Paul BakausandClaude Fable 5 da2982ab95 Fix /source guard escaping the project root via sibling directories ...

The /source route confined paths with `absPath.startsWith(process.cwd())`,
a string-prefix check with no separator. An absolute request path to a
sibling directory whose name extends the project dir name (projeto ->
projeto-backup) shared the prefix and was served. Switch to the relative-path
check already used by sessionFileMetadataFromPollReply: reject when the
relative path is empty (the root dir itself, never a file this route serves),
starts with `..`, or is absolute.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-22 21:59:28 -07:00

..

agents

Ship the finish reviewer as a named subagent; ungate the asset producer

2026-07-22 12:23:06 -07:00

reference

Command first, capability second

2026-07-22 12:23:07 -07:00

scripts

Fix /source guard escaping the project root via sibling directories

2026-07-22 21:59:28 -07:00

SKILL.src.md

Flag and repair drift in Impeccable's own project artifacts

2026-07-21 21:50:40 -07:00