@wrongstack/core 0.107.2 → 0.109.1

package/dist/{parallel-eternal-engine-CUtmM_0V.d.ts → parallel-eternal-engine-B2CbsKpc.d.ts}

@@ -5,7 +5,7 @@ import { M as ModelsRegistry } from './models-registry-B6_KfS65.js';
 import { T as ToolExecutorOptions, a as ToolExecutorStrategy, b as ToolBatchResult } from './index-DIKEcfgC.js';
 import { g as Agent, h as AgentFactory } from './agent-subagent-runner-DukQLUcS.js';
 import { b as BrainArbiter } from './brain-Dfv4Y82E.js';
-import { J as JournalEntry } from './goal-store-ht0VmR1A.js';
+import { J as JournalEntry } from './goal-store-CV9Yz2X_.js';
 import { D as DispatchClassifier, a as DefaultMultiAgentCoordinator } from './multi-agent-coordinator-51LvnXkD.js';
 
 declare class DefaultRetryPolicy implements RetryPolicy {
@@ -412,7 +412,8 @@ interface ParallelEternalOptions {
     projectRoot: string;
     /**
      * Override the resolved goal.json path. Defaults to
-     * `goalFilePath(projectRoot)` (a hashed location under the home dir).
+     * `goalFilePath(projectRoot)` — the canonical per-project goal file under
+     * `~/.wrongstack/projects/<slug>/`, shared with `/goal` and the TUI.
      * Primarily for tests that want an isolated goal file under a temp dir.
      */
     goalPath?: string | undefined;

package/dist/storage/index.d.ts

@@ -7,7 +7,7 @@ export { D as DefaultSessionReader, f as DefaultSessionReaderOptions, S as Sessi
 import { S as SessionRewinder, C as CheckpointInfo, a as RewindResultExtended } from '../session-rewinder-C9HnMkhP.js';
 import { T as TaskItem } from '../task-format-vGOIftmK.js';
 export { a as DirectorStateCheckpoint, D as DirectorStateSnapshot, b as DirectorSubagentState, c as DirectorTaskState, l as loadDirectorState } from '../director-state-BfeCUbmk.js';
-export { G as GoalFile, J as JournalEntry, M as MAX_JOURNAL_ENTRIES, a as MAX_PROGRESS_HISTORY, P as ProgressSnapshot, b as appendJournal, e as emptyGoal, f as formatGoal, g as goalFilePath, l as loadGoal, p as parseProgressFromText, r as recordProgress, s as saveGoal, c as setProgress, d as summarizeUsage } from '../goal-store-ht0VmR1A.js';
+export { G as GoalFile, J as JournalEntry, M as MAX_JOURNAL_ENTRIES, a as MAX_PROGRESS_HISTORY, P as ProgressSnapshot, b as appendJournal, e as emptyGoal, f as formatGoal, g as goalFilePath, l as loadGoal, p as parseProgressFromText, r as recordProgress, s as saveGoal, c as setProgress, d as summarizeUsage } from '../goal-store-CV9Yz2X_.js';
 import { W as WstackPaths } from '../wstack-paths-_lqjzErq.js';
 import { w as SyncCategory, g as SyncConfig } from '../config-BSU-6vah.js';
 export { A as AuditLevel, C as CORE_RECONSTRUCT_EVENTS, a as STANDARD_AUDIT_EVENTS, S as SessionEventBridge, b as SessionEventBridgeOptions, c as SessionSamplingOptions, T as ToolProgressSamplingOptions, d as createSessionEventBridge, r as resolveAuditLevel, e as resolveSessionLoggingConfig } from '../session-event-bridge-BpJ5trO9.js';

package/dist/storage/index.js

@@ -1,6 +1,6 @@
 import { randomBytes, randomUUID, createHash } from 'crypto';
 import * as fsp from 'fs/promises';
-import * as path2 from 'path';
+import * as path12 from 'path';
 import * as os from 'os';
 import { hostname } from 'os';
 
@@ -12,9 +12,9 @@ function expectDefined(value, label) {
   return value;
 }
 async function atomicWrite(targetPath, content, opts = {}) {
-  const dir = path2.dirname(targetPath);
+  const dir = path12.dirname(targetPath);
   await fsp.mkdir(dir, { recursive: true });
-  const tmp = path2.join(dir, `.${path2.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
