fix: allow dot-dot-prefixed pty session paths

src/main/daemon/pty-session-id.test.ts

@@ -75,6 +75,10 @@ describe('isSafePtySessionId', () => {
     // validator must allow that as long as the result stays inside userData.
     expect(isSafePtySessionId('sub/path/ok@@12345678', USER_DATA)).toBe(true)
   })
+
+  it('accepts ids with path segments that merely start with dot-dot', () => {
+    expect(isSafePtySessionId('..sessions/ok@@12345678', USER_DATA)).toBe(true)
+  })
 })
 
 describe('parsePtySessionId', () => {

src/main/daemon/pty-session-id.ts

@@ -61,7 +61,7 @@ export function isSafePtySessionId(id: string, userDataPath: string): boolean {
   // from C:\userdata to D:\evil yields "D:\evil", which does NOT start with
   // ".."). Reject any absolute result — a legitimate subpath under
   // userData always produces a relative result on every platform.
-  if (rel === '' || isAbsolute(rel) || rel.startsWith('..') || rel.includes(`..${sep}`)) {
+  if (rel === '' || isAbsolute(rel) || rel === '..' || rel.startsWith(`..${sep}`)) {
     return false
   }
   return true