{"version":"2.1.247","anchor":"plugin-file-access-is-checked-against-the-session-root-as-we","canonical_anchor":"plugin-file-access-is-checked-against-the-session-root-as-we","heading":"Plugin file access is checked against the session root as well as the project root, and can list ancestor files","tier":"internal","area":"Plugins","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.247\/e\/plugin-file-access-is-checked-against-the-session-root-as-we","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.247","markdown":"### Plugin file access is checked against the session root as well as the project root, and can list ancestor files\n\nPlugin file access is now checked against the session root too, and plugins can list files in parent directories.\n\n**What**\n\nFile operations from plugins (`fs.listDir`, `fs.exists`, `fs.stat`, writes) now pass the calling plugin's working directory along with the request, and the path check confirms the target sits inside the session root as well as the project root before allowing it. A new `fs.ancestors` operation lets a plugin ask for named files in the directories above its working directory.\n\n**Details**\n\n- Path vetting resolves several roots (the dispatch root, its real path, and the real session path) instead of one project root, and both roots are handed to the check for configuration files that have been moved elsewhere.\n- Plugins call the new op as `ancestors: (t) => e(\"fs.ancestors\", { names: t.names })`.\n- Neither the operation nor its handler existed in 2.1.246.\n\n**Evidence**\n\n`\"fs.ancestors\"`\n\n- Area: Plugins\n- Names: `fs.ancestors`\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 3\/5"}