@ricsam/r5d-worker 0.0.13 → 0.0.14

package/dist/cjs/main.cjs

@@ -32,6 +32,7 @@ __export(main_exports, {
   ensureVisibleGitCheckout: () => ensureVisibleGitCheckout,
   isArtifactEnvPath: () => isArtifactEnvPath,
   prepareArtifactEnvForShell: () => prepareArtifactEnvForShell,
+  resolveProjectFilePath: () => resolveProjectFilePath,
   syncSessionArtifacts: () => syncSessionArtifacts
 });
 module.exports = __toCommonJS(main_exports);
@@ -548,9 +549,12 @@ function getInternalStatus(context) {
 function hasInternalWorktreeChanges(context) {
   return getInternalStatus(context).trim().length > 0;
 }
+function isInsideBranchPath(branchPath, filePath) {
+  const relative = import_node_path.default.relative(import_node_path.default.resolve(branchPath), import_node_path.default.resolve(filePath));
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${import_node_path.default.sep}`) && !import_node_path.default.isAbsolute(relative);
+}
 function assertInsideBranch(branchPath, filePath) {
-  const relative = import_node_path.default.relative(branchPath, filePath);
-  if (relative === ".." || relative.startsWith(`..${import_node_path.default.sep}`) || import_node_path.default.isAbsolute(relative)) {
+  if (!isInsideBranchPath(branchPath, filePath)) {
     throw new Error("File path escapes the project branch");
   }
 }
@@ -558,17 +562,27 @@ function resolveProjectFilePath(branchPath, virtualPath) {
   if (typeof virtualPath !== "string" || !virtualPath.startsWith("/") || virtualPath.includes("\0")) {
     throw new Error(`File path must be an absolute project path starting with /. Got: ${JSON.stringify(virtualPath)}`);
   }
+  const checkoutAbsolutePath = import_node_path.default.resolve(virtualPath);
+  if (isInsideBranchPath(branchPath, checkoutAbsolutePath)) {
+    const checkoutVirtualPath = toVirtualPath(import_node_path.default.resolve(branchPath), checkoutAbsolutePath);
+    if (checkoutVirtualPath !== virtualPath) {
+      return resolveProjectFilePath(branchPath, checkoutVirtualPath);
+    }
+  }
+  if (virtualPath.split("/").includes("..")) {
+    throw new Error(`Invalid project file path: ${virtualPath}`);
+  }
   const normalized = import_node_path.default.posix.normalize(virtualPath);
-  if (normalized === "/" || normalized.startsWith("/../")) {
+  if (normalized.startsWith("/../")) {
     throw new Error(`Invalid project file path: ${virtualPath}`);
   }
-  const repoRelativePath = normalized.slice(1);
+  const repoRelativePath = normalized === "/" ? "" : normalized.slice(1);
   if (repoRelativePath === ".git" || repoRelativePath.startsWith(".git/")) {
     throw new Error("Refusing to access .git through worker file tools");
   }
-  const absolutePath = import_node_path.default.resolve(branchPath, ...repoRelativePath.split("/"));
+  const absolutePath = repoRelativePath ? import_node_path.default.resolve(branchPath, ...repoRelativePath.split("/")) : import_node_path.default.resolve(branchPath);
   assertInsideBranch(branchPath, absolutePath);
-  return { absolutePath, virtualPath: `/${repoRelativePath}`, repoRelativePath };
+  return { absolutePath, virtualPath: repoRelativePath ? `/${repoRelativePath}` : "/", repoRelativePath };
 }
 function branchLockKey(projectId, branchName) {
   return `${projectId}:${branchName}`;
@@ -2238,5 +2252,6 @@ if (isCliEntrypoint()) {
   ensureVisibleGitCheckout,
   isArtifactEnvPath,
   prepareArtifactEnvForShell,
+  resolveProjectFilePath,
   syncSessionArtifacts
 });

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.13",
+  "version": "0.0.14",
   "type": "commonjs"
 }

package/dist/mjs/main.mjs

@@ -511,9 +511,12 @@ function getInternalStatus(context) {
 function hasInternalWorktreeChanges(context) {
   return getInternalStatus(context).trim().length > 0;
 }
+function isInsideBranchPath(branchPath, filePath) {
+  const relative = path.relative(path.resolve(branchPath), path.resolve(filePath));
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
 function assertInsideBranch(branchPath, filePath) {
-  const relative = path.relative(branchPath, filePath);
-  if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+  if (!isInsideBranchPath(branchPath, filePath)) {
     throw new Error("File path escapes the project branch");
   }
 }
@@ -521,17 +524,27 @@ function resolveProjectFilePath(branchPath, virtualPath) {
   if (typeof virtualPath !== "string" || !virtualPath.startsWith("/") || virtualPath.includes("\0")) {
     throw new Error(`File path must be an absolute project path starting with /. Got: ${JSON.stringify(virtualPath)}`);
   }
+  const checkoutAbsolutePath = path.resolve(virtualPath);
+  if (isInsideBranchPath(branchPath, checkoutAbsolutePath)) {
+    const checkoutVirtualPath = toVirtualPath(path.resolve(branchPath), checkoutAbsolutePath);
+    if (checkoutVirtualPath !== virtualPath) {
+      return resolveProjectFilePath(branchPath, checkoutVirtualPath);
+    }
+  }
+  if (virtualPath.split("/").includes("..")) {
+    throw new Error(`Invalid project file path: ${virtualPath}`);
+  }
   const normalized = path.posix.normalize(virtualPath);
-  if (normalized === "/" || normalized.startsWith("/../")) {
+  if (normalized.startsWith("/../")) {
     throw new Error(`Invalid project file path: ${virtualPath}`);
   }
-  const repoRelativePath = normalized.slice(1);
+  const repoRelativePath = normalized === "/" ? "" : normalized.slice(1);
   if (repoRelativePath === ".git" || repoRelativePath.startsWith(".git/")) {
     throw new Error("Refusing to access .git through worker file tools");
   }
-  const absolutePath = path.resolve(branchPath, ...repoRelativePath.split("/"));
+  const absolutePath = repoRelativePath ? path.resolve(branchPath, ...repoRelativePath.split("/")) : path.resolve(branchPath);
   assertInsideBranch(branchPath, absolutePath);
-  return { absolutePath, virtualPath: `/${repoRelativePath}`, repoRelativePath };
+  return { absolutePath, virtualPath: repoRelativePath ? `/${repoRelativePath}` : "/", repoRelativePath };
 }
 function branchLockKey(projectId, branchName) {
   return `${projectId}:${branchName}`;
@@ -2200,5 +2213,6 @@ export {
   ensureVisibleGitCheckout,
   isArtifactEnvPath,
   prepareArtifactEnvForShell,
+  resolveProjectFilePath,
   syncSessionArtifacts
 };

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.13",
+  "version": "0.0.14",
   "type": "module"
 }

package/dist/types/main.d.ts

@@ -20,6 +20,11 @@ type GitAuth = {
     extraHeaderUrl: string;
     header: string;
 };
+export declare function resolveProjectFilePath(branchPath: string, virtualPath: string): {
+    absolutePath: string;
+    virtualPath: string;
+    repoRelativePath: string;
+};
 export declare function ensureVisibleGitCheckout(input: {
     projectRoot: string;
     branchName: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.13",
+  "version": "0.0.14",
   "type": "module",
   "main": "./dist/cjs/main.cjs",
   "module": "./dist/mjs/main.mjs",