indifferentketchup 7bb059511f chore: fix resolveProjectPath whitelist-root bypass ...

The scope check at routes/projects.ts:56 short-circuited when
real === whitelistReal, allowing the whitelist directory itself to
resolve as a valid project root. Dropped the `real !== whitelistReal`
half of the && so the predicate becomes the strict prefix check.

Flipped the unit test from a "BEHAVIOR GAP" assertion (documenting
the bug) to a strict-rejection assertion. 23/23 tests still pass.

2026-05-16 05:53:56 +00:00

..

src

chore: fix resolveProjectPath whitelist-root bypass

2026-05-16 05:53:56 +00:00

package.json

test: vitest harness + unit tests for security-critical pure functions

2026-05-16 04:35:31 +00:00

tsconfig.json

test: vitest harness + unit tests for security-critical pure functions

2026-05-16 04:35:31 +00:00

vitest.config.ts

test: vitest harness + unit tests for security-critical pure functions

2026-05-16 04:35:31 +00:00