Under the hood
Plugin path-traversal checks unified into one shared helper function
What
Several places that check plugin-declared paths for safety — commands, MCP server file references, and plugin.json marketplace source paths — used to each run their own simple check for ".." in the path. They now all call a single shared helper function instead. A related helper that checks whether a directory exists also changed: it now takes the plugin's root folder plus a subpath, rather than an already-resolved path.
Why
Consolidating these checks into one helper reduces the chance that one of the several places validating plugin paths is checked inconsistently or missed when the logic needs to change.