You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
server: memorySkillFiles.list() and read() do not normalize or validate non-canonical relative paths #3102
Quick question on memorySkillFiles in packages/server/src/ext/skills/files.ts (lines 53-67 on main commit 46d9c99). indexRecord normalizes keys via splitRelativePath(key, 'file path').join('/') when building the dirs and files maps, but memorySkillFiles.list(dir) and memorySkillFiles.read(path) look up dir and path directly without normalizing them through splitRelativePath first (unlike nodeSkillFiles in node.ts).
Because of that, calling list('sub/') or read('./SKILL.md') throws SkillFileNotFoundError, and in read(path) the Object.hasOwn(files, path) check runs before index ?? reindex(), so calling read() before list() bypasses splitRelativePath validation when path matches a raw key on files. Should list() and read() normalize dir and path via splitRelativePath? Happy to open a quick PR with unit tests if you want!
I went ahead with this: #3104 normalises dir/path through splitRelativePath in both list() and read() (with '' still meaning the record root), so sub/, ./SKILL.md and sub//other.txt resolve, and a .. segment is rejected before the hasOwn fast path. Six tests cover those shapes plus the unchanged missing-path errors, and there is a patch changeset.
Activity
xubenqiang commentedon Oct 26, 2026
I went ahead with this: #3104 normalises
dir/paththroughsplitRelativePathin bothlist()andread()(with''still meaning the record root), sosub/,./SKILL.mdandsub//other.txtresolve, and a..segment is rejected before thehasOwnfast path. Six tests cover those shapes plus the unchanged missing-path errors, and there is a patch changeset.Ben-Home commentedon Oct 28, 2026