+  const tmp = path12.join(dir, `.${path12.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
   try {
     if (typeof content === "string") {
       await fsp.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
@@ -53,9 +53,9 @@ async function ensureDir(dir) {
   await fsp.mkdir(dir, { recursive: true });
 }
 async function withFileLock(targetPath, fn, opts = {}) {
-  const dir = path2.dirname(targetPath);
+  const dir = path12.dirname(targetPath);
   await fsp.mkdir(dir, { recursive: true });
-  const lockPath = path2.join(dir, `.${path2.basename(targetPath)}.lock`);
+  const lockPath = path12.join(dir, `.${path12.basename(targetPath)}.lock`);
   const timeoutMs = opts.timeoutMs ?? 5e3;
   const staleMs = opts.staleMs ?? 3e4;
   const started = Date.now();
@@ -233,11 +233,11 @@ var DefaultSessionStore = class _DefaultSessionStore {
   }
   /** Absolute path to the session index file. */
   get indexFile() {
-    return path2.join(this.dir, "_index.jsonl");
+    return path12.join(this.dir, "_index.jsonl");
   }
   /** Join session ID to its absolute path within the store directory. */
   sessionPath(id, ext) {
-    return path2.join(this.dir, `${id}${ext}`);
+    return path12.join(this.dir, `${id}${ext}`);
   }
   /**
    * Ensure the directory implied by the session ID exists. When the ID
@@ -245,7 +245,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
    * subdirectory so sessions group naturally by day.
    */
   async ensureShardDir(id) {
-    const dirPath = path2.dirname(path2.join(this.dir, id));
+    const dirPath = path12.dirname(path12.join(this.dir, id));
     await ensureDir(dirPath);
     return dirPath;
   }
@@ -253,7 +253,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
     const id = meta.id && meta.id.length > 0 ? meta.id : generateSessionId(startedAt, meta.model ?? meta.provider);
     const shardDir = await this.ensureShardDir(id);
-    const file = path2.join(shardDir, `${path2.basename(id)}.jsonl`);
+    const file = path12.join(shardDir, `${path12.basename(id)}.jsonl`);
     let handle;
     try {
       handle = await fsp.open(file, "a", 384);
@@ -461,7 +461,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
         continue;
       if (entry.isDirectory()) {
         const childPrefix = depth === 0 ? entry.name : `${prefix}/${entry.name}`;
-        ids.push(...await this.collectSessionIds(path2.join(dir, entry.name), childPrefix, depth + 1));
+        ids.push(...await this.collectSessionIds(path12.join(dir, entry.name), childPrefix, depth + 1));
       } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
         if (entry.name === "_index.jsonl") continue;
         const base = entry.name.replace(/\.jsonl$/, "");
@@ -495,12 +495,12 @@ var DefaultSessionStore = class _DefaultSessionStore {
   async deleteSession(id) {
     await fsp.unlink(this.sessionPath(id, ".jsonl")).catch(() => void 0);
     await fsp.unlink(this.sessionPath(id, ".summary.json")).catch(() => void 0);
-    const shardDir = path2.dirname(path2.join(this.dir, id));
-    const base = path2.basename(id);
+    const shardDir = path12.dirname(path12.join(this.dir, id));
+    const base = path12.basename(id);
     for (const ext of [".plan.json", ".todos.json"]) {
-      await fsp.unlink(path2.join(shardDir, `${base}${ext}`)).catch(() => void 0);
+      await fsp.unlink(path12.join(shardDir, `${base}${ext}`)).catch(() => void 0);
     }
-    const sessDir = path2.join(shardDir, base);
+    const sessDir = path12.join(shardDir, base);
