From e42b76255367cb2b096a050035a1d0724d7a1f83 Mon Sep 17 00:00:00 2001
From: Mahima Shanware <mahima.shanware@gmail.com>
Date: Tue, 7 Apr 2026 03:26:29 +0000
Subject: [PATCH] fix(core): ensure path validation always executes even if
 mkdirSync fails

---
 packages/core/src/config/config.ts | 47 +++++++++++++++---------------
 1 file changed, 24 insertions(+), 23 deletions(-)

diff --git a/packages/core/src/config/config.ts b/packages/core/src/config/config.ts
index 9758ea85ee..f6526de046 100644
--- a/packages/core/src/config/config.ts
+++ b/packages/core/src/config/config.ts
@@ -2270,35 +2270,36 @@ export class Config implements McpContext, AgentLoopContext {
       return plansDir;
     }
 
+    let mkdirError: unknown;
     try {
       fs.mkdirSync(plansDir, { recursive: true });
-
-      const realPlansDir = resolveToRealPath(plansDir);
-      const realProjectRoot = this.storage.getRealProjectRoot();
-      const realGlobalGeminiDir = resolveToRealPath(
-        Storage.getGlobalGeminiDir(),
-      );
-
-      if (
-        !isSubpath(realProjectRoot, realPlansDir) &&
-        !isSubpath(realGlobalGeminiDir, realPlansDir)
-      ) {
-        throw new SecurityError(
-          `Security violation: Resolved plan directory '${realPlansDir}' is outside both the project root '${realProjectRoot}' and the global configuration directory.`,
-        );
-      }
-
-      this.initializedPlanDirs.add(plansDir);
-      this.workspaceContext.addDirectory(realPlansDir);
     } catch (e: unknown) {
-      if (e instanceof SecurityError) {
-        throw e;
-      }
-      this.initializedPlanDirs.add(plansDir); // Don't try again and spam stderr
-      const errorMessage = e instanceof Error ? e.message : String(e);
+      mkdirError = e;
+    }
+
+    const realPlansDir = resolveToRealPath(plansDir);
+    const realProjectRoot = this.storage.getRealProjectRoot();
+    const realGlobalGeminiDir = resolveToRealPath(Storage.getGlobalGeminiDir());
+
+    if (
+      !isSubpath(realProjectRoot, realPlansDir) &&
+      !isSubpath(realGlobalGeminiDir, realPlansDir)
+    ) {
+      throw new SecurityError(
+        `Security violation: Resolved plan directory '${realPlansDir}' is outside both the project root '${realProjectRoot}' and the global configuration directory.`,
+      );
+    }
+
+    this.initializedPlanDirs.add(plansDir);
+
+    if (mkdirError) {
+      const errorMessage =
+        mkdirError instanceof Error ? mkdirError.message : String(mkdirError);
       process.stderr.write(
         `Failed to initialize active plan directory at '${plansDir}': ${errorMessage}\n`,
       );
+    } else {
+      this.workspaceContext.addDirectory(realPlansDir);
     }
     return plansDir;
   }