From d0d3466a566c4204cecc95f921c17bad15b55997 Mon Sep 17 00:00:00 2001
From: suzmii <suzmii@qq.com>
Date: Thu, 3 Sep 2026 21:42:39 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20Direct=20MCP=20=E8=B7=AF?=
 =?UTF-8?q?=E5=BE=84=E6=96=87=E6=A1=88=E6=B3=84=E9=9C=B2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

平台无关拒绝盘符、绝对路径和上级目录

避免未审核路径出现在 Direct Codex 活动文案中
---
 .../src-tauri/src/agent/codex_app_server.rs      | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/apps/ai-game-creator-shell/src-tauri/src/agent/codex_app_server.rs b/apps/ai-game-creator-shell/src-tauri/src/agent/codex_app_server.rs
index a512b98ed..f88cfe0d4 100644
--- a/apps/ai-game-creator-shell/src-tauri/src/agent/codex_app_server.rs
+++ b/apps/ai-game-creator-shell/src-tauri/src/agent/codex_app_server.rs
@@ -596,15 +596,29 @@ fn direct_codex_project_path_detail(item: &serde_json::Value, pointer: &str) ->
     if value.is_empty() {
         return None;
     }
+    let trimmed = value.trim();
+    let has_windows_drive_prefix = trimmed.len() >= 2
+        && trimmed.as_bytes()[0].is_ascii_alphabetic()
+        && trimmed.as_bytes()[1] == b':';
+    let has_absolute_prefix = trimmed.starts_with('/')
+        || trimmed.starts_with('\\')
+        || trimmed.starts_with("//")
+        || trimmed.starts_with("\\\\");
+    let has_parent_segment = trimmed
+        .split(['/', '\\'])
+        .any(|component| component == "..");
     let path = std::path::Path::new(value);
     if path.is_absolute()
+        || has_windows_drive_prefix
+        || has_absolute_prefix
+        || has_parent_segment
         || path
             .components()
             .any(|component| matches!(component, std::path::Component::ParentDir))
     {
         return None;
     }
-    direct_codex_bounded_detail(value, 120)
+    direct_codex_bounded_detail(trimmed, 120)
 }
 
 fn direct_codex_mcp_tool_intermediate_text(item: &serde_json::Value) -> String {