From 924bed6c21be920fc6b75602b6cf85d0df54eeea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=9B=B7=E7=94=B5=E8=8A=BD=E8=A1=A3?=
 <zhangyanghaha0407@outlook.com>
Date: Sun, 19 Jul 2026 16:27:26 -0400
Subject: [PATCH] fix(cli): reject normalized agent directory names

---
 src/secure-files.ts        | 1 +
 test/cli-security.test.mjs | 1 +
 2 files changed, 2 insertions(+)

diff --git a/src/secure-files.ts b/src/secure-files.ts
index 08235e7..56fb442 100644
--- a/src/secure-files.ts
+++ b/src/secure-files.ts
@@ -26,6 +26,7 @@ export function resolvePrivateChildDirectory(root: string, childName: string): s
     || childName.includes('\\')
     || childName === '.'
     || childName === '..'
+    || childName.startsWith(' ')
     || childName.endsWith('.')
     || childName.endsWith(' ')
     || isWindowsDeviceName
diff --git a/test/cli-security.test.mjs b/test/cli-security.test.mjs
index eda1f7a..283349c 100644
--- a/test/cli-security.test.mjs
+++ b/test/cli-security.test.mjs
@@ -109,6 +109,7 @@ test('CLI rejects agent IDs that escape the credential directory', async () => {
     'C:escape',
     'agent.',
     'agent ',
+    ' agent',
     'CON',
     'COM¹.log',
     '.',