carrick 0.3.112 → 0.3.113

package/sidecar/dist/src/capture/check.js

@@ -27,17 +27,73 @@ import { buildPoisonIndexes } from './check-poison.js';
 import { openProbeProgram, probeDeepFindings } from './check-deep.js';
 import { pairFieldReports } from './check-fields.js';
 import { pairDispatchUnions } from './check-union.js';
-function runProcess(command, args, cwd) {
+function runProcess(command, args, cwd, env) {
     return new Promise((resolve, reject) => {
-        const child = spawn(command, args, { cwd, stdio: ['ignore', 'pipe', 'pipe'] });
+        const child = spawn(command, args, { cwd, env, stdio: ['ignore', 'pipe', 'pipe'] });
         let stdout = '';
         let stderr = '';
         child.stdout.on('data', (d) => (stdout += d.toString()));
         child.stderr.on('data', (d) => (stderr += d.toString()));
         child.on('error', reject);
-        child.on('close', (code) => resolve({ code, stdout, stderr }));
+        child.on('close', (code, signal) => resolve({ code, signal, stdout, stderr }));
     });
 }
+/** The tail V8 prints on every fatal heap-exhaustion line. */
+const HEAP_OUT_OF_MEMORY = 'JavaScript heap out of memory';
+/**
+ * V8's hard size limits print the same tail, and a larger heap does not lift
+ * them, so they are not memory deaths.
+ */
+const HARD_SIZE_LIMITS = ['invalid table size', 'invalid array length', 'Invalid array buffer length'];
+/**
+ * Whether a process's stderr carries V8's fatal heap-exhaustion line
+ * (`Reached heap limit`, `Ineffective mark-compacts near heap limit`, and the
+ * other forms all end in `JavaScript heap out of memory`), and not one of the
+ * hard size limits that end the same way (carrick#2209).
+ *
+ * The scanner applies the same rule to the sidecar's own stderr
+ * (carrick#2208); the two must stay in step.
+ */
+export function carriesHeapLimitLine(stderr) {
+    return stderr
+        .split('\n')
+        .some((line) => line.includes(HEAP_OUT_OF_MEMORY) &&
+        !HARD_SIZE_LIMITS.some((limit) => line.includes(limit)));
+}
+/** V8's default old-space ceiling on a 64-bit host, in MB. */
+const V8_DEFAULT_HEAP_CEILING_MB = 4096;
+/**
+ * The heap a Node child of the sidecar (the check's compiler) is given
+ * (carrick#2209).
+ *
+ * The scanner sizes the sidecar's cap to the machine and passes it as a
+ * command-line flag, which a child does not inherit, so the child ran at V8's
+ * default. Handing it the same cap would overcommit the box: the sidecar's
+ * cap is already 3/4 of memory, and two such caps turn a heap error into an
+ * OS kill, which the sizing exists to avoid. So the child gets what is left of
+ * the sidecar's cap after what the sidecar holds now (`rssMb`), and only when
+ * that is more than V8's default; otherwise `NODE_OPTIONS` is left as it is
+ * and the child runs at the default, as before.
+ */
+export function childHeap(execArgv, existing, rssMb) {
+    let cap;
+    for (let i = 0; i < execArgv.length; i++) {
+        const match = /^--max[-_]old[-_]space[-_]size(?:=(.*))?$/.exec(execArgv[i]);
+        if (!match)
+            continue;
+        const value = match[1] ?? execArgv[i + 1];
+        if (value !== undefined && /^\d+$/.test(value))
