From b5665ec5c091477bb96049fba5d001310eee2ce5 Mon Sep 17 00:00:00 2001
From: Jah-yee <166608075+Jah-yee@users.noreply.github.com>
Date: Thu, 20 Aug 2026 09:23:49 +0800
Subject: [PATCH] fix: path traversal in listDirectory (rebase onto latest
 main)

---
 sdk/src/tools/list-directory.ts | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/sdk/src/tools/list-directory.ts b/sdk/src/tools/list-directory.ts
index 3bf66fa968..e7a1bd6fca 100644
--- a/sdk/src/tools/list-directory.ts
+++ b/sdk/src/tools/list-directory.ts
@@ -13,6 +13,20 @@ export async function listDirectory(params: {
   try {
     const resolvedPath = path.resolve(projectPath, directoryPath)
 
+    if (
+      !resolvedPath.startsWith(projectPath + path.sep) &&
+      resolvedPath !== projectPath
+    ) {
+      return [
+        {
+          type: 'json',
+          value: {
+            errorMessage: `Invalid path: Path '${directoryPath}' is outside the project directory.`,
+          },
+        },
+      ]
+    }
+
     const entries = await fs.readdir(resolvedPath, {
       withFileTypes: true,
     })