@namzu/sdk 2.0.0 → 3.0.0

package/src/tools/builtins/edit.ts

@@ -1,77 +1,76 @@
-import { readFile } from 'node:fs/promises'
+import { readFile, writeFile } from 'node:fs/promises'
 import { resolve } from 'node:path'
 import { z } from 'zod'
 import { defineTool } from '../defineTool.js'
-import { atomicWriteFile } from './atomic-write-file.js'
-import { withFileMutationLock } from './file-mutation-lock.js'
 
 const inputSchema = z
 	.object({
-		path: z
-			.string()
-			.refine((value) => value.trim().length > 0, 'Path must not be empty.')
-			.describe('Path to the file to edit. Must not be empty.'),
+		path: z.string().describe('Path to the file to edit'),
 		old_string: z
 			.string()
-			.min(1)
+			.optional()
+			.describe('The exact string to find and replace. Must be unique in the file.'),
+		oldStr: z
+			.string()
+			.optional()
 			.describe(
-				'The exact unique text to replace, without read-tool line-number prefixes. Must not be empty.',
+				'Alias for old_string. Used by hosts that expose text replacement as oldStr/newStr.',
 			),
 		new_string: z
 			.string()
+			.optional()
+			.describe(
+				'The replacement string. Self-budget this payload under 12000 characters before calling.',
+			),
+		newStr: z
+			.string()
+			.optional()
+			.describe(
+				'Alias for new_string. Also used as inserted content when insertLine is provided. Self-budget this payload under 12000 characters before calling.',
+			),
+		insertLine: z
+			.union([z.coerce.number().int().min(0), z.string().min(1)])
+			.optional()
 			.describe(
-				'The exact replacement text. May be empty to delete old_string. Keep this payload under 12000 characters.',
+				'Optional line insertion target. Inserts the replacement after this 1-indexed line; 0 inserts before the first line; "end" appends to the file.',
 			),
 		replace_all: z
 			.boolean()
 			.default(false)
-			.describe('Replace every occurrence instead of requiring one unique match.'),
+			.describe('Replace all occurrences instead of just the first unique match'),
 	})
-	.strict()
+	.refine((value) => typeof value.new_string === 'string' || typeof value.newStr === 'string', {
+		message: 'Either new_string or newStr is required.',
+	})
+	.refine(
+		(value) =>
+			value.insertLine !== undefined ||
+			typeof value.old_string === 'string' ||
+			typeof value.oldStr === 'string',
+		{ message: 'Either old_string/oldStr or insertLine is required.' },
+	)
 
 type EditInput = z.infer<typeof inputSchema>
 
-const modelInputSchema: Record<string, unknown> = {
-	type: 'object',
-	properties: {
-		path: {
-			type: 'string',
-			description: 'Path to the file to edit. Must not be empty.',
-		},
-		old_string: {
-			type: 'string',
-			description:
-				'Exact unique text from the file, without read-tool line-number prefixes. Must not be empty.',
-		},
-		new_string: {
-			type: 'string',
-			description:
-				'Exact replacement text. May be empty to delete old_string. Keep under 12000 characters.',
-		},
-		replace_all: {
-			type: 'boolean',
-			description: 'Replace every occurrence instead of requiring one unique match.',
-		},
-	},
-	required: ['path', 'old_string', 'new_string'],
-	additionalProperties: false,
-}
-
-type ExactReplacement = Readonly<{
-	oldString: string
-	newString: string
-	replaceAll: boolean
-}>
+type NormalizedEditInput =
+	| {
+			operation: 'replace'
+			oldString: string
+			newString: string
+			replace_all: boolean
+	  }
+	| {
+			operation: 'insert'
+			insertLine: number | 'end'
+			newString: string
+			replace_all: boolean
+	  }
 