     await fsp.rm(sessDir, { recursive: true, force: true }).catch(() => void 0);
     await this.writeTombstone(id);
   }
@@ -512,7 +512,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     let deleted = 0;
     let activeSessionId = null;
     try {
-      const raw = await fsp.readFile(path2.join(this.dir, "active.json"), "utf8");
+      const raw = await fsp.readFile(path12.join(this.dir, "active.json"), "utf8");
       const active = JSON.parse(raw);
       activeSessionId = active.sessionId ?? null;
     } catch {
@@ -520,11 +520,11 @@ var DefaultSessionStore = class _DefaultSessionStore {
     const entries = await fsp.readdir(this.dir, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const dateDir = path2.join(this.dir, entry.name);
+      const dateDir = path12.join(this.dir, entry.name);
       const files = await fsp.readdir(dateDir, { withFileTypes: true }).catch(() => []);
       for (const file of files) {
         if (!file.isFile() || !file.name.endsWith(".jsonl")) continue;
-        const jsonlPath = path2.join(dateDir, file.name);
+        const jsonlPath = path12.join(dateDir, file.name);
         try {
           const stat5 = await fsp.stat(jsonlPath);
           if (stat5.mtimeMs >= cutoff) continue;
@@ -542,7 +542,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const dateDir = path2.join(this.dir, entry.name);
+      const dateDir = path12.join(this.dir, entry.name);
       try {
         const remaining = await fsp.readdir(dateDir);
         if (remaining.length === 0) {
@@ -707,7 +707,7 @@ var FileSessionWriter = class {
     this.meta = meta;
     this.events = events;
     this.resumed = opts.resumed ?? false;
-    this.manifestFile = opts.dir ? path2.join(opts.dir, `${path2.basename(id)}.summary.json`) : "";
+    this.manifestFile = opts.dir ? path12.join(opts.dir, `${path12.basename(id)}.summary.json`) : "";
     this.filePath = opts.filePath ?? "";
     this.secretScrubber = opts.secretScrubber;
     this.onCloseCb = opts.onClose;
@@ -1027,7 +1027,7 @@ function userInputTitle(content) {
 var QueueStore = class {
   file;
   constructor(opts) {
-    this.file = path2.join(opts.dir, "queue.json");
+    this.file = path12.join(opts.dir, "queue.json");
   }
   async write(items) {
     if (items.length === 0) {
@@ -1094,7 +1094,7 @@ var DefaultAttachmentStore = class {
     let data = input.data;
     if (this.spoolDir && bytes >= this.spoolThreshold) {
       await fsp.mkdir(this.spoolDir, { recursive: true });
-      spooledPath = path2.join(this.spoolDir, `${id}.bin`);
+      spooledPath = path12.join(this.spoolDir, `${id}.bin`);
       await atomicWrite(spooledPath, input.data, {
         encoding: input.kind === "image" ? "base64" : "utf8"
       });
@@ -1305,7 +1305,7 @@ var FileMemoryBackend = class {
   }
   async remember(scope, entry, filePath) {
     const file = this.resolveFile(filePath, scope);
-    await ensureDir(path2.dirname(file));
+    await ensureDir(path12.dirname(file));
     let existing = "";
     try {
       existing = await fsp.readFile(file, "utf8");
@@ -2643,7 +2643,7 @@ var RecoveryLock = class {
   sessionStore;
   probe;
   constructor(opts) {
-    this.file = path2.join(opts.dir, LOCK_FILE);
+    this.file = path12.join(opts.dir, LOCK_FILE);
     this.pid = opts.pid ?? process.pid;
     this.hostname = opts.hostname ?? os.hostname();
     this.maxAgeMs = opts.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
@@ -2701,7 +2701,7 @@ var RecoveryLock = class {
    * null return before calling this.
