@readme/cli 0.1.0 → 0.3.0

package/src/commands/setup.js

@@ -2,14 +2,10 @@ import { execSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import readline from 'node:readline';
-import * as styles from '../utils/styles.js';
-import {
-  PLATFORMS,
-  detectExistingCi,
-  detectPlatform,
-  usesBlacksmith,
-} from '../utils/git.js';
+
+import { PLATFORMS, detectExistingCi, detectPlatform, usesBlacksmith } from '../utils/git.js';
 import { templateFor } from '../utils/setup-templates.js';
+import * as styles from '../utils/styles.js';
 
 // Detect the user's CI platform at module load so the top-level `--help`
 // can advertise the right `setup:<platform>` form (e.g. `setup:github` for
@@ -43,12 +39,8 @@ export const helpHint = _hasExistingCi
 // Hidden aliases cover every other form: bare `setup` (with optional positional),
 // the generic `setup:ci`, and one entry per platform. Whichever form is the
 // primary above is filtered out so it isn't double-registered.
-const ALL_FORMS = [
-  'setup [platform]',
-  'setup:ci',
-  ...Object.keys(PLATFORMS).map((k) => `setup:${k}`),
-];
-export const aliases = ALL_FORMS.filter((a) => a.split(' ')[0] !== _primaryName);
+const ALL_FORMS = ['setup [platform]', 'setup:ci', ...Object.keys(PLATFORMS).map(k => `setup:${k}`)];
+export const aliases = ALL_FORMS.filter(a => a.split(' ')[0] !== _primaryName);
 
 export function args(cmd) {
   cmd.option('--blacksmith', 'Use Blacksmith runners (GitHub Actions only)');
@@ -56,9 +48,9 @@ export function args(cmd) {
 
   cmd.addHelpText('after', () => {
     const bin = styles.binName();
-    const cmdStrs = Object.keys(PLATFORMS).map((k) => `${bin} setup:${k}`);
-    const cmdWidth = Math.max(...cmdStrs.map((s) => s.length));
-    const labelWidth = Math.max(...Object.values(PLATFORMS).map((d) => d.label.length));
+    const cmdStrs = Object.keys(PLATFORMS).map(k => `${bin} setup:${k}`);
+    const cmdWidth = Math.max(...cmdStrs.map(s => s.length));
+    const labelWidth = Math.max(...Object.values(PLATFORMS).map(d => d.label.length));
     const rows = Object.entries(PLATFORMS).map(([key, def], i) => {
       const cmdStr = cmdStrs[i].padEnd(cmdWidth);
       const label = def.label.padEnd(labelWidth);
@@ -153,12 +145,20 @@ export async function run(...callArgs) {
 
   console.log(`  This will create a workflow that runs on every pull request:`);
   console.log();
-  console.log(`    ${styles.success('✔')} ${styles.bold('Lint docs')} — runs ${styles.orange(`${styles.binName()} lint`)} and posts results as a PR comment`);
+  console.log(
+    `    ${styles.success('✔')} ${styles.bold('Lint docs')} — runs ${styles.orange(`${styles.binName()} lint`)} and posts results as a PR comment`,
+  );
   if (platform === 'github') {
-    console.log(`    ${styles.success('✔')} ${styles.bold('OAS change detection')} — flags modified OpenAPI spec files and suggests syncing`);
-    console.log(`    ${styles.success('✔')} ${styles.bold('Auto-fix base branch')} — redirects PRs from ${styles.orange('main')} to the correct version branch`);
+    console.log(
+      `    ${styles.success('✔')} ${styles.bold('OAS change detection')} — flags modified OpenAPI spec files and suggests syncing`,
+    );
+    console.log(
+      `    ${styles.success('✔')} ${styles.bold('Auto-fix base branch')} — redirects PRs from ${styles.orange('main')} to the correct version branch`,
+    );
     if (useBlacksmith) {
-      console.log(`    ${styles.success('✔')} ${styles.bold('Blacksmith runner')} — uses ${styles.orange('blacksmith-2vcpu-ubuntu-2404')} instead of ${styles.orange('ubuntu-latest')}`);
+      console.log(
+        `    ${styles.success('✔')} ${styles.bold('Blacksmith runner')} — uses ${styles.orange('blacksmith-2vcpu-ubuntu-2404')} instead of ${styles.orange('ubuntu-latest')}`,
+      );
     }
   }
   console.log();
@@ -169,9 +169,7 @@ export async function run(...callArgs) {
 