 export const EditTool = defineTool({
 	name: 'edit',
 	description:
-		"Performs one targeted exact-string replacement in an existing file. Pass path + old_string + new_string; old_string must match exactly and be unique unless replace_all is true. Read the file immediately before editing, preserve whitespace and indentation, and never include the read tool's line-number prefix in old_string. To append or insert, replace a unique existing tail/marker with itself plus the new text; advance a deterministic marker such as {{CHUNK_001}} to {{CHUNK_002}} so replaying a completed edit cannot duplicate content. Prefer this tool over rewriting an existing file. Self-budget new_string under 12000 characters.",
+		'Makes targeted edits to a file using exact string find-and-replace or line insertion. THIS IS THE PREFERRED WAY TO MODIFY AN EXISTING FILE — never reach for `write` to change a file that already exists, because `write` overwrites the whole body and discards earlier work on partial failure. `edit` keeps the rest of the file byte-for-byte intact and is recoverable: if a single edit fails (old_string/oldStr ambiguous, broader restructuring needed), follow up with another `edit` instead of re-emitting the entire file via `write`. The old_string/oldStr must be unique in the file unless replace_all is true. For insertions, pass insertLine plus new_string/newStr; use insertLine: "end" to extend a file at the end. Self-budget new_string/newStr under 12000 characters before emitting the tool call; use repeated bounded edits for long sections. Preserves file formatting and indentation.',
 	inputSchema,
-	modelInputSchema,
-	enforceModelInput: true,
-	validationErrorHint:
-		'Required shape: {"path":"file.md","old_string":"exact unique text","new_string":"replacement text"}. Optional: "replace_all": true.',
 	category: 'filesystem',
 	permissions: ['file_write'],
 	readOnly: false,
@@ -79,120 +78,144 @@ export const EditTool = defineTool({
 	concurrencySafe: false,
 
 	async execute(input: EditInput, context) {
-		const parsed = inputSchema.safeParse(input)
-		if (!parsed.success) {
+		const normalized = normalizeEditInput(input)
+		if (!normalized.success) {
+			return { success: false, output: '', error: normalized.error }
+		}
+		if (
+			normalized.operation.operation === 'replace' &&
+			normalized.operation.oldString === normalized.operation.newString
+		) {
 			return {
 				success: false,
 				output: '',
-				error: `Invalid edit input: ${parsed.error.issues.map((issue) => issue.message).join('; ')}`,
+				error: 'old_string/oldStr and new_string/newStr are identical — no change needed',
 			}
 		}
-		const canonicalInput = parsed.data
 
-		const replacement: ExactReplacement = {
-			oldString: canonicalInput.old_string,
-			newString: canonicalInput.new_string,
-			replaceAll: canonicalInput.replace_all,
-		}
-		if (replacement.oldString === replacement.newString) {
+		// Sandbox-aware: route through sandbox when available
+		if (context.sandbox) {
+			const buffer = await context.sandbox.readFile(input.path)
+			const content = buffer.toString('utf-8')
+
+			const result = applyEdit(content, normalized.operation)
+			if (!result.success) {
+				return { success: false, output: '', error: result.error }
+			}
+
+			await context.sandbox.writeFile(input.path, result.content)
 			return {
-				success: false,
-				output: '',
-				error: 'old_string and new_string are identical — no change needed.',
+				success: true,
+				output: `Edited ${input.path}: ${result.replacements} replacement(s) [sandboxed]`,
+				data: { path: input.path, replacements: result.replacements, sandboxed: true },
 			}
 		}
 
-		const filePath = resolve(context.workingDirectory, canonicalInput.path)
-		const lockKey = `${context.sandbox ? 'sandbox' : 'local'}:${filePath}`
-
-		return withFileMutationLock(lockKey, async () => {
-			if (context.sandbox) {
-				const buffer = await context.sandbox.readFile(canonicalInput.path)
-				const result = applyEdit(buffer.toString('utf-8'), replacement)
-				if (!result.success) return { success: false as const, output: '', error: result.error }
-
-				await context.sandbox.writeFile(canonicalInput.path, result.content)
-				return {
-					success: true as const,
-					output: `Edited ${canonicalInput.path}: ${result.replacements} replacement(s) [sandboxed]`,
-					data: {
-						path: canonicalInput.path,
-						replacements: result.replacements,
-						sandboxed: true,
-					},
-				}
-			}
+		const filePath = resolve(context.workingDirectory, input.path)
+		const content = await readFile(filePath, 'utf-8')
 
-			const content = await readFile(filePath, 'utf-8')
-			const result = applyEdit(content, replacement)
-			if (!result.success) return { success: false as const, output: '', error: result.error }
+		const result = applyEdit(content, normalized.operation)
+		if (!result.success) {
+			return { success: false, output: '', error: result.error }
+		}
 
