From e17580c366562da529f0858f87fe9207f5e04874 Mon Sep 17 00:00:00 2001
From: Chris Wanstrath <chris@ozmm.org>
Date: Sun, 1 Mar 2026 22:37:46 -0800
Subject: [PATCH] Fix path normalization in safePath function

---
 apps/code/src/server/index.tsx | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/apps/code/src/server/index.tsx b/apps/code/src/server/index.tsx
index f7fb8ae..516803a 100644
--- a/apps/code/src/server/index.tsx
+++ b/apps/code/src/server/index.tsx
@@ -9,8 +9,9 @@ import type { Child } from 'hono/jsx'
 const APPS_DIR = process.env.APPS_DIR!
 
 const safePath = (base: string, ...segments: string[]) => {
-  const full = resolve(base, ...segments)
-  if (!full.startsWith(base + '/') && full !== base) return null
+  const norm = resolve(base)
+  const full = resolve(norm, ...segments)
+  if (!full.startsWith(norm + '/') && full !== norm) return null
   return full
 }