   // 4. Confirm.
   if (!opts.yes) {
-    const prompt = isOverwrite
-      ? 'This will overwrite the existing workflow. Continue?'
-      : 'Set up this workflow?';
+    const prompt = isOverwrite ? 'This will overwrite the existing workflow. Continue?' : 'Set up this workflow?';
     const confirmed = await confirm(prompt);
     if (!confirmed) {
       styles.info('Setup cancelled.');
@@ -203,7 +201,7 @@ function normalizePlatform(input) {
 function printDetectionSummary(detection, chosen) {
   const lines = [];
   if (detection.existing.length > 0) {
-    const labels = detection.existing.map((k) => PLATFORMS[k].label).join(', ');
+    const labels = detection.existing.map(k => PLATFORMS[k].label).join(', ');
     lines.push(`${styles.dim('Detected existing CI:')} ${labels}`);
   }
   if (detection.remote) {
@@ -246,8 +244,8 @@ function confirm(message) {
     output: process.stdout,
   });
 
-  return new Promise((resolve) => {
-    rl.question(`${styles.brand('?')} ${message} ${styles.dim('(Y/n)')} `, (answer) => {
+  return new Promise(resolve => {
+    rl.question(`${styles.brand('?')} ${message} ${styles.dim('(Y/n)')} `, answer => {
       rl.close();
       const val = answer.trim().toLowerCase();
       resolve(val === '' || val === 'y' || val === 'yes');

package/src/commands/versions.js

@@ -1,4 +1,5 @@
 import { execSync } from 'node:child_process';
+
 import * as styles from '../utils/styles.js';
 
 export const command = 'versions';
@@ -18,7 +19,10 @@ export function run(_options, _cmd, ctx) {
     stdio: ['pipe', 'pipe', 'pipe'],
   }).trim();
 
-  const branches = raw.split('\n').map((b) => b.trim()).filter(Boolean);
+  const branches = raw
+    .split('\n')
+    .map(b => b.trim())
+    .filter(Boolean);
 
   // Strip "origin/" prefix and deduplicate.
   const seen = new Set();
@@ -73,7 +77,7 @@ export function run(_options, _cmd, ctx) {
     for (let i = 0; i < subs.length; i++) {
       const isLast = i === subs.length - 1;
       const connector = isLast ? '└─' : '├─';
-      console.log(`  ${styles.dim(connector)} ${styles.dim(version + '_')}${subs[i].name} ${styles.dim('(branch)')}`);
+      console.log(`  ${styles.dim(connector)} ${styles.dim(`${version}_`)}${subs[i].name} ${styles.dim('(branch)')}`);
     }
   }
 

package/src/dev/app/[...slug]/page.js

@@ -1,4 +1,5 @@
 import { redirect } from 'next/navigation';
+
 import { getPage, collectSidebar } from '../../lib/docs';
 
 export const dynamic = 'force-dynamic';

package/src/dev/app/layout.js

@@ -1,7 +1,9 @@
-import { collectSidebar } from '../lib/docs';
-import { SidebarNav, SidebarPanel } from './Sidebar';
 import '@readme/markdown/dist/main.css';
+
+import { collectSidebar } from '../lib/docs';
+
 import './globals.css';
+import { SidebarNav, SidebarPanel } from './Sidebar';
 
 export const metadata = {
   title: {
@@ -21,10 +23,13 @@ export default async function RootLayout({ children }) {
       </head>
       <body className="bg-[#000343] text-gray-900 antialiased">
         {/* Top Navigation */}
-        <header className="fixed top-0 inset-x-0 h-[48px] bg-[#000343] flex items-center px-5 z-50" style={{
-          backgroundImage: `linear-gradient(rgba(255,255,255,0.08) 1px, transparent 1px), linear-gradient(90deg, rgba(255,255,255,0.08) 1px, transparent 1px)`,
-          backgroundSize: '20px 20px',
-        }}>
+        <header
+          className="fixed top-0 inset-x-0 h-[48px] bg-[#000343] flex items-center px-5 z-50"
+          style={{
+            backgroundImage: `linear-gradient(rgba(255,255,255,0.08) 1px, transparent 1px), linear-gradient(90deg, rgba(255,255,255,0.08) 1px, transparent 1px)`,
+            backgroundSize: '20px 20px',
+          }}
+        >
           <div className="flex items-center gap-3 mr-8 shrink-0">
             <div className="flex items-center gap-2">
               <i className="fa-brands fa-readme text-[#018ef5] text-[18px] relative top-[1px]" />
@@ -50,17 +55,19 @@ export default async function RootLayout({ children }) {
 