-			await atomicWriteFile(filePath, result.content)
-			return {
-				success: true as const,
-				output: `Edited ${filePath}: ${result.replacements} replacement(s)`,
-				data: { path: filePath, replacements: result.replacements },
-			}
-		})
+		await writeFile(filePath, result.content, 'utf-8')
+		return {
+			success: true,
+			output: `Edited ${filePath}: ${result.replacements} replacement(s)`,
+			data: { path: filePath, replacements: result.replacements },
+		}
 	},
 })
 
-function normalizeLineEndings(content: string, input: ExactReplacement): ExactReplacement {
-	const withoutCrlf = content.replaceAll('\r\n', '')
-	const usesOnlyCrlf = content.includes('\r\n') && !withoutCrlf.includes('\n')
-	if (usesOnlyCrlf) {
+function normalizeEditInput(
+	input: EditInput,
+): { success: true; operation: NormalizedEditInput } | { success: false; error: string } {
+	const newString = input.new_string ?? input.newStr
+	if (typeof newString !== 'string') {
+		return { success: false, error: 'Either new_string or newStr is required.' }
+	}
+
+	if (input.insertLine !== undefined) {
+		const insertLine = normalizeInsertLine(input.insertLine)
+		if (!insertLine.success) return insertLine
 		return {
-			...input,
-			oldString: content.includes(input.oldString)
-				? input.oldString
-				: input.oldString.replaceAll('\r\n', '\n').replaceAll('\n', '\r\n'),
-			newString: input.newString.replaceAll('\r\n', '\n').replaceAll('\n', '\r\n'),
+			success: true,
+			operation: {
+				operation: 'insert',
+				insertLine: insertLine.value,
+				newString,
+				replace_all: input.replace_all,
+			},
 		}
 	}
 
-	const usesOnlyLf = content.includes('\n') && !content.includes('\r\n')
-	if (usesOnlyLf) {
+	const oldString = input.old_string ?? input.oldStr
+	if (typeof oldString !== 'string') {
+		return { success: false, error: 'Either old_string/oldStr or insertLine is required.' }
+	}
+	return {
+		success: true,
+		operation: {
+			operation: 'replace',
+			oldString,
+			newString,
+			replace_all: input.replace_all,
+		},
+	}
+}
+
+function normalizeInsertLine(
+	value: string | number,
+): { success: true; value: number | 'end' } | { success: false; error: string } {
+	if (typeof value === 'string') {
+		if (value.trim().toLowerCase() === 'end') return { success: true, value: 'end' }
+		const parsed = Number(value)
+		if (Number.isInteger(parsed) && parsed >= 0) return { success: true, value: parsed }
 		return {
-			...input,
-			oldString: content.includes(input.oldString)
-				? input.oldString
-				: input.oldString.replaceAll('\r\n', '\n'),
-			newString: input.newString.replaceAll('\r\n', '\n'),
+			success: false,
+			error: 'insertLine must be a non-negative line number or "end".',
 		}
 	}
-	return input
+	return { success: true, value }
 }
 
 function applyEdit(
 	content: string,
-	rawInput: ExactReplacement,
+	input: NormalizedEditInput,
 ): { success: true; content: string; replacements: number } | { success: false; error: string } {
-	const input = normalizeLineEndings(content, rawInput)
+	if (input.operation === 'insert') {
+		return applyLineInsert(content, input)
+	}
+
 	if (!content.includes(input.oldString)) {
 		return {
 			success: false,
 			error:
-				'old_string was not found. Read the file again and copy exact text without line-number prefixes.',
+				'old_string/oldStr not found in file. Make sure the string matches exactly, including whitespace and indentation.',
 		}
 	}
 
-	if (input.replaceAll) {
+	if (input.replace_all) {
 		const parts = content.split(input.oldString)
+		const replacements = parts.length - 1
 		return {
 			success: true,
 			content: parts.join(input.newString),
-			replacements: parts.length - 1,
+			replacements,
 		}
 	}
 
+	// Uniqueness check: old_string/oldStr must appear exactly once
 	const firstIndex = content.indexOf(input.oldString)
-	const secondIndex = content.indexOf(input.oldString, firstIndex + input.oldString.length)
+	const secondIndex = content.indexOf(input.oldString, firstIndex + 1)
+
 	if (secondIndex !== -1) {
-		const firstLine = content.slice(0, firstIndex).split('\n').length
+		const lineNumber = content.slice(0, firstIndex).split('\n').length
 		const secondLine = content.slice(0, secondIndex).split('\n').length
 		return {
 			success: false,
-			error: `old_string is not unique — found at lines ${firstLine} and ${secondLine}. Include more surrounding context, or use replace_all: true.`,
+			error: `old_string/oldStr is not unique — found at lines ${lineNumber} and ${secondLine}. Provide more surrounding context to make it unique, or use replace_all: true.`,
 		}
 	}
 
