@wrongstack/tools 0.306.3 → 0.306.4

package/dist/audit.js

@@ -1041,6 +1041,7 @@ function utf8Prefix(text, maxBytes) {
 }
 
 // src/_util.ts
+import * as fsp2 from "node:fs/promises";
 import * as path3 from "node:path";
 import * as Core from "@wrongstack/core/utils";
 async function detectPackageManager(cwd, stopAt) {
@@ -1107,6 +1108,40 @@ function ensureInsideRoot(absPath, ctx) {
 function safeResolve(input, ctx) {
   return ensureInsideRoot(resolvePath(input, ctx), ctx);
 }
+async function resolveRealInsideRoot(absPath, ctx) {
+  if (ctx.allowOutsideProjectRoot) return absPath;
+  const realRoots = await Promise.all(
+    allowedRoots(ctx).map((r) => fsp2.realpath(r).catch(() => path3.resolve(r)))
+  );
+  let probe = absPath;
+  const pendingTail = [];
+  for (; ; ) {
+    let real;
+    try {
+      real = await fsp2.realpath(probe);
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        const parent = path3.dirname(probe);
+        if (parent === probe) return absPath;
+        pendingTail.unshift(path3.basename(probe));
+        probe = parent;
+        continue;
+      }
+      throw err;
+    }
+    const candidate = pendingTail.length > 0 ? path3.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
+    }
+    throw new Error(
+      `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
+    );
+  }
+}
+async function safeResolveReal(input, ctx) {
+  const abs = safeResolve(input, ctx);
+  return await resolveRealInsideRoot(abs, ctx);
+}
 var COMMAND_OUTPUT_MAX_BYTES = 32768;
 var REPEAT_RUN_THRESHOLD = 3;
 function collapseCarriageReturns(text) {
@@ -3890,7 +3925,7 @@ var auditTool = {
         "audit: `fix: true` is not supported \u2014 this tool is read-only (mutating: false). To remediate vulnerabilities, upgrade the affected packages with the `install` tool (or `language_package` for non-JS ecosystems)."
       );
     }
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const bridge = await tryLegacyPackageOperation("package-audit", {
       cwd,
       projectRoot: ctx.projectRoot,