           {/* Content */}
           <main className="ml-[300px] flex-1 min-w-0 bg-white rounded-tr-xl">
-            <div className="max-w-[820px] py-10 px-16">
-              {children}
-            </div>
+            <div className="max-w-[820px] py-10 px-16">{children}</div>
           </main>
         </div>
 
-        <style dangerouslySetInnerHTML={{ __html: `
+        <style
+          dangerouslySetInnerHTML={{
+            __html: `
           [data-sidebar-group][data-expanded="false"] .sidebar-children { display: none; }
           [data-sidebar-group][data-expanded="true"] .sidebar-children { display: block; }
           [data-sidebar-group][data-expanded="true"] .sidebar-chevron { transform: rotate(90deg); }
-        `}} />
+        `,
+          }}
+        />
         <script
           dangerouslySetInnerHTML={{
             __html: `(function(){var es=new EventSource('/__reload');es.onmessage=function(e){if(e.data==='reload')location.reload()};})();

package/src/dev/app/page.js

@@ -1,4 +1,5 @@
 import { redirect } from 'next/navigation';
+
 import { getFirstPageHref } from '../lib/docs';
 
 export const dynamic = 'force-dynamic';

package/src/dev/lib/docs.js

@@ -1,9 +1,11 @@
-import { createRequire } from 'node:module';
 import fs from 'fs';
+import { createRequire } from 'node:module';
 import path from 'path';
-import matter from 'gray-matter';
+
 import { compile, run } from '@readme/markdown';
-import yaml from 'js-yaml';
+import { load as loadYAML } from 'js-yaml';
+
+import { parseFrontmatter } from '../../utils/markdown.js';
 
 // Use createRequire to load react-dom/server at runtime,
 // bypassing Next.js App Router's static import restriction.
@@ -36,7 +38,7 @@ function walkDir(dirPath, sectionDir, depth = 0) {
   let order = [];
   const orderPath = path.join(dirPath, '_order.yaml');
   if (fs.existsSync(orderPath)) {
-    order = yaml.load(fs.readFileSync(orderPath, 'utf-8')) || [];
+    order = loadYAML(fs.readFileSync(orderPath, 'utf-8')) || [];
   }
 
   // Get all items (exclude dotfiles and _-prefixed files)
@@ -90,16 +92,14 @@ function walkDir(dirPath, sectionDir, depth = 0) {
       // If either exists, treat this as a clickable parent page.
       const indexPath = path.join(dirPath, name, 'index.md');
       const siblingMdPath = path.join(dirPath, `${name}.md`);
-      const parentPagePath = fs.existsSync(indexPath)
-        ? indexPath
-        : fs.existsSync(siblingMdPath) ? siblingMdPath : null;
+      const parentPagePath = fs.existsSync(indexPath) ? indexPath : fs.existsSync(siblingMdPath) ? siblingMdPath : null;
 
       let title = name;
       let href = null;
       let hidden = false;
       let icon = null;
       if (parentPagePath) {
-        const { data } = matter(fs.readFileSync(parentPagePath, 'utf-8'));
+        const { data } = parseFrontmatter(fs.readFileSync(parentPagePath, 'utf-8'));
         title = data.title || name;
         href = `/${sectionDir}/${encodeURIComponent(name)}`;
         hidden = !!data.hidden;
@@ -112,7 +112,7 @@ function walkDir(dirPath, sectionDir, depth = 0) {
       mdFiles.delete(name);
     } else if (isMd) {
       const filePath = path.join(dirPath, `${name}.md`);
-      const { data } = matter(fs.readFileSync(filePath, 'utf-8'));
+      const { data } = parseFrontmatter(fs.readFileSync(filePath, 'utf-8'));
       const linkUrl = data.link?.url;
       entries.push({
         title: data.title || name,
@@ -152,7 +152,7 @@ function loadCustomBlocks(docsRoot) {
 