@@ -205,3 +228,26 @@ function applyEdit(
 		replacements: 1,
 	}
 }
+
+function applyLineInsert(
+	content: string,
+	input: Extract<NormalizedEditInput, { operation: 'insert' }>,
+): { success: true; content: string; replacements: number } {
+	const hasTrailingNewline = content.endsWith('\n')
+	const lines = content.split('\n')
+	if (hasTrailingNewline) lines.pop()
+
+	const line =
+		input.insertLine === 'end'
+			? lines.length
+			: Math.min(Math.max(input.insertLine, 0), lines.length)
+	const inserted = input.newString.endsWith('\n')
+		? input.newString.slice(0, -1).split('\n')
+		: input.newString.split('\n')
+	lines.splice(line, 0, ...inserted)
+	return {
+		success: true,
+		content: `${lines.join('\n')}${hasTrailingNewline ? '\n' : ''}`,
+		replacements: 1,
+	}
+}

package/src/tools/builtins/glob.ts

@@ -1,7 +1,65 @@
 import { glob } from 'node:fs/promises'
 import { basename, dirname, relative, resolve, sep } from 'node:path'
 import { z } from 'zod'
+import type { Sandbox } from '../../types/sandbox/index.js'
+import type { ToolResult } from '../../types/tool/index.js'
 import { defineTool } from '../defineTool.js'
+import { matchesGlob } from '../glob-match.js'
+import { resolveWithin } from '../paths.js'
+import { joinPosix, relativePosix, resolveWithinPosix } from '../posix-path.js'
+
+/**
+ * Cap on results, shared by both paths so a sandboxed search and a host
+ * search truncate at the same point.
+ */
+const MAX_GLOB_RESULTS = 500
+
+/**
+ * Enumerate inside the sandbox and match there.
+ *
+ * This tool read the HOST filesystem through `node:fs` and referenced
+ * `context.sandbox` nowhere, so with a container backend wired in the
+ * sandbox was not a read boundary at all. The paths it returned were
+ * host-relative too, while `read` resolves what it is given INSIDE the
+ * sandbox — so every glob-to-read handoff either failed or opened a
+ * different file. Every sibling builtin already remembers this branch.
+ *
+ * `listFiles` returns sandbox-relative paths, which is the coordinate
+ * system `read` and `grep` already speak, so a path from here can be
+ * handed straight to them.
+ */
+async function globInSandbox(
+	input: { pattern: string; path?: string },
+	sandbox: Sandbox,
+): Promise<ToolResult> {
+	// The sandbox's own coordinate system — see `posix-path`.
+	const root = resolveWithinPosix(sandbox.rootDir, input.path)
+	const entries = await sandbox.listFiles(root)
+
+	let pattern = input.pattern
+	if (!pattern.includes('/') && !pattern.startsWith('**/')) pattern = `**/${pattern}`
+
+	const matches: string[] = []
+	for (const entry of entries) {
+		const relPath = relativePosix(sandbox.rootDir, joinPosix(root, entry.path))
+		if (!matchesGlob(relPath, pattern)) continue
+		matches.push(`./${relPath}`)
+		if (matches.length >= MAX_GLOB_RESULTS) break
+	}
+
+	if (matches.length === 0) {
+		return {
+			success: true,
+			output: `No files found matching pattern "${input.pattern}" in ${root}`,
+			data: { count: 0, files: [], sandboxed: true },
+		}
+	}
+	return {
+		success: true,
+		output: matches.join('\n'),
+		data: { count: matches.length, files: matches, sandboxed: true },
+	}
+}
 
 const inputSchema = z.object({
 	pattern: z.string().describe('Glob pattern (e.g. "**/*.ts", "src/**/*.js")'),
@@ -46,16 +104,24 @@ export const GlobTool = defineTool({
 	concurrencySafe: true,
 
