",
-    "Start a session beside any tab (#712, opt-in)",
-    "The phone keyboard no longer costs Claude its transcript (#711)",
-    "Typing stays smooth in a long prompt (#713)",
-    "Links survive wrapping and spaces (#686, #687)",
-    "`codeman agent spawn` in a project directory (#708)",
-    "Read saved Codex conversations offline (#707)",
-    "Experimental: bounded inspection and guarded submission for agents (#694, opt-in)"
+    "The wrapped tab strip uses the room under the toolbar (#721)",
+    "Bodyless requests work through Cloudflare Tunnel (#725)",
+    "A desktop dead key is typed once, and Ctrl+V stays a paste after a replay (#726, #716)",
+    "Remote sessions no longer touch the local disk at their path (#722, #727, #728)",
+    "Rendered Markdown fills a resized File Viewer (#730)",
+    "A middle click on a file path opens the file (#731)",
+    "No more duplicate-key warning on build (#729)"
   ]
 }

package/dist/web/request-body-parser.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @fileoverview Accept empty, untyped API POSTs even when a reverse proxy frames them as chunked.
+ *
+ * Cloudflare Tunnel (cloudflared, Go's HTTP client) forwards a bodyless POST as an HTTP/1.1
+ * chunked request with no Content-Type and a zero-length body. Fastify only skips its
+ * content-type check for a `Content-Length: 0` request, so this framing was refused 415
+ * (`FST_ERR_CTP_INVALID_MEDIA_TYPE`) before the route ran, breaking actions such as opening a
+ * saved web tab. This parser lets such a request reach its route with `request.body === undefined`,
+ * exactly as a `Content-Length: 0` request does.
+ *
+ * Scope is POST under `/api/` only: Go frames an empty body of unknown length as chunked for
+ * POST, PUT and PATCH and drops it for DELETE, and every PUT/PATCH the frontend sends carries a
+ * JSON body. Anything else (another method, a non-API route, a Content-Type, a non-zero
+ * Content-Length, or a single body byte) is still the 415 Fastify would have answered.
+ *
+ * ⚠️ It owns the ROOT `'*'` content-type slot. The JSON, `text/plain` (kept RAW, see the CSRF
+ * note in CLAUDE.md) and multipart parsers match first; the web-tab proxy registers its own
+ * `'*'` in an encapsulated scope and is unaffected. Fastify refuses a second root `'*'` parser at
+ * boot (`FST_ERR_CTP_ALREADY_PRESENT`), so extend this function instead of adding one.
+ */
+import { type FastifyInstance } from 'fastify';
+export declare function installEmptyApiPostParser(app: FastifyInstance): void;
+//# sourceMappingURL=request-body-parser.d.ts.map

package/dist/web/request-body-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-body-parser.d.ts","sourceRoot":"","sources":["../../src/web/request-body-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAc,KAAK,eAAe,EAAuB,MAAM,SAAS,CAAC;AAGhF,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CAmCpE"}

package/dist/web/request-body-parser.js

@@ -0,0 +1,57 @@
+/**
+ * @fileoverview Accept empty, untyped API POSTs even when a reverse proxy frames them as chunked.
+ *
+ * Cloudflare Tunnel (cloudflared, Go's HTTP client) forwards a bodyless POST as an HTTP/1.1
+ * chunked request with no Content-Type and a zero-length body. Fastify only skips its
+ * content-type check for a `Content-Length: 0` request, so this framing was refused 415
+ * (`FST_ERR_CTP_INVALID_MEDIA_TYPE`) before the route ran, breaking actions such as opening a
+ * saved web tab. This parser lets such a request reach its route with `request.body === undefined`,
+ * exactly as a `Content-Length: 0` request does.
+ *
+ * Scope is POST under `/api/` only: Go frames an empty body of unknown length as chunked for
+ * POST, PUT and PATCH and drops it for DELETE, and every PUT/PATCH the frontend sends carries a
+ * JSON body. Anything else (another method, a non-API route, a Content-Type, a non-zero
+ * Content-Length, or a single body byte) is still the 415 Fastify would have answered.
+ *
+ * ⚠️ It owns the ROOT `'*'` content-type slot. The JSON, `text/plain` (kept RAW, see the CSRF
+ * note in CLAUDE.md) and multipart parsers match first; the web-tab proxy registers its own
+ * `'*'` in an encapsulated scope and is unaffected. Fastify refuses a second root `'*'` parser at
+ * boot (`FST_ERR_CTP_ALREADY_PRESENT`), so extend this function instead of adding one.
+ */
+import { errorCodes } from 'fastify';
+export function installEmptyApiPostParser(app) {
+    // Existing JSON, text and multipart parsers take precedence. The webview
+    // proxy installs its own parser in an encapsulated scope.
+    app.addContentTypeParser('*', async (req, payload) => {
+        // Fastify normally skips an unsupported parser on its 404 path. Preserve
+        // that behavior, including the unread stream used by referer fallbacks.
+        if (req.is404)
+            return undefined;
+        if (req.method !== 'POST' ||
+            !req.routeOptions.url?.startsWith('/api/') ||
+            req.headers['content-type'] !== undefined ||
+            (req.headers['content-length'] !== undefined && req.headers['content-length'] !== '0')) {
+            throw new errorCodes.FST_ERR_CTP_INVALID_MEDIA_TYPE();
+        }
+        // Wait for the terminating chunk to prove the body is empty. Reject on the
+        // first byte instead of buffering an unsupported body. Leave the socket
+        // alive so Fastify can send its 415 and close the connection on parser errors.
+        try {
+            for await (const chunk of payload.iterator({ destroyOnReturn: false })) {
+                if (Buffer.byteLength(chunk) > 0)
+                    throw new errorCodes.FST_ERR_CTP_INVALID_MEDIA_TYPE();
+            }
+        }
+        catch (error) {
+            // Match Fastify's body reader: an interrupted request is a client error.
+            const err = error;
+            if (typeof err.statusCode !== 'number' || err.statusCode < 400)
+                err.statusCode = 400;
+            throw err;
+        }
+        // No synthetic JSON or header rewriting: required-body validation still
+        // sees the same undefined value as a direct Content-Length: 0 request.
+        return undefined;
+    });
+}
+//# sourceMappingURL=request-body-parser.js.map

