fix(terminal): reject file cwd values (#1204)

* fix(terminal): reject file cwd values

* test(terminal): remove stale cwd access mock

---------

Co-authored-by: Isaac Sanchez <isanchez-hawkins@arize.com>
Co-authored-by: Bohdan Triapitsyn <artmore@protonmail.com>

packages/web/server/lib/terminal/runtime.js

@@ -503,7 +503,10 @@ export function createTerminalRuntime({
       }
 
       try {
-        await fs.promises.access(cwd);
+        const stats = await fs.promises.stat(cwd);
+        if (!stats.isDirectory()) {
+          return res.status(400).json({ error: 'Invalid working directory' });
+        }
       } catch {
         return res.status(400).json({ error: 'Invalid working directory' });
       }