 	async execute(input, context) {
-		const basePath = input.path
-			? resolve(context.workingDirectory, input.path)
-			: context.workingDirectory
+		if (context.sandbox) {
+			return await globInSandbox(input, context.sandbox)
+		}
+
+		// Contained, not merely resolved. This was a bare `resolve`, so
+		// `path: "../../.."` reached whatever sits above the working
+		// directory — with no sandbox needed to make it work.
+		const basePath = resolveWithin(context.workingDirectory, input.path)
 
 		let searchPath = basePath
 		let pattern = input.pattern
 
 		const { baseDir, relativePattern } = extractGlobBaseDirectory(pattern)
 		if (baseDir) {
-			const resolvedPatternBase = resolve(context.workingDirectory, baseDir)
+			// A base directory lifted out of the PATTERN is caller-supplied
+			// too: `pattern: "../../**/*.pem"` is the same escape wearing a
+			// different argument.
+			const resolvedPatternBase = resolveWithin(context.workingDirectory, baseDir)
 			if (resolvedPatternBase === basePath || resolvedPatternBase.startsWith(`${basePath}/`)) {
 				searchPath = resolvedPatternBase
 				pattern = relativePattern
@@ -67,12 +133,11 @@ export const GlobTool = defineTool({
 		}
 
 		const matches: string[] = []
-		const MAX_RESULTS = 500
 
 		for await (const entry of glob(pattern, { cwd: searchPath })) {
 			const absolutePath = resolve(searchPath, entry)
 			matches.push(`./${relative(context.workingDirectory, absolutePath)}`)
-			if (matches.length >= MAX_RESULTS) break
+			if (matches.length >= MAX_GLOB_RESULTS) break
 		}
 
 		if (matches.length === 0) {

package/src/tools/builtins/grep.ts

@@ -1,7 +1,61 @@
 import { glob, readFile } from 'node:fs/promises'
-import { relative, resolve } from 'node:path'
+import { relative, resolve, sep } from 'node:path'
 import { z } from 'zod'
+import type { Sandbox } from '../../types/sandbox/index.js'
 import { defineTool } from '../defineTool.js'
+import { matchesGlob } from '../glob-match.js'
+import { resolveWithin } from '../paths.js'
+import { joinPosix, relativePosix, resolveWithinPosix } from '../posix-path.js'
+
+/**
+ * Where the files come from.
+ *
+ * The host and the sandbox differ in exactly two operations — enumerate
+ * and read — so that is all this abstracts. Matching, context lines and
+ * the caps stay in one implementation; duplicating them per source is how
+ * the two would drift apart, and the sandbox path is the one nobody runs
+ * by accident.
+ */
+interface FileSource {
+	/** The root every reported path is relative to. */
+	readonly root: string
+	/** True when paths are the sandbox's, not the host's. */
+	readonly posix?: boolean
+	list(searchRoot: string, pattern: string): AsyncIterable<string>
+	read(path: string): Promise<Buffer>
+}
+
+function hostSource(workingDirectory: string): FileSource {
+	return {
+		root: workingDirectory,
+		async *list(searchRoot, pattern) {
+			for await (const entry of glob(pattern, { cwd: searchRoot })) {
+				yield resolve(searchRoot, entry)
+			}
+		},
+		read: (path) => readFile(path),
+	}
+}
+
+function sandboxSource(sandbox: Sandbox): FileSource {
+	return {
+		root: sandbox.rootDir,
+		posix: true,
+		async *list(searchRoot, pattern) {
+			for (const entry of await sandbox.listFiles(searchRoot)) {
+				// Sandbox paths stay in the sandbox's own coordinate system.
+				// Running them through the host's path module would rewrite a
+				// POSIX container path into a host-shaped one whenever the
+				// two disagree, and then hand the model a path its own
+				// sandbox cannot open.
+				const absolute = joinPosix(searchRoot, entry.path)
+				const relPath = relativePosix(sandbox.rootDir, absolute)
+				if (matchesGlob(relPath, pattern)) yield absolute
+			}
+		},
+		read: (path) => sandbox.readFile(path),
+	}
+}
 
 const inputSchema = z.object({
 	pattern: z.string().describe('Regular expression pattern to search for in file contents'),
@@ -63,9 +117,25 @@ export const GrepTool = defineTool({
 			}
 		}
 
