fix(connect): reject traversal backup paths in undo (defense-in-depth)

The undo backup-path guard was prefix-only: a path like
"<config>.bak.x/../../secret.json" kept the "<config>.bak." prefix yet
escaped the config directory, letting undo read (and, in a crafted case,
restore) an arbitrary file — defeating the documented "must not become an
arbitrary-file-restore primitive" invariant. Anchor validation on the
cleaned path's parent directory and basename instead, both traversal-proof.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Dumbris

internal/connect/undo.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"fmt"
 	"os"
+	"path/filepath"
 	"strings"
 
 	"github.com/BurntSushi/toml"
@@ -50,10 +51,18 @@ func (s *Service) Undo(clientID, serverName, backupPath string) (*ConnectResult,
 		return nil, fmt.Errorf("cannot determine config path for %s", clientID)
 	}
 
-	// The backup must be a backup OF THIS client's config: undo must not become
-	// an arbitrary-file-restore primitive for API callers.
-	if backupPath != "" && !strings.HasPrefix(backupPath, cfgPath+".bak.") {
-		return nil, fmt.Errorf("invalid backup path %q: not a backup of %s", backupPath, cfgPath)
+	// The backup must be a real backup OF THIS client's config, living beside it:
+	// undo must not become an arbitrary-file-restore primitive for API callers.
+	// A prefix-only check is not enough — a path like "<cfg>.bak.x/../../secret"
+	// keeps the prefix yet escapes the directory, so anchor on the cleaned path's
+	// parent directory and basename (both traversal-proof).
+	if backupPath != "" {
+		cleaned := filepath.Clean(backupPath)
+		if filepath.Dir(cleaned) != filepath.Dir(cfgPath) ||
+			!strings.HasPrefix(filepath.Base(cleaned), filepath.Base(cfgPath)+".bak.") {
+			return nil, fmt.Errorf("invalid backup path %q: not a backup of %s", backupPath, cfgPath)
+		}
+		backupPath = cleaned
 	}
 
 	res, err := s.undo(client, cfgPath, serverName, backupPath)

internal/connect/undo_test.go

@@ -247,6 +247,38 @@ func TestUndo_RejectsForeignBackupPath(t *testing.T) {
 	}
 }
 
+// A path that keeps the "<config>.bak." prefix but traverses out of the config
+// directory (e.g. "<config>.bak.x/../../secret.json") must be rejected before
+// any read — a prefix-only check would let undo read/restore an arbitrary file.
+func TestUndo_RejectsBackupPathTraversal(t *testing.T) {
+	home := t.TempDir()
+	svc := NewServiceWithHome("127.0.0.1:8080", "", home)
+	res, err := svc.Connect("claude-code", "mcpproxy", false)
+	if err != nil {
+		t.Fatalf("connect: %v", err)
+	}
+
+	// Craft a traversal path that still starts with "<config>.bak." so a
+	// prefix-only guard would admit it, then climbs back out to a foreign file.
+	secret := filepath.Join(home, "secret.json")
+	if err := os.WriteFile(secret, []byte(`{"secret":true}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	rel, err := filepath.Rel(filepath.Dir(res.ConfigPath), secret)
+	if err != nil {
+		t.Fatal(err)
+	}
+	traversal := res.ConfigPath + ".bak.x/../" + rel
+
+	_, err = svc.Undo("claude-code", "mcpproxy", traversal)
+	if err == nil {
+		t.Fatal("undo must reject a traversal backup path that escapes the config directory")
+	}
+	if !strings.Contains(err.Error(), "backup") {
+		t.Fatalf("error should mention the backup path problem: %v", err)
+	}
+}
+
 func TestUndo_MissingConfigFileRefuses(t *testing.T) {
 	home := t.TempDir()
 	svc := NewServiceWithHome("127.0.0.1:8080", "", home)