git-workspace-service 0.4.1 → 0.4.3

package/dist/index.js

@@ -617,7 +617,13 @@ var WorkspaceService = class {
       });
     }
     try {
-      await fs3.rm(workspace.path, { recursive: true, force: true });
+      const realPath = await fs3.realpath(workspace.path);
+      const realBase = await fs3.realpath(this.baseDir);
+      if (!realPath.startsWith(realBase + path.sep) && realPath !== realBase) {
+        this.log("error", { workspaceId, realPath, realBase }, "Workspace path resolves outside baseDir \u2014 refusing to delete");
+      } else {
+        await fs3.rm(workspace.path, { recursive: true, force: true });
+      }
     } catch (error) {
       const errorMessage = error instanceof Error ? error.message : String(error);
       this.log("warn", { workspaceId, error: errorMessage }, "Failed to remove workspace directory");
@@ -650,6 +656,7 @@ var WorkspaceService = class {
     if (cloneUrl.startsWith("git@github.com:")) {
       cloneUrl = cloneUrl.replace("git@github.com:", "https://github.com/");
     }
+    cloneUrl = cloneUrl.replace(/\/+$/, "");
     if (!cloneUrl.endsWith(".git")) {
       cloneUrl = `${cloneUrl}.git`;
     }
@@ -784,6 +791,7 @@ var WorkspaceService = class {
     if (url.startsWith("git@github.com:")) {
       url = url.replace("git@github.com:", "https://github.com/");
     }
+    url = url.replace(/\/+$/, "");
     if (!url.endsWith(".git")) {
       url = `${url}.git`;
     }