    */
   async write(sessionId) {
-    await ensureDir(path2.dirname(this.file));
+    await ensureDir(path12.dirname(this.file));
     const lock = {
       v: 1,
       sessionId,
@@ -3188,7 +3188,7 @@ var AnnotationsStore = class {
     if (!sessionId || sessionId.includes("/") || sessionId.includes("\\") || sessionId.includes("..")) {
       throw new Error(`Invalid sessionId: ${sessionId}`);
     }
-    return path2.join(this.dir, `${sessionId}.annotations.json`);
+    return path12.join(this.dir, `${sessionId}.annotations.json`);
   }
   async readFile(sessionId) {
     const fp = this.filePath(sessionId);
@@ -3345,7 +3345,7 @@ var ReplayLogStore = class {
       out.push({
         sessionId,
         entryCount: all.length,
-        path: path2.join(this.dir, name)
+        path: path12.join(this.dir, name)
       });
     }
     return out.sort((a, b) => a.sessionId.localeCompare(b.sessionId));
@@ -3355,7 +3355,7 @@ var ReplayLogStore = class {
     if (!sessionId || sessionId.includes("/") || sessionId.includes("\\") || sessionId.includes("..")) {
       throw new Error(`Invalid sessionId: ${sessionId}`);
     }
-    return path2.join(this.dir, `${sessionId}.replay.jsonl`);
+    return path12.join(this.dir, `${sessionId}.replay.jsonl`);
   }
   async readAll(sessionId) {
     const fp = this.filePath(sessionId);
@@ -3544,7 +3544,7 @@ var SessionRecovery = class {
     if (!sessionId || sessionId.includes("/") || sessionId.includes("\\") || sessionId.includes("..")) {
       throw new Error(`Invalid sessionId: ${sessionId}`);
     }
-    return path2.join(this.dir, `${sessionId}.jsonl`);
+    return path12.join(this.dir, `${sessionId}.jsonl`);
   }
 };
 var GENESIS_PREV = "0".repeat(64);
@@ -3667,7 +3667,7 @@ var ToolAuditLog = class {
     if (!sessionId || sessionId.includes("/") || sessionId.includes("\\") || sessionId.includes("..")) {
       throw new Error(`Invalid sessionId: ${sessionId}`);
     }
-    return path2.join(this.dir, `${sessionId}.audit.jsonl`);
+    return path12.join(this.dir, `${sessionId}.audit.jsonl`);
   }
   async readAll(sessionId) {
     const fp = this.filePath(sessionId);
@@ -3852,7 +3852,7 @@ var DefaultSessionRewinder = class {
   sessionsDir;
   projectRoot;
   async listCheckpoints(sessionId) {
-    const file = path2.join(this.sessionsDir, `${sessionId}.jsonl`);
+    const file = path12.join(this.sessionsDir, `${sessionId}.jsonl`);
     const raw = await fsp.readFile(file, "utf8");
     const events = parseEvents(raw);
     const fileCountMap = /* @__PURE__ */ new Map();
@@ -3877,7 +3877,7 @@ var DefaultSessionRewinder = class {
     return checkpoints;
   }
   async rewindToCheckpoint(sessionId, checkpointIndex) {
-    const file = path2.join(this.sessionsDir, `${sessionId}.jsonl`);
+    const file = path12.join(this.sessionsDir, `${sessionId}.jsonl`);
     const raw = await fsp.readFile(file, "utf8");
     const events = parseEvents(raw);
     let targetIdx = -1;
@@ -3912,7 +3912,7 @@ var DefaultSessionRewinder = class {
     return { ...result, toPromptIndex: checkpointIndex, removedEvents };
   }
   async rewindLastN(sessionId, n) {
-    const file = path2.join(this.sessionsDir, `${sessionId}.jsonl`);
+    const file = path12.join(this.sessionsDir, `${sessionId}.jsonl`);
     const raw = await fsp.readFile(file, "utf8");
     const events = parseEvents(raw);
     const checkpoints = [];
@@ -3941,7 +3941,7 @@ var DefaultSessionRewinder = class {
     return { ...result, toPromptIndex: targetIndex, removedEvents: snapshotsToRevert.length };
   }
   async rewindToStart(sessionId) {
-    const file = path2.join(this.sessionsDir, `${sessionId}.jsonl`);
+    const file = path12.join(this.sessionsDir, `${sessionId}.jsonl`);
     const raw = await fsp.readFile(file, "utf8");
     const events = parseEvents(raw);
     const allSnapshots = [];
@@ -3977,10 +3977,10 @@ async function revertSnapshots(snapshots, projectRoot) {
