Mahima Shanware 3256b16039 fix(core): mitigate TOCTOU vulnerability in plan directory creation ...

This change addresses a critical security review finding regarding a Time-of-Check to Time-of-Use (TOCTOU) vulnerability.

Previously, plan directory paths were validated using `isSubpath` before creation. However, an attacker could potentially replace a path component with a symlink pointing outside the project root exactly between validation and creation.

By resolving the physical path *after* `fs.mkdirSync` using `resolveToRealPath` and then verifying it with `isSubpath`, we ensure that the actual directory created on disk resides safely within the workspace. Any violation results in a warning, and the malicious path is prevented from being added to the agent's `workspaceContext`.

2026-04-07 16:35:24 +00:00

..

scripts

refactor(sandbox): reorganize Windows sandbox files (#23645)

2026-03-24 14:32:20 +00:00

src

fix(core): mitigate TOCTOU vulnerability in plan directory creation

2026-04-07 16:35:24 +00:00

GEMINI.md

docs: distribute package-specific GEMINI.md context to each package (#22734)

2026-03-17 19:51:23 +00:00

index.ts

…

package.json

chore: add posttest build hooks and fix missing dependencies (#22865)

2026-03-17 22:23:00 +00:00

test-setup.ts

…

tsconfig.json

…

vitest.config.ts

…