package/dist/builtin.js

@@ -1202,8 +1202,9 @@ async function resolveRealInsideRoot(absPath, ctx) {
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) {
-      return pendingTail.length > 0 ? path3.join(real, ...pendingTail) : real;
+    const candidate = pendingTail.length > 0 ? path3.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
     }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
@@ -7737,7 +7738,7 @@ var auditTool = {
         "audit: `fix: true` is not supported \u2014 this tool is read-only (mutating: false). To remediate vulnerabilities, upgrade the affected packages with the `install` tool (or `language_package` for non-JS ecosystems)."
       );
     }
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const bridge = await tryLegacyPackageOperation("package-audit", {
       cwd,
       projectRoot: ctx.projectRoot,
@@ -18062,7 +18063,7 @@ var documentTool = {
     }
   },
   async execute(input, ctx) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const style = input.style ?? "jsdoc";
     const results = [];
     let filesProcessed = 0;
@@ -18071,7 +18072,7 @@ var documentTool = {
       Array.isArray(input.files) ? input.files.join(",") : input.files,
       cwd,
       ctx
-    ) : input.path ? [safeResolve(input.path, ctx)] : [];
+    ) : input.path ? [await safeResolveReal(input.path, ctx)] : [];
     for (const absPath of fileList) {
       try {
         const content = await fs23.readFile(absPath, "utf8");
@@ -21187,7 +21188,7 @@ var formatTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const fixer = input.fixer ?? "auto";
     if (fixer === "auto" && !input.files) {
       const op = input.check ? "format-check" : "format-write";
@@ -22405,7 +22406,7 @@ var installTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     if (!input.global) {
       const pkgList2 = input.packages ? Array.isArray(input.packages) ? input.packages : input.packages.split(",").map((p) => p.trim()) : [];
       const bridge = await tryLegacyPackageOperation(
@@ -25581,7 +25582,7 @@ var lintTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const linter = input.linter ?? "auto";
     if (linter === "auto" && !input.files) {
       const bridge = await tryLegacyCodeOperation("lint", {
@@ -25707,7 +25708,7 @@ var logsTool = {
     }
   },
   async execute(input, ctx, opts) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const lines = input.lines ?? 100;
     let filterRe = null;
     if (input.filter) {
@@ -25914,7 +25915,7 @@ var outdatedTool = {
     }
   },
   async execute(input, ctx, opts) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const manager = await detectPackageManager(cwd, ctx.projectRoot);
     if (manager === "npm") {
       try {
@@ -27628,7 +27629,7 @@ async function resolveFiles2(filesInput, ctx, extraGlob) {
   const parts = normalized.split(",").map((s) => s.trim()).filter(Boolean);
   const resolved = [];
   for (const p of parts) {
-    const absPath = safeResolve(p, ctx);
+    const absPath = await safeResolveReal(p, ctx);
     if (extraGlob && !passesExtraGlob(extraGlob, path35.basename(absPath), absPath)) continue;
     const stat19 = await fs30.stat(absPath).catch(() => null);
     if (stat19?.isFile()) {
@@ -27866,7 +27867,7 @@ var scaffoldTool = {
     required: ["template", "name"]
   },
   async execute(input, ctx) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const name = input.name;
     const vars = { name, ...input.vars };
     const builtIn = BUILT_IN_TEMPLATES[input.template];
@@ -28954,7 +28955,7 @@ var testTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const runner = input.runner ?? "auto";
     if (runner === "auto") {
       const bridge = await tryLegacyCodeOperation("test", {
@@ -29469,7 +29470,7 @@ var treeTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    const basePath = input.path ? safeResolve(input.path, ctx) : ctx.cwd;
+    const basePath = input.path ? await safeResolveReal(input.path, ctx) : ctx.cwd;
     const maxDepth = input.depth ?? 3;
     const showFiles = input.show_files ?? true;
     const showDirs = input.show_dirs ?? true;
@@ -29649,7 +29650,7 @@ var typecheckTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const bridge = await tryLegacyCodeOperation("semantic", {
       cwd,
       projectRoot: ctx.projectRoot,
@@ -29686,7 +29687,7 @@ var typecheckTool = {
         cmdArgs = ["tsc", ...tscArgs];
       }
     } else {
-      const tsconfig = input.project ? safeResolve(input.project, ctx) : await findTsConfig(cwd);
+      const tsconfig = input.project ? await safeResolveReal(input.project, ctx) : await findTsConfig(cwd);
       const tscArgs = ["--noEmit"];
       if (input.strict) tscArgs.push("--strict");
       if (tsconfig) tscArgs.push("--project", tsconfig);

package/dist/diff.js

@@ -52,8 +52,9 @@ async function resolveRealInsideRoot(absPath, ctx) {
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) {
-      return pendingTail.length > 0 ? path.join(real, ...pendingTail) : real;
+    const candidate = pendingTail.length > 0 ? path.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
     }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`

package/dist/document.js

@@ -3,6 +3,7 @@ import * as fs from "node:fs/promises";
 import * as path2 from "node:path";
 
 // src/_util.ts
+import * as fsp from "node:fs/promises";
 import * as path from "node:path";
 import * as Core from "@wrongstack/core/utils";
 function resolvePath(input, ctx) {
@@ -26,6 +27,40 @@ function ensureInsideRoot(absPath, ctx) {
 function safeResolve(input, ctx) {
   return ensureInsideRoot(resolvePath(input, ctx), ctx);
 }
+async function resolveRealInsideRoot(absPath, ctx) {
+  if (ctx.allowOutsideProjectRoot) return absPath;
+  const realRoots = await Promise.all(
+    allowedRoots(ctx).map((r) => fsp.realpath(r).catch(() => path.resolve(r)))
+  );
+  let probe = absPath;
+  const pendingTail = [];
+  for (; ; ) {
+    let real;
+    try {
+      real = await fsp.realpath(probe);
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        const parent = path.dirname(probe);
+        if (parent === probe) return absPath;
+        pendingTail.unshift(path.basename(probe));
+        probe = parent;
+        continue;
+      }
+      throw err;
+    }
+    const candidate = pendingTail.length > 0 ? path.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
+    }
+    throw new Error(
+      `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
+    );
+  }
+}
+async function safeResolveReal(input, ctx) {
+  const abs = safeResolve(input, ctx);
+  return await resolveRealInsideRoot(abs, ctx);
+}
 