+            cap = Number(value);
+    }
+    const budget = cap === undefined ? 0 : Math.floor(cap - rssMb);
+    if (budget <= V8_DEFAULT_HEAP_CEILING_MB)
+        return { nodeOptions: existing, heapCapMb: null };
+    const flag = `--max-old-space-size=${budget}`;
+    return {
+        nodeOptions: existing && existing.trim() ? `${existing} ${flag}` : flag,
+        heapCapMb: budget,
+    };
+}
 /** Resolve the sidecar root (where the vendored pnpm/tsc live) from this bundle. */
 function sidecarRoot() {
     // dist/src/capture/check.js -> up three -> sidecar root.
@@ -198,7 +254,8 @@ export async function runCheck(opts, onProgress) {
     }
     // ---- Judge (async, off the event loop) ----------------------------------
     progress('checking', 'type-checking probes');
-    const tsc = await runProcess(tscPath, ['--noEmit', '--pretty', 'false', '-p', path.join(ws.probesRel, 'tsconfig.json')], ws.workspaceDir);
+    const heap = childHeap(process.execArgv, process.env.NODE_OPTIONS, process.memoryUsage().rss / (1024 * 1024));
+    const tsc = await runProcess(tscPath, ['--noEmit', '--pretty', 'false', '-p', path.join(ws.probesRel, 'tsconfig.json')], ws.workspaceDir, { ...process.env, NODE_OPTIONS: heap.nodeOptions });
     const diagnostics = parseTscOutput(tsc.stdout + '\n' + tsc.stderr);
     // Abnormal tsc termination: OOM/SIGKILL (exit code null), an internal
     // crash, or a fileless config error (e.g. TS18003, printed without a
@@ -207,7 +264,9 @@ export async function runCheck(opts, onProgress) {
     // WITH parsed diagnostics is the legitimate incompatible path (tsc exits 1
     // on ordinary type errors) and stays untouched. Mirrors the install step's
     // `code === 0` guard.
-    if (tsc.code !== 0 && diagnostics.length === 0) {
+    // A compiler a signal ended never finished, so a pair with no diagnostic
+    // was never cleared, whatever it printed first (carrick#2209).
+    if (tsc.signal !== null || (tsc.code !== 0 && diagnostics.length === 0)) {
         const excerpt = scrubPaths((tsc.stderr || tsc.stdout).trim().slice(0, 2000), scrubCtx);
         errors.push(`tsc terminated abnormally (exit code ${tsc.code ?? 'null'}) ` +
             `with no parseable diagnostics${excerpt ? `: ${excerpt}` : ''}`);
@@ -224,6 +283,15 @@ export async function runCheck(opts, onProgress) {
             ...preGated,
             ...unresolved,
         ]);
+        // How the compiler ended, as fields, so the scanner can tell a memory
+        // death from any other abnormal end without reading the text
+        // (carrick#2209).
+        const compilerEnd = {
+            exit_code: tsc.code,
+            signal: tsc.signal,
+            heap_limit: carriesHeapLimitLine(tsc.stderr),
+            heap_cap_mb: heap.heapCapMb,
+        };
         if (cleanup)
             safeRm(ws);
         return {
@@ -235,6 +303,7 @@ export async function runCheck(opts, onProgress) {
             verdicts,
             degraded_services: dedupeDegraded(degraded),
             errors,
+            compiler_end: compilerEnd,
         };
     }
     const { probeDiagsByPair, poison, globalErrors } = attributeDiagnostics(diagnostics, ws, probing);

