feat: update webui extensions, models, and agent config

.pi/agent/extensions/webui/backend/services/sessions.ts

@@ -9,6 +9,7 @@ import {
 } from "node:fs";
 import { join, resolve } from "node:path";
 import type { WebUiPaths } from "../config/paths.ts";
+import { isPathInsideRoot } from "../utils/paths.ts";
 import { prunePinnedSessionPaths, removePinnedSessionPath, setSessionPinned } from "../db/index.ts";
 
 function isMachineSessionLabel(text: string, sessionHeaderId: string): boolean {
@@ -140,9 +141,15 @@ export function readSessionMessages(filePath: string): unknown[] {
 }
 
 export function resolveSessionFile(paths: WebUiPaths, filePath: string): string {
-	const resolved = resolve(filePath);
+	if (typeof filePath !== "string" || !filePath.trim()) {
+		throw new Error("无效会话路径");
+	}
 	const sessionsRoot = resolve(paths.sessionsDir);
-	if (!resolved.startsWith(`${sessionsRoot}/`) || !resolved.endsWith(".jsonl")) {
+	const resolved = resolve(filePath.trim());
+	if (!resolved.toLowerCase().endsWith(".jsonl")) {
+		throw new Error("无效会话路径");
+	}
+	if (!isPathInsideRoot(sessionsRoot, resolved)) {
 		throw new Error("无效会话路径");
 	}
 	return resolved;