 // src/document.ts
 var documentTool = {
@@ -63,7 +98,7 @@ var documentTool = {
     }
   },
   async execute(input, ctx) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const style = input.style ?? "jsdoc";
     const results = [];
     let filesProcessed = 0;
@@ -72,7 +107,7 @@ var documentTool = {
       Array.isArray(input.files) ? input.files.join(",") : input.files,
       cwd,
       ctx
-    ) : input.path ? [safeResolve(input.path, ctx)] : [];
+    ) : input.path ? [await safeResolveReal(input.path, ctx)] : [];
     for (const absPath of fileList) {
       try {
         const content = await fs.readFile(absPath, "utf8");

package/dist/e2e.js

@@ -48,8 +48,9 @@ async function resolveRealInsideRoot(absPath, ctx) {
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) {
-      return pendingTail.length > 0 ? path.join(real, ...pendingTail) : real;
+    const candidate = pendingTail.length > 0 ? path.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
     }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`

package/dist/edit.js

@@ -369,8 +369,9 @@ async function resolveRealInsideRoot(absPath, ctx) {
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) {
-      return pendingTail.length > 0 ? path2.join(real, ...pendingTail) : real;
+    const candidate = pendingTail.length > 0 ? path2.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
     }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`

package/dist/exec.js

@@ -487,8 +487,9 @@ async function resolveRealInsideRoot(absPath, ctx) {
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) {
-      return pendingTail.length > 0 ? path2.join(real, ...pendingTail) : real;
+    const candidate = pendingTail.length > 0 ? path2.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
     }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`

package/dist/format.js

@@ -1041,6 +1041,7 @@ function utf8Prefix(text, maxBytes) {
 }
 
 // src/_util.ts
+import * as fsp2 from "node:fs/promises";
 import * as path3 from "node:path";
 import * as Core from "@wrongstack/core/utils";
 function resolvePath(input, ctx) {
@@ -1064,6 +1065,40 @@ function ensureInsideRoot(absPath, ctx) {
 function safeResolve(input, ctx) {
   return ensureInsideRoot(resolvePath(input, ctx), ctx);
 }
+async function resolveRealInsideRoot(absPath, ctx) {
+  if (ctx.allowOutsideProjectRoot) return absPath;
+  const realRoots = await Promise.all(
+    allowedRoots(ctx).map((r) => fsp2.realpath(r).catch(() => path3.resolve(r)))
+  );
+  let probe = absPath;
+  const pendingTail = [];
+  for (; ; ) {
+    let real;
+    try {
+      real = await fsp2.realpath(probe);
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        const parent = path3.dirname(probe);
+        if (parent === probe) return absPath;
+        pendingTail.unshift(path3.basename(probe));
+        probe = parent;
+        continue;
+      }
+      throw err;
+    }
+    const candidate = pendingTail.length > 0 ? path3.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
+    }
+    throw new Error(
+      `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
+    );
+  }
+}
+async function safeResolveReal(input, ctx) {
+  const abs = safeResolve(input, ctx);
+  return await resolveRealInsideRoot(abs, ctx);
+}
 var COMMAND_OUTPUT_MAX_BYTES = 32768;
 var REPEAT_RUN_THRESHOLD = 3;
 function collapseCarriageReturns(text) {
@@ -3590,7 +3625,7 @@ var formatTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const fixer = input.fixer ?? "auto";
     if (fixer === "auto" && !input.files) {
       const op = input.check ? "format-check" : "format-write";

package/dist/glob.js

@@ -125,8 +125,9 @@ async function resolveRealInsideRoot(absPath, ctx) {
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) {
-      return pendingTail.length > 0 ? path2.join(real, ...pendingTail) : real;
+    const candidate = pendingTail.length > 0 ? path2.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
     }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`

package/dist/grep.js

@@ -199,8 +199,9 @@ async function resolveRealInsideRoot(absPath, ctx) {
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) {
-      return pendingTail.length > 0 ? path.join(real, ...pendingTail) : real;
+    const candidate = pendingTail.length > 0 ? path.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
     }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`

