@sparkelf/dsh-plus 0.1.0-rc.30 → 0.1.0-rc.31

package/lib/bin.js

@@ -3,7 +3,7 @@ import { r as runApply } from "./apply-e0aMC4B4.js";
 import { createRequire } from "node:module";
 import { execFileSync, spawn, spawnSync } from "node:child_process";
 import { createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { dirname, join, posix, resolve, win32 } from "node:path";
 import { homedir } from "node:os";
 import semver from "semver";
 import { fileURLToPath } from "node:url";
@@ -232,6 +232,27 @@ function resolveHome(env = process.env) {
 	return configured === void 0 || configured === "" ? join(homedir(), ".dsh") : resolve(configured);
 }
 /**
+* Whether one absolute path is the other or sits beneath it.
+*
+* A path outside the parent has a relative form starting with `..`, which every
+* platform answers the same way. Comparing the text against a literal separator is
+* not: Windows separates with a backslash, so a nested path never matched its own
+* ancestor and every Windows installation reported the distribution as sitting
+* outside its own tree.
+*
+* @param candidate - absolute path to test.
+* @param parent - absolute path that may contain it.
+* @param platform - separating convention, injectable so the Windows answer is
+* testable where the suite runs on a POSIX host.
+* @returns true when the candidate is the parent or inside it.
+*/
+function isWithin(candidate, parent, platform = process.platform) {
+	if (candidate === parent) return true;
+	const path = platform === "win32" ? win32 : posix;
+	const inside = path.relative(parent, candidate);
+	return inside !== "" && !inside.startsWith("..") && !inside.startsWith(path.sep + "..");
+}
+/**
 * Resolve the installed distribution directory from one requiring anchor.
 *
 * The anchor must be a path inside the consumer's own tree. Resolving from this
@@ -250,7 +271,7 @@ function resolveDistributionDirectory(anchor) {
 	}
 	let current = resolve(dirname(anchor));
 	for (;;) {
-		if (resolved === current || resolved.startsWith(current + "/")) return resolved;
+		if (isWithin(resolved, current)) return resolved;
 		const parent = dirname(current);
 		if (parent === current) break;
 		current = parent;

package/lib/types/standalone-profile.d.ts

@@ -21,6 +21,22 @@ export interface StandalonePaths {
 }
 /** Resolve the DSH home, honouring the environment override the launcher itself reads. */
 export declare function resolveHome(env?: NodeJS.ProcessEnv): string;
+/**
+ * Whether one absolute path is the other or sits beneath it.
+ *
+ * A path outside the parent has a relative form starting with `..`, which every
+ * platform answers the same way. Comparing the text against a literal separator is
+ * not: Windows separates with a backslash, so a nested path never matched its own
+ * ancestor and every Windows installation reported the distribution as sitting
+ * outside its own tree.
+ *
+ * @param candidate - absolute path to test.
+ * @param parent - absolute path that may contain it.
+ * @param platform - separating convention, injectable so the Windows answer is
+ * testable where the suite runs on a POSIX host.
+ * @returns true when the candidate is the parent or inside it.
+ */
+export declare function isWithin(candidate: string, parent: string, platform?: NodeJS.Platform): boolean;
 /**
  * Resolve the installed distribution directory from one requiring anchor.
  *

package/lib/types/standalone-profile.js

@@ -11,7 +11,7 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, symlinkSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { homedir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
+import { dirname, join, posix, resolve, win32 } from 'node:path';
 /** Profile name a standalone installation owns. */
 export const STANDALONE_PROFILE = 'plus';
 function requireRecord(value, label) {
@@ -29,6 +29,28 @@ export function resolveHome(env = process.env) {
     const configured = env.DSH_HOME;
     return configured === undefined || configured === '' ? join(homedir(), '.dsh') : resolve(configured);
 }
+/**
+ * Whether one absolute path is the other or sits beneath it.
+ *
+ * A path outside the parent has a relative form starting with `..`, which every
+ * platform answers the same way. Comparing the text against a literal separator is
+ * not: Windows separates with a backslash, so a nested path never matched its own
+ * ancestor and every Windows installation reported the distribution as sitting
+ * outside its own tree.
+ *
+ * @param candidate - absolute path to test.
+ * @param parent - absolute path that may contain it.
+ * @param platform - separating convention, injectable so the Windows answer is
+ * testable where the suite runs on a POSIX host.
+ * @returns true when the candidate is the parent or inside it.
+ */
+export function isWithin(candidate, parent, platform = process.platform) {
+    if (candidate === parent)
+        return true;
+    const path = platform === 'win32' ? win32 : posix;
+    const inside = path.relative(parent, candidate);
+    return inside !== '' && !inside.startsWith('..') && !inside.startsWith(path.sep + '..');
+}
 /**
  * Resolve the installed distribution directory from one requiring anchor.
  *
@@ -54,7 +76,7 @@ export function resolveDistributionDirectory(anchor) {
     // reports \`<root>/node_modules/@sparkelf/dsh-plus\`.
     let current = resolve(dirname(anchor));
     for (;;) {
-        if (resolved === current || resolved.startsWith(current + '/'))
+        if (isWithin(resolved, current))
             return resolved;
         const parent = dirname(current);
         if (parent === current)

package/package.json

@@ -138,5 +138,5 @@
   },
   "type": "module",
   "types": "lib/types/index.d.ts",
-  "version": "0.1.0-rc.30"
+  "version": "0.1.0-rc.31"
 }