@wrongstack/tools 0.306.2 → 0.306.4

package/dist/exec.js

@@ -487,8 +487,9 @@ async function resolveRealInsideRoot(absPath, ctx) {
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) {
-      return pendingTail.length > 0 ? path2.join(real, ...pendingTail) : real;
+    const candidate = pendingTail.length > 0 ? path2.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
     }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`

package/dist/format.js

@@ -1041,6 +1041,7 @@ function utf8Prefix(text, maxBytes) {
 }
 
 // src/_util.ts
+import * as fsp2 from "node:fs/promises";
 import * as path3 from "node:path";
 import * as Core from "@wrongstack/core/utils";
 function resolvePath(input, ctx) {
@@ -1064,6 +1065,40 @@ function ensureInsideRoot(absPath, ctx) {
 function safeResolve(input, ctx) {
   return ensureInsideRoot(resolvePath(input, ctx), ctx);
 }
+async function resolveRealInsideRoot(absPath, ctx) {
+  if (ctx.allowOutsideProjectRoot) return absPath;
+  const realRoots = await Promise.all(
+    allowedRoots(ctx).map((r) => fsp2.realpath(r).catch(() => path3.resolve(r)))
+  );
+  let probe = absPath;
+  const pendingTail = [];
+  for (; ; ) {
+    let real;
+    try {
+      real = await fsp2.realpath(probe);
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        const parent = path3.dirname(probe);
+        if (parent === probe) return absPath;
+        pendingTail.unshift(path3.basename(probe));
+        probe = parent;
+        continue;
+      }
+      throw err;
+    }
+    const candidate = pendingTail.length > 0 ? path3.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
+    }
+    throw new Error(
+      `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
+    );
+  }
+}
+async function safeResolveReal(input, ctx) {
+  const abs = safeResolve(input, ctx);
+  return await resolveRealInsideRoot(abs, ctx);
+}
 var COMMAND_OUTPUT_MAX_BYTES = 32768;
 var REPEAT_RUN_THRESHOLD = 3;
 function collapseCarriageReturns(text) {
@@ -3590,7 +3625,7 @@ var formatTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const fixer = input.fixer ?? "auto";
     if (fixer === "auto" && !input.files) {
       const op = input.check ? "format-check" : "format-write";

package/dist/glob.js

@@ -125,8 +125,9 @@ async function resolveRealInsideRoot(absPath, ctx) {
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) {
-      return pendingTail.length > 0 ? path2.join(real, ...pendingTail) : real;
+    const candidate = pendingTail.length > 0 ? path2.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
     }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`

package/dist/grep.js

@@ -199,8 +199,9 @@ async function resolveRealInsideRoot(absPath, ctx) {
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) {
-      return pendingTail.length > 0 ? path.join(real, ...pendingTail) : real;
+    const candidate = pendingTail.length > 0 ? path.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
     }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`