package/sidecar/dist/src/capture/checkout.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The checkout a service sits in, and the bound an untrusted scan reads
+ * inside (carrick#2230).
+ *
+ * `CARRICK_UNTRUSTED_TREE` (any non-empty value) is the scan's switch, read
+ * the same way the scanner reads it. Unset, nothing here constructs a
+ * wrapper and every caller passes the compiler what it passed before. Set,
+ * the compiler reads no file whose REAL path (links followed) is outside the
+ * checkout, outside the sidecar's own install (its TypeScript library files),
+ * and outside the directories the caller names as its own (a capture's stub).
+ * A refused file reads as missing, so its types become `any`: the posture an
+ * unprepared tree already has.
+ */
+import ts from 'typescript';
+export declare const UNTRUSTED_TREE_ENV = "CARRICK_UNTRUSTED_TREE";
+/** The checkout the service root sits in: the nearest ancestor holding a
+ * `.git` entry (a directory, or the file a worktree carries), else the service
+ * root itself. */
+export declare function checkoutRootOf(repoRoot: string): string;
+export declare function isInsideCheckout(file: string, repoRoot: string): boolean;
+/** True when the scan runs under the untrusted-tree switch. */
+export declare function untrustedTree(): boolean;
+/** The real roots an untrusted scan may read beneath. */
+export interface ReadBound {
+    readonly roots: readonly string[];
+    /** Whether the real path of `file` is beneath a root. Never throws. */
+    allows(file: string): boolean;
+}
+/**
+ * The bound for a scan of the service at `repoRoot`, or `undefined` when the
+ * switch is off. `own` names directories the caller itself owns and reads
+ * back (a capture's stub, its scratch).
+ */
+export declare function untrustedReadBound(repoRoot: string, own?: readonly string[]): ReadBound | undefined;
+/** `host` with every read the bound refuses answered as a missing file. */
+export declare function boundedCompilerHost(host: ts.CompilerHost, bound: ReadBound | undefined): ts.CompilerHost;
+/** The compiler's own file system, bounded; `ts.sys` itself when no bound. */
+export declare function boundedSys(bound: ReadBound | undefined): ts.System;