package/dist/web/request-body-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-body-parser.js","sourceRoot":"","sources":["../../src/web/request-body-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAA6C,MAAM,SAAS,CAAC;AAGhF,MAAM,UAAU,yBAAyB,CAAC,GAAoB;IAC5D,yEAAyE;IACzE,0DAA0D;IAC1D,GAAG,CAAC,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAmB,EAAE,OAAiB,EAAE,EAAE;QAC7E,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,GAAG,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAEhC,IACE,GAAG,CAAC,MAAM,KAAK,MAAM;YACrB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC;YAC1C,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,SAAS;YACzC,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,GAAG,CAAC,EACtF,CAAC;YACD,MAAM,IAAI,UAAU,CAAC,8BAA8B,EAAE,CAAC;QACxD,CAAC;QAED,2EAA2E;QAC3E,wEAAwE;QACxE,+EAA+E;QAC/E,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBACvE,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,UAAU,CAAC,8BAA8B,EAAE,CAAC;YAC1F,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,MAAM,GAAG,GAAG,KAAwC,CAAC;YACrD,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG;gBAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrF,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/web/routes/file-routes.d.ts

@@ -58,6 +58,11 @@ export declare function sendFileBody(reply: FastifyReply, size: number, rangeHea
  * the form is refused instead of guessed.
  */
 export declare const DOCKER_HOME_PATH_ERROR = "A ~/ path inside a Docker case is the container home, which this server cannot read; use the absolute path";
+/**
+ * Whether `candidate` is `root` itself or lies beneath it (both already resolved). The one lexical
+ * containment check for workspace confinement; ralph-routes.ts uses it for a remote `@fix_plan.md`.
+ */
+export declare function isPathWithinRoot(root: string, candidate: string): boolean;
 export declare function registerFileRoutes(app: FastifyInstance, ctx: SessionPort & EventPort & ConfigPort): void;
 export {};
 //# sourceMappingURL=file-routes.d.ts.map

package/dist/web/routes/file-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-routes.d.ts","sourceRoot":"","sources":["../../../src/web/routes/file-routes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAG7D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAgE5C,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAU5E;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,QAAmB,CAAC;AAgH/D;;;GAGG;AACH,UAAU,cAAc;IACtB,OAAO,EAAE,QAAQ,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,IAC1C,QAAQ;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,KAAG,cAAc,CAGhE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EAC1C,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,KAAK,cAAc,GAC/D,IAAI,CAyBN;AAoTD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,+GAC2E,CAAC;AA2tB/G,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,IAAI,CA09CxG"}
+{"version":3,"file":"file-routes.d.ts","sourceRoot":"","sources":["../../../src/web/routes/file-routes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAG7D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAgE5C,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAU5E;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,QAAmB,CAAC;AAgH/D;;;GAGG;AACH,UAAU,cAAc;IACtB,OAAO,EAAE,QAAQ,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,IAC1C,QAAQ;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,KAAG,cAAc,CAGhE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EAC1C,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,KAAK,cAAc,GAC/D,IAAI,CAyBN;AAoTD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,+GAC2E,CAAC;AA0L/G;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAGzE;AA8hBD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,IAAI,CA09CxG"}

package/dist/web/routes/file-routes.js

@@ -515,7 +515,11 @@ const FILESYSTEM_BINARY_PREVIEW_LIMIT = 50 * 1024 * 1024;
 const FILESYSTEM_IMAGE_PREVIEW_EXTENSIONS = new Set(['png', 'jpg', 'jpeg', 'gif', 'webp', 'bmp']);
 const FILESYSTEM_TEXT_PREVIEW_EXTENSIONS = new Set(['md', 'txt', 'json']);
 const FILESYSTEM_DOCUMENT_PREVIEW_EXTENSIONS = new Set(['pdf', 'docx', 'pptx']);
-function isPathWithinRoot(root, candidate) {
+/**
+ * Whether `candidate` is `root` itself or lies beneath it (both already resolved). The one lexical
+ * containment check for workspace confinement; ralph-routes.ts uses it for a remote `@fix_plan.md`.
+ */
+export function isPathWithinRoot(root, candidate) {
     const rel = relative(root, candidate);
     return rel === '' || (!isAbsolute(rel) && rel !== '..' && !rel.startsWith(`..${sep}`));
 }