From 4395c5785ddf5b1a97a8049faf27222cc77e9694 Mon Sep 17 00:00:00 2001
From: NieiR <31194814+NieiR@users.noreply.github.com>
Date: Wed, 14 Jan 2026 10:04:23 +0800
Subject: [PATCH] fix(codeagent-wrapper): reject dash as workdir parameter
 (#118)

Prevent '-' from being incorrectly parsed as a workdir path.
This fixes a potential ambiguity when using stdin mode.
---
 codeagent-wrapper/config.go    | 12 ++++++++++++
 codeagent-wrapper/main_test.go |  6 ++++++
 2 files changed, 18 insertions(+)

diff --git a/codeagent-wrapper/config.go b/codeagent-wrapper/config.go
index 6cab9b6..7e4c642 100644
--- a/codeagent-wrapper/config.go
+++ b/codeagent-wrapper/config.go
@@ -184,6 +184,10 @@ func parseParallelConfig(data []byte) (*ParallelConfig, error) {
 			case "id":
 				task.ID = value
 			case "workdir":
+				// Validate workdir: "-" is not a valid directory
+				if value == "-" {
+					return nil, fmt.Errorf("task block #%d has invalid workdir: '-' is not a valid directory path", taskIndex)
+				}
 				task.WorkDir = value
 			case "session_id":
 				task.SessionID = value
@@ -417,6 +421,10 @@ func parseArgs() (*Config, error) {
 		cfg.Task = args[2]
 		cfg.ExplicitStdin = (args[2] == "-")
 		if len(args) > 3 {
+			// Validate workdir: "-" is not a valid directory
+			if args[3] == "-" {
+				return nil, fmt.Errorf("invalid workdir: '-' is not a valid directory path")
+			}
 			cfg.WorkDir = args[3]
 		}
 	} else {
@@ -424,6 +432,10 @@ func parseArgs() (*Config, error) {
 		cfg.Task = args[0]
 		cfg.ExplicitStdin = (args[0] == "-")
 		if len(args) > 1 {
+			// Validate workdir: "-" is not a valid directory
+			if args[1] == "-" {
+				return nil, fmt.Errorf("invalid workdir: '-' is not a valid directory path")
+			}
 			cfg.WorkDir = args[1]
 		}
 	}
diff --git a/codeagent-wrapper/main_test.go b/codeagent-wrapper/main_test.go
index 0c66408..a01793a 100644
--- a/codeagent-wrapper/main_test.go
+++ b/codeagent-wrapper/main_test.go
@@ -1094,6 +1094,11 @@ func TestBackendParseArgs_NewMode(t *testing.T) {
 			args: []string{"codeagent-wrapper", "-", "/some/dir"},
 			want: &Config{Mode: "new", Task: "-", WorkDir: "/some/dir", ExplicitStdin: true, Backend: defaultBackendName},
 		},
+		{
+			name:    "stdin with dash workdir rejected",
+			args:    []string{"codeagent-wrapper", "-", "-"},
+			wantErr: true,
+		},
 		{name: "no args", args: []string{"codeagent-wrapper"}, wantErr: true},
 	}
 
@@ -1155,6 +1160,7 @@ func TestBackendParseArgs_ResumeMode(t *testing.T) {
 		{name: "resume missing task", args: []string{"codeagent-wrapper", "resume", "session-123"}, wantErr: true},
 		{name: "resume empty session_id", args: []string{"codeagent-wrapper", "resume", "", "task"}, wantErr: true},
 		{name: "resume whitespace session_id", args: []string{"codeagent-wrapper", "resume", "   ", "task"}, wantErr: true},
+		{name: "resume with dash workdir rejected", args: []string{"codeagent-wrapper", "resume", "session-123", "task", "-"}, wantErr: true},
 	}
 
 	for _, tt := range tests {