package/sidecar/dist/src/capture/checkout.js

@@ -0,0 +1,139 @@
+/**
+ * The checkout a service sits in, and the bound an untrusted scan reads
+ * inside (carrick#2230).
+ *
+ * `CARRICK_UNTRUSTED_TREE` (any non-empty value) is the scan's switch, read
+ * the same way the scanner reads it. Unset, nothing here constructs a
+ * wrapper and every caller passes the compiler what it passed before. Set,
+ * the compiler reads no file whose REAL path (links followed) is outside the
+ * checkout, outside the sidecar's own install (its TypeScript library files),
+ * and outside the directories the caller names as its own (a capture's stub).
+ * A refused file reads as missing, so its types become `any`: the posture an
+ * unprepared tree already has.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import ts from 'typescript';
+export const UNTRUSTED_TREE_ENV = 'CARRICK_UNTRUSTED_TREE';
+const checkoutRoots = new Map();
+/** The checkout the service root sits in: the nearest ancestor holding a
+ * `.git` entry (a directory, or the file a worktree carries), else the service
+ * root itself. */
+export function checkoutRootOf(repoRoot) {
+    const key = path.resolve(repoRoot);
+    const cached = checkoutRoots.get(key);
+    if (cached)
+        return cached;
+    let dir = key;
+    let root = key;
+    for (;;) {
+        if (fs.existsSync(path.join(dir, '.git'))) {
+            root = dir;
+            break;
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    checkoutRoots.set(key, root);
+    return root;
+}
+export function isInsideCheckout(file, repoRoot) {
+    const root = checkoutRootOf(repoRoot).replace(/\\/g, '/');
+    return file === root || file.startsWith(root.endsWith('/') ? root : root + '/');
+}
+/** True when the scan runs under the untrusted-tree switch. */
+export function untrustedTree() {
+    const value = process.env[UNTRUSTED_TREE_ENV];
+    return value !== undefined && value !== '';
+}
+/** `p` with every link resolved; a path that does not exist yet resolves
+ * through its deepest existing ancestor. */
+function realOf(p) {
+    const abs = path.resolve(p);
+    const tail = [];
+    let dir = abs;
+    for (;;) {
+        try {
+            return path.join(fs.realpathSync(dir), ...tail.reverse());
+        }
+        catch {
+            const parent = path.dirname(dir);
+            if (parent === dir)
+                return abs;
+            tail.push(path.basename(dir));
+            dir = parent;
+        }
+    }
+}
+function within(real, root) {
+    return real === root || real.startsWith(root.endsWith(path.sep) ? root : root + path.sep);
+}
+/** Where the sidecar's own files live: its install, and the TypeScript package
+ * whose `lib.*.d.ts` every program reads (beside the sidecar in the npm
+ * package, so not always beneath it). */
+function sidecarRoots() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    const roots = [
+        path.resolve(here, '..', '..', '..'),
+        path.dirname(path.dirname(ts.getDefaultLibFilePath({}))),
+    ];
+    const configured = process.env.CARRICK_SIDECAR_DIR;
+    if (configured && configured.trim() !== '')
+        roots.push(path.resolve(configured));
+    return roots;
+}
+/**
+ * The bound for a scan of the service at `repoRoot`, or `undefined` when the
+ * switch is off. `own` names directories the caller itself owns and reads
+ * back (a capture's stub, its scratch).
+ */
+export function untrustedReadBound(repoRoot, own = []) {
+    if (!untrustedTree())
+        return undefined;
+    const roots = [...new Set([checkoutRootOf(repoRoot), ...sidecarRoots(), ...own].map(realOf))];
+    return {
+        roots,
+        allows: (file) => {
+            const real = realOf(file);
+            return roots.some((root) => within(real, root));
+        },
+    };
+}
+/** `host` with every read the bound refuses answered as a missing file. */
+export function boundedCompilerHost(host, bound) {
+    if (!bound)
+        return host;
+    const getSourceFile = host.getSourceFile.bind(host);
+    const read = host.readFile.bind(host);
+    const exists = host.fileExists.bind(host);
+    const dirExists = host.directoryExists?.bind(host);
+    const dirs = host.getDirectories?.bind(host);
+    const readDirectory = host.readDirectory?.bind(host);
+    host.getSourceFile = (file, ...rest) => (bound.allows(file) ? getSourceFile(file, ...rest) : undefined);
+    host.readFile = (file) => (bound.allows(file) ? read(file) : undefined);
+    host.fileExists = (file) => bound.allows(file) && exists(file);
+    if (dirExists)
+        host.directoryExists = (dir) => bound.allows(dir) && dirExists(dir);
+    if (dirs)
+        host.getDirectories = (dir) => (bound.allows(dir) ? dirs(dir) : []);
+    if (readDirectory) {
+        host.readDirectory = (root, ...rest) => readDirectory(root, ...rest).filter((file) => bound.allows(file));
+    }
+    return host;
+}
+/** The compiler's own file system, bounded; `ts.sys` itself when no bound. */
+export function boundedSys(bound) {
+    if (!bound)
+        return ts.sys;
+    return {
+        ...ts.sys,
+        readFile: (file, encoding) => (bound.allows(file) ? ts.sys.readFile(file, encoding) : undefined),
+        fileExists: (file) => bound.allows(file) && ts.sys.fileExists(file),
+        directoryExists: (dir) => bound.allows(dir) && ts.sys.directoryExists(dir),
+        getDirectories: (dir) => (bound.allows(dir) ? ts.sys.getDirectories(dir) : []),
+        readDirectory: (root, ...rest) => ts.sys.readDirectory(root, ...rest).filter((file) => bound.allows(file)),
+    };
+}