-		const searchRoot = input.path
-			? resolve(context.workingDirectory, input.path)
-			: context.workingDirectory
+		// Inside the sandbox when there is one, on the host otherwise. Only
+		// the file SOURCE differs — matching, context lines and the caps are
+		// one implementation, because duplicating the substantive half is
+		// how the two paths would drift.
+		//
+		// This tool read the host filesystem through `node:fs` and
+		// referenced `context.sandbox` nowhere, so with a container backend
+		// wired in the sandbox was not a read boundary at all — and grep
+		// returns file CONTENT, so what leaked was not a listing.
+		const source: FileSource = context.sandbox
+			? sandboxSource(context.sandbox)
+			: hostSource(context.workingDirectory)
+
+		// Contained, not merely resolved — see `resolveWithin`. Bare
+		// resolution let `path: "../../.."` read whatever sits above the
+		// working directory, with no sandbox needed to make it work.
+		const searchRoot = source.posix
+			? resolveWithinPosix(source.root, input.path)
+			: resolveWithin(source.root, input.path)
 
 		// Auto-prepend **/ for simple patterns (e.g. "*.ts" → "**/*.ts")
 		let filePattern = input.include ?? '**/*'
@@ -78,13 +148,12 @@ export const GrepTool = defineTool({
 		let filesSearched = 0
 		let filesMatched = 0
 
-		for await (const entry of glob(filePattern, { cwd: searchRoot })) {
-			const filePath = resolve(searchRoot, entry)
+		for await (const filePath of source.list(searchRoot, filePattern)) {
 			filesSearched++
 
 			let content: string
 			try {
-				const buffer = await readFile(filePath)
+				const buffer = await source.read(filePath)
 				if (buffer.length > MAX_FILE_SIZE) continue
 				if (isBinaryContent(buffer)) continue
 				content = buffer.toString('utf-8')
@@ -105,7 +174,12 @@ export const GrepTool = defineTool({
 					filesMatched++
 				}
 
-				const relPath = `./${relative(context.workingDirectory, filePath)}`
+				// Relative to the root the file came FROM. Reporting a
+				// host-relative path for a file read inside the sandbox would
+				// hand the model a string `read` then resolves somewhere else.
+				const relPath = source.posix
+					? `./${relativePosix(source.root, filePath)}`
+					: `./${relative(source.root, filePath).split(sep).join('/')}`
 
 				if (input.context_lines > 0) {
 					const start = Math.max(0, i - input.context_lines)

package/src/tools/builtins/index.ts

@@ -22,12 +22,12 @@ import { WriteFileTool } from './write-file.js'
 // because it requires a schema parameter and is created per-use case.
 //
 // `LsTool` and `SearchToolsTool` are still exported for direct use but are
-// NOT in the default builtin set. Claude Code's training distribution (per
-// `code.claude.com/docs/en/tools-reference`) does NOT include `LS` —
-// directory listing is canonical `Bash` + `Glob`. `search_tools` has no
-// Claude analogue at all. Including these in the defaults gives the model
-// tools that look right but degrade alignment. File extension uses canonical
-// exact replacement against a unique tail or deterministic marker.
+// NOT in the default builtin set. A directory listing is already reachable
+// through `bash` + `glob`, and `search_tools` answers a question the tool
+// catalog in the prompt has already answered. Offering a model two ways to
+// do one thing costs a decision on every turn and buys nothing. File
+// extension is canonical `edit` with `insertLine: "end"` — the legacy
+// `Append` tool is gone.
 // Hosts that genuinely want LS/search can still register them explicitly.
 
 export function getBuiltinTools(): ToolDefinition[] {

package/src/tools/builtins/ls.ts

@@ -1,7 +1,8 @@
 import { readdir, stat } from 'node:fs/promises'
-import { join, relative, resolve } from 'node:path'
+import { join, relative } from 'node:path'
 import { z } from 'zod'
 import { defineTool } from '../defineTool.js'
+import { resolveWithin } from '../paths.js'
 
 const inputSchema = z.object({
 	path: z.string().default('.').describe('Directory path to list. Defaults to working directory.'),
@@ -116,7 +117,8 @@ export const LsTool = defineTool({
 	concurrencySafe: true,
 
 	async execute(input, context) {
-		const targetPath = resolve(context.workingDirectory, input.path)
+		// Contained, not merely resolved — see `resolveWithin`.
+		const targetPath = resolveWithin(context.workingDirectory, input.path)
 
 		if (input.recursive) {
 			const output: string[] = []