[qvalentin]

fixes the following security report: https://security.snyk.io/vuln/SNYK-PYTHON-CHAINLIT-19659988

---

Summary by cubic

Fixes a path traversal vulnerability (SNYK-PYTHON-CHAINLIT-19659988) where a client-supplied session ID could escape the session files directory and delete arbitrary paths.

• Session IDs are now validated against a strict pattern ([A-Za-z0-9_-]{1,128}) before use.
• Websocket connections with invalid or missing session IDs are refused at connect time, and accessing files_dir with an invalid ID raises a ValueError.

^{Written for commit f41969d. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 4 files

_{View guided diff | Re-trigger cubic}