package/sidecar/dist/src/capture/index.d.ts

@@ -31,6 +31,7 @@ import type { CaptureStubOptions, CaptureStubResult } from './api.js';
 export type { CaptureStubOptions, CaptureStubResult } from './api.js';
 export { DenoProject, findDenoConfig } from './deno-project.js';
 export { sidecarCompilerOptions } from './compiler-options.js';
+export { isInsideCheckout, untrustedReadBound, UNTRUSTED_TREE_ENV, type ReadBound } from './checkout.js';
 export { serviceConfigPath } from './project-references.js';
 export { findServiceTsconfig } from './service-config.js';
 export { runCheck } from './check.js';

package/sidecar/dist/src/capture/index.js

@@ -44,8 +44,10 @@ import { findServiceTsconfig } from './service-config.js';
 import { placeEmittedTree, surfaceModuleInTree } from './outside-root.js';
 import { WriteGuard } from './guarded-fs.js';
 import { sidecarCompilerOptions } from './compiler-options.js';
+import { boundedCompilerHost, boundedSys, untrustedReadBound } from './checkout.js';
 export { DenoProject, findDenoConfig } from './deno-project.js';
 export { sidecarCompilerOptions } from './compiler-options.js';
+export { isInsideCheckout, untrustedReadBound, UNTRUSTED_TREE_ENV } from './checkout.js';
 export { serviceConfigPath } from './project-references.js';
 export { findServiceTsconfig } from './service-config.js';
 // v2 check core ("tsc as the judge"). Same bundle, same seam: the sidecar
@@ -132,6 +134,10 @@ export function captureStub(opts) {
     const packageName = `@carrick/${sanitizeServiceName(opts.serviceName)}`;
     const stubDir = path.resolve(opts.outDir);
     const errors = [];
+    // Under CARRICK_UNTRUSTED_TREE every compiler read below is held to the
+    // checkout, the sidecar's own install and this stub; otherwise undefined
+    // and nothing here changes (carrick#2230).
+    const bound = untrustedReadBound(repoRoot, [stubDir]);
     // The named config, else the one the init'd project reads too
     // (carrick#1776). A service with neither is typed under defaults below.
     const configPath = opts.tsconfigPath
@@ -192,7 +198,7 @@ export function captureStub(opts) {
                 checkJs: false,
                 resolveJsonModule: true,
             },
-        }, ts.sys, repoRoot);
+        }, boundedSys(bound), repoRoot);
     }
     else {
         // Each anchor is typed under the project that owns its file: the named
@@ -260,7 +266,7 @@ export function captureStub(opts) {
     // ---- Phase A: analysis program over placeholder entry + anchor sources ----
     let resolved;
     const progress = opts.onProgress ?? (() => { });
-    const analysisCtx = { repoRoot, entryDir: path.dirname(entryPath), entryPath, guard, progress };
+    const analysisCtx = { repoRoot, entryDir: path.dirname(entryPath), entryPath, guard, progress, bound };
     try {
         resolved = ownerGroups && emitProject
             ? resolveAnchorsByOwner(opts, ownerGroups, emitProject, analysisCtx, errors)
@@ -302,7 +308,7 @@ export function captureStub(opts) {
         written = emitDeclarations({
             rootNames: [entryPath, ...augmentationSources],
             options: emitOptions,
-            host: deno?.host(emitOptions),
+            host: programHost(emitOptions, deno, bound),
             staging,
             entryDir,
         });
@@ -490,8 +496,8 @@ export function captureStub(opts) {
         pinned,
         bareCheckout,
         repoRoot: dependencyRoot,
-        compilerHost: deno || Object.keys(rewritten.installs).length > 0
-            ? (options) => withInstalledPackages(options, rewritten.installs, deno ? deno.host(options) : undefined)
+        compilerHost: deno || bound || Object.keys(rewritten.installs).length > 0
+            ? (options) => boundedCompilerHost(withInstalledPackages(options, rewritten.installs, deno ? deno.host(options) : undefined), bound)
             : undefined,
     });
     const fidelity = computeFidelity(aliases);
@@ -691,6 +697,15 @@ function resolveAnchorsByOwner(opts, groups, emit, ctx, errors) {
     }
     return resolved;
 }
+/**
+ * The compiler host a capture program is built on: the Deno graph's, else the
+ * default one (`undefined`), each held to the read bound when there is one.
+ */
+function programHost(options, deno, bound) {
+    if (!bound)
+        return deno?.host(options);
+    return boundedCompilerHost(deno ? deno.host(options) : ts.createCompilerHost(options), bound);
+}
 /** Phase A: build the placeholder entry, then resolve every anchor. */
 function resolveAnchors(opts, parsed, ctx, deno) {
     const placeholderLines = ['// Carrick capture v2 analysis placeholder.'];
@@ -708,7 +723,7 @@ function resolveAnchors(opts, parsed, ctx, deno) {
             ...parsed.options,
             noEmit: true,
         });
-        const program = ts.createProgram([ctx.entryPath, ...anchorSources, ...(deno?.globals ?? [])], options, deno?.host(options));
+        const program = ts.createProgram([ctx.entryPath, ...anchorSources, ...(deno?.globals ?? [])], options, programHost(options, deno, ctx.bound));
         // The checker binds every file of the program when it is first asked for,
         // which the first anchor would otherwise do: asked for here, so that the
         // report below says the program is whole before any anchor is read.
@@ -731,7 +746,7 @@ function resolveAnchors(opts, parsed, ctx, deno) {
             if (!fromEntry.has(specifier)) {
                 fromEntry.set(specifier, (deno
                     ? deno.resolve(specifier, ctx.entryPath, options)
-                    : ts.resolveModuleName(specifier, ctx.entryPath, options, ts.sys, undefined, undefined, entryMode)
+                    : ts.resolveModuleName(specifier, ctx.entryPath, options, boundedSys(ctx.bound), undefined, undefined, entryMode)
                         .resolvedModule)?.resolvedFileName);
             }
             return fromEntry.get(specifier);

