From 22ddcf81782f7bd393f7ca6dfd6f401fa3ca091b Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Sat, 30 May 2026 06:44:55 -0700
Subject: [PATCH] fix: allow dot-dot-prefixed pty session paths

---
 src/main/daemon/pty-session-id.test.ts | 4 ++++
 src/main/daemon/pty-session-id.ts      | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/main/daemon/pty-session-id.test.ts b/src/main/daemon/pty-session-id.test.ts
index da0bfd5ffba..6ba42f0876a 100644
--- a/src/main/daemon/pty-session-id.test.ts
+++ b/src/main/daemon/pty-session-id.test.ts
@@ -75,6 +75,10 @@ describe('isSafePtySessionId', () => {
     // validator must allow that as long as the result stays inside userData.
     expect(isSafePtySessionId('sub/path/ok@@12345678', USER_DATA)).toBe(true)
   })
+
+  it('accepts ids with path segments that merely start with dot-dot', () => {
+    expect(isSafePtySessionId('..sessions/ok@@12345678', USER_DATA)).toBe(true)
+  })
 })
 
 describe('parsePtySessionId', () => {
diff --git a/src/main/daemon/pty-session-id.ts b/src/main/daemon/pty-session-id.ts
index fec681d1c19..447c5f3616b 100644
--- a/src/main/daemon/pty-session-id.ts
+++ b/src/main/daemon/pty-session-id.ts
@@ -61,7 +61,7 @@ export function isSafePtySessionId(id: string, userDataPath: string): boolean {
   // from C:\userdata to D:\evil yields "D:\evil", which does NOT start with
   // ".."). Reject any absolute result — a legitimate subpath under
   // userData always produces a relative result on every platform.
-  if (rel === '' || isAbsolute(rel) || rel.startsWith('..') || rel.includes(`..${sep}`)) {
+  if (rel === '' || isAbsolute(rel) || rel === '..' || rel.startsWith(`..${sep}`)) {
     return false
   }
   return true