   for (const file of files) {
     const raw = fs.readFileSync(path.join(blocksDir, file), 'utf-8');
-    const { data, content } = matter(raw);
+    const { data, content } = parseFrontmatter(raw);
     const name = data.name || path.basename(file, path.extname(file));
     sources[name] = content;
     modules[name] = run(compile(content));
@@ -202,7 +202,7 @@ export function getPage(slugArray) {
   if (!filePath) return null;
 
   const raw = fs.readFileSync(filePath, 'utf-8');
-  const { data, content } = matter(raw);
+  const { data, content } = parseFrontmatter(raw);
 
   let html;
 
@@ -254,7 +254,7 @@ function renderOasOperationPreview(specFile, operationId) {
   let spec;
   try {
     const rawSpec = fs.readFileSync(specPath, 'utf-8');
-    spec = specFile.toLowerCase().endsWith('.json') ? JSON.parse(rawSpec) : yaml.load(rawSpec);
+    spec = specFile.toLowerCase().endsWith('.json') ? JSON.parse(rawSpec) : loadYAML(rawSpec);
   } catch (e) {
     return `<p><em>Couldn't parse <code>reference/${specFile}</code>: ${escapeHtml(e.message)}</em></p>`;
   }
@@ -272,16 +272,21 @@ function renderOasOperationPreview(specFile, operationId) {
   }
 
   const { method, path: opPath, op } = found;
-  const methodColor = {
-    GET: '#22c55e', POST: '#3b82f6', PUT: '#f59e0b', PATCH: '#a855f7', DELETE: '#ef4444',
-  }[method] || '#6b7280';
+  const methodColor =
+    {
+      GET: '#22c55e',
+      POST: '#3b82f6',
+      PUT: '#f59e0b',
+      PATCH: '#a855f7',
+      DELETE: '#ef4444',
+    }[method] || '#6b7280';
 
   const parts = [];
   parts.push(
     `<div style="display: flex; gap: 0.5rem; align-items: center; margin-bottom: 1rem;">` +
-    `<span style="background: ${methodColor}; color: white; padding: 0.15rem 0.5rem; border-radius: 0.25rem; font-family: monospace; font-weight: 600; font-size: 0.85rem;">${method}</span>` +
-    `<code style="font-size: 1rem;">${escapeHtml(opPath)}</code>` +
-    `</div>`,
+      `<span style="background: ${methodColor}; color: white; padding: 0.15rem 0.5rem; border-radius: 0.25rem; font-family: monospace; font-weight: 600; font-size: 0.85rem;">${method}</span>` +
+      `<code style="font-size: 1rem;">${escapeHtml(opPath)}</code>` +
+      `</div>`,
   );
   if (op.description) parts.push(`<p>${escapeHtml(op.description)}</p>`);
 
@@ -317,7 +322,10 @@ function renderOasOperationPreview(specFile, operationId) {
 }
 
 function escapeHtml(s) {
-  return String(s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+  return String(s).replace(
+    /[&<>"']/g,
+    c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c],
+  );
 }
 
 function findFirstHref(items) {

package/src/dev/next.config.mjs

@@ -10,8 +10,8 @@ export default {
   // Next's SWC loader excludes `node_modules` from JSX transformation by
   // default. Marking our own package as a transpile target bypasses that.
   transpilePackages: ['@readme/cli'],
-  serverExternalPackages: ['gray-matter', 'js-yaml', '@readme/markdown'],
-  webpack: (config) => {
+  serverExternalPackages: ['js-yaml', '@readme/markdown'],
+  webpack: config => {
     // Suppress noisy cache serialization warnings from large @readme/markdown bundle
     config.infrastructureLogging = {
       ...config.infrastructureLogging,

package/src/gha.js

@@ -17,8 +17,8 @@
 // let it do what it already does, exit code included.
 
 import * as lint from './commands/lint.js';
-import * as oasValidate from './commands/oas-validate.js';
 import * as oasSync from './commands/oas-sync.js';
+import * as oasValidate from './commands/oas-validate.js';
 import { writeGithubActionsOutputs } from './utils/gha-output.js';
 