package/sidecar/dist/src/capture/machinery.js

@@ -18,8 +18,7 @@
  * user payload that merely shares a member name can never trip it.
  */
 import ts from 'typescript';
-import * as fs from 'node:fs';
-import * as path from 'node:path';
+import { isInsideCheckout } from './checkout.js';
 /**
  * Strongly-discriminating member names of HTTP transport machinery. Kept
  * identical to `MACHINERY_MEMBER_INDICATORS` in `type-inferrer.ts`. These are
@@ -171,34 +170,6 @@ export function isExternalOrigin(program, sourceFile, repoRoot) {
     }
     return program.isSourceFileFromExternalLibrary(sourceFile) && !isInsideCheckout(file, repoRoot);
 }
-const checkoutRoots = new Map();
-/** The checkout the service root sits in: the nearest ancestor holding a
- * `.git` entry (a directory, or the file a worktree carries), else the service
- * root itself. */
-function checkoutRootOf(repoRoot) {
-    const key = path.resolve(repoRoot);
-    const cached = checkoutRoots.get(key);
-    if (cached)
-        return cached;
-    let dir = key;
-    let root = key;
-    for (;;) {
-        if (fs.existsSync(path.join(dir, '.git'))) {
-            root = dir;
-            break;
-        }
-        const parent = path.dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    checkoutRoots.set(key, root);
-    return root;
-}
-function isInsideCheckout(file, repoRoot) {
-    const root = checkoutRootOf(repoRoot).replace(/\\/g, '/');
-    return file === root || file.startsWith(root.endsWith('/') ? root : root + '/');
-}
 /**
  * True when the symbol is declared in a runtime/library origin. Works on a bare
  * checkout: the DOM `Response`/`Request` resolve from the bundled

package/sidecar/dist/src/capture/project-references.js

@@ -19,10 +19,11 @@
  */
 import * as path from 'node:path';
 import ts from 'typescript';
+import { boundedSys, untrustedReadBound } from './checkout.js';
 /** Parse one config; throws on a file that cannot be read or parsed. */
 function parseConfig(configPath, extendedConfigCache) {
     const host = {
-        ...ts.sys,
+        ...boundedSys(untrustedReadBound(path.dirname(configPath))),
         onUnRecoverableConfigFileDiagnostic: (d) => {
             throw new Error(ts.flattenDiagnosticMessageText(d.messageText, '\n'));
         },

package/sidecar/dist/src/origin.js

@@ -13,8 +13,8 @@
  * bundle, so the two are kept in lockstep by `machinery-indicator-mirror.test.ts`
  * rather than by sharing this module.
  */
-import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { isInsideCheckout } from './capture/index.js';
 /**
  * True when a declaration's source file is runtime/library origin rather than
  * user source. Four answers, in order:
@@ -129,31 +129,3 @@ export function registerExternalImports(project, imports) {
 export function externalImportsOf(project) {
     return externalImportsByProject.get(project);
 }
-const checkoutRoots = new Map();
-/** The checkout the service root sits in: the nearest ancestor holding a
- * `.git` entry (a directory, or the file a worktree carries), else the service
- * root itself. */
-function checkoutRootOf(repoRoot) {
-    const key = path.resolve(repoRoot);
-    const cached = checkoutRoots.get(key);
-    if (cached)
-        return cached;
-    let dir = key;
-    let root = key;
-    for (;;) {
-        if (fs.existsSync(path.join(dir, '.git'))) {
-            root = dir;
-            break;
-        }
-        const parent = path.dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    checkoutRoots.set(key, root);
-    return root;
-}
-function isInsideCheckout(file, repoRoot) {
-    const root = checkoutRootOf(repoRoot).replace(/\\/g, '/');
-    return file === root || file.startsWith(root.endsWith('/') ? root : root + '/');
-}

package/sidecar/dist/src/project-loader.d.ts

@@ -95,6 +95,12 @@ export declare class ProjectLoader {
      * Convert a TsconfigSnapshot to ts-morph CompilerOptions
      */
     private snapshotToCompilerOptions;
+    /**
+     * Under CARRICK_UNTRUSTED_TREE, the file system every project reads
+     * through: nothing whose real path is outside the checkout (carrick#2230).
+     * Nothing at all otherwise, so a project is built as it always was.
+     */
+    private fileSystemOption;
     /** A ts-morph project built from one tsconfig and the files it lists. */
     private projectFromConfig;
     /**