package/dist/index.js

@@ -1205,8 +1205,9 @@ async function resolveRealInsideRoot(absPath, ctx) {
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) {
-      return pendingTail.length > 0 ? path3.join(real, ...pendingTail) : real;
+    const candidate = pendingTail.length > 0 ? path3.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
     }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
@@ -8095,7 +8096,7 @@ var auditTool = {
         "audit: `fix: true` is not supported \u2014 this tool is read-only (mutating: false). To remediate vulnerabilities, upgrade the affected packages with the `install` tool (or `language_package` for non-JS ecosystems)."
       );
     }
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const bridge = await tryLegacyPackageOperation("package-audit", {
       cwd,
       projectRoot: ctx.projectRoot,
@@ -18609,7 +18610,7 @@ var documentTool = {
     }
   },
   async execute(input, ctx) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const style = input.style ?? "jsdoc";
     const results = [];
     let filesProcessed = 0;
@@ -18618,7 +18619,7 @@ var documentTool = {
       Array.isArray(input.files) ? input.files.join(",") : input.files,
       cwd,
       ctx
-    ) : input.path ? [safeResolve(input.path, ctx)] : [];
+    ) : input.path ? [await safeResolveReal(input.path, ctx)] : [];
     for (const absPath of fileList) {
       try {
         const content = await fs23.readFile(absPath, "utf8");
@@ -21438,7 +21439,7 @@ var formatTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const fixer = input.fixer ?? "auto";
     if (fixer === "auto" && !input.files) {
       const op = input.check ? "format-check" : "format-write";
@@ -22656,7 +22657,7 @@ var installTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     if (!input.global) {
       const pkgList2 = input.packages ? Array.isArray(input.packages) ? input.packages : input.packages.split(",").map((p) => p.trim()) : [];
       const bridge = await tryLegacyPackageOperation(
@@ -26261,7 +26262,7 @@ var lintTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const linter = input.linter ?? "auto";
     if (linter === "auto" && !input.files) {
       const bridge = await tryLegacyCodeOperation("lint", {
@@ -26387,7 +26388,7 @@ var logsTool = {
     }
   },
   async execute(input, ctx, opts) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const lines = input.lines ?? 100;
     let filterRe = null;
     if (input.filter) {
@@ -26594,7 +26595,7 @@ var outdatedTool = {
     }
   },
   async execute(input, ctx, opts) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const manager = await detectPackageManager(cwd, ctx.projectRoot);
     if (manager === "npm") {
       try {
@@ -28308,7 +28309,7 @@ async function resolveFiles2(filesInput, ctx, extraGlob) {
   const parts = normalized.split(",").map((s) => s.trim()).filter(Boolean);
   const resolved = [];
   for (const p of parts) {
-    const absPath = safeResolve(p, ctx);
+    const absPath = await safeResolveReal(p, ctx);
     if (extraGlob && !passesExtraGlob(extraGlob, path35.basename(absPath), absPath)) continue;
     const stat20 = await fs30.stat(absPath).catch(() => null);
     if (stat20?.isFile()) {
@@ -28546,7 +28547,7 @@ var scaffoldTool = {
     required: ["template", "name"]
   },
   async execute(input, ctx) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const name = input.name;
     const vars = { name, ...input.vars };
     const builtIn = BUILT_IN_TEMPLATES[input.template];
@@ -29634,7 +29635,7 @@ var testTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const runner = input.runner ?? "auto";
     if (runner === "auto") {
       const bridge = await tryLegacyCodeOperation("test", {
@@ -30149,7 +30150,7 @@ var treeTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    const basePath = input.path ? safeResolve(input.path, ctx) : ctx.cwd;
+    const basePath = input.path ? await safeResolveReal(input.path, ctx) : ctx.cwd;
     const maxDepth = input.depth ?? 3;
     const showFiles = input.show_files ?? true;
     const showDirs = input.show_dirs ?? true;
@@ -30329,7 +30330,7 @@ var typecheckTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const bridge = await tryLegacyCodeOperation("semantic", {
       cwd,
       projectRoot: ctx.projectRoot,
@@ -30366,7 +30367,7 @@ var typecheckTool = {
         cmdArgs = ["tsc", ...tscArgs];
       }
     } else {
-      const tsconfig = input.project ? safeResolve(input.project, ctx) : await findTsConfig(cwd);
+      const tsconfig = input.project ? await safeResolveReal(input.project, ctx) : await findTsConfig(cwd);
       const tscArgs = ["--noEmit"];
       if (input.strict) tscArgs.push("--strict");
       if (tsconfig) tscArgs.push("--project", tsconfig);