   for (const snapshot of snapshots) {
     for (const file of snapshot.files) {
       try {
-        const absPath = path2.resolve(file.path);
-        const root = path2.resolve(projectRoot);
-        const rel = path2.relative(root, absPath);
-        if (rel.startsWith("..") || path2.isAbsolute(rel)) {
+        const absPath = path12.resolve(file.path);
+        const root = path12.resolve(projectRoot);
+        const rel = path12.relative(root, absPath);
+        if (rel.startsWith("..") || path12.isAbsolute(rel)) {
           errors.push(`${file.path}: path resolves outside project root \u2014 skipping`);
           continue;
         }
@@ -4560,6 +4560,57 @@ var color = {
   bgRed: wrap("41", "49"),
   bgGreen: wrap("42", "49")
 };
+function projectHash(absRoot) {
+  return createHash("sha256").update(path12.resolve(absRoot)).digest("hex").slice(0, 12);
+}
+function projectSlug(absRoot) {
+  const base = slugify(path12.basename(absRoot));
+  const hash = createHash("sha256").update(path12.resolve(absRoot)).digest("hex").slice(0, 6);
+  return `${base}-${hash}`;
+}
+function slugify(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "project";
+}
+function resolveWstackPaths(opts) {
+  const home = opts.userHome ?? os.homedir();
+  const globalRoot = opts.globalRoot ?? path12.join(home, ".wrongstack");
+  const hash = projectHash(opts.projectRoot);
+  const slug = projectSlug(opts.projectRoot);
+  const projectDir = path12.join(globalRoot, "projects", slug);
+  return {
+    globalRoot,
+    configDir: globalRoot,
+    globalConfig: path12.join(globalRoot, "config.json"),
+    secretsKey: path12.join(globalRoot, ".key"),
+    globalMemory: path12.join(globalRoot, "memory.md"),
+    globalSkills: path12.join(globalRoot, "skills"),
+    globalPrompts: path12.join(globalRoot, "prompts"),
+    cacheDir: path12.join(globalRoot, "cache"),
+    modelsCache: path12.join(globalRoot, "cache", "models.dev.json"),
+    modelsOverlayCache: path12.join(globalRoot, "cache", "models-overlay.json"),
+    historyFile: path12.join(globalRoot, "history"),
+    logFile: path12.join(globalRoot, "logs", "wrongstack.log"),
+    projectDir,
+    projectCodebaseIndex: path12.join(projectDir, "codebase-index"),
+    projectMemory: path12.join(projectDir, "memory.md"),
+    projectSessions: path12.join(projectDir, "sessions"),
+    projectTrust: path12.join(projectDir, "trust.json"),
+    projectMeta: path12.join(projectDir, "meta.json"),
+    projectLocalConfig: path12.join(projectDir, "config.local.json"),
+    inProjectAgentsFile: path12.join(opts.projectRoot, ".wrongstack", "AGENTS.md"),
+    inProjectSkills: path12.join(opts.projectRoot, ".wrongstack", "skills"),
+    inProjectWorktrees: path12.join(opts.projectRoot, ".wrongstack", "worktrees"),
+    projectHash: hash,
+    projectSlug: slug,
+    projectGoal: path12.join(projectDir, "goal.json"),
+    projectSpecs: path12.join(projectDir, "specs"),
+    projectTaskGraphs: path12.join(projectDir, "task-graphs"),
+    projectSddSession: path12.join(projectDir, "sdd-session.json"),
+    projectPlan: path12.join(projectDir, "plan.json"),
+    projectAutophase: path12.join(projectDir, "autophase"),
+    syncConfig: path12.join(globalRoot, "sync.json")
+  };
+}
 
 // src/types/errors.ts
 var ERROR_CODES = {
@@ -4614,8 +4665,7 @@ var FsError = class extends WrongStackError {
 // src/storage/goal-store.ts
 var MAX_JOURNAL_ENTRIES = 500;
 function goalFilePath(projectRoot) {
-  const hash = createHash("sha256").update(path2.resolve(projectRoot)).digest("hex").slice(0, 12);
-  return path2.join(os.homedir(), ".wrongstack", "projects", hash, "goal.json");
+  return resolveWstackPaths({ projectRoot }).projectGoal;
 }
 async function loadGoal(filePath) {
   let raw;
@@ -4801,7 +4851,7 @@ var DefaultPromptStore = class {
         if (!file.endsWith(".json")) continue;
         try {
           const raw = JSON.parse(
