From dc4d2a12217d1320c0451974c72f751317dff6e9 Mon Sep 17 00:00:00 2001 From: Eric Wagoner Date: Sat, 5 Sep 2026 22:10:03 -0400 Subject: [PATCH] The stub path checks the room id, as the ledger path does Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Jm2auWk6RP71CjaAb4FMoG --- packages/server/src/store.ts | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/packages/server/src/store.ts b/packages/server/src/store.ts index 879241a..2d95864 100644 --- a/packages/server/src/store.ts +++ b/packages/server/src/store.ts @@ -150,7 +150,10 @@ export function ledgerStat(roomId: string): { bytes: number; mtimeMs: number } | // the room's whole truth and the room stays asleep, unreplayed. const stubDir = () => join(DATA_DIR, "..", "stubs"); -const stubFor = (roomId: string) => join(stubDir(), `${roomId}.json`); +function stubFor(roomId: string): string { + if (!safeRoomId(roomId)) throw new Error(`unsafe room id: ${JSON.stringify(roomId)}`); + return join(stubDir(), `${roomId}.json`); +} export function readStubFile(roomId: string): { bytes: number; stub: T } | null { if (!safeRoomId(roomId)) return null;