package/dist/install.js

@@ -1048,6 +1048,7 @@ function utf8Prefix(text, maxBytes) {
 }
 
 // src/_util.ts
+import * as fsp2 from "node:fs/promises";
 import * as path3 from "node:path";
 import * as Core from "@wrongstack/core/utils";
 async function detectPackageManager(cwd, stopAt) {
@@ -1114,6 +1115,40 @@ function ensureInsideRoot(absPath, ctx) {
 function safeResolve(input, ctx) {
   return ensureInsideRoot(resolvePath(input, ctx), ctx);
 }
+async function resolveRealInsideRoot(absPath, ctx) {
+  if (ctx.allowOutsideProjectRoot) return absPath;
+  const realRoots = await Promise.all(
+    allowedRoots(ctx).map((r) => fsp2.realpath(r).catch(() => path3.resolve(r)))
+  );
+  let probe = absPath;
+  const pendingTail = [];
+  for (; ; ) {
+    let real;
+    try {
+      real = await fsp2.realpath(probe);
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        const parent = path3.dirname(probe);
+        if (parent === probe) return absPath;
+        pendingTail.unshift(path3.basename(probe));
+        probe = parent;
+        continue;
+      }
+      throw err;
+    }
+    const candidate = pendingTail.length > 0 ? path3.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
+    }
+    throw new Error(
+      `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
+    );
+  }
+}
+async function safeResolveReal(input, ctx) {
+  const abs = safeResolve(input, ctx);
+  return await resolveRealInsideRoot(abs, ctx);
+}
 var COMMAND_OUTPUT_MAX_BYTES = 32768;
 var REPEAT_RUN_THRESHOLD = 3;
 function collapseCarriageReturns(text) {
@@ -3905,7 +3940,7 @@ var installTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     if (!input.global) {
       const pkgList2 = input.packages ? Array.isArray(input.packages) ? input.packages : input.packages.split(",").map((p) => p.trim()) : [];
       const bridge = await tryLegacyPackageOperation(

package/dist/json.js

@@ -174,8 +174,9 @@ async function resolveRealInsideRoot(absPath, ctx) {
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) {
-      return pendingTail.length > 0 ? path.join(real, ...pendingTail) : real;
+    const candidate = pendingTail.length > 0 ? path.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
     }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`

package/dist/languages/index.js

@@ -3214,8 +3214,9 @@ async function resolveRealInsideRoot(absPath, ctx) {
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) {
-      return pendingTail.length > 0 ? path5.join(real, ...pendingTail) : real;
+    const candidate = pendingTail.length > 0 ? path5.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
     }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`

package/dist/lint.js

@@ -1041,6 +1041,7 @@ function utf8Prefix(text, maxBytes) {
 }
 
 // src/_util.ts
+import * as fsp2 from "node:fs/promises";
 import * as path3 from "node:path";
 import * as Core from "@wrongstack/core/utils";
 function resolvePath(input, ctx) {
@@ -1064,6 +1065,40 @@ function ensureInsideRoot(absPath, ctx) {
 function safeResolve(input, ctx) {
   return ensureInsideRoot(resolvePath(input, ctx), ctx);
 }
+async function resolveRealInsideRoot(absPath, ctx) {
+  if (ctx.allowOutsideProjectRoot) return absPath;
+  const realRoots = await Promise.all(
+    allowedRoots(ctx).map((r) => fsp2.realpath(r).catch(() => path3.resolve(r)))
+  );
+  let probe = absPath;
+  const pendingTail = [];
+  for (; ; ) {
+    let real;
+    try {
+      real = await fsp2.realpath(probe);
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        const parent = path3.dirname(probe);
+        if (parent === probe) return absPath;
+        pendingTail.unshift(path3.basename(probe));
+        probe = parent;
+        continue;
+      }
+      throw err;
+    }
+    const candidate = pendingTail.length > 0 ? path3.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
+    }
+    throw new Error(
+      `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
+    );
+  }
+}
+async function safeResolveReal(input, ctx) {
+  const abs = safeResolve(input, ctx);
+  return await resolveRealInsideRoot(abs, ctx);
+}
 var COMMAND_OUTPUT_MAX_BYTES = 32768;
 var REPEAT_RUN_THRESHOLD = 3;
 function collapseCarriageReturns(text) {
@@ -3584,7 +3619,7 @@ var lintTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const linter = input.linter ?? "auto";
     if (linter === "auto" && !input.files) {
       const bridge = await tryLegacyCodeOperation("lint", {