@wrongstack/tools 0.306.3 → 0.307.0

package/dist/tree.js

@@ -4,6 +4,7 @@ import * as path2 from "node:path";
 import { DEFAULT_WALK_IGNORE_DIRS, expectDefined } from "@wrongstack/core/utils";
 
 // src/_util.ts
+import * as fsp from "node:fs/promises";
 import * as path from "node:path";
 import * as Core from "@wrongstack/core/utils";
 function resolvePath(input, ctx) {
@@ -27,6 +28,40 @@ function ensureInsideRoot(absPath, ctx) {
 function safeResolve(input, ctx) {
   return ensureInsideRoot(resolvePath(input, ctx), ctx);
 }
+async function resolveRealInsideRoot(absPath, ctx) {
+  if (ctx.allowOutsideProjectRoot) return absPath;
+  const realRoots = await Promise.all(
+    allowedRoots(ctx).map((r) => fsp.realpath(r).catch(() => path.resolve(r)))
+  );
+  let probe = absPath;
+  const pendingTail = [];
+  for (; ; ) {
+    let real;
+    try {
+      real = await fsp.realpath(probe);
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        const parent = path.dirname(probe);
+        if (parent === probe) return absPath;
+        pendingTail.unshift(path.basename(probe));
+        probe = parent;
+        continue;
+      }
+      throw err;
+    }
+    const candidate = pendingTail.length > 0 ? path.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
+    }
+    throw new Error(
+      `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
+    );
+  }
+}
+async function safeResolveReal(input, ctx) {
+  const abs = safeResolve(input, ctx);
+  return await resolveRealInsideRoot(abs, ctx);
+}
 
 // src/tree.ts
 var DEFAULT_IGNORE = /* @__PURE__ */ new Set([
@@ -102,7 +137,7 @@ var treeTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    const basePath = input.path ? safeResolve(input.path, ctx) : ctx.cwd;
+    const basePath = input.path ? await safeResolveReal(input.path, ctx) : ctx.cwd;
     const maxDepth = input.depth ?? 3;
     const showFiles = input.show_files ?? true;
     const showDirs = input.show_dirs ?? true;

package/dist/typecheck.js

@@ -425,13 +425,16 @@ function killWin32Tree(pid, opts = {}) {
     };
     child.on("error", settle);
     child.on("close", settle);
-    timeout = setTimeout(() => {
-      try {
-        child.kill();
-      } catch {
-      }
-      settle();
-    }, Math.max(1, opts.timeoutMs ?? WIN32_TASKKILL_TIMEOUT_MS));
+    timeout = setTimeout(
+      () => {
+        try {
+          child.kill();
+        } catch {
+        }
+        settle();
+      },
+      Math.max(1, opts.timeoutMs ?? WIN32_TASKKILL_TIMEOUT_MS)
+    );
     timeout.unref?.();
     child.unref();
     return true;
@@ -605,7 +608,10 @@ var ProcessRegistryImpl = class {
   getBreakerCountdown() {
     if (this.autoKillArmedAt === null || this.autoKillResetMs <= 0) return null;
     const elapsed = Date.now() - this.autoKillArmedAt;
-    return { remainingMs: Math.max(0, this.autoKillResetMs - elapsed), totalMs: this.autoKillResetMs };
+    return {
+      remainingMs: Math.max(0, this.autoKillResetMs - elapsed),
+      totalMs: this.autoKillResetMs
+    };
   }
   /**
    * Subscribe to countdown arm/cancel events. Returns an unsubscribe function.
@@ -1044,6 +1050,7 @@ function utf8Prefix(text, maxBytes) {
 }
 
 // src/_util.ts
+import * as fsp2 from "node:fs/promises";
 import * as path3 from "node:path";
 import * as Core from "@wrongstack/core/utils";
 async function detectPackageManager(cwd, stopAt) {
@@ -1110,6 +1117,40 @@ function ensureInsideRoot(absPath, ctx) {
 function safeResolve(input, ctx) {
   return ensureInsideRoot(resolvePath(input, ctx), ctx);
 }
+async function resolveRealInsideRoot(absPath, ctx) {
+  if (ctx.allowOutsideProjectRoot) return absPath;
+  const realRoots = await Promise.all(
+    allowedRoots(ctx).map((r) => fsp2.realpath(r).catch(() => path3.resolve(r)))
+  );
+  let probe = absPath;
+  const pendingTail = [];
+  for (; ; ) {
+    let real;
+    try {
+      real = await fsp2.realpath(probe);
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        const parent = path3.dirname(probe);
+        if (parent === probe) return absPath;
+        pendingTail.unshift(path3.basename(probe));
+        probe = parent;
+        continue;
+      }
+      throw err;
+    }
+    const candidate = pendingTail.length > 0 ? path3.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
+    }
+    throw new Error(
+      `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
+    );
+  }
+}
+async function safeResolveReal(input, ctx) {
+  const abs = safeResolve(input, ctx);
+  return await resolveRealInsideRoot(abs, ctx);
+}
 var COMMAND_OUTPUT_MAX_BYTES = 32768;
 var REPEAT_RUN_THRESHOLD = 3;
 function collapseCarriageReturns(text) {
@@ -3629,7 +3670,7 @@ var typecheckTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const bridge = await tryLegacyCodeOperation("semantic", {
       cwd,
       projectRoot: ctx.projectRoot,
@@ -3666,7 +3707,7 @@ var typecheckTool = {
         cmdArgs = ["tsc", ...tscArgs];
       }
     } else {
-      const tsconfig = input.project ? safeResolve(input.project, ctx) : await findTsConfig(cwd);
+      const tsconfig = input.project ? await safeResolveReal(input.project, ctx) : await findTsConfig(cwd);
       const tscArgs = ["--noEmit"];
       if (input.strict) tscArgs.push("--strict");
       if (tsconfig) tscArgs.push("--project", tsconfig);