 // Each command's run(options, cmd, ctx) only ever reads specific boolean
@@ -26,8 +26,8 @@ import { writeGithubActionsOutputs } from './utils/gha-output.js';
 // (the commander Command instance normal CLI invocation would pass) — so a
 // plain options object and a null cmd are enough here.
 const COMMANDS = {
-  'lint': { run: lint.run, flags: ['json', 'github', 'fix'] },
-  'validate': { run: lint.run, flags: ['json', 'github', 'fix'] }, // alias, matches src/commands/lint.js
+  lint: { run: lint.run, flags: ['json', 'github', 'fix'] },
+  validate: { run: lint.run, flags: ['json', 'github', 'fix'] }, // alias, matches src/commands/lint.js
   'oas:validate': { run: oasValidate.run, flags: ['dereference'] },
   'oas:sync': { run: oasSync.run, flags: [] },
 };
@@ -46,7 +46,7 @@ export async function run() {
   if (!entry) {
     console.error(
       `::error::Unknown or unsupported command "${command || '(empty)'}" for the \`readme\` input. ` +
-        `Supported: ${[...new Set(Object.keys(COMMANDS).filter((k) => k !== 'validate'))].join(', ')}.`,
+        `Supported: ${[...new Set(Object.keys(COMMANDS).filter(k => k !== 'validate'))].join(', ')}.`,
     );
     writeGithubActionsOutputs({ 'has-errors': 'true' });
     process.exit(1);
@@ -72,8 +72,8 @@ export async function run() {
 
   if (badTokens.length > 0) {
     console.error(
-      `::error::Unknown option${badTokens.length > 1 ? 's' : ''} ${badTokens.map((t) => `"${t}"`).join(', ')} for "${command}". ` +
-        `Supported: ${entry.flags.length > 0 ? entry.flags.map((f) => `--${f}`).join(', ') : '(none)'}.`,
+      `::error::Unknown option${badTokens.length > 1 ? 's' : ''} ${badTokens.map(t => `"${t}"`).join(', ')} for "${command}". ` +
+        `Supported: ${entry.flags.length > 0 ? entry.flags.map(f => `--${f}`).join(', ') : '(none)'}.`,
     );
     writeGithubActionsOutputs({ 'has-errors': 'true' });
     process.exit(1);
@@ -89,7 +89,7 @@ export async function run() {
   await entry.run(options, null, { gitRoot });
 }
 
-run().catch((err) => {
+run().catch(err => {
   console.error(err);
   // A thrown error (as opposed to a command's own controlled process.exit)
   // means whatever run() was doing never reached its own

package/src/prompts/index.js

@@ -25,7 +25,7 @@ export const slotOrphansSystemPrompt = [
   'Example output: {"assignments": [0, 2, 0, 1, -1, 3]}',
   '',
   'Guidance:',
-  '- Choose the best semantic fit based on the orphan\'s title and URL path.',
+  "- Choose the best semantic fit based on the orphan's title and URL path.",
   '- Only use -1 when no existing category is plausible.',
 ].join('\n');
 
@@ -54,13 +54,18 @@ export const slotOrphansOutputSchema = {
  */
 export function buildSlotOrphansUserPrompt({ categories, orphans }) {
   const catList = categories.map((c, i) => {
-    const sample = (c.pages || []).slice(0, 3).map((p) => p.title).join(', ');
+    const sample = (c.pages || [])
+      .slice(0, 3)
+      .map(p => p.title)
+      .join(', ');
     return `${i}. ${c.title}${sample ? ` (e.g. ${sample})` : ''}`;
   });
 
   const orphanList = orphans.map((p, i) => {
     let relPath = p.url;
-    try { relPath = new URL(p.url).pathname; } catch {}
+    try {
+      relPath = new URL(p.url).pathname;
+    } catch {}
     return `${i}. ${p.title} — ${relPath}`;
   });
 