-            await fsp.readFile(path2.join(this.dir, file), "utf8")
+            await fsp.readFile(path12.join(this.dir, file), "utf8")
           );
           entries.push(raw.entry);
         } catch {
@@ -4814,7 +4864,7 @@ var DefaultPromptStore = class {
     );
   }
   async get(id) {
-    const file = path2.join(this.dir, `${id}.json`);
+    const file = path12.join(this.dir, `${id}.json`);
     try {
       const raw = JSON.parse(await fsp.readFile(file, "utf8"));
       return raw.entry;
@@ -4824,12 +4874,12 @@ var DefaultPromptStore = class {
   }
   async save(entry) {
     await ensureDir(this.dir);
-    const file = path2.join(this.dir, `${entry.id}.json`);
+    const file = path12.join(this.dir, `${entry.id}.json`);
     const raw = { version: 1, entry };
     await atomicWrite(file, JSON.stringify(raw, null, 2));
   }
   async delete(id) {
-    const file = path2.join(this.dir, `${id}.json`);
+    const file = path12.join(this.dir, `${id}.json`);
     try {
       await fsp.unlink(file);
       return true;
@@ -4863,7 +4913,7 @@ var CloudSync = class {
     this.paths = paths;
     this.getConfig = getConfig;
     this.setConfig = setConfig;
-    this.statePath = path2.join(paths.globalRoot, "sync-state.json");
+    this.statePath = path12.join(paths.globalRoot, "sync-state.json");
   }
   paths;
   getConfig;
@@ -4970,7 +5020,7 @@ var CloudSync = class {
       const rel = segments.slice(2).join("/");
       const destPath = resolvePulledCategoryPath(cat, localPath, rel, entry.path);
       const blobData = await this.getBlob(token, owner, repoName, entry.sha);
-      await fsp.mkdir(path2.dirname(destPath), { recursive: true });
+      await fsp.mkdir(path12.dirname(destPath), { recursive: true });
       await fsp.writeFile(destPath, Buffer.from(blobData, "base64"));
     }
     const localRev = await this.hashLocalCategories(cfg.categories);
@@ -5077,7 +5127,7 @@ var CloudSync = class {
           const files = await this.walkDir(localPath, localPath);
           for (const file of files) {
             const content = await fsp.readFile(file, "utf8");
-            const rel = path2.relative(localPath, file).replace(/\\/g, "/");
+            const rel = path12.relative(localPath, file).replace(/\\/g, "/");
             entries.push({ path: `data/${cat}/${rel}`, content, mode: "100644" });
             hashes.push(content);
           }
@@ -5134,7 +5184,7 @@ var CloudSync = class {
     const results = [];
     const entries = await fsp.readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const full = path2.join(dir, entry.name);
+      const full = path12.join(dir, entry.name);
       if (entry.isDirectory()) {
         results.push(...await this.walkDir(full, base));
       } else {
@@ -5151,15 +5201,15 @@ function resolvePulledCategoryPath(cat, localPath, rel, remotePath) {
     return localPath;
   }
   if (!rel) return localPath;
-  const normalizedRel = path2.normalize(rel);
-  const traversesUp = normalizedRel === ".." || normalizedRel.startsWith(`..${path2.sep}`);
-  if (path2.isAbsolute(normalizedRel) || traversesUp) {
+  const normalizedRel = path12.normalize(rel);
+  const traversesUp = normalizedRel === ".." || normalizedRel.startsWith(`..${path12.sep}`);
+  if (path12.isAbsolute(normalizedRel) || traversesUp) {
     throw new Error(`Refusing CloudSync path traversal: ${remotePath}`);
   }
-  const dest = path2.resolve(localPath, normalizedRel);
-  const root = path2.resolve(localPath);
-  const relative3 = path2.relative(root, dest);
-  if (relative3.startsWith("..") || path2.isAbsolute(relative3)) {
+  const dest = path12.resolve(localPath, normalizedRel);
+  const root = path12.resolve(localPath);
+  const relative3 = path12.relative(root, dest);
+  if (relative3.startsWith("..") || path12.isAbsolute(relative3)) {
     throw new Error(`Refusing CloudSync path outside category root: ${remotePath}`);
   }
   return dest;