package/sidecar/dist/src/project-loader.js

@@ -12,7 +12,7 @@
 import { Project, getCompilerOptionsFromTsConfig } from 'ts-morph';
 import * as path from 'node:path';
 import * as fs from 'node:fs';
-import { DenoProject, findDenoConfig, findServiceTsconfig, serviceConfigPath, sidecarCompilerOptions, } from './capture/index.js';
+import { DenoProject, findDenoConfig, findServiceTsconfig, serviceConfigPath, sidecarCompilerOptions, untrustedReadBound, } from './capture/index.js';
 import { moduleFormatResolutionHost } from './module-format.js';
 import { ExternalImports, registerExternalImports } from './origin.js';
 /**
@@ -177,6 +177,7 @@ export class ProjectLoader {
                 this.log('Project will load with tsconfig snapshot');
                 this.buildProject = () => {
                     const project = new Project({
+                        ...this.fileSystemOption(),
                         compilerOptions: sidecarCompilerOptions(this.snapshotToCompilerOptions(snapshot)),
                         skipAddingFilesFromTsConfig: true,
                     });
@@ -197,6 +198,7 @@ export class ProjectLoader {
                         // rebuilds that drop them (carrick#1731).
                         const imports = new ExternalImports();
                         const project = new Project({
+                            ...this.fileSystemOption(),
                             compilerOptions: sidecarCompilerOptions(deno.parsed.options),
                             skipAddingFilesFromTsConfig: true,
                             resolutionHost: imports.recording((host, getOptions) => ({
@@ -221,6 +223,7 @@ export class ProjectLoader {
                     this.log('No tsconfig.json found, using default compiler options');
                     this.buildProject = () => {
                         const project = new Project({
+                            ...this.fileSystemOption(),
                             compilerOptions: sidecarCompilerOptions(DEFAULT_COMPILER_OPTIONS),
                             skipAddingFilesFromTsConfig: true,
                         });
@@ -318,10 +321,20 @@ export class ProjectLoader {
         }
         return result;
     }
+    /**
+     * Under CARRICK_UNTRUSTED_TREE, the file system every project reads
+     * through: nothing whose real path is outside the checkout (carrick#2230).
+     * Nothing at all otherwise, so a project is built as it always was.
+     */
+    fileSystemOption() {
+        const bound = untrustedReadBound(this.repoRoot);
+        return bound ? { fileSystem: boundedFileSystem(bound) } : {};
+    }
     /** A ts-morph project built from one tsconfig and the files it lists. */
     projectFromConfig(configPath) {
         const imports = new ExternalImports();
         const project = new Project({
+            ...this.fileSystemOption(),
             tsConfigFilePath: configPath,
             // Over the tsconfig's own options: ts-morph lays these on top.
             compilerOptions: sidecarCompilerOptions(getCompilerOptionsFromTsConfig(configPath).options),
@@ -492,3 +505,53 @@ export class ProjectLoader {
         console.error(`[sidecar:project-loader:error] ${message}`);
     }
 }
+/**
+ * A ts-morph file system that reads only inside the bound. ts-morph reads the
+ * tsconfig, lists the files it names and reads each through this host, and its
+ * module resolution asks it whether a file exists. Writes are not bounded:
+ * the write guard owns them (carrick#1748).
+ */
+function boundedFileSystem(bound) {
+    const base = new Project({
+        compilerOptions: sidecarCompilerOptions({}),
+        skipAddingFilesFromTsConfig: true,
+        skipFileDependencyResolution: true,
+    }).getFileSystem();
+    const missing = (filePath) => Object.assign(new Error(`ENOENT: no such file or directory, open '${filePath}'`), { code: 'ENOENT' });
+    return new Proxy(base, {
+        get(target, prop, receiver) {
+            const value = Reflect.get(target, prop, receiver);
+            if (typeof value !== 'function')
+                return value;
+            const fn = value.bind(target);
+            switch (prop) {
+                case 'readFileSync':
+                    return (p, e) => {
+                        if (!bound.allows(p))
+                            throw missing(p);
+                        return fn(p, e);
+                    };
+                case 'readFile':
+                    return async (p, e) => {
+                        if (!bound.allows(p))
+                            throw missing(p);
+                        return fn(p, e);
+                    };
+                case 'fileExistsSync':
+                case 'directoryExistsSync':
+                    return (p) => bound.allows(p) && fn(p);
+                case 'fileExists':
+                case 'directoryExists':
+                    return async (p) => bound.allows(p) && (await fn(p));
+                case 'readDirSync':
+                    return (p) => (bound.allows(p) ? fn(p) : []);
+                case 'globSync':
+                    return (patterns) => fn(patterns).filter((f) => bound.allows(f));
+                case 'glob':
+                    return async (patterns) => (await fn(patterns)).filter((f) => bound.allows(f));
+                default:
+                    return fn;
+            }
+        },
+    });
+}