@@ -264,13 +269,17 @@ export const organizeFromScratchOutputSchema = {
 export function buildOrganizeFromScratchUserPrompt({ siteTitle, items }) {
   const compactLines = items.map((it, idx) => {
     let relPath = it.url;
-    try { relPath = new URL(it.url).pathname + new URL(it.url).search; } catch {}
+    try {
+      relPath = new URL(it.url).pathname + new URL(it.url).search;
+    } catch {}
     return `${idx}\t${it.title}\t${relPath}`;
   });
 
   let origin = '(unknown)';
   if (items.length > 0) {
-    try { origin = new URL(items[0].url).origin; } catch {}
+    try {
+      origin = new URL(items[0].url).origin;
+    } catch {}
   }
 
   return [
@@ -507,7 +516,8 @@ export function prettifyPagePrompt(input) {
  * @returns {string}
  */
 export function stripCodeFences(text) {
-  return String(text).trim()
+  return String(text)
+    .trim()
     .replace(/^```json\s*/i, '')
     .replace(/^```\s*/i, '')
     .replace(/\s*```$/, '')

package/src/utils/containment.js

@@ -0,0 +1,87 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+/**
+ * A path that would leave `baseDir`, including by following a symlink. `target` is the refused
+ * path (the symlink itself when that is what was hit).
+ */
+export class PathEscapeError extends Error {
+  constructor(target, reason) {
+    super(`${target}: ${reason}`);
+    this.name = 'PathEscapeError';
+    this.target = target;
+  }
+}
+
+/**
+ * Guard for "this path stays inside `baseDir`" that does not trust the lexical path.
+ *
+ * `path.relative` only compares strings. A directory symlink committed under the base (git records
+ * it as mode 120000, so a clone recreates it) still looks inside the base, and `mkdir`,
+ * `writeFile`, `rename`, `unlink`, and `rm` all follow it. Walk each segment with `lstat` so a
+ * symlink is refused even when its target is also inside the base, and `realpath` the nearest
+ * existing ancestor so a link that points out of the base cannot hide behind a not-yet-created
+ * child.
+ *
+ * Paths that do not exist yet are allowed when that ancestor is a real directory inside the base —
+ * callers are about to create them.
+ *
+ * @param {string} baseDir Existing directory that bounds every path.
+ * @param {{ label?: string }} [opts] Noun used in the error (`reference directory`).
+ * @returns {(target: string) => void}
+ */
+export function makeContainment(baseDir, { label = 'reference directory' } = {}) {
+  const baseReal = fs.realpathSync(baseDir);
+  const baseResolved = path.resolve(baseDir);
+
+  return function assertContained(target) {
+    const resolved = path.resolve(target);
+    const rel = path.relative(baseResolved, resolved);
+
+    // '' is the base itself. Callers pass a child, so deleting or writing the base is not a
+    // contained operation.
+    if (rel === '' || escapes(rel)) {
+      throw new PathEscapeError(resolved, `path escapes the ${label}`);
+    }
+
+    let cursor = baseReal;
+    for (const segment of rel.split(path.sep)) {
+      if (segment === '' || segment === '.' || segment === '..') {
+        throw new PathEscapeError(resolved, `path escapes the ${label}`);
+      }
+
+      cursor = path.join(cursor, segment);
+
+      let st;
+      try {
+        st = fs.lstatSync(cursor);
+      } catch (err) {
+        if (err.code !== 'ENOENT') throw err;
+
+        // `cursor` is the first missing segment. Its parent is either the base (relative path '')
+        // or a segment just lstat'd as a real directory. realpath it anyway so a link above the
+        // base cannot hide behind a not-yet-created child.
+        const parentRel = path.relative(baseReal, fs.realpathSync(path.dirname(cursor)));
+        if (escapes(parentRel)) {
+          throw new PathEscapeError(resolved, `path escapes the ${label}`);
+        }
+
+        return;
+      }
+
+      if (st.isSymbolicLink()) {
+        throw new PathEscapeError(cursor, `symbolic links inside the ${label} are not followed`);
+      }
+    }
+
+    const realRel = path.relative(baseReal, fs.realpathSync(cursor));
+    if (realRel === '' || escapes(realRel)) {
+      throw new PathEscapeError(resolved, `path escapes the ${label}`);
+    }
+  };
+}
+
+/** True when `path.relative(base, candidate)` climbed out of `base`. '' did not. */
+function escapes(rel) {
+  return rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel);
+}