From 282bc79510ecf1a85ef6db163e809933e3de7ea6 Mon Sep 17 00:00:00 2001
From: LukeMackin <luke@yuzu-gca.dev>
Date: Wed, 22 Jul 2026 20:30:04 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20exec=E9=BB=98=E8=AE=A4cwd=E4=B9=9F?=
 =?UTF-8?q?=E8=B5=B0safePath(=E5=AE=A1=E6=9F=A5)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 packages/server/src/tools.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/server/src/tools.ts b/packages/server/src/tools.ts
index bf95a91..137f777 100644
--- a/packages/server/src/tools.ts
+++ b/packages/server/src/tools.ts
@@ -61,7 +61,7 @@ function sanitizeCommand(cmd: string): string {
 
 export async function exec(args: { command: string; cwd?: string; timeout?: number }): Promise<any> {
   const command = sanitizeCommand(args.command);
-  const cwd = args.cwd ? safePath(args.cwd) : process.cwd();
+  const cwd = safePath(args.cwd ?? ".");
   try {
     const stdout = execSync(command, { cwd, timeout: args.timeout ?? 30000, encoding: "utf8", maxBuffer: 10*1024*1024, stdio: ["pipe","pipe","pipe"] });
     return { ok: true, stdout: stdout.toString(), stderr: "" };