From 9f5502b4b6e68e39395153b7cc14130a7bc7cf55 Mon Sep 17 00:00:00 2001 From: DoSun Date: Fri, 15 May 2026 09:15:30 +0800 Subject: [PATCH] fix: prevent SSE event cross-workspace leakage - Register session cwd before publishing created event (was async void, causing cwd to be undefined during event dispatch) - Fix EventBus cwd filter: skip events when sessionCwd is undefined instead of allowing them through unfiltered Co-Authored-By: claude-sonnet-4-6 --- src/server/eventBus.ts | 2 +- src/server/sessionManager.ts | 5 ++--- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/src/server/eventBus.ts b/src/server/eventBus.ts index 9f40aade4..899eb5299 100644 --- a/src/server/eventBus.ts +++ b/src/server/eventBus.ts @@ -74,7 +74,7 @@ export class EventBus { const sid = dataObj?.session_id ?? dataObj?.sessionID if (typeof sid === 'string') { const sessionCwd = this.sessionCwds.get(sid) - if (sessionCwd && sessionCwd !== client.cwdFilter) { + if (sessionCwd !== client.cwdFilter) { continue } } diff --git a/src/server/sessionManager.ts b/src/server/sessionManager.ts index 78f01d562..7e930d730 100644 --- a/src/server/sessionManager.ts +++ b/src/server/sessionManager.ts @@ -237,9 +237,8 @@ export class SessionManager { this.sessions.set(sessionId, handle) if (!opts.silent) { - void canonicalizePath(cwd).then(canonical => { - this.eventBus.registerSessionCwd(sessionId, canonical) - }) + const canonical = await canonicalizePath(cwd).catch(() => cwd) + this.eventBus.registerSessionCwd(sessionId, canonical) this.eventBus.publishSessionEvent(sessionId, 'created', { status: 'starting', created_at: Date.now(),